C Band Satellite TV Hacking Guide for Dummies - A Reference for the Rest of Us !!

C Band Satellite TV Hacking Guide for Dummies - A Reference for the Rest of Us !!

By Iggy

The configurations you need to perform are highlighted in mustard. Just follow my instructions and you'll be up and running in no time !!

CONTENTS

1. Disclaimer

2. Downloads

3. C Band Dish

4. E2 Receiver

5. E2 Receiver Image

6. NCAM Emulator

7. Downloading NCAM

8. Unpacking NCAM

9. Uploading NCAM EMU Files to Receiver

10. Starting NCAM

11. Configuration Files

12. Softcam Key File

13. NCAM Monitoring

14. Finding Keys

1. DISCLAIMER

This guide is solely for educational purposes only.

Happy days are here again !! Unless you have been sleeping under a rock C band satellite testing in the USA is once again possible. But it takes a little bit of effort to get going. If you are familiar with directv or dishnetwork testing from the past, hacking C band is similar, except there is no smart card glitching and no flashing of an OEM FTA box involved. Instead C band testers are using E2 ( Enigma 2 ) linux satellite receivers loaded with a CAM emulator.

This guide is written for C band enthusiasts in the USA who have little or no background in linux and never owned an E2 satellite receiver like me until now. From the moment I bought my first E2 receiver ( Octagon SF4008 ), I struggled for nearly 6 months to get my first linux CAM emulator working properly and testing C band. But I finally nailed it !! If you are like me and struggling, this guide is dedicated to you !

2. DOWNLOADS

To get going you will need to download and install some programs.

****************************

7-Zip ( for unzipping files )

https://www.7-zip.org/

****************************

*******************************************************

FTP Program ( choose one )

http://www.coreftp.com/download.html

https://filezilla-project.org/download.php?type=client

*******************************************************

3. C BAND DISH

You need a tuned C band satellite dish. Duhh ! Bigger is better. I use a 10 footer and I am pretty far north. It can be a fiber glass, aluminum or wire mesh dish. It doesn't matter as long as your dish is tracking the satellite arc.

4. E2 RECEIVER

You also need an E2 satellite receiver. There are many on the market. You might as well splurge a bit and go with a 4K model. Here are some examples:

Octagon SF4008 E2 4K ( sold by Rick's Satellite )

Edision OS mio 4K ( sold by Titanium Satellite )

Mutant, Zgemma, Gigablue and others should work too but I don't have any on hand to test.

5. E2 RECEIVER IMAGE

Your E2 receiver should run OPEN ATV. I think the latest version is 6.2 and works fine. Most E2 receivers sold today come pre-flashed with OPEN ATV, but if yours had a different image, you need to install OPEN ATV which you can find at

https://www.opena.tv/

Other images like OpenPLi will work too but with a different emulator. Keep on reading.

6. NCAM EMULATOR

NCAM is the emulator software used with OPEN ATV. OSCAM is the emulator software used with OpenPLi.

This guide focuses on using NCAM since most of us on this side of the pond have E2 receivers flashed with OPEN ATV out of the box. You can try to get OSCAM working on OpenPLi by following this guide but directory locations and configurations will vary.

7. DOWNLOADING NCAM

Let's give it a go !

Download the latest version of NCAM from

*************************************************

NCam

*************************************************

There will be several different emulator file for different hardware. Most E2 receivers today run on an *ARM* core, so you need to download the "MIPS-IPK" image. It looks something like

*************************

Ncam-Images-MIPS-IPK.zip

*************************

8. UNPACKING NCAM

This can get complicated. I use 7-zip to unpack it.

*************************************************

Right click on the

Ncam-Images-MIPS-IPK.zip

and select "Extract to Ncam-Images-MIPS-IPK.zip"

*************************************************

Double click on the extracted folder. You should see

enigma2-plugin-softcams-ncam-mips_V9.3-ro_all.ipk

*************************************************************************************

Right click again and "Extract to enigma2-plugin-softcams-ncam-mips_V9.3-ro_all.ipk"

*************************************************************************************

Now double click on the new folder. You should see something called data.tar

***************************************************

Right click on data.tar and "Extract to data.tar".

***************************************************

Double click on the data.tar folder.

***************************************************

Right click one last time and "Extract to data".

***************************************************

Double click on data and then on tmp and finally on the RAED folder.

If you did all this correctly you should see this directory

**********************************************************************************************

Ncam-Images-MIPS-IPK/enigma2-plugin-softcams-ncam-mips_V9.3-ro_all.ipk/data.tar/data/tmp/RAED

**********************************************************************************************

9. UPLOADING NCAM EMU FILES to RECEIVER

For this step you will need an FTP progam and your receiver's IP address. You can find your receiver network address by going into the menu and information and network selection.

