Help for Nagra cak7

There are 2 replies in this Thread which was already clicked 4,373 times. The last Post () by master G.

    Hello everyone

    I'm working on nagra merlin and I would like to know the method to calculate RSAmod1 and RSAmod2 from the dump flash memory.

    I dumped the flash and I search the 5 blocks that will allow me to find mod1 mod2.

    Thanks for your help


    Code
    This 2 0x70 RSAs are a Result of Xoring other 4 blocks of 0x70 bytes stored in STB firmware Flash.

Block 1 XOR Block 2 = RSA_MOD_1 Provider STB manufacturer specific global key ( This key is only used on DT05_00 and DT05_10 RSA decrypt steps for Global Generic Pairing Mode)

Block 3 xor Block 4 = RSA_MOD_2 Provider Specific STB Global RSA key ( This key is Unique for Each Provider and this key is used only for STB using Unique Pairing with CMD DT05_20)

Block 4 xor Block 5 = RSA_MOD88 used for CMD$03 steps


    Thank you for your help

    Edited 2 times, last by satbidule ().

Your resource for OSCam softcam

Find configs, downloads, tutorials, and support for setting up and optimizing this open-source card server with wide protocol compatibility. Master the versatile OSCam softcam. Access support, configs, tutorials, and downloads for open-source card sharing and multi-protocol server management.

Participate now!

Don’t have an account yet? Register yourself now and be a part of our community!

Register Yourself Login