1 | #include "globals.h"
|
---|
2 | #include "reader-common.h"
|
---|
3 |
|
---|
4 | #include <termios.h>
|
---|
5 | #include <unistd.h>
|
---|
6 | #ifdef OS_LINUX
|
---|
7 | #include <linux/serial.h>
|
---|
8 | #endif
|
---|
9 |
|
---|
10 | #define MAX_ATR_LEN 33 // max. ATR length
|
---|
11 | #define MAX_HIST 15 // max. number of historical characters
|
---|
12 |
|
---|
13 | #define VG2_EMMTYPE_MASK 0xC0
|
---|
14 | #define VG2_EMMTYPE_G 0
|
---|
15 | #define VG2_EMMTYPE_U 1
|
---|
16 | #define VG2_EMMTYPE_S 2
|
---|
17 |
|
---|
18 | #define write_cmd_vg(cmd, data) (card_write(reader, cmd, data, cta_res, &cta_lr) == 0)
|
---|
19 |
|
---|
20 | ////// ====================================================================================
|
---|
21 |
|
---|
22 | int aes_active=0;
|
---|
23 | AES_KEY dkey, ekey, Astro_Key;
|
---|
24 | int BASEYEAR = 1997;
|
---|
25 | static void cAES_SetKey(const unsigned char *key)
|
---|
26 | {
|
---|
27 | AES_set_decrypt_key(key,128,&dkey);
|
---|
28 | AES_set_encrypt_key(key,128,&ekey);
|
---|
29 | aes_active=1;
|
---|
30 | }
|
---|
31 |
|
---|
32 | static int cAES_Encrypt(const unsigned char *data, int len, unsigned char *crypt)
|
---|
33 | {
|
---|
34 | if(aes_active) {
|
---|
35 | len=(len+15)&(~15); // pad up to a multiple of 16
|
---|
36 | int i;
|
---|
37 | for(i=0; i<len; i+=16) AES_encrypt(data+i,crypt+i,(const AES_KEY *)&ekey);
|
---|
38 | return len;
|
---|
39 | }
|
---|
40 | return -1;
|
---|
41 | }
|
---|
42 |
|
---|
43 | static int cw_is_valid(unsigned char *cw) //returns 1 if cw_is_valid, returns 0 if cw is all zeros
|
---|
44 | {
|
---|
45 | int i;
|
---|
46 | for (i = 0; i < 8; i++)
|
---|
47 | if (cw[i] != 0) {//test if cw = 00
|
---|
48 | return OK;
|
---|
49 | }
|
---|
50 | return ERROR;
|
---|
51 | }
|
---|
52 |
|
---|
53 | static const unsigned short NdTabB001[0x15][0x20]= {
|
---|
54 | { 0xEAF1,0x0237,0x29D0,0xBAD2,0xE9D3,0x8BAE,0x2D6D,0xCD1B,0x538D,0xDE6B,0xA634,0xF81A,0x18B5,0x5087,0x14EA,0x672E,
|
---|
55 | 0xF0FC,0x055E,0x62E5,0xB78F,0x5D09,0x0003,0xE4E8,0x2DCE,0x6BE0,0xAC4E,0xF485,0x6967,0xF28C,0x97A0,0x01EF,0x0100 },
|
---|
56 | { 0xC539,0xF5B9,0x9099,0x013A,0xD4B9,0x6AB5,0xEA67,0x7EB4,0x6C30,0x4BF0,0xB810,0xB0B5,0xB76D,0xA751,0x1AE7,0x14CA,
|
---|
57 | 0x4F4F,0x1586,0x2608,0x10B1,0xE7E1,0x48BE,0x7DDD,0x5ECB,0xCFBF,0x323B,0x8B31,0xB131,0x0F1A,0x664B,0x0140,0x0100 },
|
---|
58 | { 0x3C7D,0xBDC4,0xFEC7,0x26A6,0xB0A0,0x6E55,0xF710,0xF9BF,0x0023,0xE81F,0x41CA,0xBE32,0xB461,0xE92D,0xF1AF,0x409F,
|
---|
59 | 0xFC85,0xFE5B,0x7FCE,0x17F5,0x01AB,0x4A46,0xEB05,0xA251,0xDC6F,0xF0C0,0x10F0,0x1D51,0xEFAA,0xE9BF,0x0100,0x0100 },
|
---|
60 | { 0x1819,0x0CAA,0x9067,0x607A,0x7576,0x1CBC,0xE51D,0xBF77,0x7EC6,0x839E,0xB695,0xF096,0xDC10,0xCB69,0x4654,0x8E68,
|
---|
61 | 0xD62D,0x4F1A,0x4227,0x92AC,0x9064,0x6BD1,0x1E75,0x2747,0x00DA,0xA6A6,0x6CF1,0xD151,0xBE56,0x3E33,0x0128,0x0100 },
|
---|
62 | { 0x4091,0x09ED,0xD494,0x6054,0x1869,0x71D5,0xB572,0x7BF1,0xE925,0xEE2D,0xEEDE,0xA13C,0x6613,0x9BAB,0x122D,0x7AE4,
|
---|
63 | 0x5268,0xE6C9,0x50CB,0x79A1,0xF212,0xA062,0x6B48,0x70B3,0xF6B0,0x06D5,0xF8AB,0xECF5,0x6255,0xEDD8,0x79D2,0x290A },
|
---|
64 | { 0xD3CF,0x014E,0xACB3,0x8F6B,0x0F2C,0xA5D8,0xE8E0,0x863D,0x80D5,0x5705,0x658A,0x8BC2,0xEE46,0xD3AE,0x0199,0x0100,
|
---|
65 | 0x4A35,0xABE4,0xF976,0x935A,0xA8A5,0xBAE9,0x24D0,0x71AA,0xB3FE,0x095E,0xAB06,0x4CD5,0x2F0D,0x1ACB,0x59F3,0x4C50 },
|
---|
66 | { 0xFD27,0x0F8E,0x191A,0xEEE7,0x2F49,0x3A05,0x3267,0x4F88,0x38AE,0xFCE9,0x9476,0x18C6,0xF961,0x4EF0,0x39D0,0x42E6,
|
---|
67 | 0xB747,0xE625,0xB68E,0x5100,0xF92A,0x86FE,0xE79B,0xEE91,0x21D5,0x4C3C,0x683D,0x5AD1,0x1B49,0xF407,0x0194,0x0100 },
|
---|
68 | { 0x4BF9,0xDC0D,0x9478,0x5174,0xCB4A,0x8A89,0x4D6A,0xFED8,0xF123,0xA8CD,0xEEE7,0xA6D1,0xB763,0xF5E2,0xE085,0x01EF,
|
---|
69 | 0xE466,0x9FA3,0x2F68,0x2190,0x423F,0x287F,0x7F3F,0x09F6,0x2111,0xA963,0xD0BB,0x674A,0xBA72,0x45F9,0xF186,0xB8F5 },
|
---|
70 | { 0x0010,0xD1B9,0xB164,0x9E87,0x1F49,0x6950,0x2DBF,0x38D3,0x2EB0,0x3E8E,0x91E6,0xF688,0x7E41,0x566E,0x01B0,0x0100,
|
---|
71 | 0x24A1,0x73D8,0xA0C3,0xF71B,0xA0A5,0x2A06,0xBA46,0xFEC3,0xDD4C,0x52CC,0xF9BC,0x3B7E,0x3812,0x0666,0xB74B,0x40F8 },
|
---|
72 | { 0x28F2,0x7C81,0xFC92,0x6FBD,0x53D6,0x72A3,0xBBDF,0xB6FC,0x9CE5,0x2331,0xD4F6,0xC5BB,0xE8BB,0x6676,0x02D9,0x2F0E,
|
---|
73 | 0xD009,0xD136,0xCD09,0x7551,0x1826,0x9D9B,0x63EA,0xFC63,0x68CD,0x3672,0xCB95,0xD28E,0xF1CD,0x20CA,0x014C,0x0100 },
|
---|
74 | { 0xE539,0x55B7,0x989D,0x21C4,0x463A,0xE68F,0xF8B5,0xE5C5,0x662B,0x35BF,0x3C50,0x0131,0xF4BF,0x38B2,0x41BC,0xB829,
|
---|
75 | 0x02B7,0x6B8F,0xA25C,0xAFD2,0xD84A,0x2243,0x53EB,0xC6C9,0x2E14,0x181F,0x8F96,0xDF0E,0x0D4C,0x30F6,0xFFE1,0x9DDA },
|
---|
76 | { 0x30B6,0x777E,0xDA3D,0xAF77,0x205E,0xC90B,0x856B,0xB451,0x3BCC,0x76C2,0x8ACF,0xDCB1,0xA5E5,0xDD64,0x0197,0x0100,
|
---|
77 | 0xE751,0xB661,0x0404,0xDB4A,0xE9DD,0xA400,0xAF26,0x3F5E,0x904B,0xA924,0x09E0,0xE72B,0x825B,0x2C50,0x6FD0,0x0D52 },
|
---|
78 | { 0x2730,0xC2BA,0x9E44,0x5815,0xFC47,0xB21D,0x67B8,0xF8B9,0x047D,0xB0AF,0x9F14,0x741B,0x4668,0xBE54,0xDE16,0xDB14,
|
---|
79 | 0x7CB7,0xF2B8,0x0683,0x762C,0x09A0,0x9507,0x7F92,0x022C,0xBA6A,0x7D52,0x0AF4,0x1BC3,0xB46A,0xC4FD,0x01C2,0x0100 },
|
---|
80 | { 0x7611,0x66F3,0xEE87,0xEDD3,0xC559,0xEFD4,0xDC59,0xF86B,0x6D1C,0x1C85,0x9BB1,0x3373,0x763F,0x4EBE,0x1BF3,0x99B5,
|
---|
81 | 0xD721,0x978F,0xCF5C,0xAC51,0x0984,0x7462,0x8F0C,0x2817,0x4AD9,0xFD41,0x6678,0x7C85,0xD330,0xC9F8,0x1D9A,0xC622 },
|
---|
82 | { 0x5AE4,0xE16A,0x60F6,0xFD45,0x668C,0x29D6,0x0285,0x6B92,0x92C2,0x21DE,0x45E0,0xEF3D,0x8B0D,0x02CD,0x0198,0x0100,
|
---|
83 | 0x9E6D,0x4D38,0xDEF9,0xE6F2,0xF72E,0xB313,0x14F2,0x390A,0x2D67,0xC71E,0xCB69,0x7F66,0xD3CF,0x7F8A,0x81D9,0x9DDE },
|
---|
84 | { 0x85E3,0x8F29,0x36EB,0xC968,0x3696,0x59F6,0x7832,0xA78B,0xA1D8,0xF5CF,0xAB64,0x646D,0x7A2A,0xBAF8,0xAA87,0x41C7,
|
---|
85 | 0x5120,0xDE78,0x738D,0xDC1A,0x268D,0x5DF8,0xED69,0x1C8A,0xBC85,0x3DCD,0xAE30,0x0F8D,0xEC89,0x3ABD,0x0166,0x0100 },
|
---|
86 | { 0xB8BD,0x643B,0x748E,0xBD63,0xEC6F,0xE23A,0x9493,0xDD76,0x0A62,0x774F,0xCD68,0xA67A,0x9A23,0xC8A8,0xBDE5,0x9D1B,
|
---|
87 | 0x2B86,0x8B36,0x5428,0x1DFB,0xCD1D,0x0713,0x29C2,0x8E8E,0x5207,0xA13F,0x6005,0x4F5E,0x52E0,0xE7C8,0x6D1C,0x3E34 },
|
---|
88 | { 0x581D,0x2BFA,0x5E1D,0xA891,0x1069,0x1DA4,0x39A0,0xBE45,0x5B9A,0x7333,0x6F3E,0x8637,0xA550,0xC9E9,0x5C6C,0x42BA,
|
---|
89 | 0xA712,0xC3EA,0x3808,0x0910,0xAA4D,0x5B25,0xABCD,0xE680,0x96AD,0x2CEC,0x8EBB,0xA47D,0x1690,0xE8FB,0x01C8,0x0100 },
|
---|
90 | { 0x73B9,0x82BC,0x9EBC,0xB130,0x0DA5,0x8617,0x9F7B,0x9766,0x205D,0x752D,0xB05C,0x2A17,0xA75C,0x18EF,0x8339,0xFD34,
|
---|
91 | 0x8DA2,0x7970,0xD0B4,0x70F1,0x3765,0x7380,0x7CAF,0x570E,0x6440,0xBC44,0x0743,0x2D02,0x0419,0xA240,0x2113,0x1AD4 },
|
---|
92 | { 0x1EB5,0xBBFF,0x39B1,0x3209,0x705F,0x15F4,0xD7AD,0x340B,0xC2A6,0x25CA,0xF412,0x9570,0x0F4F,0xE4D5,0x1614,0xE464,
|
---|
93 | 0x911A,0x0F0E,0x07DA,0xA929,0x2379,0xD988,0x0AA6,0x3B57,0xBF63,0x71FB,0x72D5,0x26CE,0xB0AF,0xCF45,0x011B,0x0100 },
|
---|
94 | { 0x9999,0x98FE,0xA108,0x6588,0xF90B,0x4554,0xFF38,0x4642,0x8F5F,0x6CC3,0x4E8E,0xFF7E,0x64C2,0x50CA,0x0E7F,0xAD7D,
|
---|
95 | 0x6AAB,0x33C1,0xE1F4,0x6165,0x7894,0x83B9,0x0A0C,0x38AF,0x5803,0x18C0,0xFA36,0x592C,0x4548,0xABB8,0x1527,0xAEE9 }
|
---|
96 |
|
---|
97 | };
|
---|
98 |
|
---|
