Changeset 1162

Timestamp:

01/10/10 13:48:41 (13 years ago)

Author:

nightmann

Message:

1.Fix some timming issues
2.remove some debug output
3.some changes in emm handling.
4.we dont care about providerID. Now you can also use 000000 as providerid in newcamd connection.
5.tivusat idea is not longer needed in oscam.server, we go an other way to check if rsa is ok. This should be a good compromise from the hint of neoen.
6.remove some not needed global vars

File:

• trunk/reader-nagra.c (modified) (27 diffs)

trunk/reader-nagra.c

@@ -11 +11 @@
 int is_tiger=0;
 int has_dt08=0;
+int swapCW=0;
 unsigned char rom[15];
 unsigned char plainDT08RSA[64];
 unsigned char IdeaCamKey[16];
 unsigned char irdId[] = {0xff,0xff,0xff,0xff};
-unsigned char camid[] = {0xff,0xff,0xff,0xff};
 unsigned char sessi[16];
 unsigned char signature[8];
 unsigned char cam_state[3];
-unsigned char static_dt08[73];
-unsigned char prv0401[] = {0x00, 0x00, 0x04, 0x01};
-unsigned char prv3411[] = {0x00, 0x00, 0x34, 0x11};
 
 // Card Status checks
@@ -94 +91 @@
         if(!reader_cmd2icc(msg,msglen))
     {
-        //cs_sleepms(15);
+        cs_sleepms(10);
         if(cta_res[0]!=res) 
             {
@@ -186 +183 @@
 }
 
-void getCamID(void)
-{
-    /*
-    Hack: 
-    Get camid. For provider 0401/3411 camid is 0xff,0xff,0xff,0xff. 
-    for other provider we will take them from hexserial
-    */
-    if ((memcmp(prv3411,&reader[ridx].prid[0],4)==0) || (memcmp(prv0401,&reader[ridx].prid[0],4)==0))
-    {
-        memset(camid,0xff,4);
-    }
-    else
-    {
-        memcpy(camid,reader[ridx].hexserial+2,4);
-    }
-}
-
 int NegotiateSessionKey_Tiger(void)
 {
@@ -216 +196 @@
     unsigned char tmp[104];
     unsigned char tmp1[8];
+    unsigned char idea_sig[16];
     unsigned char random[88] = {0x51,0xd0,0xcc,0x4a,0x51,0xbc,0x4f,0xa4,0x7d,0x44,0xa9,0xa8,0x97,0x13,0x01,0x63,
                 0x8f,0xaf,0x86,0x60,0x7c,0xe3,0xee,0x29,0xca,0x13,0x09,0x44,0x83,0x48,0x17,0x8b,
@@ -228 +209 @@
         return 0;
     }
-
-//  cs_debug("[nagra-reader] crypted parte_fija: %s", cs_hexdump (1, &cta_res[90], 32));
-//  cs_debug("[nagra-reader] crypted parte_fija: %s", cs_hexdump (1, &cta_res[122], 32));
-//  cs_debug("[nagra-reader] crypted parte_fija: %s", cs_hexdump (1, &cta_res[154], 32));
-//  cs_debug("[nagra-reader] crypted parte_fija: %s", cs_hexdump (1, &cta_res[186], 24));
     
     BN_CTX *ctx = BN_CTX_new();
@@ -248 +224 @@
     BN_CTX_free (ctx);
     
-//  cs_debug("[nagra-reader] decrypted parte_fija: %s", cs_hexdump (1, parte_fija, 32));
-//  cs_debug("[nagra-reader] decrypted parte_fija: %s", cs_hexdump (1, &parte_fija[32], 32));
-//  cs_debug("[nagra-reader] decrypted parte_fija: %s", cs_hexdump (1, &parte_fija[64], 32));
-//  cs_debug("[nagra-reader] decrypted parte_fija: %s", cs_hexdump (1, &parte_fija[96], 24));
-    
     cs_debug("[nagra-reader] ---------- SIG CHECK ---------------------");
     memset(tmp,0, 104);
     memcpy(tmp+4, parte_fija+11, 100);
-    Signature(sign1, reader[ridx].nagra_boxkey, tmp, 104);
-//  cs_debug("[nagra-reader] foo: %s", cs_hexdump (0, tmp, 32));
-//  cs_debug("[nagra-reader] foo: %s", cs_hexdump (0, &tmp[32], 32));
-//  cs_debug("[nagra-reader] foo: %s", cs_hexdump (0, &tmp[64], 32));
-//  cs_debug("[nagra-reader] foo: %s", cs_hexdump (0, &tmp[96], 8));
+    memset(idea_sig, 0x37, 16);
+    Signature(sign1, idea_sig, tmp, 104);
     cs_debug("[nagra-reader] sign1: %s", cs_hexdump (0, sign1, 8));
     cs_debug("[nagra-reader] sign2: %s", cs_hexdump (0, parte_fija+111, 8));
@@ -276 +244 @@
     memcpy(d1_rsa_modulo,parte_fija+23,88);
     
