1925 replies to this topic

[Alex_NL]

Hi,

 

with some hacks I was able to get picture (for SD channels sound too) on DM7020HD and Oscam ymod:

 

1. I've got video / audio / PCR pids and flag set to 4 in lamedb (no PMT timeout by Enigma then)

2. I've created /tmp/pmt.tmp file for Oscam (contains SID, PMT PID, VPID, APID).

3. For DM7020HD (for other boxes maybe not needed): I had to force Oscam using demux3 and ca3 devices. It seems, that device numbers are passed to oscam in capmt via camd.socket. If using pmt.tmp file, Oscam defaults to demux0 and ca0.

http://imagebin.org/271095

 

1. How do you set this flag?

2. What is the contents of such a 'pmt.tmp' file?

3. How do you force OSCam to use that?

 

http://www.streamboa...ig/oscam.dvbapi

 

I presume an A: line will do the trick (!)

 

If I read where this parameter stands for I should think that too, but what do I use for 'ECM PID' and 'dummy'?

[doublet]

1. How do you set this flag?

2. What is the contents of such a 'pmt.tmp' file?

3. How do you force OSCam to use that?

 

1. I've edited lamedb manually:

1044:0cfdace7:1000:0001:1:0
BBC ONE
p:BBC,c:000065,c:010066,c:030065,f:4

 

and then http://db/web/servicelistreload?mode=0

You can do it with dreamboxEDIT too - "P (Use PIDs): Always use the cached instead of current PIDs (dxNoDVB)"
 

2. WIth dvbsnoop, I have dumped PMT of random FTA channel with few streams:

dvbsnoop V1.4.51 -- http://dvbsnoop.sourceforge.net/ 

------------------------------------------------------------
SECT-Packet: 00000001   PID: 1007 (0x03ef), Length: 40 (0x0028)
Time received: Sat 2013-09-14  21:55:15.619
------------------------------------------------------------
  0000:  02 b0 25 13 f3 c3 00 00  e3 f9 f0 00 02 e3 f9 f0   ..%.............
  0010:  05 02 03 1a 48 5f 03 e4  03 f0 09 03 01 67 0a 04   ....H_.......g..
  0020:  73 6c 6f 00 5a 12 b5 ed                            slo.Z...

PID:  1007 (0x03ef)

Guess table from table id...
PMT-decoding....
Table_ID: 2 (0x02)  [= Program Map Table (PMT)]
section_syntax_indicator: 1 (0x01)
(fixed '0'): 0 (0x00)
reserved_1: 3 (0x03)
Section_length: 37 (0x0025)
Program_number: 5107 (0x13f3)
reserved_2: 3 (0x03)
Version_number: 1 (0x01)
current_next_indicator: 1 (0x01)  [= valid now]
Section_number: 0 (0x00)
Last_Section_number: 0 (0x00)
reserved_3: 7 (0x07)
PCR PID: 1017 (0x03f9)
reserved_4: 15 (0x0f)
Program_info_length: 0 (0x0000)

Stream_type loop: 

    Stream_type: 2 (0x02)  [= ITU-T Rec. H.262 | ISO/IEC 13818-2 Video | ISO/IEC 11172-2 constr. parameter video stream]
    reserved_1: 7 (0x07)
    Elementary_PID: 1017 (0x03f9)
    reserved_2: 15 (0x0f)
    ES_info_length: 5 (0x0005)

            MPEG-DescriptorTag: 2 (0x02)  [= video_stream_descriptor]
            descriptor_length: 3 (0x03)
            multiple_frame_rate_flag: 0 (0x00)
            frame_rate_code: 3 (0x0003)
            MPEG_1_only_flag: 0 (0x00)
            constrained_parameter_flag: 1 (0x01)
            still_picture_flag: 0 (0x00)


    Stream_type: 3 (0x03)  [= ISO/IEC 11172 Audio]
    reserved_1: 7 (0x07)
    Elementary_PID: 1027 (0x0403)
    reserved_2: 15 (0x0f)
    ES_info_length: 9 (0x0009)

            MPEG-DescriptorTag: 3 (0x03)  [= audio_stream_descriptor]
            descriptor_length: 1 (0x01)
            free_format_flag: 0 (0x00)
            ID: 1 (0x01)
            layer: 2 (0x02)
            variable_rate_audio_indicator: 0 (0x00)
            reserved_1: 7 (0x07)

            MPEG-DescriptorTag: 10 (0x0a)  [= ISO_639_language_descriptor]
            descriptor_length: 4 (0x04)
               ISO639_language_code:  slo
               Audio_type: 0 (0x00)  [= undefined]


CRC: 1511175661 (0x5a12b5ed)
==========================================================

I have dumped the PMT in binary form (- and then (using hex editor) changed SID and PIDs (in red) to BBC ONE values. Oscam doesn't care about CRC, so I kept original one.