99 | static const unsigned short Hash3[] = {0x0123,0x4567,0x89AB,0xCDEF,0xF861,0xCB52};
|
---|
100 | static const unsigned char Hash4[] = {0x0B,0x04,0x07,0x08,0x05,0x09,0x0B,0x0A,0x07,0x02,0x0A,0x05,0x04,0x08,0x0D,0x0F};
|
---|
101 |
|
---|
102 | static void swap_lb (unsigned char *buff, int len)
|
---|
103 | {
|
---|
104 |
|
---|
105 | #if __BYTE_ORDER != __BIG_ENDIAN
|
---|
106 | return;
|
---|
107 |
|
---|
108 | #endif /* */
|
---|
109 | int i;
|
---|
110 | unsigned short *tmp;
|
---|
111 | for (i = 0; i < len / 2; i++) {
|
---|
112 | tmp = (unsigned short *) buff + i;
|
---|
113 | *tmp = ((*tmp << 8) & 0xff00) | ((*tmp >> 8) & 0x00ff);
|
---|
114 | }
|
---|
115 | }
|
---|
116 |
|
---|
117 | static inline void __xxor(unsigned char *data, int len, const unsigned char *v1, const unsigned char *v2)
|
---|
118 | {
|
---|
119 | switch(len) { // looks ugly, but the compiler can optimize it very well ;)
|
---|
120 | case 16:
|
---|
121 | *((unsigned int *)data+3) = *((unsigned int *)v1+3) ^ *((unsigned int *)v2+3);
|
---|
122 | *((unsigned int *)data+2) = *((unsigned int *)v1+2) ^ *((unsigned int *)v2+2);
|
---|
123 | case 8:
|
---|
124 | *((unsigned int *)data+1) = *((unsigned int *)v1+1) ^ *((unsigned int *)v2+1);
|
---|
125 | case 4:
|
---|
126 | *((unsigned int *)data+0) = *((unsigned int *)v1+0) ^ *((unsigned int *)v2+0);
|
---|
127 | break;
|
---|
128 | default:
|
---|
129 | while(len--) *data++ = *v1++ ^ *v2++;
|
---|
130 | break;
|
---|
131 | }
|
---|
132 | }
|
---|
133 | #define xor16(v1,v2,d) __xxor((d),16,(v1),(v2))
|
---|
134 | #define val_by2on3(x) ((0xaaab*(x))>>16) //fixed point *2/3
|
---|
135 |
|
---|
136 | unsigned short cardkeys[3][32];
|
---|
137 | unsigned char stateD3A[16];
|
---|
138 |
|
---|
139 | static void cCamCryptVG2_LongMult(unsigned short *pData, unsigned short *pLen, unsigned int mult, unsigned int carry);
|
---|
140 | static void cCamCryptVG2_PartialMod(unsigned short val, unsigned int count, unsigned short *outkey, const unsigned short *inkey);
|
---|
141 | static void cCamCryptVG2_RotateRightAndHash(unsigned char *p);
|
---|
142 | static void cCamCryptVG2_Reorder16A(unsigned char *dest, const unsigned char *src);
|
---|
143 | static void cCamCryptVG2_ReorderAndEncrypt(unsigned char *p);
|
---|
144 | static void cCamCryptVG2_Process_D0(const unsigned char *ins, unsigned char *data);
|
---|
145 | static void cCamCryptVG2_Process_D1(const unsigned char *ins, unsigned char *data, const unsigned char *status);
|
---|
146 | static void cCamCryptVG2_Decrypt_D3(unsigned char *ins, unsigned char *data, const unsigned char *status);
|
---|
147 | static void cCamCryptVG2_PostProcess_Decrypt(unsigned char *buff, int len, unsigned char *cw1, unsigned char *cw2);
|
---|
148 | static void cCamCryptVG2_SetSeed(unsigned char *Key1, unsigned char *Key2);
|
---|
149 | static void cCamCryptVG2_GetCamKey(unsigned char *buff);
|
---|
150 |
|
---|
151 | static void cCamCryptVG2_SetSeed(unsigned char *Key1, unsigned char *Key2)
|
---|
152 | {
|
---|
153 | swap_lb (Key1, 64);
|
---|
154 | swap_lb (Key2, 64);
|
---|
155 | memcpy(cardkeys[1],Key1,sizeof(cardkeys[1]));
|
---|
156 | memcpy(cardkeys[2],Key2,sizeof(cardkeys[2]));
|
---|
157 | swap_lb (Key1, 64);
|
---|
158 | swap_lb (Key2, 64);
|
---|
159 | }
|
---|
160 |
|
---|
161 | static void cCamCryptVG2_GetCamKey(unsigned char *buff)
|
---|
162 | {
|
---|
163 | unsigned short *tb2=(unsigned short *)buff, c=1;
|
---|
164 | memset(tb2,0,64);
|
---|
165 | tb2[0]=1;
|
---|
166 | int i;
|
---|
167 | for(i=0; i<32; i++) cCamCryptVG2_LongMult(tb2,&c,cardkeys[1][i],0);
|
---|
168 | swap_lb (buff, 64);
|
---|
169 | }
|
---|
170 |
|
---|
171 | static void cCamCryptVG2_PostProcess_Decrypt(unsigned char *buff, int len, unsigned char *cw1, unsigned char *cw2)
|
---|
172 | {
|
---|
173 | switch(buff[0]) {
|
---|
174 | case 0xD0:
|
---|
175 | cCamCryptVG2_Process_D0(buff,buff+5);
|
---|
176 | break;
|
---|
177 | case 0xD1:
|
---|
178 | cCamCryptVG2_Process_D1(buff,buff+5,buff+buff[4]+5);
|
---|
179 | break;
|
---|
180 | case 0xD3:
|
---|
181 | cCamCryptVG2_Decrypt_D3(buff,buff+5,buff+buff[4]+5);
|
---|
182 | if(buff[1]==0x54) {
|
---|
183 | memcpy(cw1,buff+5,8);
|
---|
184 | memset(cw2,0,8); //set to 0 so client will know it is not valid if not overwritten with valid cw
|
---|
185 | int ind;
|
---|
186 | for(ind=13; ind<len+13-8; ind++) {
|
---|
187 | if(buff[ind]==0x25) {
|
---|
188 | //memcpy(cw2,buff+5+ind+2,8);
|
---|
189 | memcpy(cw2,buff+ind+3,8); //tested on viasat 093E, sky uk 0963, sky it 919 //don't care whether cw is 0 or not
|
---|
190 | break;
|
---|
191 | }
|
---|
192 | /* if(buff[ind+1]==0) break;
|
---|
193 | ind+=buff[ind+1];*/
|
---|
194 | }
|
---|
195 | }
|
---|
196 | break;
|
---|
197 | }
|
---|
198 | }
|
---|
199 |
|
---|
200 | static void cCamCryptVG2_Process_D0(const unsigned char *ins, unsigned char *data)
|
---|
201 | {
|
---|
202 | switch(ins[1]) {
|
---|
203 | case 0xb4:
|
---|
204 | swap_lb (data, 64);
|
---|
205 | memcpy(cardkeys[0],data,sizeof(cardkeys[0]));
|
---|
206 | break;
|
---|
207 | case 0xbc:
|
---|
208 | {
|
---|
209 | swap_lb (data, 64);
|
---|
210 | unsigned short *idata=(unsigned short *)data;
|
---|
211 | const unsigned short *key1=(const unsigned short *)cardkeys[1];
|
---|
212 | unsigned short key2[32];
|
---|
213 | memcpy(key2,cardkeys[2],sizeof(key2));
|
---|
214 | int count2;
|
---|
215 | for(count2=0; count2<32; count2++) {
|
---|
216 | unsigned int rem=0, div=key1[count2];
|
---|
217 | int i;
|
---|
218 | for(i=31; i>=0; i--) {
|
---|
219 | unsigned int x=idata[i] | (rem<<16);
|
---|
220 | rem=(x%div)&0xffff;
|
---|
221 | }
|
---|
222 | unsigned int carry=1, t=val_by2on3(div) | 1;
|
---|
223 | while(t) {
|
---|
224 | if(t&1) carry=((carry*rem)%div)&0xffff;
|
---|
225 | rem=((rem*rem)%div)&0xffff;
|
---|
226 | t>>=1;
|
---|
227 | }
|
---|
228 | cCamCryptVG2_PartialMod(carry,count2,key2,key1);
|
---|
229 | }
|
---|
230 | unsigned short idatacount=0;
|
---|
231 | int i;
|
---|
232 | for(i=31; i>=0; i--) cCamCryptVG2_LongMult(idata,&idatacount,key1[i],key2[i]);
|
---|
233 | swap_lb (data, 64);
|
---|
234 | unsigned char stateD1[16];
|
---|
235 | cCamCryptVG2_Reorder16A(stateD1,data);
|
---|
236 | cAES_SetKey(stateD1);
|
---|
237 | break;
|
---|
238 | }
|
---|
239 | }
|
---|
240 | }
|
---|
241 |
|
---|
242 | static void cCamCryptVG2_Process_D1(const unsigned char *ins, unsigned char *data, const unsigned char *status)
|
---|
243 | {
|
---|
244 | unsigned char iter[16], tmp[16];
|
---|
245 | memset(iter,0,sizeof(iter));
|
---|
246 | memcpy(iter,ins,5);
|
---|
247 | xor16(iter,stateD3A,iter);
|
---|
248 | memcpy(stateD3A,iter,sizeof(iter));
|
---|
249 |
|
---|
250 | int datalen=status-data;
|
---|
251 | int datalen1=datalen;
|
---|
252 | if(datalen<0) datalen1+=15;
|
---|
253 | int blocklen=datalen1>>4;
|
---|
254 | int i;
|
---|
255 | int iblock;
|
---|
256 | for(i=0,iblock=0; i<blocklen+2; i++,iblock+=16) {
|
---|
257 | unsigned char in[16];
|
---|
258 | int docalc=1;
|
---|
259 | if(blocklen==i && (docalc=datalen&0xf)) {
|
---|
260 | memset(in,0,sizeof(in));
|
---|
261 | memcpy(in,&data[iblock],datalen-(datalen1&~0xf));
|
---|
262 | }
|
---|
263 | else if(blocklen+1==i) {
|
---|
264 | memset(in,0,sizeof(in));
|
---|
265 | memcpy(&in[5],status,2);
|
---|
266 | }
