1943 replies to this topic

[Robinson]

pieterg, what is the best way to find out what is actually crypted?

Would dvbsnoop provide some information? Would it be useful to provide some dvbsnoop output both from the time PMT is hidden and non-hidden and compare the two? I intentionally use the word "hidden" instead of "crypted" or "scrambled" because I am not quite sure what is going on there.

EnoSat, is it possible that only PMT PID numer is crypted and not the real content of the PID?

pieterg, if the content of the PMT PID was indeed crypted, would it mean that those other box manufacturers, such as Dr.HD or Technomate, have some inside information and know the PMT scrambling algorithm used by BBC/ITV? I doubt they would know the scrambling algorithm and so I doubt the content of the PMT PID is really scrambled.

Anyway, we would be glad to provide you with some sort of log if only we knew what exactly to do. Mind, however, that at the moment the channels work without bigger problems so we may have to wait a while bofore things change. But in the meantime we can provide some logs in order to compare them with the logs which can ba made in the future when viewing problems appear.

[pieterg]

If you could run dvbsnoop on the PAT pid (1) and the PMT pid we should be able to see what's going on.

[robbieb43]

Hi pieterg

 

I am new to dvbsnoop so may need some driving lessons .  Since it (PMT content) seems to be encrypted at present I thought I should try to grab some output: channel details are:

 

BBC One England
TP: 11495 H 44100 9/10 DVB-S
CAID 2600 SID 1044 - VPID 0065 - APID 0066 - PMT 0064 - PCR PID 0065 - ECM PID 1FFF -
Transport ID 1000 - Network ID 0001 - ProvID 000000

 

First few lines of PID scan:

 

---------------------------------------------------------
Transponder PID-Scan...
---------------------------------------------------------
PID found:    0 (0x0000)  [SECTION: Program Association Table (PAT)]
PID found:   16 (0x0010)  [SECTION: Network Information Table (NIT) - actual network]
PID found:   17 (0x0011)  [SECTION: Service Description Table (SDT) - actual transport stream]
PID found:   18 (0x0012)  [SECTION: Event Information Table (EIT) - actual transport stream, present/following]
PID found:   20 (0x0014)  [SECTION: Time Date Table (TDT)]
PID found:   32 (0x0020)  [scrambled]
PID found:   33 (0x0021)  [scrambled]
PID found:   50 (0x0032)  [scrambled]
PID found:   56 (0x0038)  [scrambled]
PID found:   57 (0x0039)  [scrambled]
PID found:   58 (0x003a)  [scrambled]
PID found:   60 (0x003c)  [scrambled]
PID found:  100 (0x0064)  [scrambled]
PID found:  101 (0x0065)  [scrambled]
PID found:  102 (0x0066)  [scrambled]
PID found:  200 (0x00c8)  [scrambled]
PID found:  201 (0x00c9)  [scrambled]
PID found:  202 (0x00ca)  [scrambled]
PID found:  205 (0x00cd)  [unknown]
PID found:  300 (0x012c)  [scrambled]
PID found:  301 (0x012d)  [scrambled]
 etc

 

___________________________________________

PID 0

------------------------------------------------------------
SECT-Packet: 00000001   PID: 0 (0x0000), Length: 188 (0x00bc)
Time received: Thu 2013-09-05  14:37:22.538
------------------------------------------------------------
  0000:  00 b0 b9 10 00 cd 00 00  00 00 e0 10 00 03 e0 21   ...............!
  0010:  00 32 e0 32 10 44 e0 64  10 7c f0 04 10 7d f3 ec   .2.2.D.d.|...}..
  0020:  10 7e ec 1c 10 bf e0 c8  10 c0 e1 2c 11 00 e1 f4   .~.........,....
  0030:  11 40 ea 8c 11 c0 e1 90  12 00 e2 bc 12 40 e3 20   .@...........@.
  0040:  12 80 e2 58 12 fc ea f0  16 00 e5 78 16 40 e5 dc   ...X.......x.@..
  0050:  16 80 e6 40 16 c0 e6 a4  17 00 e7 08 17 40 e7 6c   ...@.........@.l
  0060:  17 80 e7 d0 18 3c e8 fc  18 7c e9 60 18 bd e9 c4   .....<...|.`....
  0070:  18 fd ea 28 19 3e e8 34  19 7e e8 98 1a 40 e3 e8   ...(.>.4.~...@..
  0080:  1a 80 e4 4c 1a c0 e4 b0  1b 00 e5 14 1c 00 e3 84   ...L............
  0090:  1c 40 eb 54 44 40 f7 d4  44 84 f9 c8 44 c8 f8 38   .@.TD@..D...D..8
  00a0:  45 00 f8 9c 45 80 f9 00  45 c0 f9 64 4c c0 fa 2c   E...E...E..dL..,
  00b0:  4e 80 fa 90 4f 40 fa f4  41 92 22 65               N...O@..A."e

