OscamEmu For All (by Youchie) Support

Quote from didou

TVCAS are Conax and Irdeto cards that operate with the master key on the emulator.

ECMBIN records a portion of the ECM with the CW .

The data is then compiled into BIN files.

It's a bit complex, but we're currently working on simplifying it.

Display More

Thanks for the explanation, but what's the point of all of this? To be able to watch channels offline? But for this you need to have a valid, and working line before.

Is it possible to stop ecmemu from creating unnecessary logs for biss and powervu channels?

Is it normal for ecmemu to display this message: No matching bin file for caid...

If it is normal, it is spamming the log every time a CW is found.

Quote from odem2014

Thanks for support , please can anyone who tried oscam emu 803 which support the new conax batch of youchie to confirm that it is working and decrypts conax encrypted channels offline ? And if possible attach the working configurations ,

I tried for a long time but only ecmlogs file created for every channel named with caid and service is , but no bin file created .

Thanks in advance

The Conax emulator has nothing to do with ecmbin. I already explained about ecmbin earlier, and it is not related to Conax at all. On any package or encrypted system that you access and watch through CCcam, it starts collecting CW data. When it succeeds in finding a repeating pattern in the CW data for that CAID, an ecmbin file is created and stored. Until a repeating pattern is found, no ecmbin file will be generated. When an ecmbin file is finally created, it means the algorithm has successfully identified the repeating pattern in the CW data, and that’s when the file is produced. An example of data collection can be seen in the picture below. These are two completely separate topic

Screenshot 2025-09-02 184219.png

Screenshot 2025-09-02 184539.png

When the bin file is created for the desired CAID, you can watch the channels offline. It can be for any package and any CAID.

Quote from JDavid22

Youchie
The master keys are known? the ones you show above could be valid for some NA satellites? Thanks

To use the Conax emulator, these need to be added to the emulator readers

[reader]
label                         = Internal_SoftCam
protocol                      = emu
device                        = emulator
disablecrccws_only_for        = 0E00:000000
caid                          = 0B00,0B01,0500,090F,0E00,1010,8191,1801,2600,2602,2610,4AE1,FFFE
detect                        = cd
ident                         = 0B00:000000;0B01:000000;0500:000000,007400,007800,021110,023800;090F:000000;0E00:000000;1010:000000;8191:000000;1801:000000,001101,002111,007301;2600:000000;2602:000000;2610:000000;4AE1:000011,000014,0000FE
group                         = 1

The master keys must be published. Friends who have access to a Conax card can do this faster.

Then it is enough to add them in SoftCam as follows:

For Exampel: in SoftCam.Key

#############################################
#                   ConaX                   #
#############################################
C 0B01 00 000102030405060708090A0B0C0D0E0F
C 0B01 01 101112131415161718191A1B1C1D1E1F
C 0B01 00 9F3C17A2B5D0481E6A7B92F4C8E05D13;
C 0B01 01 A1B9E4F276C3058D4ACF19B08273DE5F;

I am developing the modules so that they can try to obtain the master key through data collection and calculation. If I succeed, I will definitely make it public. It requires time, but friends who have access to the card can obtain the keys faster.

Screenshot 2025-09-02 190331.png

Quote from FGD

Youchie

Can you please be more specific regarding this Conax EMU support?

Does this mean that some packages uses Conax, can be opened with this EMU, without using any cardsharing?

I followed your instructions (inserting keys into softcam.key, ECMbin setup in oscam config file), but nothing happens when switching to any conax channels.

I do appreciate if you can provide more information on this conax emu.

Display More

I gave a full explanation in the post above.

Quote from OnOffline

Quote

ECMBIN

The ECmbin system has been added to the readers section.

The ECmbin system works in such a way that when you are using a CCCam line or any card-sharing line, if you activate the ECmbin reader, it will start saving CW data and look for repeating patterns in them. If a repeating pattern is found in the keys, it will save it into a .bin file. Whenever this pattern is recognized and the bin file is created, you can watch the channels of that package even when you are offline, based on the repeating pattern that ECmbin has found.

For configuration and activation, you can go to the OSCam configuration section (as shown in the attached image), set the storage path for the files from the Global section as you wish, and save it.

If you don’t want to use ECmbin, simply disable it from the readers section.

I hope that's understandable.

Display More

Quote from FGD

So, when you have a working line for any Conax packages, you can copy/paste the ecm logs to softcam.key file as a master key, then you can watch these channels when you are offline, right?

Quote from didou

There seems to be confusion between tvcas and ecmbin.

I explained it fully in these two posts.

#84

#85

Quote from Youchie

Quote from odem2014

Thanks for support , please can anyone who tried oscam emu 803 which support the new conax batch of youchie to confirm that it is working and decrypts conax encrypted channels offline ? And if possible attach the working configurations ,

I tried for a long time but only ecmlogs file created for every channel named with caid and service is , but no bin file created .