|
---|
267 | else
|
---|
268 | memcpy(in,&data[iblock],sizeof(in));
|
---|
269 |
|
---|
270 | if(docalc) {
|
---|
271 | xor16(iter,in,tmp);
|
---|
272 | cCamCryptVG2_ReorderAndEncrypt(tmp);
|
---|
273 | xor16(tmp,stateD3A,iter);
|
---|
274 | }
|
---|
275 | }
|
---|
276 | memcpy(stateD3A,tmp,16);
|
---|
277 | }
|
---|
278 |
|
---|
279 | static void cCamCryptVG2_Decrypt_D3(unsigned char *ins, unsigned char *data, const unsigned char *status)
|
---|
280 | {
|
---|
281 | if(ins[4]>16) ins[4]-=16;
|
---|
282 | if(ins[1]==0xbe) memset(stateD3A,0,sizeof(stateD3A));
|
---|
283 |
|
---|
284 | unsigned char tmp[16];
|
---|
285 | memset(tmp,0,sizeof(tmp));
|
---|
286 | memcpy(tmp,ins,5);
|
---|
287 | xor16(tmp,stateD3A,stateD3A);
|
---|
288 |
|
---|
289 | int len1=ins[4];
|
---|
290 | int blocklen=len1>>4;
|
---|
291 | if(ins[1]!=0xbe) blocklen++;
|
---|
292 |
|
---|
293 | unsigned char iter[16], states[16][16];
|
---|
294 | memset(iter,0,sizeof(iter));
|
---|
295 | int blockindex;
|
---|
296 | for(blockindex=0; blockindex<blocklen; blockindex++) {
|
---|
297 | iter[0]+=blockindex;
|
---|
298 | xor16(iter,stateD3A,iter);
|
---|
299 | cCamCryptVG2_ReorderAndEncrypt(iter);
|
---|
300 | xor16(iter,&data[blockindex*16],states[blockindex]);
|
---|
301 | if(blockindex==(len1>>4)) {
|
---|
302 | int c=len1-(blockindex*16);
|
---|
303 | if(c<16) memset(&states[blockindex][c],0,16-c);
|
---|
304 | }
|
---|
305 | xor16(states[blockindex],stateD3A,stateD3A);
|
---|
306 | cCamCryptVG2_RotateRightAndHash(stateD3A);
|
---|
307 | }
|
---|
308 | memset(tmp,0,sizeof(tmp));
|
---|
309 | memcpy(tmp+5,status,2);
|
---|
310 | xor16(tmp,stateD3A,stateD3A);
|
---|
311 | cCamCryptVG2_ReorderAndEncrypt(stateD3A);
|
---|
312 |
|
---|
313 | memcpy(stateD3A,status-16,sizeof(stateD3A));
|
---|
314 | cCamCryptVG2_ReorderAndEncrypt(stateD3A);
|
---|
315 |
|
---|
316 | memcpy(data,states[0],len1);
|
---|
317 | if(ins[1]==0xbe) {
|
---|
318 | cCamCryptVG2_Reorder16A(tmp,states[0]);
|
---|
319 | cAES_SetKey(tmp);
|
---|
320 | }
|
---|
321 | }
|
---|
322 |
|
---|
323 | static void cCamCryptVG2_ReorderAndEncrypt(unsigned char *p)
|
---|
324 | {
|
---|
325 | unsigned char tmp[16];
|
---|
326 | cCamCryptVG2_Reorder16A(tmp,p);
|
---|
327 | cAES_Encrypt(tmp,16,tmp);
|
---|
328 | cCamCryptVG2_Reorder16A(p,tmp);
|
---|
329 | }
|
---|
330 |
|
---|
331 | // reorder AAAABBBBCCCCDDDD to ABCDABCDABCDABCD
|
---|
332 |
|
---|
333 | static void cCamCryptVG2_Reorder16A(unsigned char *dest, const unsigned char *src)
|
---|
334 | {
|
---|
335 | int i;
|
---|
336 | int j;
|
---|
337 | int k;
|
---|
338 | for(i=0,k=0; i<4; i++)
|
---|
339 | for(j=i; j<16; j+=4,k++)
|
---|
340 | dest[k]=src[j];
|
---|
341 | }
|
---|
342 |
|
---|
343 | static void cCamCryptVG2_LongMult(unsigned short *pData, unsigned short *pLen, unsigned int mult, unsigned int carry)
|
---|
344 | {
|
---|
345 | int i;
|
---|
346 | for(i=0; i<*pLen; i++) {
|
---|
347 | carry+=pData[i]*mult;
|
---|
348 | pData[i]=(unsigned short)carry;
|
---|
349 | carry>>=16;
|
---|
350 | }
|
---|
351 | if(carry) pData[(*pLen)++]=carry;
|
---|
352 | }
|
---|
353 |
|
---|
354 | static void cCamCryptVG2_PartialMod(unsigned short val, unsigned int count, unsigned short *outkey, const unsigned short *inkey)
|
---|
355 | {
|
---|
356 | if(count) {
|
---|
357 | unsigned int mod=inkey[count];
|
---|
358 | unsigned short mult=(inkey[count]-outkey[count-1])&0xffff;
|
---|
359 | unsigned int i;
|
---|
360 | unsigned int ib1;
|
---|
361 | for(i=0,ib1=count-2; i<count-1; i++,ib1--) {
|
---|
362 | unsigned int t=(inkey[ib1]*mult)%mod;
|
---|
363 | mult=t-outkey[ib1];
|
---|
364 | if(mult>t) mult+=mod;
|
---|
365 | }
|
---|
366 | mult+=val;
|
---|
367 | if((val>mult) || (mod<mult)) mult-=mod;
|
---|
368 | outkey[count]=(outkey[count]*mult)%mod;
|
---|
369 | }
|
---|
370 | else
|
---|
371 | outkey[0]=val;
|
---|
372 | }
|
---|
373 |
|
---|
374 | static const unsigned char table1[256] = {
|
---|
375 | 0x63,0x7c,0x77,0x7b,0xf2,0x6b,0x6f,0xc5, 0x30,0x01,0x67,0x2b,0xfe,0xd7,0xab,0x76,
|
---|
376 | 0xca,0x82,0xc9,0x7d,0xfa,0x59,0x47,0xf0, 0xad,0xd4,0xa2,0xaf,0x9c,0xa4,0x72,0xc0,
|
---|
377 | 0xb7,0xfd,0x93,0x26,0x36,0x3f,0xf7,0xcc, 0x34,0xa5,0xe5,0xf1,0x71,0xd8,0x31,0x15,
|
---|
378 | 0x04,0xc7,0x23,0xc3,0x18,0x96,0x05,0x9a, 0x07,0x12,0x80,0xe2,0xeb,0x27,0xb2,0x75,
|
---|
379 | 0x09,0x83,0x2c,0x1a,0x1b,0x6e,0x5a,0xa0, 0x52,0x3b,0xd6,0xb3,0x29,0xe3,0x2f,0x84,
|
---|
380 | 0x53,0xd1,0x00,0xed,0x20,0xfc,0xb1,0x5b, 0x6a,0xcb,0xbe,0x39,0x4a,0x4c,0x58,0xcf,
|
---|
381 | 0xd0,0xef,0xaa,0xfb,0x43,0x4d,0x33,0x85, 0x45,0xf9,0x02,0x7f,0x50,0x3c,0x9f,0xa8,
|
---|
382 | 0x51,0xa3,0x40,0x8f,0x92,0x9d,0x38,0xf5, 0xbc,0xb6,0xda,0x21,0x10,0xff,0xf3,0xd2,
|
---|
383 | 0xcd,0x0c,0x13,0xec,0x5f,0x97,0x44,0x17, 0xc4,0xa7,0x7e,0x3d,0x64,0x5d,0x19,0x73,
|
---|
384 | 0x60,0x81,0x4f,0xdc,0x22,0x2a,0x90,0x88, 0x46,0xee,0xb8,0x14,0xde,0x5e,0x0b,0xdb,
|
---|
385 | 0xe0,0x32,0x3a,0x0a,0x49,0x06,0x24,0x5c, 0xc2,0xd3,0xac,0x62,0x91,0x95,0xe4,0x79,
|
---|
386 | 0xe7,0xc8,0x37,0x6d,0x8d,0xd5,0x4e,0xa9, 0x6c,0x56,0xf4,0xea,0x65,0x7a,0xae,0x08,
|
---|
387 | 0xba,0x78,0x25,0x2e,0x1c,0xa6,0xb4,0xc6, 0xe8,0xdd,0x74,0x1f,0x4b,0xbd,0x8b,0x8a,
|
---|
388 | 0x70,0x3e,0xb5,0x66,0x48,0x03,0xf6,0x0e, 0x61,0x35,0x57,0xb9,0x86,0xc1,0x1d,0x9e,
|
---|
389 | 0xe1,0xf8,0x98,0x11,0x69,0xd9,0x8e,0x94, 0x9b,0x1e,0x87,0xe9,0xce,0x55,0x28,0xdf,
|
---|
390 | 0x8c,0xa1,0x89,0x0d,0xbf,0xe6,0x42,0x68, 0x41,0x99,0x2d,0x0f,0xb0,0x54,0xbb,0x16,
|
---|
391 | };
|
---|
392 |
|
---|
393 | static void cCamCryptVG2_RotateRightAndHash(unsigned char *p)
|
---|
394 | {
|
---|
395 | unsigned char t1=p[15];
|
---|
396 | int i;
|
---|
397 | for(i=0; i<16; i++) {
|
---|
398 | unsigned char t2=t1;
|
---|
399 | t1=p[i]; p[i]=table1[(t1>>1)|((t2&1)<<7)];
|
---|
400 | }
|
---|
401 | }
|
---|
402 |
|
---|
403 | ////// ====================================================================================
|
---|
404 |
|
---|
405 | static unsigned char CW1[8], CW2[8];
|
---|
406 |
|
---|
407 | extern int io_serial_need_dummy_char;
|
---|
408 |
|
---|
409 | struct CmdTabEntry {
|
---|
410 | unsigned char cla;
|
---|
411 | unsigned char cmd;
|
---|
412 | unsigned char len;
|
---|
413 | unsigned char mode;
|
---|
414 | };
|
---|
415 |
|
---|
416 | struct CmdTab {
|
---|
417 | unsigned char index;
|
---|
418 | unsigned char size;
|
---|
419 | unsigned char Nentries;
|
---|
420 | unsigned char dummy;
|
---|
421 | struct CmdTabEntry e[1];
|
---|
422 | };
|
---|
423 |
|
---|
424 | struct CmdTab *cmd_table=NULL;
|
---|
425 | static void memorize_cmd_table (const unsigned char *mem, int size){
|
---|
426 | cmd_table=(struct CmdTab *)malloc(sizeof(unsigned char) * size);
|
---|
427 | memcpy(cmd_table,mem,size);
|
---|
428 | }
|
---|
429 |
|
---|
430 | void Manage_Tag(unsigned char *Answer)
|
---|
431 | {
|
---|
432 | unsigned char Tag,Len,Len2;
|
---|
433 | bool Valid_0x55=0;
|
---|
434 | unsigned char *Body;
|
---|
435 | unsigned char Buffer[0x10];
|
---|
436 | int a=0x13;
|
---|
437 | Len2=Answer[4];
|
---|
438 | while(a<Len2)
|
---|
439 | {
|
---|
440 | Tag=Answer[a];
|
---|
441 | Len=Answer[a+1];
|
---|
442 | Body=Answer+a+2;
|
---|
443 | switch(Tag)
|
---|
444 | {
|
---|
445 | case 0x55:{
|
---|
446 | if(Body[0]==0x84) //Tag 0x56 has valid data...