Start the FTP application. Enter your receiver's IP address and the following

Username = root

Password = root

If the password root doesn't work for you try entering your E2 brand name ( like octagon, edision and so on ). If this doesn't work either then do a google search man !

Upload the following 3 files/folders from the directory you extracted before

***********************************************

.../RAED/ARM/ncam to /usr/bin/

( change permission of ncam to "755" )

***********************************************

***********************************************

.../RAED/openatv/etc/ncam.emu to /etc/

( change permission of ncam.emu to "755" )

***********************************************

***********************************************

.../RAED/etc/tuxbox/config to /etc/tuxbox/

( change permission of config folder to "777" )

***********************************************

You nailed it !! The NCAM emulator is now installed !!

In the future if you want to upgrade to a newer version of NCAM, just overwrite those 3 files/folders. Simple.

10. STARTING NCAM

Check to see if NCAM is working in your receiver.

**********************************

Menu - Info Panel - Softcam Panel

**********************************

Where it says "Select Cam 1", press the right arrow on your remote until you see the NCAM version you just installed. Press Start and NCAM should start running. To stop it, press Stop. To restart, press ReStart.

Whenever you make updates to your /config files, you must always restart NCAM for them to take effect. Remember this !

11. CONFIGURATION FILES

The configuration files for NCAM are found in the directory

*****************************

.../RAED/etc/tuxbox/config/

*****************************

ncam.conf

ncam.server

ncam.services

ncam.provid

The default files won't work for you. You need to edit them. Just copy and paste like I tell you.

Erase the default ( ncam.conf ) and paste this one

############################################################################

# ncam.conf generated automatically by NCAM 9.3

[global]

logfile = /tmp/ncam.log

nice = -1

initial_debuglevel = 64

preferlocalcards = 1

emmlogdir = /tmp/emm.log

[cache]

[streamrelay]

stream_relay_enabled = 1

[dvbapi]

enabled = 1

au = 1

pmt_mode = 0

delayer = 60

ecminfo_type = 1

user = linuxsatsupport

read_sdt = 1

write_sdt_prov = 1

extended_cw_api = 1

boxtype = dreambox

[webif]

httpport = 8181

httptpl = /etc/tuxbox/config/tpl/

httprefresh = 30

httpallowed = 127.0.0.1,192.168.0.0-192.168.255.255

httpemmsclean = 256

httpemmgclean = 256

httputf8 = 0

###########################################################################

Do the same for the ( ncam.server ) file and paste this one

##########################################################################

# ncam.server generated automatically by NCAM 9.3

[reader]

label = emulator

enable = 1

protocol = emu

device = emulator

caid = 090F,0500,1801,0604,2600,FFFF,0E00,4AE1,1010

detect = cd

ident = 090F:000000;0500:000000,023800,021110,007400,007800;1801:000000,007301,001101,002111;0604:000000;2600:000000;FFFF:000000;0E00:000000;4AE1:000011,000014,0000FE;1010:000000

disablecrccws_only_for = 0E00:000000

group = 1

emmcache = 2,2,2,0

saveemm-u = 1

emu_auproviders = 0E00:000000

auprovid = 000E00

[reader]

label = SoftCam.Key

protocol = emu

device = /etc/tuxbox/config/SoftCam.Key

caid = 0D00,0D02,090F,0500,1801,0604,2600,FFFF,0E00,4AE1

detect = cd

ident = 0D00:000000,000004,000010,000014,000020,0000C0,0000C4,0000C8,0000CC;0D02:000000,00008C,0000A0,0000A4,0000A8;090F:000000;0500:000000,030B00,023800,021110,007400,007800;1801:000000;0604:000000;2600:000000;FFFF:000000;0E00:000000

disablecrccws_only_for = 0E00:000000

group = 2

emmcache = 2,2,2,0

saveemm-unknown = 1

saveemm-u = 1

saveemm-s = 1

saveemm-g = 1

emu_auproviders = 090F:000000;0500:000000;0604:000000;2600:000000;FFFF:000000; 0E00:000000;4AE1:000011,000014,0000FE;1010:000000;0621:00000 0

#################################################################################

Finally cut and paste this for ( ncam.user )

##########################################################################

# ncam.server generated automatically by NCAM 9.3

[account]

#description = dvbapi

user = linuxsatsupport

monlevel = 4

au = 1

group = 1

keepalive = 1

[account]

user = dvbapiau

description = dvbapi

caid = 1802,1861,0907,0942,0646,09C3,2600,0E00,0E01

au = pvr-emu

group = 1,2,3,4,5

ident = 1802:000000;1861:000000;2600:000000;0907:000000;0646:000000;0942:000000;09C3:000000

#################################################################################

Now upload the updated ( ncam.conf ), ( ncam.server ) and ( ncam.user ) files to etc/tuxbox/config/ on your E2 receiver. Set the permission of these files to 644. Your new configuration files are guaranteed to work for powervu ( autoroll ), biss and tandberg in the USA.