Next time PMT not encrypted, I could dump it, and hopefully it could be used without any modification.

Also currently I don't get AAC sound on HD channels, perhaps it need some more editing in PMT...

 

3.

Backup of ca0 and demux0:

mv /dev/dvb/adapter0/ca0 /dev/dvb/adapter0/ca4
mv /dev/dvb/adapter0/demux0 /dev/dvb/adapter0/demux5

Symlink ca0 -> ca3, demux0 -> demux3:

ln -s /dev/dvb/adapter0/ca3 /dev/dvb/adapter0/ca0
ln -s /dev/dvb/adapter0/demux3 /dev/dvb/adapter0/demux0

[doublet]

Data to be changed:

0000: 02 b0 25 13 f3 c3 00 00 e3 f9 f0 00 02 e3 f9 f0 ..%.............
0010: 05 02 03 1a 48 5f 03 e4 03 f0 09 03 01 67 0a 04 ....H_.......g..
0020: 73 6c 6f 00 5a 12 b5 ed slo.Z...

 

dvbsnoop binary dump option is -b

[betacentauri]

Also currently I don't get AAC sound on HD channels, perhaps it need some more editing in PMT...

The problem might be this: e2 caches only mpeg and ac3 audio stream pids in the lamedb (see pmt.cpp lines 350-355). To distinguish between them a streamtype is also stored in the lamedb (afaik). So if you change pid to AAC pid e2 still thinks it's an mpeg or ac3 stream and sends the stream to the wrong hardware decoder.

[doublet]

Also currently I don't get AAC sound on HD channels, perhaps it need some more editing in PMT...

The problem might be this: e2 caches only mpeg and ac3 audio stream pids in the lamedb (see pmt.cpp lines 350-355). To distinguish between them a streamtype is also stored in the lamedb (afaik). So if you change pid to AAC pid e2 still thinks it's an mpeg or ac3 stream and sends the stream to the wrong hardware decoder.

 

Yes, I've got no audio PID cached in lamedb for HD channels. I've put audio PID is inside pmt.tmp but didn't change stream_type, descriptor,.... So maybe because of that, descrambled AAC stream is passed to wrong hw decoder. I have to find out, how PMT for HD/AAC channel looks like.

[Robinson]

Hi,

 

with some hacks I was able to get picture (for SD channels sound too) on DM7020HD and Oscam ymod:

 

1. I've got video / audio / PCR pids and flag set to 4 in lamedb (no PMT timeout by Enigma then)

2. I've created /tmp/pmt.tmp file for Oscam (contains SID, PMT PID, VPID, APID).

3. For DM7020HD (for other boxes maybe not needed): I had to force Oscam using demux3 and ca3 devices. It seems, that device numbers are passed to oscam in capmt via camd.socket. If using pmt.tmp file, Oscam defaults to demux0 and ca0.

http://imagebin.org/271095

 

0) Which oscam_ymod version are you using? And are you on OpenPLi?

1) I guess it does not matter if it is  04  or 4. Don't you also need the following entry in lamedb: C:2600 ?

2) Do you mean that there should be a different pmt.tmp file for each channel on 27.5W? So does it mean that every time I want to watch a different channel I need to ftp a different version of this file? Also, what is the structure of this file? Surely, it is not just these 4 values separated by commas: SID, PMT PID, VPID, APID. Or is that so? Probably not because you mentioned CRC value so I guess it needs to be some bin/hex type file. Do you think you could attach your working file here?

3) On my box all the files in these locations are o KB long:

/dev/dvb/adapter0/ca0

/dev/dvb/adapter0/demux0

Is this correct?

 

Thanks for your help.

[doublet]

0) OSCAM ymodv18-t44 build #0, I'm on DMM image + Gemini BP

1) I had 2600 in lamedb, but found out, that it doesn't change much - it adds just "scrambled service" icon becomes yellow.

2) Yes, you have to have different file for each channel. Theoretically you could add all the pids on TP into the file but I think there are some limits in oscam as well as ca device. Structure of the file is same as standard PMT section packet. Maybe there is some sw which allows to build the packet, I have just dumped the data from some other channel with dvbsnoop and edited with hex editor afterwards.