Thanks in advance

The Conax emulator has nothing to do with ecmbin. I already explained about ecmbin earlier, and it is not related to Conax at all. On any package or encrypted system that you access and watch through CCcam, it starts collecting CW data. When it succeeds in finding a repeating pattern in the CW data for that CAID, an ecmbin file is created and stored. Until a repeating pattern is found, no ecmbin file will be generated. When an ecmbin file is finally created, it means the algorithm has successfully identified the repeating pattern in the CW data, and that’s when the file is produced. An example of data collection can be seen in the picture below. These are two completely separate topic

Screenshot 2025-09-02 184219.png

Screenshot 2025-09-02 184539.png

When the bin file is created for the desired CAID, you can watch the channels offline. It can be for any package and any CAID.

Display More

Thanks for answer , but I am collecting cw for one channel for more than 24 hours , and no bin file created, so is that logic to wait all this time to find the pattern ?

Do you test this patch and succeeded to find a pattern? Or this patch is an idea only ?

As I understand, this patch is some how like finding ECM key for afn package, only few seconds on the afn channel and ECM will be found and written to the softcam then I can watch the channels .

Another question, in case anyone succeeded to find the pattern and bin file created , can he share this bin file to others ?

Excuse me , you are offered a very important idea and a lightning point in decrypting conax channels , but no prove for that , no one succeeded, so we need more details and of course you are doing a great work so thank you .

Quote from odem2014

Quote from Youchie

Quote from odem2014

Thanks for support , please can anyone who tried oscam emu 803 which support the new conax batch of youchie to confirm that it is working and decrypts conax encrypted channels offline ? And if possible attach the working configurations ,

I tried for a long time but only ecmlogs file created for every channel named with caid and service is , but no bin file created .

Thanks in advance

The Conax emulator has nothing to do with ecmbin. I already explained about ecmbin earlier, and it is not related to Conax at all. On any package or encrypted system that you access and watch through CCcam, it starts collecting CW data. When it succeeds in finding a repeating pattern in the CW data for that CAID, an ecmbin file is created and stored. Until a repeating pattern is found, no ecmbin file will be generated. When an ecmbin file is finally created, it means the algorithm has successfully identified the repeating pattern in the CW data, and that’s when the file is produced. An example of data collection can be seen in the picture below. These are two completely separate topic

Screenshot 2025-09-02 184219.png

Screenshot 2025-09-02 184539.png

When the bin file is created for the desired CAID, you can watch the channels offline. It can be for any package and any CAID.

Display More

Thanks for answer , but I am collecting cw for one channel for more than 24 hours , and no bin file created, so is that logic to wait all this time to find the pattern ?

Do you test this patch and succeeded to find a pattern? Or this patch is an idea only ?

As I understand, this patch is some how like finding ECM key for afn package, only few seconds on the afn channel and ECM will be found and written to the softcam then I can watch the channels .

Another question, in case anyone succeeded to find the pattern and bin file created , can he share this bin file to others ?

Excuse me , you are offered a very important idea and a lightning point in decrypting conax channels , but no prove for that , no one succeeded, so we need more details and of course you are doing a great work so thank you .

Display More

ECM bin is a module that, according to its algorithm, searches for similar patterns in CWs. So finding a pattern easily is not simple, but when most users use this algorithm, it is possible to find a similar pattern, which is better than nothing. Moreover, this module is very useful for data collection and reverse engineering. If a bin file is created, it can be easily shared and others can use it. When the bin file is found and a specific pattern is registered, it is very effective for hacking the encryption algorithm of that system, and modules corresponding to that CAID can be upgraded.

As you know, encryption systems on networks have become very advanced. Some modern encryption systems, such as:

Modern generations (Viaccess 5 and 6 – Viaccess-Orca)

are a different story. Cards are paired with the receiver chipset, meaning the card only works on specific hardware. Even if someone records TS or saves ECM+EMM, without a secure chipset, nothing can be obtained. OSCam logs or even dumping the receiver memory no longer help, because the keys are stored in secure hardware (Secure Element). The algorithms have become more complex (AES-128, CSA3, AES-CMAC, etc.), so we must try to find solutions.

The best hackers are with the global team and IKS servers, and they certainly do not cooperate in publicizing algorithms or keys because they are financially supported by the global mafia. Therefore, any idea and its implementation on an EMU can be effective.

Regarding the Conax system, because it uses TVCS3 and TVCAS4, development and trial-and-error testing are 100% necessary to get a good output. This algorithm has been tested and works well via a Python emulator, but without the master keys, no channel can be opened. However, if the master keys are public, friends who have access to the card can extract the keys via brute-force attacks and make them public. Then the algorithm can also be improved on TVCAS4.

I am attaching a screenshot of the emulator test. As I mentioned in the earlier post, I am developing the module so that, through ECM data collection and analysis within the module itself, and by testing brute-force attacks on ECMs, I can patiently obtain the master keys from channels and extract them. It is a time-consuming task but not impossible.