PID:  0 (0x0000)  [= assigned for: ISO 13818-1 Program Association Table (PAT)]

Guess table from table id...
PAT-decoding....
Table_ID: 0 (0x00)  [= Program Association Table (PAT)]
section_syntax_indicator: 1 (0x01)
(fixed): 0 (0x00)
reserved_1: 3 (0x03)
Section_length: 185 (0x00b9)
Transport_Stream_ID: 4096 (0x1000)
reserved_2: 3 (0x03)
Version_number: 6 (0x06)
current_next_indicator: 1 (0x01)  [= valid now]
Section_number: 0 (0x00)
Last_Section_number: 0 (0x00)

    Program_number: 0 (0x0000)
    reserved: 7 (0x07)
    Network_PID: 16 (0x0010)

    Program_number: 3 (0x0003)
    reserved: 7 (0x07)
    Program_map_PID: 33 (0x0021)

    Program_number: 50 (0x0032)
    reserved: 7 (0x07)
    Program_map_PID: 50 (0x0032)

    Program_number: 4164 (0x1044)
    reserved: 7 (0x07)
    Program_map_PID: 100 (0x0064)

    Program_number: 4220 (0x107c)
    reserved: 7 (0x07)
    Program_map_PID: 4100 (0x1004)

    Program_number: 4221 (0x107d)
    reserved: 7 (0x07)
    Program_map_PID: 5100 (0x13ec)

    Program_number: 4222 (0x107e)
    reserved: 7 (0x07)
    Program_map_PID: 3100 (0x0c1c)

    Program_number: 4287 (0x10bf)
    reserved: 7 (0x07)
    Program_map_PID: 200 (0x00c8)

    Program_number: 4288 (0x10c0)
    reserved: 7 (0x07)
    Program_map_PID: 300 (0x012c)

    Program_number: 4352 (0x1100)
    reserved: 7 (0x07)
    Program_map_PID: 500 (0x01f4)

    Program_number: 4416 (0x1140)
    reserved: 7 (0x07)
    Program_map_PID: 2700 (0x0a8c)

    Program_number: 4544 (0x11c0)
    reserved: 7 (0x07)
    Program_map_PID: 400 (0x0190)

    Program_number: 4608 (0x1200)
    reserved: 7 (0x07)
    Program_map_PID: 700 (0x02bc)

    Program_number: 4672 (0x1240)
    reserved: 7 (0x07)
    Program_map_PID: 800 (0x0320)

    Program_number: 4736 (0x1280)
    reserved: 7 (0x07)
    Program_map_PID: 600 (0x0258)

    Program_number: 4860 (0x12fc)
    reserved: 7 (0x07)
    Program_map_PID: 2800 (0x0af0)

    Program_number: 5632 (0x1600)
    reserved: 7 (0x07)
    Program_map_PID: 1400 (0x0578)

    Program_number: 5696 (0x1640)
    reserved: 7 (0x07)
    Program_map_PID: 1500 (0x05dc)

    Program_number: 5760 (0x1680)
    reserved: 7 (0x07)
    Program_map_PID: 1600 (0x0640)

    Program_number: 5824 (0x16c0)
    reserved: 7 (0x07)
    Program_map_PID: 1700 (0x06a4)

    Program_number: 5888 (0x1700)
    reserved: 7 (0x07)
    Program_map_PID: 1800 (0x0708)

    Program_number: 5952 (0x1740)
    reserved: 7 (0x07)
    Program_map_PID: 1900 (0x076c)

    Program_number: 6016 (0x1780)
    reserved: 7 (0x07)
    Program_map_PID: 2000 (0x07d0)

    Program_number: 6204 (0x183c)
    reserved: 7 (0x07)
    Program_map_PID: 2300 (0x08fc)

    Program_number: 6268 (0x187c)
    reserved: 7 (0x07)
    Program_map_PID: 2400 (0x0960)

    Program_number: 6333 (0x18bd)
    reserved: 7 (0x07)
    Program_map_PID: 2500 (0x09c4)

    Program_number: 6397 (0x18fd)
    reserved: 7 (0x07)
    Program_map_PID: 2600 (0x0a28)

    Program_number: 6462 (0x193e)
    reserved: 7 (0x07)
    Program_map_PID: 2100 (0x0834)

    Program_number: 6526 (0x197e)
    reserved: 7 (0x07)
    Program_map_PID: 2200 (0x0898)

    Program_number: 6720 (0x1a40)
    reserved: 7 (0x07)
    Program_map_PID: 1000 (0x03e8)

    Program_number: 6784 (0x1a80)
    reserved: 7 (0x07)
    Program_map_PID: 1100 (0x044c)