-//  cs_debug("[nagra-reader] d1_rsa_modulo: %s", cs_hexdump (1, d1_rsa_modulo, 22));
-//  cs_debug("[nagra-reader] d1_rsa_modulo: %s", cs_hexdump (1, &d1_rsa_modulo[22], 22));
-//  cs_debug("[nagra-reader] d1_rsa_modulo: %s", cs_hexdump (1, &d1_rsa_modulo[44], 22));
-//  cs_debug("[nagra-reader] d1_rsa_modulo: %s", cs_hexdump (1, &d1_rsa_modulo[66], 22));
     ReverseMem(cta_res+2, 88);
     BN_CTX *ctx1 = BN_CTX_new();
@@ -294 +258 @@
     BN_CTX_end(ctx1);
     BN_CTX_free (ctx1);
-//  cs_debug("[nagra-reader] parte_variable: %s", cs_hexdump (1, parte_variable, 22));
-//  cs_debug("[nagra-reader] parte_variable: %s", cs_hexdump (1, &parte_variable[22], 22));
-//  cs_debug("[nagra-reader] parte_variableo: %s", cs_hexdump (1, &parte_variable[44], 22));
-//  cs_debug("[nagra-reader] parte_variable: %s", cs_hexdump (1, &parte_variable[66], 22));
     
     reader[ridx].prid[0][0]=0x00;
@@ -308 +268 @@
         cs_ri_log("[nagra-reader] ProviderID: %s",cs_hexdump (1,reader[ridx].prid[0],4));
         
-/*      
-    BN_CTX *ctx2 = BN_CTX_new();
-    BIGNUM *rand0x50  = BN_CTX_get(ctx2);
-    BIGNUM *r_big = BN_CTX_get(ctx2);
-    BN_rand(rand0x50, 0x50, 0, 0);
-    //BN_mod(rand0x50, rand0x50, r_big, ctx2);
-    memset(rand, 0, 88);
-    BN_bn2bin(rand0x50, rand + (0x50-BN_num_bytes(r_big)));
-    rand[0] |= rand[0] & 0x80;
-    BN_CTX_end(ctx2);
-    BN_CTX_free (ctx2);
-
-    memset(rand, 0, 88);
-    memcpy(rand, test_d1_resp, 80);
-    
-    cs_debug("[nagra-reader] grandom: %s", cs_hexdump (1, rand, 22));
-    cs_debug("[nagra-reader] grandom: %s", cs_hexdump (1, &rand[22], 22));
-    cs_debug("[nagra-reader] grandom: %s", cs_hexdump (1, &rand[44], 22));
-    cs_debug("[nagra-reader] grandom: %s", cs_hexdump (1, &rand[66], 22));
-*/  
     memcpy(sessi2,&random[72], 8);
-    
     memset(tmp1,0,8);
     memcpy(tmp1, random+72,8);
-//  cs_debug("[nagra-reader] byteflop last 8 bytes of random data: %s", cs_hexdump (1, tmp1, 8));
-    ReverseMem(tmp1, 8); //byteflop last 8 bytes of random data
-    
+    ReverseMem(tmp1, 8); //byteflop last 8 bytes of random data 
     memcpy(random+72, tmp1,8); // insert back the byteflop data
-//  cs_debug("[nagra-reader] insert back the byteflop data: %s", cs_hexdump (1, random, 22));
-//  cs_debug("[nagra-reader] insert back the byteflop data: %s", cs_hexdump (1, &random[22], 22));
-//  cs_debug("[nagra-reader] insert back the byteflop data: %s", cs_hexdump (1, &random[44], 22));
-//  cs_debug("[nagra-reader] insert back the byteflop data: %s", cs_hexdump (1, &random[66], 22));
     
     memset(tmp1,0,8);
@@ -360 +293 @@
     BN_CTX_end(ctx3);
     BN_CTX_free (ctx3);
-//  cs_debug("[nagra-reader] d2_data: %s", cs_hexdump (1, d2_data, 22));
-//  cs_debug("[nagra-reader] d2_data: %s", cs_hexdump (1, &d2_data[22], 22));
-//  cs_debug("[nagra-reader] d2_data: %s", cs_hexdump (1, &d2_data[44], 22));
-//  cs_debug("[nagra-reader] d2_data: %s", cs_hexdump (1, &d2_data[66], 22));
     ReverseMem(d2_data, 88);
 
