How to get Ins nds writh oscam
Code
Telekom TV (Romania)) – OSCam
https://trac.streamboard.tv/oscam/ticket/4797#comment:2
exemple here is one Mini TUTO for TTV caid 091F
- STEP 1 : Find BoxID / you can do it directly with OsCam (i.e. r11581) with option -S ((reader) tTV [internal] serial: 0000XXXX, BoxID: XXXXXXXX, baseyear: 200X)
- STEP 2 : Find ins7e / you can find it via menu and to adapt it in this format 6E736BXXXXXXXXXXXXXXXXXXXXXXXXXX00010202030002020203 ?
- STEP 3 : how to find k1 /
step 3.1 : you need to switch in debug logs 6 via OsCam LiveLog -> Show Settings -> select 2 + 4 (Switch Debug from 6 to) than search for (Search01: crypted CW is: and Search02: ecm hash:) than check Found Only
step 3.2 : check with someone who has a working card :) in order to compare the ECM hash in the same time for the same channel
step 3.3 : once you have one working decrypted CW vs your encrypted CW with the same HASH (the most important thing) you can start DES attack to find your unique k1 via hashcat <hashcat -m 14000 eCW:dCW -o /root/tTV.txt -a 3 -1 /usr/share/hashcat/charsets/DES_full.charset --hex-charset ?1?1?1?1?1?1?1?1 -w 4 --force> (you can use vast.ai to RENT a several GPU configs)
For info : with 8x RTX 2080 Ti k1 was calculated in 1 day, 6 hours on 46.23 % :)))
Here is the working reader (AU is activated and works very well) :
label = tTV
description = tTV
protocol = internal
device = /dev/sci1
autospeed = 0
caid = 091F
boxid = your 8char boxID as described in STEP 1
ins7e = your 52char ins7e as described in STEP 2
k1_unique = your 16char k1 calculated as described in STEP 3
fix07 = 0
readtiers = 2
detect = cd
mhz = 450
cardmhz = 2700
ident = 091F:000000
group = 1
emmcache = 1,1,3,0
blockemm-unknown = 1
saveemm-unknown = 1
saveemm-u = 1
saveemm-s = 1
disablecrccws = 1
[reader]
label = TTV
enable = 1
protocol = internal
device = /dev/sci0
disablecrccws_only_for = 091F:000000
caid = 091F
boxid = E11809B5 #exemple
ins7e = 4D00166000000000611809B50000000000010202030002020203 #exemple
k1_generic = 86C1F1CB6DB59740 #exemple
detect = cd
group = 1
blockemm-unknown = 1
blockemm-u = 1
saveemm-u = 1
Or
[reader]
label = TTV
enable = 1
protocol = internal
device = /dev/sci0
disablecrccws_only_for = 091F:000000
caid = 091F
boxid = E11809B5 #exemple
ins7e = 4D00166000000000611809B50000000000010202030002020203 #exemple
k1_unique = 86C1F1CB6DB59740 #exemple
detect = cd
group = 1
blockemm-unknown = 1
blockemm-u = 1
saveemm-u = 1Thanks @ciprysat