|
---|
447 | Valid_0x55=1;
|
---|
448 | }break;
|
---|
449 | case 0x56:{
|
---|
450 | memcpy(Buffer+8,Body,8);
|
---|
451 | }break;
|
---|
452 | }
|
---|
453 | a+=Len+2;
|
---|
454 |
|
---|
455 | }
|
---|
456 | if(Valid_0x55)
|
---|
457 | {
|
---|
458 | memcpy(Buffer,Answer+5,8); //Copy original DW
|
---|
459 | AES_decrypt(Buffer,Buffer,&Astro_Key); //Astro_Key declared and filled before...
|
---|
460 | memcpy(CW1,Buffer,8); //Now copy calculated DW in right place
|
---|
461 | }
|
---|
462 | }
|
---|
463 |
|
---|
464 | static int cmd_table_get_info(const unsigned char *cmd, unsigned char *rlen, unsigned char *rmode)
|
---|
465 | {
|
---|
466 | struct CmdTabEntry *pcte=cmd_table->e;
|
---|
467 | int i;
|
---|
468 | for(i=0; i<cmd_table->Nentries; i++,pcte++)
|
---|
469 | if(cmd[1]==pcte->cmd) {
|
---|
470 | *rlen=pcte->len;
|
---|
471 | *rmode=pcte->mode;
|
---|
472 | return 1;
|
---|
473 | }
|
---|
474 | return 0;
|
---|
475 | }
|
---|
476 |
|
---|
477 | static int status_ok(const unsigned char *status){
|
---|
478 | //cs_log("[videoguard2-reader] check status %02x%02x", status[0],status[1]);
|
---|
479 | return (status[0] == 0x90 || status[0] == 0x91)
|
---|
480 | && (status[1] == 0x00 || status[1] == 0x01
|
---|
481 | || status[1] == 0x20 || status[1] == 0x21
|
---|
482 | || status[1] == 0x80 || status[1] == 0x81
|
---|
483 | || status[1] == 0xa0 || status[1] == 0xa1);
|
---|
484 | }
|
---|
485 |
|
---|
486 | static int read_cmd_len(struct s_reader * reader, const unsigned char *cmd)
|
---|
487 | {
|
---|
488 | def_resp;
|
---|
489 | unsigned char cmd2[5];
|
---|
490 | memcpy(cmd2,cmd,5);
|
---|
491 | cmd2[3]=0x80;
|
---|
492 | cmd2[4]=1;
|
---|
493 | // some card reply with L 91 00 (L being the command length).
|
---|
494 |
|
---|
495 | if(!write_cmd_vg(cmd2,NULL) || !status_ok(cta_res+1)) {
|
---|
496 | cs_debug("[videoguard2-reader] failed to read %02x%02x cmd length (%02x %02x)",cmd[1],cmd[2],cta_res[1],cta_res[2]);
|
---|
497 | return -1;
|
---|
498 | }
|
---|
499 | return cta_res[0];
|
---|
500 | }
|
---|
501 |
|
---|
502 | static int do_cmd(struct s_reader * reader, const unsigned char *ins, const unsigned char *txbuff, unsigned char *rxbuff, unsigned char * cta_res)
|
---|
503 | {
|
---|
504 | ushort cta_lr;
|
---|
505 | unsigned char ins2[5];
|
---|
506 | memcpy(ins2,ins,5);
|
---|
507 | unsigned char len=0, mode=0;
|
---|
508 | if(cmd_table_get_info(ins2,&len,&mode)) {
|
---|
509 | if(len==0xFF && mode==2) {
|
---|
510 | if(ins2[4]==0) ins2[4]=len=read_cmd_len(reader, ins2);
|
---|
511 | }
|
---|
512 | else if(mode!=0) ins2[4]=len;
|
---|
513 | }
|
---|
514 | if(ins2[0]==0xd3) ins2[4]=len+16;
|
---|
515 | len=ins2[4];
|
---|
516 |
|
---|
517 | unsigned char tmp[264];
|
---|
518 | if(!rxbuff) rxbuff=tmp;
|
---|
519 | if(mode>1) {
|
---|
520 | if(!write_cmd_vg(ins2,NULL) || !status_ok(cta_res+len)) return -1;
|
---|
521 | memcpy(rxbuff,ins2,5);
|
---|
522 | memcpy(rxbuff+5,cta_res,len);
|
---|
523 | memcpy(rxbuff+5+len,cta_res+len,2);
|
---|
524 | }
|
---|
525 | else {
|
---|
526 | if(!write_cmd_vg(ins2,(uchar *)txbuff) || !status_ok(cta_res)) return -2;
|
---|
527 | memcpy(rxbuff,ins2,5);
|
---|
528 | memcpy(rxbuff+5,txbuff,len);
|
---|
529 | memcpy(rxbuff+5+len,cta_res,2);
|
---|
530 | }
|
---|
531 |
|
---|
532 | cCamCryptVG2_PostProcess_Decrypt(rxbuff,len,CW1,CW2);
|
---|
533 |
|
---|
534 | // Start of suggested fix for 09ac cards
|
---|
535 | // Log decrypted INS54
|
---|
536 | ///if (rxbuff[1] == 0x54) {
|
---|
537 | /// cs_dump (rxbuff, 5, "Decrypted INS54:");
|
---|
538 | /// cs_dump (rxbuff + 5, rxbuff[4], "");
|
---|
539 | ///}
|
---|
540 |
|
---|
541 | Manage_Tag(rxbuff);
|
---|
542 | // End of suggested fix
|
---|
543 | return len;
|
---|
544 | }
|
---|
545 |
|
---|
546 | static void rev_date_calc(const unsigned char *Date, int *year, int *mon, int *day, int *hh, int *mm, int *ss)
|
---|
547 | {
|
---|
548 | *year=(Date[0]/12)+BASEYEAR;
|
---|
549 | *mon=(Date[0]%12)+1;
|
---|
550 | *day=Date[1] & 0x1f;
|
---|
551 | *hh=Date[2]/8;
|
---|
552 | *mm=(0x100*(Date[2]-*hh*8)+Date[3])/32;
|
---|
553 | *ss=(Date[3]-*mm*32)*2;
|
---|
554 | }
|
---|
555 |
|
---|
556 | typedef struct{
|
---|
557 | unsigned short id;
|
---|
558 | char name[32];
|
---|
559 | } GCC_PACK tier_t;
|
---|
560 |
|
---|
561 | static const tier_t skyit_tiers[] =
|
---|
562 | {
|
---|
563 | { 0x0320, "Promo" },
|
---|
564 | { 0x000B, "Service" },
|
---|
565 | { 0x0219, "Mondo HD" },
|
---|
566 | { 0x021A, "Cinema HD" },
|
---|
567 | { 0x021B, "Cinema" },
|
---|
568 | { 0x0222, "Sport HD" },
|
---|
569 | { 0x0224, "Sky Play IT" },
|
---|
570 | { 0x0226, "Mondo" },
|
---|
571 | { 0x0228, "Sport" },
|
---|
572 | { 0x0229, "Disney Channel" },
|
---|
573 | { 0x022A, "Inter Channel" },
|
---|
574 | { 0x022B, "Milan Channel" },
|
---|
575 | { 0x022C, "Roma Channel" },
|
---|
576 | { 0x022D, "Classica" },
|
---|
577 | { 0x022E, "Music & News" },
|
---|
578 | { 0x022F, "Caccia e Pesca" },
|
---|
579 | { 0x023D, "Juventus Channel" },
|
---|
580 | { 0x023E, "Moto TV" },
|
---|
581 | { 0x026B, "Calcio HD" },
|
---|
582 | { 0x0275, "Promo" },
|
---|
583 | { 0x0295, "Calcio" },
|
---|
584 | { 0x0296, "Serie B" },
|
---|
585 | { 0x02FE, "PPV" }
|
---|
586 | };
|
---|
587 |
|
---|
588 | static const char *get_tier_name(struct s_reader * reader, unsigned short tier_id){
|
---|
589 | static char *empty = "";
|
---|
590 | unsigned int i;
|
---|
591 |
|
---|
592 | switch (reader->caid[0])
|
---|
593 | {
|
---|
594 | case 0x919:
|
---|
595 | case 0x93b:
|
---|
596 | for (i = 0; i < sizeof(skyit_tiers) / sizeof(tier_t); ++i)
|
---|
597 | if (skyit_tiers[i].id == tier_id)
|
---|
598 | return skyit_tiers[i].name;
|
---|
599 | break;
|
---|
600 | }
|
---|
601 | return empty;
|
---|
602 | }
|
---|
603 |
|
---|
604 | static void read_tiers(struct s_reader * reader)
|
---|
605 | {
|
---|
606 | def_resp;
|
---|
607 | static const unsigned char ins2a[5] = { 0xd0,0x2a,0x00,0x00,0x00 };
|
---|
608 | int l;
|
---|
609 | l=do_cmd(reader, ins2a,NULL,NULL,cta_res);
|
---|
610 | if(l<0 || !status_ok(cta_res+l)) return;
|
---|
611 | static unsigned char ins76[5] = { 0xd0,0x76,0x00,0x00,0x00 };
|
---|
612 | ins76[3]=0x7f; ins76[4]=2;
|
---|
613 | if(!write_cmd_vg(ins76,NULL) || !status_ok(cta_res+2)) return;
|
---|
614 | ins76[3]=0; ins76[4]=0;
|
---|
615 | int num=cta_res[1];
|
---|
616 | int i;
|
---|
617 | #ifdef CS_RDR_INIT_HIST
|
---|
618 | reader->init_history_pos = 0; //reset for re-read
|
---|
