Changeset 3115
- Timestamp:
- 09/21/10 04:23:43 (14 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/reader-videoguard-common.c
r3114 r3115 272 272 } 273 273 274 static void cCamCryptVG_PostProcess_Decrypt(unsigned char * buff, int len, unsigned char *cw)275 { 276 switch( buff[0]) {274 static void cCamCryptVG_PostProcess_Decrypt(unsigned char *rxbuff, int len, unsigned char *cw) 275 { 276 switch(rxbuff[0]) { 277 277 case 0xD0: 278 cCamCryptVG_Process_D0( buff,buff+5);278 cCamCryptVG_Process_D0(rxbuff,rxbuff+5); 279 279 break; 280 280 case 0xD1: 281 cCamCryptVG_Process_D1( buff,buff+5,buff+buff[4]+5);281 cCamCryptVG_Process_D1(rxbuff,rxbuff+5,rxbuff+rxbuff[4]+5); 282 282 break; 283 283 case 0xD3: 284 cCamCryptVG_Decrypt_D3( buff,buff+5,buff+buff[4]+5);285 if( buff[1]==0x54) {286 memcpy(cw+0, buff+5,8);287 memset(cw+8,0,8); //set to 0 so client will know it is not valid if not overwritten withvalid cw284 cCamCryptVG_Decrypt_D3(rxbuff,rxbuff+5,rxbuff+rxbuff[4]+5); 285 if(rxbuff[1]==0x54) { 286 memcpy(cw+0,rxbuff+5,8); 287 memset(cw+8,0,8); //set to 0 so client will know it is invalid unless it is overwritten with a valid cw 288 288 int ind; 289 for(ind=15; ind<len+5-10; ind++) { // +5 for 5 ins bytes, -10 to prevent memcpy ind+3,8 from reading past buffer289 for(ind=15; ind<len+5-10; ind++) { // +5 for 5 ins bytes, -10 to prevent memcpy ind+3,8 from reading past rxbuffer 290 290 // we start searching at 15 because start at 13 goes wrong with 090F 090b and 096a 291 if( buff[ind]==0x25) {292 //memcpy(cw2, buff+5+ind+2,8);293 memcpy(cw+8, buff+ind+3,8); //tested on viasat 093E, sky uk 0963, sky it 919 //don't care whether cw is 0 or not291 if(rxbuff[ind]==0x25) { 292 //memcpy(cw2,rxbuff+5+ind+2,8); 293 memcpy(cw+8,rxbuff+ind+3,8); //tested on viasat 093E, sky uk 0963, sky it 919 //don't care whether cw is 0 or not 294 294 break; 295 295 } 296 /* if( buff[ind+1]==0) break;297 ind+= buff[ind+1];*/296 /* if(rxbuff[ind+1]==0) break; 297 ind+=rxbuff[ind+1];*/ 298 298 } 299 299 } … … 508 508 int a=0x13; 509 509 len2=rxbuff[4]; 510 while(a<len2 -9) //-9 (body=8 len=1) to prevent memcpy(buffer+8,body,8) from reading past rxbuff510 while(a<len2+5-9) // +5 for 5 ins bytes, -9 (body=8 len=1) to prevent memcpy(buffer+8,body,8) from reading past rxbuff 511 511 { 512 512 tag=rxbuff[a];
Note:
See TracChangeset
for help on using the changeset viewer.