 

BBC 2 HD PMT decoded by dvbsnoop:

 bbc2hd_pmt.txt   7.78KB   202 downloads

 

BBC 2 HD PMT in binary form.

 bbc2hd_pmt_bin.txt   159bytes   79 downloads

 

My BBC ONE england binary PMT created from FTA channel (see my post above):

 1044_bin.txt   40bytes   87 downloads

 

3) Yes, that's correct. These device files ale all like that. Alternatively to making symlinks like I described earlier, you can rename devices higher than 0 and then restart E2. This forces E2 to use demux0 / ca0, so oscam and E2 will use same devices.

 

As betacentauri correctly noted, it will be not possible to have sound on HD channels, because E2 cannot cache AAC PID in lamedb.

To get AAC sound, E2 has to have descrambled PMT. I've done some experiments and it's possible to put PMT PID into pmt.tmp ;-) Oscam will descramble PMT, E2 will get it, so in this case there is no need to use "4" flag in lamedb and there is AAC sound available.

 

In general Oscam handling of pmt.tmp file is not very well (restart of Oscam is often necessary), but for experiments it's quite sufficient.

[hemertje]

No Oscam support here, please continue this discussion at the Oscam board...

[Robinson]

Yes, you have to have different file for each channel. Theoretically you could add all the pids on TP into the file but I think there are some limits in oscam as well as ca device. Structure of the file is same as standard PMT section packet. Maybe there is some sw which allows to build the packet, I have just dumped the data from some other channel with dvbsnoop and edited with hex editor afterwards.

 

BBC 2 HD PMT decoded by dvbsnoop:

bbc2hd_pmt.txt

 

BBC 2 HD PMT in binary form.

bbc2hd_pmt_bin.txt

 

My BBC ONE england binary PMT created from FTA channel (see my post above):

1044_bin.txt

 

As betacentauri correctly noted, it will be not possible to have sound on HD channels, because E2 cannot cache AAC PID in lamedb.

To get AAC sound, E2 has to have descrambled PMT. I've done some experiments and it's possible to put PMT PID into pmt.tmp ;-)

 

As a topic starter, I can certainly say that doublet has risen to the challenge. Thank you very much for your contribution. I would also like to thank others who dropped some hints, pieterg, Erik and others.

doublet, I have also noticed that you do not have to juggle pmt.tmp files for various channels. You can have several files in tmp folder at the same time, using names such as pmt1, pmt2, etc.

As regards symlinks ca0 -> ca3 and demux0 -> demux3, I did not have to do it for my ET9000 with OpenPLi.

It seems that there remains just one thing: how to make AAC sound work for HD channels. Reading between the lines, I gather that you were ingenious enough to make it work for you. I see that PMT is much longer for HD channels than SD, so I assume you have edited it with some special values.

Do you think you could shed some light on that as well?

Thanks a lot.
 

[doublet]

Ok, so from now no word about Oscam to not violate rules of board.

 

To watch a HD channel with sound (should work for any other channel on TP):

 

- remove "f:4" flag from channel in lamedb to make E2 use PMT being broadcasted, reload settings

- put your receiver into standby (E2 has to be still running)

- create /tmp/pmt.tmp containing just PMT PID. Here is example for BBC 2 HD:

 4440_pmt_bin.txt   21bytes   258 downloads

- now CAM should start to descramble PMT PID

- bring your receiver from standby to operational state

- E2 will receive descrambled PMT and send "capmt" data (includes all the PIDs of the channel) to CAM

- now CAM should start to descramble all PIDs of the channel

- you should get picture and sound

 

Enjoy!

[pieterg]

ok, so they're actually using dvb-csa to decrypt the pmt? weird... (but understandable, as it does not require any non-standard components)

[Robinson]

To watch a HD channel with sound (should work for any other channel on TP):

 

- remove "f:4" flag from channel in lamedb to make E2 use PMT being broadcasted, reload settings

- put your receiver into standby (E2 has to be still running)

- create /tmp/pmt.tmp containing just PMT PID. Here is example for BBC 2 HD:

4440_pmt_bin.txt

- now CAM should start to descramble PMT PID

- bring your receiver from standby to operational state

- E2 will receive descrambled PMT and send "capmt" data (includes all the PIDs of the channel) to CAM

- now CAM should start to descramble all PIDs of the channel

- you should get picture and sound

 

 

This time I failed miserably.