619 | memset(reader->init_history, 0, sizeof(reader->init_history));
|
---|
620 | #endif
|
---|
621 | for(i=0; i<num; i++) {
|
---|
622 | ins76[2]=i;
|
---|
623 | l=do_cmd(reader, ins76,NULL,NULL,cta_res);
|
---|
624 | if(l<0 || !status_ok(cta_res+l)) return;
|
---|
625 | if(cta_res[2]==0 && cta_res[3]==0) break;
|
---|
626 | int y,m,d,H,M,S;
|
---|
627 | rev_date_calc(&cta_res[4],&y,&m,&d,&H,&M,&S);
|
---|
628 | unsigned short tier_id = (cta_res[2] << 8) | cta_res[3];
|
---|
629 | const char *tier_name = get_tier_name(reader, tier_id);
|
---|
630 | cs_ri_log(reader, "[videoguard2-reader] tier: %04x, expiry date: %04d/%02d/%02d-%02d:%02d:%02d %s",tier_id,y,m,d,H,M,S,tier_name);
|
---|
631 | }
|
---|
632 | }
|
---|
633 |
|
---|
634 | int videoguard_card_init(struct s_reader * reader, ATR newatr)
|
---|
635 | {
|
---|
636 | get_hist;
|
---|
637 | if ((hist_size < 7) || (hist[1] != 0xB0) || (hist[4] != 0xFF) || (hist[5] != 0x4A) || (hist[6] != 0x50))
|
---|
638 | return ERROR;
|
---|
639 | get_atr;
|
---|
640 | def_resp;
|
---|
641 | /* known atrs */
|
---|
642 | unsigned char atr_bskyb[] = { 0x3F, 0x7F, 0x13, 0x25, 0x03, 0x33, 0xB0, 0x06, 0x69, 0xFF, 0x4A, 0x50, 0xD0, 0x00, 0x00, 0x53, 0x59, 0x00, 0x00, 0x00 };
|
---|
643 | unsigned char atr_bskyb_new[] = { 0x3F, 0xFD, 0x13, 0x25, 0x02, 0x50, 0x00, 0x0F, 0x33, 0xB0, 0x0F, 0x69, 0xFF, 0x4A, 0x50, 0xD0, 0x00, 0x00, 0x53, 0x59, 0x02 };
|
---|
644 | unsigned char atr_skyitalia[] = { 0x3F, 0xFF, 0x13, 0x25, 0x03, 0x10, 0x80, 0x33, 0xB0, 0x0E, 0x69, 0xFF, 0x4A, 0x50, 0x70, 0x00, 0x00, 0x49, 0x54, 0x02, 0x00, 0x00 };
|
---|
645 | unsigned char atr_skyitalia93b[] = { 0x3F, 0xFD, 0x13, 0x25, 0x02, 0x50, 0x80, 0x0F, 0x33, 0xB0, 0x13, 0x69, 0xFF, 0x4A, 0x50, 0xD0, 0x80, 0x00, 0x49, 0x54, 0x03 };
|
---|
646 | unsigned char atr_directv[] = { 0x3F, 0x78, 0x13, 0x25, 0x03, 0x40, 0xB0, 0x20, 0xFF, 0xFF, 0x4A, 0x50, 0x00 };
|
---|
647 | unsigned char atr_yes[] = { 0x3F, 0xFF, 0x13, 0x25, 0x03, 0x10, 0x80, 0x33, 0xB0, 0x11, 0x69, 0xFF, 0x4A, 0x50, 0x50, 0x00, 0x00, 0x47, 0x54, 0x01, 0x00, 0x00 };
|
---|
648 | unsigned char atr_viasat_new[] = { 0x3F, 0x7D, 0x11, 0x25, 0x02, 0x41, 0xB0, 0x03, 0x69, 0xFF, 0x4A, 0x50, 0xF0, 0x80, 0x00, 0x56, 0x54, 0x03};
|
---|
649 | unsigned char atr_dsmart[] = { 0x3F, 0xFF, 0x14, 0x25, 0x03, 0x10, 0x80, 0x41, 0xB0, 0x01, 0x69, 0xFF, 0x4A, 0x50, 0x70, 0x00, 0x00, 0x5A, 0x48, 0x01, 0x00, 0x00 };
|
---|
650 | unsigned char atr_viasat_scandinavia[] = { 0x3F, 0x7F, 0x11, 0x25, 0x03, 0x33, 0xB0, 0x09, 0x69, 0xFF, 0x4A, 0x50, 0x70, 0x00, 0x00, 0x56, 0x54, 0x01, 0x00, 0x00 };
|
---|
651 | unsigned char atr_premiere[] = { 0x3F, 0xFF, 0x11, 0x25, 0x03, 0x10, 0x80, 0x41, 0xB0, 0x07, 0x69, 0xFF, 0x4A, 0x50, 0x70, 0x00, 0x00, 0x50, 0x31, 0x01, 0x00, 0x11 };
|
---|
652 | unsigned char atr_kbw[] = { 0x3F, 0xFF, 0x14, 0x25, 0x03, 0x10, 0x80, 0x54, 0xB0, 0x01, 0x69, 0xFF, 0x4A, 0x50, 0x70, 0x00, 0x00, 0x4B, 0x57, 0x01, 0x00, 0x00};
|
---|
653 | unsigned char atr_get[] = { 0x3F, 0xFF, 0x14, 0x25, 0x03, 0x10, 0x80, 0x33, 0xB0, 0x10, 0x69, 0xFF, 0x4A, 0x50, 0x70, 0x00, 0x00, 0x5A, 0x45, 0x01, 0x00, 0x00};
|
---|
654 | unsigned char atr_foxtel_90b[] = { 0x3F, 0x7F, 0x11, 0x25, 0x03, 0x33, 0xB0, 0x09, 0x69, 0xFF, 0x4A, 0x50, 0x70, 0x00, 0x00, 0x46, 0x44, 0x01, 0x00, 0x00};
|
---|
655 | unsigned char atr_china_988[] = { 0x3F, 0x7F, 0x13, 0x25, 0x04, 0x33, 0xB0, 0x02, 0x69, 0xFF, 0x4A, 0x50, 0xE0, 0x00, 0x00, 0x54, 0x42, 0x00, 0x00, 0x00};
|
---|
656 | unsigned char atr_toptv_9b8[] = { 0x3F, 0xFF, 0x14, 0x25, 0x03, 0x10, 0x80, 0x41, 0xB0, 0x02, 0x69, 0xFF, 0x4A, 0x50, 0x70, 0x80, 0x00, 0x58, 0x38, 0x01, 0x00, 0x14};
|
---|
657 | unsigned char atr_skyBRgl23[] = { 0x3F, 0xFF, 0x13, 0x25, 0x02, 0x40, 0xB0, 0x12, 0x69, 0xFF, 0x4A, 0x50, 0x90, 0x47, 0x4C, 0x00, 0x00, 0x00, 0x00, 0x00 };
|
---|
658 | unsigned char atr_skyBRgl39[] = { 0x3F, 0xFD, 0x13, 0x25, 0x02, 0x50, 0x80, 0x0F, 0x33, 0xB0, 0x08, 0xFF, 0xFF, 0x4A, 0x50, 0x90, 0x00, 0x00, 0x47, 0x4C, 0x01};
|
---|
659 | unsigned char atr_skyBRgl54[] = { 0x3F, 0xFF, 0x13, 0x25, 0x02, 0x50, 0x80, 0x0F, 0x54, 0xB0, 0x03, 0xFF, 0xFF, 0x4A, 0x50, 0x80, 0x00, 0x00, 0x00, 0x00, 0x47, 0x4C, 0x05 };
|
---|
660 |
|
---|
661 | if ((atr_size == sizeof (atr_bskyb)) && (memcmp (atr, atr_bskyb, atr_size) == 0))
|
---|
662 | {
|
---|
663 | cs_ri_log(reader, "[videoguard2-reader] type: VideoGuard BSkyB");
|
---|
664 | BASEYEAR = 2000;
|
---|
665 | /* BSkyB seems to need one additionnal byte in the serial communication... */
|
---|
666 | io_serial_need_dummy_char = 1;
|
---|
667 | }
|
---|
668 | else if ((atr_size == sizeof (atr_bskyb_new)) && (memcmp (atr, atr_bskyb_new, atr_size) == 0))
|
---|
669 | {
|
---|
670 | cs_ri_log(reader, "[videoguard2-reader] type: VideoGuard BSkyB - New");
|
---|
671 | }
|
---|
672 | else if ((atr_size == sizeof (atr_skyitalia)) && (memcmp (atr, atr_skyitalia, atr_size) == 0))
|
---|
673 | {
|
---|
674 | cs_ri_log(reader, "[videoguard2-reader] type: VideoGuard Sky Italia");
|
---|
675 | }
|
---|
676 | else if ((atr_size == sizeof (atr_directv)) && (memcmp (atr, atr_directv, atr_size) == 0))
|
---|
677 | {
|
---|
678 | cs_ri_log(reader, "[videoguard2-reader] type: VideoGuard DirecTV");
|
---|
679 | }
|
---|
680 | else if ((atr_size == sizeof (atr_yes)) && (memcmp (atr, atr_yes, atr_size) == 0))
|
---|
681 | {
|
---|
682 | cs_ri_log(reader, "[videoguard2-reader] type: VideoGuard YES DBS Israel");
|
---|
683 | }
|
---|
684 | else if ((atr_size == sizeof (atr_viasat_new)) && (memcmp (atr, atr_viasat_new, atr_size) == 0))
|
---|
685 | {
|
---|
686 | cs_ri_log(reader, "[videoguard2-reader] type: VideoGuard Viasat new (093E)");
|
---|
687 | BASEYEAR = 2000;
|
---|
688 | }
|
---|
689 | else if ((atr_size == sizeof (atr_viasat_scandinavia)) && (memcmp (atr, atr_viasat_scandinavia, atr_size) == 0))
|
---|
690 | {
|
---|
691 | cs_ri_log(reader, "[videoguard2-reader] type: VideoGuard Viasat Scandinavia");
|
---|
692 | BASEYEAR = 2000;
|
---|
693 | }
|
---|
694 | else if ((atr_size == sizeof (atr_skyitalia93b)) && (memcmp (atr, atr_skyitalia93b, atr_size) == 0))
|
---|
695 | {
|
---|
696 | cs_ri_log(reader, "[videoguard2-reader] type: VideoGuard Sky Italia new (093B)");
|
---|
697 | }
|
---|
698 | else if ((atr_size == sizeof (atr_premiere)) && (memcmp (atr, atr_premiere, atr_size) == 0))
|
---|
699 | {
|
---|
700 | cs_ri_log(reader, "[videoguard2-reader] type: VideoGuard Sky Germany");
|
---|
701 | }
|
---|
702 | else if ((atr_size == sizeof (atr_dsmart)) && (memcmp (atr, atr_dsmart, atr_size) == 0))