@@ -494 +423 @@
     unsigned char buf[72];
     unsigned char sign2[8];
+    unsigned char static_dt08[73];
+    unsigned char camid[4];
     int i, n;
     BN_CTX *ctx;
@@ -506 +437 @@
     ctx= BN_CTX_new();
     if (ctx == NULL) cs_debug("[nagra-reader] RSA Error in dt08 decrypt");
-    //cs_debug("[nagra-reader]   DT08 RSA modulus: %s", cs_hexdump (1, reader[ridx].rsa_mod, 32));
-    //cs_debug("[nagra-reader]   DT08 RSA modulus: %s", cs_hexdump (1, &reader[ridx].rsa_mod[32], 32));
     ReverseMem(static_dt08+1, 64);
     BN_bin2bn (reader[ridx].rsa_mod, 64, bn_mod); // rsa modulus
     BN_bin2bn (vFixed+3, 1, bn_exp); // exponent
     BN_bin2bn (static_dt08+1, 64, bn_data);
-    //cs_debug("[nagra-reader]   DT08 crypted rsa: %s", cs_hexdump (1, static_dt08+1, 32));
-    //cs_debug("[nagra-reader]   DT08 crypted rsa: %s", cs_hexdump (1, static_dt08+33, 32));
     BN_mod_exp (bn_res, bn_data, bn_exp, bn_mod, ctx);
     memset (static_dt08+1, 0, 64);
     n = BN_bn2bin (bn_res, static_dt08+1);
+    BN_CTX_free (ctx);
     ReverseMem(static_dt08+1, n);
-    //cs_debug("[nagra-reader] DT08 decrypted rsa: %s", cs_hexdump (1, static_dt08+1, 32));
-    //cs_debug("[nagra-reader] DT08 decrypted rsa: %s", cs_hexdump (1, static_dt08+33, 32));
     
     // RSA data can never be bigger than the modulo
@@ -529 +455 @@
     for (i = 0; i < 4; i++)
             IdeaCamKey[12 + i] = ~irdId[i];
-        //cs_debug("[nagra-reader] DT08 Plainkey: %s", cs_hexdump (1, IdeaCamKey, 16));
         
     // now IDEA decrypt
@@ -535 +460 @@
     idea_set_encrypt_key(IdeaCamKey,&ks);
     idea_set_decrypt_key(&ks,&ksSession);
-    //cs_debug("[nagra-reader] dt08 idea part: %s", cs_hexdump (1, static_dt08+65, 8));
     memcpy (&buf[0], static_dt08+1, 64);
     memcpy (&buf[64], static_dt08+65, 8);
-    //cs_debug("[nagra-reader] dt08 64byte rsa decrypted + 8last byte: %s", cs_hexdump (1, buf, 64));
-    //cs_debug("[nagra-reader] dt08 64byte rsa decrypted + 8last byte: %s", cs_hexdump (1, &buf[64], 8));
     memset(v,0,sizeof(v));
     memset(static_dt08,0,sizeof(static_dt08));
     idea_cbc_encrypt(buf,static_dt08,72,&ksSession,v,IDEA_DECRYPT);
-    //cs_debug("[nagra-reader] dt08 72byte idea decrypted: %s", cs_hexdump (1, &static_dt08[0], 36));
-    //cs_debug("[nagra-reader] dt08 72byte idea decrypted: %s", cs_hexdump (1, &static_dt08[35], 37));
     
-    getCamID();
-    cs_debug("[nagra-reader] using camid %sfor dt08 calc",cs_hexdump (1,camid,4));
+    if (swapCW==1)
+    {
+        memset(camid,0xff,4);
+    }
+    else
+    {
+        memcpy(camid, reader[ridx].hexserial+2,4);
+    }
+    cs_debug("[nagra-reader] using camid %s for dt08 calc",cs_hexdump (1,camid,4));
     
