EMU for starchoice

I took a quick look at the Multicas-- 1.70d I believe was the version. I had to unpack it from gzip type of compression and inside I found about 0x180000 bytes. Much of the contents are strings and data, but looks like mips type of code from about 0x12500 to 0xe0000 for a processor that might be SMP8634-2801 from one type of string I found. gcc seems to have been used to create the code as I find a "gcc" string as well. I also see addresses that look to be around 0xf0400000 and I think I have seen mips processor that used a flash address around that 0xf0000000 base address so, maybe code executes in flash around there, but I would think with gz compression used that might be RAM address--hard to say for sure just with the one sample and I haven't tried to figure out the base addrs for where the MultiCas get put.

I do see a couple of card dumps in there too: REV 340 for sure, maybe others as I see a few "DNASP" strings. Lots of copies of the DN RSA modulus, just one of the GC N2 RSA mod that is used for radio. I'm guessing that it does card emu for most of the decryption needed as I see st19 and st20 emu indications and "map" strings like were needed for 2008+ decryption.

If the code were disassembled after figuring out the base addr to use, one might be able to do some modding.

Quote:

---

Originally Posted by jvvh5897

I took a quick look at the Multicas-- 1.70d I believe was the version. I had to unpack it from gzip type of compression and inside I found about 0x180000 bytes. Much of the contents are strings and data, but looks like mips type of code from about 0x12500 to 0xe0000 for a processor that might be SMP8634-2801 from one type of string I found. gcc seems to have been used to create the code as I find a "gcc" string as well. I also see addresses that look to be around 0xf0400000 and I think I have seen mips processor that used a flash address around that 0xf0000000 base address so, maybe code executes in flash around there, but I would think with gz compression used that might be RAM address--hard to say for sure just with the one sample and I haven't tried to figure out the base addrs for where the MultiCas get put.

I do see a couple of card dumps in there too: REV 340 for sure, maybe others as I see a few "DNASP" strings. Lots of copies of the DN RSA modulus, just one of the GC N2 RSA mod that is used for radio. I'm guessing that it does card emu for most of the decryption needed as I see st19 and st20 emu indications and "map" strings like were needed for 2008+ decryption.

If the code were disassembled after figuring out the base addr to use, one might be able to do some modding.

---

Part of the info is in the firmware of the azbox/ and all of it is stored in the DOM within the receiver, the DOM can be removed
from the receiver and put in a computer IDE port, if I wanted to get N2 music CH on sat 97.0w I think I would load an older
firmware, 0.9.5308 or older and an older multicas, JMO,LOL.

i think if multicas has only key format like this: xx-xx-xx-xx-xx-xx-xx-xx it was done to emu N1 only.

Not if the card dump inside the code is of as high a revision as I see--way past the N1 days. Plus I see map calls--those would be for late N2 decrypt. I would think that if your only choice is 8 byte key then you are not entering the keys in the right section. For N2 there should be a section with 4 groups of 8 bytes or two sections of 16 bytes. If you could find the DN or 3ev key area then you have an example of what you want.

all multicases have 4 x 8 bytes keys for DN and 3EV and only 1 x 8 bytes for C101, and i see no way to edit this.

Well, then go into the code and make some changes. Maybe swap things around so that where you enter 3ev becomes c101's spot instead.

I figured out how to disassemble the multicam file. There is an easy way and a harder way, but neither makes it easy to follow code execution because of the way the code was built. The easy way is to trim off the first 0x8000 byte to just leave the elf file and save it as an elf file, load it into IDA Pro and select mipsl processor setting and let IDA to an automatic analysis of the file as elf. It will find the entry point at 0x40a5c0 and auto label the routine names. The harder way is to just load the file to 0x3f8000 and run an IDC that I built to do the disassembly, run a readelf program to get the routine addresses and look around or use the results of the readelf to label the disassembled code. I might have a glimmer of a method to get the code execution labeled, but still thinking about it.

It looks like the nagra_ecm routine does the following:

Quote:

---

.text:004811F0 lbu $v0, 5($s3)
.text:004811F4 andi $v0, 0xFE
.text:004811F8 sb $v0, 0x308+var_268+1($sp)
.text:004811FC
.text:004811FC loc_4811FC: # CODE XREF: nagra2_ecm+4C8j
.text:004811FC lbu $v1, 0x308+var_268+1($sp)
.text:00481200 li $v0, 0xC0
.text:00481204 beq $v1, $v0, loc_48121C

---

Since c101 or c001 will get the same results from the above test, it looks to me like you need to use the TV Globo keys for N2 radio.