    Program_number: 6848 (0x1ac0)
    reserved: 7 (0x07)
    Program_map_PID: 1200 (0x04b0)

    Program_number: 6912 (0x1b00)
    reserved: 7 (0x07)
    Program_map_PID: 1300 (0x0514)

    Program_number: 7168 (0x1c00)
    reserved: 7 (0x07)
    Program_map_PID: 900 (0x0384)

    Program_number: 7232 (0x1c40)
    reserved: 7 (0x07)
    Program_map_PID: 2900 (0x0b54)

    Program_number: 17472 (0x4440)
    reserved: 7 (0x07)
    Program_map_PID: 6100 (0x17d4)

    Program_number: 17540 (0x4484)
    reserved: 7 (0x07)
    Program_map_PID: 6600 (0x19c8)

    Program_number: 17608 (0x44c8)
    reserved: 7 (0x07)
    Program_map_PID: 6200 (0x1838)

    Program_number: 17664 (0x4500)
    reserved: 7 (0x07)
    Program_map_PID: 6300 (0x189c)

    Program_number: 17792 (0x4580)
    reserved: 7 (0x07)
    Program_map_PID: 6400 (0x1900)

    Program_number: 17856 (0x45c0)
    reserved: 7 (0x07)
    Program_map_PID: 6500 (0x1964)

    Program_number: 19648 (0x4cc0)
    reserved: 7 (0x07)
    Program_map_PID: 6700 (0x1a2c)

    Program_number: 20096 (0x4e80)
    reserved: 7 (0x07)
    Program_map_PID: 6800 (0x1a90)

    Program_number: 20288 (0x4f40)
    reserved: 7 (0x07)
    Program_map_PID: 6900 (0x1af4)

CRC: 1100096101 (0x41922265)
==========================================================
 

Please let me know (if possible with some guidance on which options to select) if you need further output.

 

Rob

[pieterg]

Ok, so PAT is plain, and PMT is scrambled.
So you have to use fixed vpid/apid in e2, and use a similar workaround for your softcam (if at all possible)

[robbieb43]

Thanks pieterg - I think I read that this is not an e2 problem then given that we can support fixed vpid/apid using the f:4 lamedb flag.

[Erik Slagter]

Just a suggestion that comes to mind: as long as you write the proper codewords into the descrambler, you can decrypt anything. The crux is having the proper codewords For obtaining the codewords, you don't need enigma. If I understand it correctly, the cam gets some information from enigma, the ca-pmt, which is more or less equal to what's sent to a hardware CI and then the cam knows which pid's to descramble and to fetch the ecm's from what pid. This is very helpful but not really necessary, if you could hand these values to the softcam using another method (e.g. a config file entry), that could work as well. You don't really need enigma support.

 

Existing softcams don't have such a mode, afaik, but you could always drop the idea on places where softcam developer use to show up every now and then.

[robbieb43]

Many thanks. This seems to make sense to me Erik and it may give us a clue to how those non e2 boxes are able to tollerate this intermittent scrambling e.g. they may cache the ECM and use it when they cannot decipher one from the PMT PID location.

[Erik Slagter]

Maybe the non-e2 boxes have a way to decrypt the PMT, that may also be possible... The buttom line, if DVB-scrambling is used (and I've never seen otherwise) and you have the proper codewords, it can be decrypted on standard hardware.

 

Isn't there any other position you can watch BBC on, like 13E?

[robbieb43]

Thanks Erik.  Sadly the main UK versions of BBC are only officially available via 28E.  There are some repackaged versions of BBC content on 13E but that's all. In places such as here in the Canaries we have been able to get the BBC transponders from 28E in various ways over the years - at first on a 1.4M dish, then with Astra 2D only on a big dish, and for the last year or two on a 2.4M dish or less while Astra 1N has been standing in for 2E.  Sadly that all comes to an end later this year when 2E is finaly launched, with initial indications by some (based on 2F) that a 5M dish could be needed - hence the interest in these feeds. I think the internet is going to be seeing some serious traffic once 2E changeover happens as all the thousands ex-pats tune in for their favourite shows.  Now fibre broadband is becoming commonplace in the UK, with 10M+ upstream, I can see we might be doing some interesting things with our Dreamboxes and Slingboxes also .

[Erik Slagter]

Hehe, I am quite lucky that I live near the west coast of the Netherlands

[Alex_NL]

... at the moment the channels work without bigger problems so we may have to wait a while bofore things change. ...

 

What do you mean? If I tune into the channels op 27.5W I get a black screen and after a while an error 'Service invalid! (Timeout reading PMT)'.
Can anyone explain how to set the PID's and the flags to keep the PID's?
I see with DreamboxEDIT or Dreamset you can do that, but what actually needs to be set for these channels?