     // Calculate signature
@@ -554 +481 @@
     memcpy (static_dt08 + 4, camid, 4);
     Signature(sign2,IdeaCamKey,static_dt08,72);
-
-    BN_CTX_free (ctx);
-    //cs_debug("[nagra-reader] dt08 sign1: %s", cs_hexdump (0, signature, 8));
-    //cs_debug("[nagra-reader] dt08 sign2: %s", cs_hexdump (0, sign2, 8));
     
     if (memcmp (signature, sign2, 8)==0)
@@ -607 +530 @@
             reader[ridx].prid[0][3]=cta_res[8];
             memcpy(reader[ridx].sa[0], reader[ridx].sa[0], 4);
-            /*
+            if ( (cta_res[7] == 0x34 && cta_res[8] == 0x11) || (cta_res[7] == 0x04 || cta_res[8] == 0x01))
+            {
+                swapCW=1;
+            }
+            
             reader[ridx].prid[1][0]=0x00;
             reader[ridx].prid[1][1]=0x00;
@@ -614 +541 @@
             memcpy(reader[ridx].sa[1], reader[ridx].sa[0], 4);
             reader[ridx].nprov+=1;
-            */      
+                    
             reader[ridx].caid[0] =(SYSTEM_NAGRA|cta_res[11]);
             //reader[ridx].caid[0] =0x1801;
@@ -661 +588 @@
     memset(rom, 0, 15);
     reader[ridx].nprov = 1;
-    memset (reader[ridx].sa, 0xff, sizeof (reader[ridx].sa));
     memset(reader[ridx].hexserial, 0, 8); 
     reader[ridx].caid[0]=SYSTEM_NAGRA;
@@ -668 +594 @@
     {
         if(SetIFS(0xFE) != 1) return 0;
-        cs_debug("[nagra-reader] detect native nagra card T1 protocol");
+        cs_ri_log("[nagra-reader] detect native nagra card T1 protocol");
         memcpy(rom,atr+11,15);
     }
@@ -674 +600 @@
     {
         if(SetIFS(0xFE) != 1) return 0;
-        cs_debug("[nagra-reader] detect nagra tiger card");
+        cs_ri_log("[nagra-reader] detect nagra tiger card");
         memcpy(rom,atr+11,15);
         is_tiger=1;
@@ -680 +606 @@
     else if (!memcmp(atr+4, "IRDETO", 6))
     {
-        cs_debug("[nagra-reader] detect Irdeto tunneled nagra card");
+        cs_ri_log("[nagra-reader] detect Irdeto tunneled nagra card");
         if(!reader[ridx].nagra_native) return 0;
-        cs_debug("[nagra-reader] using nagra mode");
+        cs_ri_log("[nagra-reader] using nagra mode");
         is_pure_nagra=1;
         if(!do_cmd(0x10,0x02,0x90,0x11,0))
@@ -703 +629 @@
         memcpy(reader[ridx].hexserial+2, cta_res+2, 4);
         cs_debug("[nagra-reader] SER:  %s", cs_hexdump (1, reader[ridx].hexserial+2, 4));
-        memcpy(reader[ridx].sa[0], cta_res+2, 4);
+        //memset(reader[ridx].sa[0], 0xff, 4);
+        //memcpy(reader[ridx].sa[0], cta_res+2, 2);
         
         if(!GetDataType(DT01,0x0E,MAX_REC)) return 0;
@@ -782 +709 @@
     
         }
-        cs_sleepms(10);
+        cs_sleepms(15);
         while(!CamStateRequest() && retry < 5)
         {
@@ -789 +716 @@
                     cs_sleepms(15);
         }
-        cs_sleepms(10);
+        cs_sleepms(15);
         if (HAS_CW && do_cmd(0x1C,0x02,0x9C,0x36,NULL))
         {
@@ -797 +724 @@
             memset(v,0,sizeof(v));
             idea_cbc_encrypt(&cta_res[4],er->cw+8,8,&ksSession,v,IDEA_DECRYPT);
-            if ((memcmp(prv3411,&reader[ridx].prid[0],4)==0) || (memcmp(prv0401,&reader[ridx].prid[0],4)==0))
+            if (swapCW==1)
             {
                     unsigned char tt[8];
@@ -835 +762 @@
 int nagra2_do_emm(EMM_PACKET *ep)
 {
+    cs_debug("[nagra-reader] do_emm #########################################################");
+    cs_debug("[nagra-reader] do_emm #########################################################");
+    cs_debug("[nagra-reader] do_emm #########################################################");
+    cs_debug("[nagra-reader] do_emm #########################################################");
+    cs_debug("[nagra-reader] do_emm #########################################################");
     if(!do_cmd(ep->emm[8],ep->emm[9]+2,0x84,0x02,ep->emm+8+2))
     {
@@ -840 +772 @@
         return (0);
     }
-    cs_sleepms(300);
+    cs_sleepms(3000);
     nagra2_post_process();
     return 1;