In the code you find something that looks like default keys for c001--you could go in and change those and maybe change the c001 to c101--don't know that you have to do that in the code as you might be able to do it from the menu system or dump a key.bin file and change things then send results to box (I don't own one so hard for me to know best way):

Quote:

---

109660 20 20 20 20 20 20 20 20-00 C0 01 00 00 00 00 00 TV Globo
109670 00 00 00 00 54 56 20 47-6C 6F 62 6F 20 20 20 20
109680 20 20 20 20 00 C0 01 10-00 00 00 00 00 00 00 00
109690 54 56 20 47 6C 6F 62 6F-20 20 20 20 20 20 20 20
1096A0 00 C0 01 01 D7 CB E9 3D-30 E2 C9 13 54 56 20 47
1096B0 6C 6F 62 6F 20 20 20 20-20 20 20 20 00 C0 01 11
1096C0 91 07 38 74 57 DB 90 23-50 52 45 4D 49 45 52 45

---

Anyway the keys are 00, 10, 01, 11 in the above.

thank a lot jvvh but i have not enough knowledge to do such a job

You can't enter keys?

no, to edit multicas code

Quote:

---

Originally Posted by jvvh5897

You can't enter keys?

---

Yes you can, in nagra key edit of multicas from the receiver menu.

Well, that is where the TV Globo keys should be changed too.

no room for this key format: 00-xx-xx-xx-xx-xx-xx-xx-xx only xx-xx-xx-xx-xx-xx-xx-xx under C101
10-xx-xx-xx-xx-xx-xx-xx-xx
01-xx-xx-xx-xx-xx-xx-xx-xx
11-xx-xx-xx-xx-xx-xx-xx-xx

C001 not c101 is TV globo

right, C101 is GC. in my pansat i put keys under C101 years ago, radio is still working.....

Yes, and in the code snippet I posted, you can see that as far as the code in your Mcas is concerned C001 and c101 is the same (c0 AND fe == c1 AND fe). SO, If you put your c101 keys in the c001 spot the radio channels should try to use them--I don't know if the rest of the code will work correctly, but for that part of the N2 decrypt you should be OK.

If I were doing it, I would want to learn much more about manipulating the box code, so I would use a hexeditor to change the Mcas code directly rather than just load the keys with remote--but that is me.

OK, i'll try to explain again. in azbox multicas under GC there is the room for ONLY ONE 8x2 bytes N1 key like this xx-xx-xx-xx-xx-xx-xx-xx, not FOUR 8x2 bytes N2 keys.
i cant post a screenshot for some reason, if somebody has multicas any version installed could you post a screenshot of globecast C101 keys section?
tnx

And I will try again--you don't enter keys at c101--as you say there is not room for 4 block of 8 bytes. BUT if you look for c001, you will find four such blocks and the code does not know how to tell the diff between c001 and c101. This is in the Mcas 1.70 version.

tnx jvvh, i'll try

Quote:

---

Originally Posted by jvvh5897

And I will try again--you don't enter keys at c101--as you say there is not room for 4 block of 8 bytes. BUT if you look for c001, you will find four such blocks and the code does not know how to tell the diff between c001 and c101. This is in the Mcas 1.70 version.

---

Multicas v1.82 has the same option.

So, did it work?

I didn't test it, when I have time I will.

did not try it yet, something wrong with freaking internet connection.

Not sure if this will make a difference but I found this in my notes: Not sure if activation will change anything before and/or after code wise. Am TFTA person but still would be interested in the music part. Excuse my post if no help to this thread.

Credit: KIKO post 1

KIKO

Quote:

---

How to activate or deactivate EMU's you know that on Your AzBox HD

You can install and use several emu. This tutorial will help You to activate and deactivate EMUs.

Go in Menu ---> Plugi-In ---> OpenXCAS Setup choose Activation and Priority Settings, now click on Blue button on Your Remote Controll and in front of name of EMU you will see # which means that emu is disabled, and if there is no # that emu is activated.So if u put # in front of Incubus and Gcam, only one activated EMU will be MultiCAS, then press Yellow button on remote controller to Start/Restart EMU.

---

ok, installed multicas 1.82, entered working keys under C001 provider (from pansat), activated EMU, reboot receiver few times, waited one hour..... nothing works....

In the Azbox download section are two versions of MultiCas along with their "example files" as I am not sure if you have these examples. As before if no help, I apologized.

http://www.satfix.net/showthread.php...68#post1030968

Did the keys for N2 radio on 97 Globecast change if they did where can i get the new ones

I think the N2 radio channels are gone. We are loosing Ebru from 97 degree sat as well at thte end of the year.

Hijack ..I know this has nothing do to with original post. Just an option . Older dtv units still work for radio .

Yep, and I think I could make older STB with sti5518 processor do the audio for that prov too. If you do older dtv boxes right they do the audio for all the SD channels.

BTW, on 97 degrees you can get retro TV and revn. And right now Tele5 TVpolonia on 12082 are not encrytped. The DFH series on 11933 are also not encrypted and you get some sports on a couple ch and overdubbed movies on another.