 

 

Attached Files

•  DreamboxEDIT.jpg   132.28KB   0 downloads

[Alex_NL]

Here is the screen in DreamboxEDIT, I can't find any manual or explanation. F.e. what can be done in the field 'Extra parameters':

 DreamboxEDIT.jpg   122.38KB   190 downloads

This is the same in Dreamset but without Extra parameters option:

 Dreamset.jpg   66.78KB   184 downloads

[robbieb43]

... at the moment the channels work without bigger problems so we may have to wait a while bofore things change. ...

 
What do you mean? If I tune into the channels op 27.5W I get a black screen and after a while an error 'Service invalid! (Timeout reading PMT)'.
Can anyone explain how to set the PID's and the flags to keep the PID's?
I see with DreamboxEDIT or Dreamset you can do that, but what actually needs to be set for these channels?

I would be happy for anyone to confirm this but as far as I can tell the PMT is still encrypted so you will get the timeout problem. If you enter the PIDs as shown you will still get a blank screen for the reasons we have discussed above, but without the timeout. If the PMT ever clears again enigma2 will operate correctly, though a softcam would be necessary to clear the channel.

[robbieb43]

Here is the screen in DreamboxEDIT, I can't find any manual or explanation. F.e. what can be done in the field 'Extra parameters':DreamboxEDIT.jpgThis is the same in Dreamset but without Extra parameters option:Dreamset.jpg

Dreamset does not support the extra PID/flag entries and in my experience will strip out cached PIDs if you are not careful.

You put the flags in the extra parameter field of DreamboxEdit. However you can probably avoid this by scanning when the PMT content is clear.

[Robinson]

... at the moment the channels work without bigger problems so we may have to wait a while bofore things change. ...

 

What do you mean? If I tune into the channels op 27.5W I get a black screen and after a while an error 'Service invalid! (Timeout reading PMT)'.

 

Robbieb43 says PMT is scrambled again today (I cannot verify it at the moment), so you will not see anything on Enigma2 boxes no matter how hard you try.

[Alex_NL]

 

... at the moment the channels work without bigger problems so we may have to wait a while bofore things change. ...

 
What do you mean? If I tune into the channels op 27.5W I get a black screen and after a while an error 'Service invalid! (Timeout reading PMT)'.
Can anyone explain how to set the PID's and the flags to keep the PID's?
I see with DreamboxEDIT or Dreamset you can do that, but what actually needs to be set for these channels?

 

I would be happy for anyone to confirm this but as far as I can tell the PMT is still encrypted so you will get the timeout problem. If you enter the PIDs as shown you will still get a blank screen for the reasons we have discussed above, but without the timeout. If the PMT ever clears again enigma2 will operate correctly, though a softcam would be necessary to clear the channel.

 

AND with the proper key / smartcard I guess?
 
 

Here is the screen in DreamboxEDIT, I can't find any manual or explanation. F.e. what can be done in the field 'Extra parameters':DreamboxEDIT.jpgThis is the same in Dreamset but without Extra parameters option:Dreamset.jpg

Dreamset does not support the extra PID/flag entries and in my experience will strip out cached PIDs if you are not careful.

You put the flags in the extra parameter field of DreamboxEdit. However you can probably avoid this by scanning when the PMT content is clear.

 

How?
What's the syntax of those parameters and what kind of paramaters are possible?

[Robinson]

This is very helpful but not really necessary, if you could hand these values to the softcam using another method (e.g. a config file entry), that could work as well. You don't really need enigma support.

 

Existing softcams don't have such a mode, afaik, but you could always drop the idea on places where softcam developer use to show up every now and then.

 

Thanks for your suggestion.

Does anyone here participate in any Oscam/Mgcamd/Cccam forum and can pass this idea there?

In other words, can anyone here get softcam guys interested in 27.5W problem?

[Erik Slagter]

You might want to have a look at streamboard, the home of oscam.

[doublet]

Hi,

 

with some hacks I was able to get picture (for SD channels sound too) on DM7020HD and Oscam ymod:

 

1. I've got video / audio / PCR pids and flag set to 4 in lamedb (no PMT timeout by Enigma then)

2. I've created /tmp/pmt.tmp file for Oscam (contains SID, PMT PID, VPID, APID).

3. For DM7020HD (for other boxes maybe not needed): I had to force Oscam using demux3 and ca3 devices. It seems, that device numbers are passed to oscam in capmt via camd.socket. If using pmt.tmp file, Oscam defaults to demux0 and ca0.

http://imagebin.org/271095

Edited by doublet, 16 September 2013 - 20:31.

[theparasol]

http://www.streamboa...ig/oscam.dvbapi

 

I presume an A: line will do the trick (!)