rendered paste bodydiff -ur sc-0.6.0/systems/nagra/nagra2.c sc-0.6.0-rwx/systems/nagra/nagra2.c--- sc-0.6.0/systems/nagra/nagra2.c 2007-01-13 11:04:26.000000000 +0100+++ sc-0.6.0-rwx/systems/nagra/nagra2.c 2007-02-08 16:25:52.000000000 +0100@@ -264,6 +264,7 @@ virtual void CreatePQ(const unsigned char *key, BIGNUM *p, BIGNUM *q); bool DecryptECM(const unsigned char *in, unsigned char *out, const unsigned char *key, int len, const unsigned char *vkey, BIGNUM *m); bool DecryptEMM(const unsigned char *in, unsigned char *out, const unsigned char *key, int len, const unsigned char *vkey, BIGNUM *m);+ void DecryptIkey(const unsigned char *desKey, unsigned char *iKey); }; void cNagra2::CreatePQ(const unsigned char *key, BIGNUM *p, BIGNUM *q)@@ -375,6 +376,16 @@ return true; } +void cNagra2::DecryptIkey(const unsigned char *desKey, unsigned char *iKey)+{+ DES_key_schedule ks0, ks1, ks2;+ DES_set_key((DES_cblock *) &desKey[0], &ks0);+ DES_set_key((DES_cblock *) &desKey[8], &ks1);+ DES_set_key((DES_cblock *) &desKey[16], &ks2);+ DES_ecb3_encrypt((const_DES_cblock *)&iKey[0], (DES_cblock *)&iKey[0], &ks0, &ks1, &ks2, DES_DECRYPT);+ DES_ecb3_encrypt((const_DES_cblock *)&iKey[8], (DES_cblock *)&iKey[8], &ks0, &ks1, &ks2, DES_DECRYPT);+}+ // -- cSystemNagra2 ------------------------------------------------------------ class cSystemNagra2 : public cSystem, protected cNagra2 {@@ -517,8 +528,9 @@ int sigsel=(buffer[13]&0x80)>>1; cPlainKey *pk; cBN n;- unsigned char ideaKey[24], vKey[16];+ unsigned char ideaKey[24], vKey[16], desKey[24]; bool hasVerifyKey=false;+ bool hasdesKey=false; if(!(pk=keys.FindKey('N',id,MBC(N2_MAGIC,keyset+0x10+sel),96))) { dl(printf("logger-nagra2: missing %04x NN %.02X RSA key (96 bytes)\n",id,keyset+0x10+sel)) return;@@ -544,7 +556,11 @@ return; } lastEmmId=id;-+ // now get the 3DES key if present, switch id from 4001 to 4101+ if((pk=keys.FindKey('N',(emmdata[19]*256+emmdata[20]),MBC(N2_MAGIC,0x13+sel),24))) {+ pk->Get(desKey);+ hasdesKey=true;+ } id=(emmdata[8]<<8)+emmdata[9]; #ifdef DEBUG_LOG bool contFail=false;@@ -554,6 +570,11 @@ case 0x42: // plain Key update if(emmdata[i+2]==0x10 && (emmdata[i+3]&0xBF)==0x06 && (emmdata[i+4]&0xF8)==0x08 && emmdata[i+5]==0x00 && emmdata[i+6]==0x10) {+ // decrypt 4101 keys+ if (hasdesKey) {+ id = (emmdata[19]*256+emmdata[20]); // switch the id+ DecryptIkey(desKey, &emmdata[i+7]);+ } cSoftCAM::FoundKey(); if(keys.NewKey('N',id,(emmdata[i+3]&0x40)>>6,&emmdata[i+7],16)) cSoftCAM::NewKey(); cSoftCAM::Save();diff -ur sc-0.6.0/systems/nagra/nagra.h sc-0.6.0-rwx/systems/nagra/nagra.h--- sc-0.6.0/systems/nagra/nagra.h 2006-10-10 19:03:54.000000000 +0200+++ sc-0.6.0-rwx/systems/nagra/nagra.h 2007-02-08 16:17:36.000000000 +0100@@ -47,6 +47,7 @@ #define N2_MAGIC 0x80 #define N2_EMM_G_I 0x02 #define N2_EMM_G_R 0x12+#define N2_EMM_G_D 0x13 // 3DES #define N2_EMM_S_I 0x01 #define N2_EMM_S_R 0x11 #define N2_EMM_SEL 0x40