More information about editing configuration files is available at

***************************************************

https://github.com/oscam-emu/oscam-patched/wiki

http://www.streamboard.tv/oscam/

***************************************************

12. SOFTCAM KEY FILE

The SoftCam.Key file is where you write the keys for the emulator.

The file is located at

****************************************

.../RAED/etc/tuxbox/config/SoftCam.key

****************************************

and needs to be written to this directory

****************************************

/etc/tuxbox/config/

****************************************

Open the default SoftCam.Key file in notepad or wordpad or any other editor. Delete all

the keys you see because they are for Europe and useless to us on this side of the pond.

Now you will learn how to add your own keys. Let's test Fox News on Galaxy 17.

;############## 91 West ( Galaxy 17 ) ######################################

P 10910001 00 CB5653EF16A12B ; Fox News ; 91W ; 3820V

P 10910001 01 FE52825FB076A5 ; Fox News ; 91W ; 3820V

;###################################################################

Cut and paste the keys above into your SoftCam.Key file, save it and upload it to

*********************

/etc/tuxbox/config/

*********************

Set the permission to 644.

Once you restart NCAM, the scrambled channel Fox News on Galaxy 17 will start to clear and you will be testing your first C band channel !!

Let's discuss the syntax of the key file for just a moment. In general your key entries will look like

************************************************************************************

P <groupid><srvid> <key number> <key> ; <description>

where

P denotes: Powervu

<groupid> denotes: Any 4 hex digit number ( 1091 )

<srvid> denotes: Service id of channel in hex with leading zeroes ( 0001 )

<key number> denotes: ( 00 ) for even or ( 01 ) for odd key

<key> denotes: The ECM key ( CB5653EF16A12B ) and ( FE52825FB076A5 )

; denotes: emu instructed to ignore comments

<description> denotes: Any description of your choice for keeping track of the keys.

************************************************************************************

It took me at least a month to understand this so pay attention !!

<groupid> ( 1091 ): The group id is completely up to you. What I do is assign the last 3 digits to the satellite's longitude. In this case 091 west. I also add a unique transponder prefix which in this case was 1. So it becomes 1091 and is unique. If I were adding a second mux on 091 west, I would choose 2091 and a third mux as 3091 and on and on. If I were adding a sixth mux on 127 west I would use 6127. The reason for adding unique group ids will become apparent when we add autoroll keys to our SoftCam.Key file.

The <srvid> is the service id of the channel in hex. You can get this value from a place like lyngsat.com. In the case of Fox News on the 3820V transponder the sid is listed as 1. When you convert this to hex you still get 1 but you must add leading zeroes so it becomes 0001.

The <key number> is self explanatory. For Powervu two ECM keys are used: 00 and 01. The actual <key> can usually be found on the internet with the help of google. You can search for "Powervu Keys" and the satellite mux you are looking for. You can also ask people in the hack forums for the keys. Most of the keys are kept secret because the provider can change them at any time in which case you will need the autoroll key also known as the EMM Key, which is even harder to find !!

Now let's add a second channel to our key file. Let's add Fox Business on the same mux.

;############## 91 West ( Galaxy 17 ) ######################################

P 10910001 00 CB5653EF16A12B ; Fox News ; 91W ; 3820V

P 10910001 01 FE52825FB076A5 ; Fox News ; 91W ; 3820V

P 10910009 00 CB5653EF16A12B ; Fox Business ; 91W ; 3820V

P 10910009 01 FE52825FB076A5 ; Fox Business ; 91W ; 3820V

;###################################################################

Cut and paste the above to your SoftCam.Key file, save and upload to

*********************

/etc/tuxbox/config/

*********************

After restarting NCAM both Fox News and Fox Business will clear. Notice that the keys are the same. For Powervu encrypted channels the same key 00 and key 01 are used for all the channels in the mux which makes it easier for us !! You can add the remaining channels for that mux by looking up the sids on lyngsat.

The last thing we will cover is how to add an autoroll key. This key is also known as an EMM key. Sometimes the provider updates the key 00 and key 01 and your channels will go scrambled. In that case you just need to add an EMM key for the mux group and let it do the work of updating the ECM keys.

By the time you read this the providers may have already changed the ECM keys 00 and 01 used in our examples, so try the key file below with EMM autoroll key !!