|
---|
703 | {
|
---|
704 | cs_ri_log(reader, "[videoguard2-reader] type: VideoGuard DSMART Turkey");
|
---|
705 | BASEYEAR = 2004;
|
---|
706 | }
|
---|
707 | else if ((atr_size == sizeof (atr_kbw)) && (memcmp (atr, atr_kbw, atr_size) == 0))
|
---|
708 | {
|
---|
709 | cs_ri_log(reader, "[videoguard2-reader] type: VideoGuard Kabel BW");
|
---|
710 | }
|
---|
711 | else if ((atr_size == sizeof (atr_get)) && (memcmp (atr, atr_get, atr_size) == 0))
|
---|
712 | {
|
---|
713 | cs_ri_log(reader, "[videoguard2-reader] type: VideoGuard Get Kabel Norway");
|
---|
714 | BASEYEAR = 2004;
|
---|
715 | }
|
---|
716 | else if ((atr_size == sizeof (atr_foxtel_90b)) && (memcmp (atr, atr_foxtel_90b, atr_size) == 0))
|
---|
717 | {
|
---|
718 | cs_ri_log(reader, "[videoguard2-reader] type: VideoGuard Foxtel Australia (090b)");
|
---|
719 | BASEYEAR = 2000;
|
---|
720 | }
|
---|
721 | else if ((atr_size == sizeof (atr_china_988)) && (memcmp (atr, atr_china_988, atr_size) == 0))
|
---|
722 | {
|
---|
723 | cs_ri_log(reader, "[videoguard2-reader] type: VideoGuard China (0988)");
|
---|
724 | }
|
---|
725 | else if ((atr_size == sizeof (atr_toptv_9b8)) && (memcmp (atr, atr_toptv_9b8, atr_size) == 0))
|
---|
726 | {
|
---|
727 | cs_ri_log(reader, "[videoguard2-reader] type: VideoGuard TopTV (09B8)");
|
---|
728 | }
|
---|
729 | else if ((atr_size == sizeof (atr_skyBRgl23)) && (memcmp (atr, atr_skyBRgl23, atr_size) == 0))
|
---|
730 | {
|
---|
731 | cs_log("[videoguard2-reader] type: VideoGuard SkyBrasilGL23 (0942)");
|
---|
732 | BASEYEAR = 2000;
|
---|
733 | }
|
---|
734 | else if ((atr_size == sizeof (atr_skyBRgl39)) && (memcmp (atr, atr_skyBRgl39, atr_size) == 0))
|
---|
735 | {
|
---|
736 | cs_log("[videoguard2-reader] type: VideoGuard SkyBrasilGL39 (0907)");
|
---|
737 | BASEYEAR = 2004;
|
---|
738 | }
|
---|
739 | else if ((atr_size == sizeof (atr_skyBRgl54)) && (memcmp (atr, atr_skyBRgl54, atr_size) == 0))
|
---|
740 | {
|
---|
741 | cs_log("[videoguard2-reader] type: VideoGuard SkyBrasilGL54 (0943)");
|
---|
742 | BASEYEAR = 2009;
|
---|
743 | }
|
---|
744 |
|
---|
745 | //a non videoguard2/NDS card will fail on read_cmd_len(ins7401)
|
---|
746 | //this way also unknown videoguard2/NDS cards will work
|
---|
747 |
|
---|
748 | unsigned char ins7401[5] = { 0xD0,0x74,0x01,0x00,0x00 };
|
---|
749 | int l;
|
---|
750 | ins7401[3]=0x80; // from newcs log
|
---|
751 | ins7401[4]=0x01;
|
---|
752 | if((l=read_cmd_len(reader, ins7401))<0) return ERROR; //not a videoguard2/NDS card or communication error
|
---|
753 | ins7401[3]=0x00;
|
---|
754 | ins7401[4]=l;
|
---|
755 | if(!write_cmd_vg(ins7401,NULL) || !status_ok(cta_res+l)) {
|
---|
756 | cs_log ("[videoguard2-reader] failed to read cmd list");
|
---|
757 | return ERROR;
|
---|
758 | }
|
---|
759 |
|
---|
760 | memorize_cmd_table (cta_res,l);
|
---|
761 |
|
---|
762 | unsigned char buff[256];
|
---|
763 |
|
---|
764 | unsigned char ins7416[5] = { 0xD0,0x74,0x16,0x00,0x00 };
|
---|
765 | if(do_cmd(reader, ins7416, NULL, NULL,cta_res)<0) {
|
---|
766 | cs_log ("[videoguard2-reader] cmd 7416 failed");
|
---|
767 | return ERROR;
|
---|
768 | }
|
---|
769 |
|
---|
770 | unsigned char ins36[5] = { 0xD0,0x36,0x00,0x00,0x00 };
|
---|
771 | unsigned char boxID [4];
|
---|
772 |
|
---|
773 | if (reader->boxid > 0) {
|
---|
774 | /* the boxid is specified in the config */
|
---|
775 | int i;
|
---|
776 | for (i=0; i < 4; i++) {
|
---|
777 | boxID[i] = (reader->boxid >> (8 * (3 - i))) % 0x100;
|
---|
778 | }
|
---|
779 | } else {
|
---|
780 | /* we can try to get the boxid from the card */
|
---|
781 | int boxidOK=0;
|
---|
782 | l=do_cmd(reader, ins36, NULL, buff,cta_res);
|
---|
783 | if(l<13)
|
---|
784 | cs_log("[videoguard2-reader] ins36: too short answer");
|
---|
785 | else if (buff[7] > 0x0F)
|
---|
786 | cs_log("[videoguard2-reader] ins36: encrypted - can't parse");
|
---|
787 | else {
|
---|
788 | /* skipping the initial fixed fields: cmdecho (4) + length (1) + encr/rev++ (4) */
|
---|
789 | int i=9;
|
---|
790 | int gotUA=0;
|
---|
791 | while (i<l) {
|
---|
792 | if (!gotUA && buff[i]<0xF0) { /* then we guess that the next 4 bytes is the UA */
|
---|
793 | gotUA=1;
|
---|
794 | i+=4;
|
---|
795 | } else switch (buff[i]) { /* object length vary depending on type */
|
---|
796 | case 0xEF: /* card status */
|
---|
797 | i+=3;
|
---|
798 | break;
|
---|
799 | case 0xD1:
|
---|
800 | i+=4;
|
---|
801 | break;
|
---|
802 | case 0xDF: /* next server contact */
|
---|
803 | i+=5;
|
---|
804 | break;
|
---|
805 | case 0xF3: /* boxID */
|
---|
806 | memcpy(&boxID,&buff[i+1],sizeof(boxID));
|
---|
807 | boxidOK=1;
|
---|
808 | i+=5;
|
---|
809 | break;
|
---|
810 | case 0xF6:
|
---|
811 | i+=6;
|
---|
812 | break;
|
---|
813 | case 0x01: /* date & time */
|
---|
814 | i+=7;
|
---|
815 | break;
|
---|
816 | case 0xFA:
|
---|
817 | i+=9;
|
---|
818 | break;
|
---|
819 | case 0x5E:
|
---|
820 | case 0x67: /* signature */
|
---|
821 | case 0xDE:
|
---|
822 | case 0xE2:
|
---|
823 | case 0xE9: /* tier dates */
|
---|
824 | case 0xFD:
|
---|
825 | i+=buff[i+1]+2; /* skip length + 2 bytes (type and length) */
|
---|
826 | break;
|
---|
827 | default: /* default to assume a length byte */
|
---|
828 | cs_log("[videoguard2-reader] ins36 returned unknown type=0x%02X - parsing may fail", buff[i]);
|
---|
829 | i+=buff[i+1]+2;
|
---|
830 | }
|
---|
831 | }
|
---|
832 | }
|
---|
833 |
|
---|
834 | if(!boxidOK) {
|
---|
835 | cs_log ("[videoguard2-reader] no boxID available");
|
---|
836 | return ERROR;
|
---|
837 | }
|
---|
838 | }
|
---|
839 |
|
---|
840 | unsigned char ins4C[5] = { 0xD0,0x4C,0x00,0x00,0x09 };
|
---|
841 | unsigned char payload4C[9] = { 0,0,0,0, 3,0,0,0,4 };
|
---|
842 | memcpy(payload4C,boxID,4);
|
---|
843 | if(!write_cmd_vg(ins4C,payload4C) || !status_ok(cta_res+l)) {
|
---|
844 | cs_log("[videoguard2-reader] sending boxid failed");
|
---|
845 | return ERROR;
|
---|
846 | }
|
---|
847 | // Start of suggested fix for 09ac cards
|
---|
848 | unsigned char Dimeno_Magic[0x10]={0xF9,0xFB,0xCD,0x5A,0x76,0xB5,0xC4,0x5C,0xC8,0x2E,0x1D,0xE1,0xCC,0x5B,0x6B,0x02};
|
---|
849 | int a;
|
---|
850 | for(a=0; a<4; a++)
|
---|
851 | Dimeno_Magic[a]=Dimeno_Magic[a]^boxID[a];
|
---|
852 | //I supposed to declare a AES_KEY Astro_Key somewhere before...
|
---|
853 | AES_set_decrypt_key(Dimeno_Magic,128,&Astro_Key);
|
---|
854 | Astro_Key.rounds=10;
|
---|
855 | //Important for ecm decryption...
