ahrm,,, if you say its scrambled using dvb CSA-scrambling, what key/controlword is used to descramble the PMT? I guess that is unknown in public but known to boxes like Technomate 5402HD, Dr. HD and Blade.
From what I see in the script its just fetching correct apid/vpid out of the channel list and making a dummy capmt file that is fed to the softcam.
Another method is that dvbsnoop can also fetch all streams from a channel, even if they are not in the ca pmt. Thats handy since the ca pmt is useless until we know how to decrypt it. So dvbsnoop fetches all video/audio streampids and the script is writing a bogus ca pmt based on that info.
Ok, ca pmt files is written now its the softcam to do its magic:
The softcam is starting up a dummy ecm filter, biss controlword key is received, streampids for video/audio get enabled on ca device and controlword is written to ca device.
And there you go, picture and audio is cleared!
So since now oscam doesnt rely any longer on ca pmt that receiver delivers, we can add decryption of ca pmt too. Making the whole script and dvbsnoop obsolete. Even the usage of special channellist with correct vpid/apid in it.
But to accomplish this we have to analyze the crypted pmt tables the channels have. It could be something easy like the pmt table is scrambled with exact same biss key that is used for decoding the apid/vpid but it could be a static key like "DEADBEAFDEADBEAFDEADBEAF01020304"
But if its CSA scrambled perhaps a modified colibri's CSA decryption tool can get the correct key for us. (think this tool is used too to hack new biss key if key is changed)
My problem: I dont have any crypted PMT table of any of these channels... and I dont know what size of dish is needed to get these channels from my location (if its possible at all!)
So further research from my side is stalled right now.