I removed "f:4" for just this one channel (with SID 4440) and ftp-ed your file to my box (changed filename to pmt.tmp). Then I put my box out of standby but keep getting timeout reading PMT message.

[Erik Slagter]

ok, so they're actually using dvb-csa to decrypt the pmt? weird... (but understandable, as it does not require any non-standard components)

OTOH if they wanted really effective encryption, they should have used their own scrambling algorithm...

[doublet]

Robinson and all who are interested on BBC-SATBACK package,

I have written (my very first one) python script, which helps a little E2 with these channels: if no PMT is received, it sends PMT PID in CAPMT data to CAM.

 

 bbc_pmt.zip   1002bytes   230 downloads

 

- unpack archive

- edit the "demux = "/dev/dvb/adapter0/demux3"" line if needed (on my DM7020HD demux3 is used)

- upload to your box

- make it executable (chmod 755 bbc_pmt.py)

- run it on background (./bbc_pmt.py &)

- make sure channels have no "4" flag set in lamedb

- zap

Edited by doublet, 22 September 2013 - 06:56.

[gorski]

Cool!

 

I now have BBC, ITV and CH4 in northern Italy (minus BBC HD channels), on 28E, with my T90.

 

However, a really good thing to see from a hobbyist point of view!!!

 

Still, non-IT pros would like to know a few missing details...

 

Where to check which demux our boxes use, please?

 

Also, where to put the file you attached?

 

You can only run it via Telnet?

 

Just to make sure we all...

 

Thanx!

[doublet]

Cool!

 

I now have BBC, ITV and CH4 in northern Italy (minus BBC HD channels), on 28E, with my T90.

 

However, a really good thing to see from a hobbyist point of view!!!

 

Still, non-IT pros would like to know a few missing details...

 

Where to check which demux our boxes use, please?

 

Also, where to put the file you attached?

 

You can only run it via Telnet?

 

Just to make sure we all...

 

Thanx!

 

I don't really know how to check which demux is actually used. Maybe E2 experts could give some hint how to obtain demux number from E2.

Easyest way is now to check what demuxes are under /dev/dvb/adapterX and just try. Now I see a bug regarding demux setting in capmt.... corrected script here:

 bbc_pmt.zip   1KB   128 downloads

 

I've got it in /home/root, but /usr/script would be fine too... it doensn't matter much where it is located.

I run it via telnet, but for sure there are also other options... like start it at receiver boot.

[doublet]

Forgot to note, that now "demuxNb = 3" line has to be adapted if necessary.

[luki24]

What is the full command to run the script from telnet?

[Robinson]

- unpack archive

- edit the "demux = "/dev/dvb/adapter0/demux3"" line if needed (on my DM7020HD demux3 is used)

- upload to your box

- make it executable (chmod 755 bbc_pmt.py)

- run it on background (./bbc_pmt.py &)

- make sure channels have no "4" flag set in lamedb

- zap

 

Thanks again doublet.

Before I try it out, I need to make sure I understand everything.

 

- edit the "demux = "/dev/dvb/adapter0/demux3"" line if needed (on my DM7020HD demux3 is used)

How do i know which demux (0-6) is being used in my case so as to edit the file? As I said before, all these files are 0 B long on my box and I did not have to do that to make BBC 1 SD work with pmt.tmp file:

For DM7020HD (for other boxes maybe not needed): I had to force Oscam using demux3 and ca3 devices. It seems, that device numbers are passed to oscam in capmt via camd.socket. If using pmt.tmp file, Oscam defaults to demux0 and ca0.

 

- upload to your box

Into any directory I want?

 

- run it on background (./bbc_pmt.py &)

How to run it in the background? I guess I need a telnet command. When I put the following "bbc_pmt.py &", I get this:

root@et9x00:~# -sh: bbc_pmt.py: not found

 

And some additional questions.

I understand this script will not interefere when watching normal scrambled channels?

If so, could it be possible to load this script each time Enigma starts automatically and just zap all channels (from 27.5W and others) without using a computer to start or stop the script?

 

Thanks again.

[betacentauri]

- run it on background (./bbc_pmt.py &)
How to run it in the background? I guess I need a telnet command. When I put the following "bbc_pmt.py &", I get this:
root@et9x00:~# -sh: bbc_pmt.py: not found
 

Open a telnet connection and go to the directory which contains the bbc_pmt.py file then execute:
./bbc_pmt.py &

So with the ./