|
---|
856 | // End of suggested fix
|
---|
857 |
|
---|
858 | //short int SWIRDstatus = cta_res[1];
|
---|
859 | unsigned char ins58[5] = { 0xD0,0x58,0x00,0x00,0x00 };
|
---|
860 | l=do_cmd(reader, ins58, NULL, buff,cta_res);
|
---|
861 | if(l<0) {
|
---|
862 | cs_log("[videoguard2-reader] cmd ins58 failed");
|
---|
863 | return ERROR;
|
---|
864 | }
|
---|
865 | memset(reader->hexserial, 0, 8);
|
---|
866 | memcpy(reader->hexserial+2, cta_res+3, 4);
|
---|
867 | memcpy(reader->sa, cta_res+3, 3);
|
---|
868 | reader->caid[0] = cta_res[24]*0x100+cta_res[25];
|
---|
869 |
|
---|
870 | /* we have one provider, 0x0000 */
|
---|
871 | reader->nprov = 1;
|
---|
872 | memset(reader->prid, 0x00, sizeof(reader->prid));
|
---|
873 |
|
---|
874 | /*
|
---|
875 | cs_log ("[videoguard2-reader] INS58 : Fuse byte=0x%02X, IRDStatus=0x%02X", cta_res[2],SWIRDstatus);
|
---|
876 | if (SWIRDstatus==4) {
|
---|
877 | // If swMarriage=4, not married then exchange for BC Key
|
---|
878 | cs_log ("[videoguard2-reader] Card not married, exchange for BC Keys");
|
---|
879 | */
|
---|
880 |
|
---|
881 | static unsigned char seed1[] = {
|
---|
882 | 0xb9, 0xd5, 0xef, 0xd5, 0xf5, 0xd5, 0xfb, 0xd5, 0x31, 0xd6, 0x43, 0xd6, 0x55, 0xd6, 0x61, 0xd6,
|
---|
883 | 0x85, 0xd6, 0x9d, 0xd6, 0xaf, 0xd6, 0xc7, 0xd6, 0xd9, 0xd6, 0x09, 0xd7, 0x15, 0xd7, 0x21, 0xd7,
|
---|
884 | 0x27, 0xd7, 0x3f, 0xd7, 0x45, 0xd7, 0xb1, 0xd7, 0xbd, 0xd7, 0xdb, 0xd7, 0x11, 0xd8, 0x23, 0xd8,
|
---|
885 | 0x29, 0xd8, 0x2f, 0xd8, 0x4d, 0xd8, 0x8f, 0xd8, 0xa1, 0xd8, 0xad, 0xd8, 0xbf, 0xd8, 0xd7, 0xd8
|
---|
886 | };
|
---|
887 | static unsigned char seed2[] = {
|
---|
888 | 0x01, 0x00, 0xcf, 0x13, 0xe0, 0x60, 0x54, 0xac, 0xab, 0x99, 0xe6, 0x0c, 0x9f, 0x5b, 0x91, 0xb9,
|
---|
889 | 0x72, 0x72, 0x4d, 0x5b, 0x5f, 0xd3, 0xb7, 0x5b, 0x01, 0x4d, 0xef, 0x9e, 0x6b, 0x8a, 0xb9, 0xd1,
|
---|
890 | 0xc9, 0x9f, 0xa1, 0x2a, 0x8d, 0x86, 0xb6, 0xd6, 0x39, 0xb4, 0x64, 0x65, 0x13, 0x77, 0xa1, 0x0a,
|
---|
891 | 0x0c, 0xcf, 0xb4, 0x2b, 0x3a, 0x2f, 0xd2, 0x09, 0x92, 0x15, 0x40, 0x47, 0x66, 0x5c, 0xda, 0xc9
|
---|
892 | };
|
---|
893 | cCamCryptVG2_SetSeed(seed1,seed2);
|
---|
894 |
|
---|
895 | unsigned char insB4[5] = { 0xD0,0xB4,0x00,0x00,0x40 };
|
---|
896 | unsigned char tbuff[64];
|
---|
897 | cCamCryptVG2_GetCamKey(tbuff);
|
---|
898 | l=do_cmd(reader, insB4, tbuff, NULL,cta_res);
|
---|
899 | if(l<0 || !status_ok(cta_res)) {
|
---|
900 | cs_log ("[videoguard2-reader] cmd D0B4 failed (%02X%02X)", cta_res[0], cta_res[1]);
|
---|
901 | return ERROR;
|
---|
902 | }
|
---|
903 |
|
---|
904 | unsigned char insBC[5] = { 0xD0,0xBC,0x00,0x00,0x00 };
|
---|
905 | l=do_cmd(reader, insBC, NULL, NULL,cta_res);
|
---|
906 | if(l<0) {
|
---|
907 | cs_log("[videoguard2-reader] cmd D0BC failed");
|
---|
908 | return ERROR;
|
---|
909 | }
|
---|
910 |
|
---|
911 | unsigned char insBE[5] = { 0xD3,0xBE,0x00,0x00,0x00 };
|
---|
912 | l=do_cmd(reader, insBE, NULL, NULL,cta_res);
|
---|
913 | if(l<0) {
|
---|
914 | cs_log("[videoguard2-reader] cmd D3BE failed");
|
---|
915 | return ERROR;
|
---|
916 | }
|
---|
917 |
|
---|
918 | unsigned char ins58a[5] = { 0xD1,0x58,0x00,0x00,0x00 };
|
---|
919 | l=do_cmd(reader, ins58a, NULL, NULL,cta_res);
|
---|
920 | if(l<0) {
|
---|
921 | cs_log("[videoguard2-reader] cmd D158 failed");
|
---|
922 | return ERROR;
|
---|
923 | }
|
---|
924 |
|
---|
925 | unsigned char ins4Ca[5] = { 0xD1,0x4C,0x00,0x00,0x00 };
|
---|
926 | l=do_cmd(reader, ins4Ca,payload4C, NULL,cta_res);
|
---|
927 | if(l<0 || !status_ok(cta_res)) {
|
---|
928 | cs_log("[videoguard2-reader] cmd D14Ca failed");
|
---|
929 | return ERROR;
|
---|
930 | }
|
---|
931 |
|
---|
932 | cs_ri_log(reader, "[videoguard2-reader] type: VideoGuard, caid: %04X, serial: %02X%02X%02X%02X, BoxID: %02X%02X%02X%02X",
|
---|
933 | reader->caid[0],
|
---|
934 | reader->hexserial[2],reader->hexserial[3],reader->hexserial[4],reader->hexserial[5],
|
---|
935 | boxID[0],boxID[1],boxID[2],boxID[3]);
|
---|
936 |
|
---|
937 | cs_log("[videoguard2-reader] ready for requests");
|
---|
938 |
|
---|
939 | return OK;
|
---|
940 | }
|
---|
941 |
|
---|
942 | static void do_post_dw_hash(unsigned char *cw, unsigned char *ecm_header_data) {
|
---|
943 | int i,ecmi,ecm_header_count;
|
---|
944 | unsigned char buffer[0x80];
|
---|
945 | unsigned char md5_digest[0x10];
|
---|
946 | //ecm_header_data = 01 03 b0 01 01
|
---|
947 |
|
---|
948 | if (!cw_is_valid(cw)) //if cw is all zero, keep it that way
|
---|
949 | return;
|
---|
950 |
|
---|
951 | ecm_header_count=ecm_header_data[0];
|
---|
952 |
|
---|
953 | for(i=0, ecmi = 1; i<ecm_header_count; i++) {
|
---|
954 | if(ecm_header_data[ecmi+1] != 0xb0) {
|
---|
955 | ecmi += ecm_header_data[ecmi]+1;
|
---|
956 | } else {
|
---|
957 | switch(ecm_header_data[ecmi+2]) { //b0 01
|
---|
958 | case 1:
|
---|
959 | {
|
---|
960 | unsigned short hk[8],i,j,m=0;
|
---|
961 | for (i = 0; i < 6; i++) hk[2+i]=Hash3[i];
|
---|
962 | for (i = 0; i < 2; i++) {
|
---|
963 | for (j = 0; j < 0x48; j+=2) {
|
---|
964 | if (i)
|
---|
965 | hk[0]=((hk[3] & hk[5]) | ((~hk[5]) & hk[4]));
|
---|
966 | else
|
---|
967 | hk[0]=((hk[3] & hk[4]) | ((~hk[3]) & hk[5]));
|
---|
968 | if (j<8)
|
---|
969 | hk[0]=(hk[0]+((cw[j +1]<<8) | cw[j]));
|
---|
970 | if(j==8) hk[0]=(hk[0]+0x80);
|
---|
971 | hk[0]=(hk[0]+hk[2] + (0xFF & NdTabB001[ecm_header_data[ecmi+3]][m>>1] >> ((m&1)<<3))) ;
|
---|
972 | hk[1] = hk[2];
|
---|
973 | hk[2] = hk[3];
|
---|
974 | hk[3] = hk[4];
|
---|
975 | hk[4] = hk[5];
|
---|
976 | hk[5] = hk[6];
|
---|
977 | hk[6] = hk[7];
|
---|
978 | hk[7] = hk[2]+
|
---|
979 | (((hk[0] << Hash4[m&0xF]) | (hk[0] >> (0x10 - Hash4[m&0xF]))));
|
---|
980 | m=(m+1)&0x3F;
|
---|
981 | }
|
---|
982 | }
|
---|
983 | for (i = 0; i < 6; i++)
|
---|
984 | hk[2+i]+=Hash3[i];
|
---|
985 | for (i = 0; i < 7; i++)
|
---|
986 | cw[i]=hk[2+(i>>1)]>>((i&1)<<3);
|
---|
987 |
|
---|
988 | cw[3] = (cw[0] + cw[1] + cw[2]) & 0xFF;
|
---|
989 | cw[7] = (cw[4] + cw[5] + cw[6]) & 0xFF;
|
---|
990 | cs_ddump (cw, 8, "Postprocessed2 DW:");
|
---|
991 | break;
|
---|
992 | }
|
---|
993 | case 3:
|
---|
994 | {
|
---|
995 | memset(buffer,0,sizeof(buffer));
|
---|
996 | memcpy(buffer,cw,8);
|
---|
997 | memcpy(buffer+8,&ecm_header_data[ecmi+3],ecm_header_data[ecmi]-2);
|
---|
998 | MD5( buffer, 8+ecm_header_data[ecmi]-2, md5_digest) ;
|
---|
999 | memcpy(cw,md5_digest,8);
|
---|
1000 | cs_ddump (cw, 8, "Postprocessed2 DW:");
|
---|
1001 | break;
|
---|
1002 | }
|
---|
1003 |
|
---|
1004 | case 2:
|
---|
1005 | { /* Method 2 left out */
|
---|
1006 | //memcpy(DW_OUTPUT, DW_INPUT, 8);
|
---|
1007 | break;
|
---|
1008 | }
|
---|
1009 | }
|
---|
1010 | }
|
---|
1011 | }
|
---|
1012 | }
|
---|
1013 |
|
---|
1014 | int videoguard_do_ecm(struct s_reader * reader, ECM_REQUEST *er)
|
---|
1015 | {
|
---|
1016 | unsigned char cta_res[CTA_RES_LEN];
|
---|
1017 | static unsigned char ins40[5] = { 0xD1,0x40,0x00,0x80,0xFF };
|
---|
1018 | static const unsigned char ins54[5] = { 0xD3,0x54,0x00,0x00,0x00};
|
---|
1019 | int posECMpart2=er->ecm[6]+7;
|
---|
1020 | int lenECMpart2=er->ecm[posECMpart2]+1;
|
---|
1021 | unsigned char tbuff[264];
|
---|
1022 | tbuff[0]=0;
|
---|
1023 | memcpy(&tbuff[1],&(er->ecm[posECMpart2+1]),lenECMpart2-1);
|
---|
1024 | ins40[4]=lenECMpart2;
|
---|
1025 | int l;
|
---|
1026 | l = do_cmd(reader, ins40,tbuff,NULL,cta_res);
|
---|
1027 | if(l>0 && status_ok(cta_res)) {
|
---|
1028 | l = do_cmd(reader, ins54,NULL,NULL,cta_res);
|
---|
1029 | if(l>0 && status_ok(cta_res+l)) {
|
---|
1030 | if (!cw_is_valid(CW1)) //sky cards report 90 00 = ok but send cw = 00 when channel not subscribed
|
---|
1031 | return ERROR;
|
---|
1032 | if(er->ecm[0]&1) {
|
---|
1033 | memcpy(er->cw+8,CW1,8);
|
---|
1034 | memcpy(er->cw+0,CW2,8);
|
---|
1035 | }
|
---|
1036 | else {
|
---|
1037 | memcpy(er->cw+0,CW1,8);
|
---|
1038 | memcpy(er->cw+8,CW2,8);
|
---|
1039 | }
|
---|
1040 |
|
---|
1041 |
|
---|
1042 | //test for postprocessing marker
|
---|
1043 | int posB0 = -1;
|
---|
1044 | int i;
|
---|
1045 | for (i = 6; i < posECMpart2; i++)
|
---|
1046 | {
|
---|
1047 | if (er->ecm[i-3] == 0x80 && er->ecm[i] == 0xB0 && ((er->ecm[i+1] == 0x01) ||(er->ecm[i+1] == 0x02)||(er->ecm[i+1] == 0x03) ) ) {
|
---|
1048 | posB0 = i;
|
---|
1049 | break;
|
---|
1050 | }
|
---|
1051 | }
|
---|
1052 |