;############## 91 West ( Galaxy 17 ) ######################################

P 10910001 00 CB5653EF16A12B ; Fox News ; 91W ; 3820V

P 10910001 01 FE52825FB076A5 ; Fox News ; 91W ; 3820V

P 10910009 00 CB5653EF16A12B ; Fox Business ; 91W ; 3820V

P 10910009 01 FE52825FB076A5 ; Fox Business ; 91W ; 3820V

P 1091 003FF5F9 44BEB355A450BA ; EMM;

;###################################################################

*************************************************************************************************

The format for the EMM key is like this

P <groupid> <UA> <key>

where

P denotes: Powervu

<groupid> denotes: Any 4 hex digit number ( 1091 ). It should match exactly the groupid you chose for the mux before.

<UA> denotes: Unique address of the EMM key.

<key> denotes: The EMM key.

**************************************************************************************************

Once again the EMM keys for different muxes are posted online by people who already have them. Unless the key 00 and key 01 are constantly changing, you don't need the EMM key in your SoftCam file. Most muxes in the USA do not update keys on a regular basis. The only exception is 4020H on SES 1. Keep in mind that the provider can blacklist our EMM keys so it is wise not to post them in open forums.

One final thing to remember is that the EMM key will update keys for all channels with the same <groupid> so make sure you use different group id's for different muxes. If you have more than one EMM key you can add them like this

;############## 91 West ( Galaxy 17 ) ######################################

P 10910001 00 CB5653EF16A12B ; Fox News ; 91W ; 3820V

P 10910001 01 FE52825FB076A5 ; Fox News ; 91W ; 3820V

P 10910009 00 CB5653EF16A12B ; Fox Business ; 91W ; 3820V

P 10910009 01 FE52825FB076A5 ; Fox Business ; 91W ; 3820V

P 1091 003FF5F9 44BEB355A450BA ; EMM;

P 1091 00xxxxxx yyyyyyyyyyyyyy ; EMM;

P 1091 00pppppp zzzzzzzzzzzzzz ; EMM;

;###################################################################

NCAM will use whichever EMM key works to update the ECM keys. Key rolls take a few minutes but some providers don't roll the keys often so leave it overnight. You can find more information about configuring the SoftCam.Key file for Powervu at

****************************************************************

https://github.com/oscam-emu/o…tched/wiki/PowerVU-config

****************************************************************

You may also wish to add BISS support to your NCAM emulator. Here is an example

;############## 121 West ( Galaxy 23 ) ######################################

F 00051FFF 00 6CAC627A26CAC6B6 ; Dog TV ; 121.0W ; 3840H

F 00051FFF 01 6CAC627A26CAC6B6 ; Dog TV ; 121.0W ; 3840H

;####################################################################

**********************************************************

The syntax for BISS is

F <sid>1FFF <key number> <key>

where

F denotes: BISS

<sid> denotes: The service id of the channel

<key number> denotes: 00 or 01

<key> denotes: 8 byte BISS Key

**********************************************************

The same BISS key is used for both key number 00 and 01. Like before you can lookup the sid on lyngsat.com which is 5 in this case. With leading zeros it becomes 0005.

There is no autoroll with BISS. The BISS key is static and can be changed by the provider at any time. You can find more information about BISS configuration at

*************************************************************

https://github.com/oscam-emu/oscam-patched/wiki/BISS-config

*************************************************************

13. NCAM MONITORING

You can monitor the NCAM emulator and troubleshoot any problems by using NCAM Admin Control. Use your web browser and enter the IP address of your receiver followed by :8181.

For example 192.168.1.5:8181

NCAM Admin lets you change configurations and even edit the SoftCam.Key file on the fly. You can also check the Live Log to find out why a particular channel is not clearing or why autoroll is not working. It is a good tool and worth learning how to use it in case you need to fix some problem with your NCAM.

14. FINDING KEYS

I already mentioned that the default ECM Key 0123456789ABCD is in widespread use on many C band transponders over the USA. For example 125W/4080H, 123W/4020H, 103W/3860V all use this key for both key 00 and key 01. So if you are just starting out I suggest adding these to your SoftCam.Key file and giving them a try !!

Some other sources for keys include

******************************************************

http://www.sat-universe.com/showthread.php?t=283633

( ECM KEY COLLECTION IN REGION AMERICA )

******************************************************

****************************************************************************************

Working SoftCam Keys and Configurations

( Working Softcam Keys and Configurations )

****************************************************************************************

Some of these keys have long since changed but others are still active. You can also use google to search for other keys. If you can't find the keys for a particular transponder or need an EMM key for autoroll your best bet is to ask at one of the hack forums. I think the hackers have almost all the keys and that's how I got some of them. So just ask in one of the forums where private messaging is allowed.

Love the hobby !!

====================================================================================