|
---|
1053 | if (posB0 != -1) {
|
---|
1054 | do_post_dw_hash( er->cw+0, &er->ecm[posB0-2]);
|
---|
1055 | do_post_dw_hash( er->cw+8, &er->ecm[posB0-2]);
|
---|
1056 | }
|
---|
1057 |
|
---|
1058 | return OK;
|
---|
1059 | }
|
---|
1060 | }
|
---|
1061 | return ERROR;
|
---|
1062 | }
|
---|
1063 |
|
---|
1064 | static int num_addr(const unsigned char *data)
|
---|
1065 | {
|
---|
1066 | return ((data[3]&0x30)>>4)+1;
|
---|
1067 | }
|
---|
1068 |
|
---|
1069 | static const unsigned char *payload_addr(uchar emmtype, const unsigned char *data, const unsigned char *a)
|
---|
1070 | {
|
---|
1071 | int s;
|
---|
1072 | int l;
|
---|
1073 | const unsigned char *ptr = NULL;
|
---|
1074 | int position=-1;
|
---|
1075 | int numAddrs=0;
|
---|
1076 |
|
---|
1077 | switch(emmtype) {
|
---|
1078 | case VG2_EMMTYPE_S: s=3; break;
|
---|
1079 | case VG2_EMMTYPE_U: s=4; break;
|
---|
1080 | default: s=0;
|
---|
1081 | }
|
---|
1082 |
|
---|
1083 | numAddrs=num_addr(data);
|
---|
1084 |
|
---|
1085 | if(s>0) {
|
---|
1086 | for(l=0;l<numAddrs;l++) {
|
---|
1087 | if(!memcmp(&data[l*4+4],a+2,s)) {
|
---|
1088 | position=l;
|
---|
1089 | break;
|
---|
1090 | }
|
---|
1091 | }
|
---|
1092 | }
|
---|
1093 |
|
---|
1094 | int num_filter = (position == -1) ? 0 : numAddrs;
|
---|
1095 |
|
---|
1096 | /* skip header and the filter list */
|
---|
1097 | ptr = data+4+4*num_filter;
|
---|
1098 |
|
---|
1099 | if (*ptr != 0x02 && *ptr != 0x07) // some clients omit 00 00 separator */
|
---|
1100 | {
|
---|
1101 | ptr += 2; // skip 00 00 separator
|
---|
1102 | if (*ptr == 0x00) ptr++; // skip optional 00
|
---|
1103 | ptr++; // skip the 1st bitmap len
|
---|
1104 | }
|
---|
1105 |
|
---|
1106 | /* check for IRD-EMM */
|
---|
1107 | if (*ptr != 0x02 && *ptr != 0x07) return NULL;
|
---|
1108 |
|
---|
1109 | /* skip IRD-EMM part, 02 00 or 02 06 xx aabbccdd yy */
|
---|
1110 | ptr += 2 + ptr[1];
|
---|
1111 |
|
---|
1112 | /* check for EMM boundaries - ptr should not exceed EMM length */
|
---|
1113 | if ((int)(ptr - data) >= data[2]) return NULL;
|
---|
1114 |
|
---|
1115 | for(l=0;l<position;l++) {
|
---|
1116 |
|
---|
1117 | /* skip the payload of the previous sub-EMM */
|
---|
1118 | ptr += 1 + ptr [0];
|
---|
1119 |
|
---|
1120 | /* skip optional 00 */
|
---|
1121 | if (*ptr == 0x00) ptr++;
|
---|
1122 |
|
---|
1123 | /* skip the bitmap len */
|
---|
1124 | ptr++;
|
---|
1125 |
|
---|
1126 | /* check for IRD-EMM */
|
---|
1127 | if (*ptr != 0x02 && *ptr != 0x07) return NULL;
|
---|
1128 |
|
---|
1129 | /* skip IRD-EMM part, 02 00 or 02 06 xx aabbccdd yy */
|
---|
1130 | ptr += 2 + ptr[1];
|
---|
1131 | }
|
---|
1132 |
|
---|
1133 | return ptr;
|
---|
1134 | }
|
---|
1135 |
|
---|
1136 | int videoguard_get_emm_type(EMM_PACKET *ep, struct s_reader * rdr)
|
---|
1137 | {
|
---|
1138 |
|
---|
1139 | /*
|
---|
1140 | 82 30 ad 70 00 XX XX XX 00 XX XX XX 00 XX XX XX 00 XX XX XX 00 00
|
---|
1141 | d3 02 00 22 90 20 44 02 4a 50 1d 88 ab 02 ac 79 16 6c df a1 b1 b7 77 00 ba eb 63 b5 c9 a9 30 2b 43 e9 16 a9 d5 14 00
|
---|
1142 | d3 02 00 22 90 20 44 02 13 e3 40 bd 29 e4 90 97 c3 aa 93 db 8d f5 6b e4 92 dd 00 9b 51 03 c9 3d d0 e2 37 44 d3 bf 00
|
---|
1143 | d3 02 00 22 90 20 44 02 97 79 5d 18 96 5f 3a 67 70 55 bb b9 d2 49 31 bd 18 17 2a e9 6f eb d8 76 ec c3 c9 cc 53 39 00
|
---|
1144 | d2 02 00 21 90 1f 44 02 99 6d df 36 54 9c 7c 78 1b 21 54 d9 d4 9f c1 80 3c 46 10 76 aa 75 ef d6 82 27 2e 44 7b 00
|
---|
1145 | */
|
---|
1146 |
|
---|
1147 | int i, pos;
|
---|
1148 | int serial_count = ((ep->emm[3] >> 4) & 3) + 1;
|
---|
1149 | int serial_len = (ep->emm[3] & 0x80) ? 3 : 4;
|
---|
1150 | uchar emmtype = (ep->emm[3] & VG2_EMMTYPE_MASK) >> 6;
|
---|
1151 |
|
---|
1152 | pos = 4 + (serial_len * serial_count) + 2;
|
---|
1153 |
|
---|
1154 | switch(emmtype) {
|
---|
1155 | case VG2_EMMTYPE_G:
|
---|
1156 | ep->type=GLOBAL;
|
---|
1157 | cs_debug_mask(D_EMM, "VIDEOGUARD2 EMM: GLOBAL");
|
---|
1158 | return TRUE;
|
---|
1159 |
|
---|
1160 | case VG2_EMMTYPE_U:
|
---|
1161 | cs_debug_mask(D_EMM, "VIDEOGUARD2 EMM: UNIQUE");
|
---|
1162 | ep->type=UNIQUE;
|
---|
1163 | if (ep->emm[1] == 0) // detected UNIQUE EMM from cccam (there is no serial)
|
---|
1164 | return TRUE;
|
---|
1165 | for (i = 1;i <= serial_count;i++) {
|
---|
1166 | if (!memcmp (rdr->hexserial + 2, ep->emm + (serial_len * i), serial_len)) {
|
---|
1167 | memcpy(ep->hexserial, ep->emm + (serial_len * i), serial_len);
|
---|
1168 | return TRUE;
|
---|
1169 | }
|
---|
1170 |
|
---|
1171 | pos = pos + ep->emm[pos+5] + 5;
|
---|
1172 | }
|
---|
1173 | return FALSE; // if UNIQUE but no serial match return FALSE
|
---|
1174 |
|
---|
1175 | case VG2_EMMTYPE_S:
|
---|
1176 | ep->type=SHARED;
|
---|
1177 | cs_debug_mask(D_EMM, "VIDEOGUARD2 EMM: SHARED");
|
---|
1178 | return TRUE; // FIXME: no check for SA
|
---|
1179 |
|
---|
1180 | default:
|
---|
1181 | if (ep->emm[pos-2] != 0x00 && ep->emm[pos-1] != 0x00 && ep->emm[pos-1] != 0x01) {
|
---|
1182 | //remote emm without serial
|
---|
1183 | ep->type=UNKNOWN;
|
---|
1184 | return TRUE;
|
---|
1185 | }
|
---|
1186 | return FALSE;
|
---|
1187 | }
|
---|
1188 | }
|
---|
1189 |
|
---|
1190 | void videoguard_get_emm_filter(struct s_reader * rdr, uchar *filter)
|
---|
1191 | {
|
---|
1192 | filter[0]=0xFF;
|
---|
1193 | filter[1]=3;
|
---|
1194 |
|
---|
1195 | //ToDo videoguard_get_emm_filter basic construction
|
---|
1196 |
|
---|
1197 | filter[2]=UNIQUE;
|
---|
1198 | filter[3]=0;
|
---|
1199 |
|
---|
1200 | filter[4+0] = 0x82;
|
---|
1201 | filter[4+0+16] = 0xFF;
|
---|
1202 |
|
---|
1203 | memcpy(filter+4+2, rdr->hexserial+2, 4);
|
---|
1204 | memset(filter+4+2+16, 0xFF, 4);
|
---|
1205 |
|
---|
1206 |
|
---|
1207 | filter[36]=UNIQUE;
|
---|
1208 | filter[37]=0;
|
---|
1209 |
|
---|
1210 | filter[38+0] = 0x82;
|
---|
1211 | filter[38+0+16] = 0xFF;
|
---|
1212 |
|
---|
1213 | memcpy(filter+38+6, rdr->hexserial+2, 4);
|
---|
1214 | memset(filter+38+6+16, 0xFF, 4);
|
---|
1215 |
|
---|
1216 |
|
---|
1217 | filter[70]=UNIQUE;
|
---|
1218 | filter[71]=0;
|
---|
1219 |
|
---|
1220 | filter[72+0] = 0x82;
|
---|
1221 | filter[72+0+16] = 0xFF;
|
---|
1222 |
|
---|
1223 | memcpy(filter+72+10, rdr->hexserial+2, 4);
|
---|
1224 | memset(filter+72+10+16, 0xFF, 4);
|
---|
1225 |
|
---|
1226 |
|
---|
1227 | /* filter[104]=UNIQUE;
|
---|
1228 | filter[105]=0;
|
---|
1229 |
|
---|
1230 | filter[106+0] = 0x82;
|
---|
1231 | filter[106+0+16] = 0xFF;
|
---|
1232 |
|
---|
1233 | memcpy(filter+106+14, rdr->hexserial+2, 2);
|
---|
1234 | memset(filter+106+14+16, 0xFF, 2); */
|
---|
1235 |
|
---|
1236 | return;
|
---|
1237 | }
|
---|
1238 |
|
---|
1239 | int videoguard_do_emm(struct s_reader * reader, EMM_PACKET *ep)
|
---|
1240 | {
|
---|
1241 | unsigned char cta_res[CTA_RES_LEN];
|
---|
1242 | unsigned char ins42[5] = { 0xD1,0x42,0x00,0x00,0xFF };
|
---|
1243 | int rc=ERROR;
|
---|
1244 |
|
---|
1245 | const unsigned char *payload = payload_addr(ep->type, ep->emm, reader->hexserial);
|
---|
1246 | while (payload) {
|
---|
1247 | ins42[4]=*payload;
|
---|
1248 | int l = do_cmd(reader, ins42,payload+1,NULL,cta_res);
|
---|
1249 | if(l>0 && status_ok(cta_res)) {
|
---|
1250 | rc=OK;
|
---|
1251 | }
|
---|
1252 |
|
---|
1253 | cs_debug_mask(D_EMM, "[videoguard2-reader] EMM request return code : %02X%02X", cta_res[0], cta_res[1]);
|
---|
1254 | //cs_dump(ep->emm, 64, "EMM:");
|
---|
1255 | if (status_ok (cta_res) && (cta_res[1] & 0x01)) {
|
---|
1256 | read_tiers(reader);
|
---|
1257 | }
|
---|
1258 |
|
---|
1259 | if (num_addr(ep->emm) == 1 && (int)(&payload[1] - &ep->emm[0]) + *payload + 1 < ep->l) {
|
---|
1260 | payload += *payload + 1;
|
---|
1261 | if (*payload == 0x00) ++payload;
|
---|
1262 | ++payload;
|
---|
1263 | if (*payload != 0x02) break;
|
---|
1264 | payload += 2 + payload[1];
|
---|
1265 | }
|
---|
1266 | else
|
---|
1267 | payload = 0;
|
---|
1268 |
|
---|
1269 | }
|
---|
1270 |
|
---|
1271 | return(rc);
|
---|
1272 | }
|
---|
1273 |
|
---|
1274 | int videoguard_card_info(struct s_reader * reader)
|
---|
1275 | {
|
---|
1276 | /* info is displayed in init, or when processing info */
|
---|
1277 | cs_log("[videoguard2-reader] card detected");
|
---|
1278 | cs_log("[videoguard2-reader] type: VideoGuard" );
|
---|
1279 | read_tiers (reader);
|
---|
1280 | return OK;
|
---|
1281 | }
|
---|