As I said, friends who have the card can get the master keys faster and make them public, which is a challenge because card owners prefer to earn revenue by reshareing the card on CCcam servers. Therefore, we need to see if anyone is willing to cooperate. I live in Iran and do not have access to the card, but I am trying to obtain the master keys through TS streaming and improving the module. I hope it will be fruitful.

Screenshot 2025-09-02 230432.png

Example TVCAS3 ECM...:

80 70 34 70 32 64 21 2A F1 45 2D AB C7 AC F8 52

27 05 30 11 24 E5 58 0F 21 83 18 E3 C8 4F D1 56

0D F9 A7 C8 09 19 83 2B 70 27 1C AF 34 64 7E 97

C1 25 30 F1 EF 37 BD

---

80 <--- ECM type

70 34 <-- len

70 32 <-- data len (0x32 - 2 = 48)

64 <-- nano

21 <-- ? (ID)

2A F1 45 2D <--- ECM time (encrypted data)

AB C7 AC F8 52 27 05 30 <--- cw1 (encrypted data)

11 24 E5 58 0F 21 83 18 <--- cw0 (encrypted data)

E3 C8 4F D1 <--- Access criteria (encrypted data)

56 0D F9 A7 C8 09 19 83 2B 70 27 1C AF 34 64 7E 97 C1 25 30 <--- ECM gift (encrypted data)

F1 EF 37 <--- reserve (encrypted data)

BD <--- control summ (encrypted data)

data length = 48 and nano = 0x64 then equals TVCAS3

For ecm bin, you can find similarities in this line detail : 52 27 05 30 11 24 E5 58 0F 21 83 18 E3 C8 4F D1 ...

Quote from Youchie

Quote from JDavid22

Youchie
The master keys are known? the ones you show above could be valid for some NA satellites? Thanks

To use the Conax emulator, these need to be added to the emulator readers

Code

[reader]
label                         = Internal_SoftCam
protocol                      = emu
device                        = emulator
disablecrccws_only_for        = 0E00:000000
caid                          = 0B00,0B01,0500,090F,0E00,1010,8191,1801,2600,2602,2610,4AE1,FFFE
detect                        = cd
ident                         = 0B00:000000;0B01:000000;0500:000000,007400,007800,021110,023800;090F:000000;0E00:000000;1010:000000;8191:000000;1801:000000,001101,002111,007301;2600:000000;2602:000000;2610:000000;4AE1:000011,000014,0000FE
group                         = 1

The master keys must be published. Friends who have access to a Conax card can do this faster.

Then it is enough to add them in SoftCam as follows:

For Exampel: in SoftCam.Key

Code

#############################################
#                   ConaX                   #
#############################################
C 0B01 00 000102030405060708090A0B0C0D0E0F
C 0B01 01 101112131415161718191A1B1C1D1E1F
C 0B01 00 9F3C17A2B5D0481E6A7B92F4C8E05D13;
C 0B01 01 A1B9E4F276C3058D4ACF19B08273DE5F;

I am developing the modules so that they can try to obtain the master key through data collection and calculation. If I succeed, I will definitely make it public. It requires time, but friends who have access to the card can obtain the keys faster.

Screenshot 2025-09-02 190331.png

Display More

Quote from fegol

Example TVCAS3 ECM...:

80 70 34 70 32 64 21 2A F1 45 2D AB C7 AC F8 52

27 05 30 11 24 E5 58 0F 21 83 18 E3 C8 4F D1 56

0D F9 A7 C8 09 19 83 2B 70 27 1C AF 34 64 7E 97

C1 25 30 F1 EF 37 BD

---

80 <--- ECM type

70 34 <-- len

70 32 <-- data len (0x32 - 2 = 48)

64 <-- nano

21 <-- ? (ID)

2A F1 45 2D <--- ECM time (encrypted data)

AB C7 AC F8 52 27 05 30 <--- cw1 (encrypted data)

11 24 E5 58 0F 21 83 18 <--- cw0 (encrypted data)

E3 C8 4F D1 <--- Access criteria (encrypted data)

56 0D F9 A7 C8 09 19 83 2B 70 27 1C AF 34 64 7E 97 C1 25 30 <--- ECM gift (encrypted data)

F1 EF 37 <--- reserve (encrypted data)

BD <--- control summ (encrypted data)

data length = 48 and nano = 0x64 then equals TVCAS3

For ecm bin, you can find similarities in this line detail : 52 27 05 30 11 24 E5 58 0F 21 83 18 E3 C8 4F D1 ...

Display More

I’m currently working on upgrading the TVCAS module using this data so that the calculations are handled directly within the module. However, since I’m still testing it with different algorithms, I haven’t released it publicly yet. Once I achieve proper results, I’ll publish it openly.

In the attached OSCam log, you can see the debug process for automatic testing and for obtaining the master key

@Youchie

please open telegram

Quote from fegol

Example TVCAS3 ECM...:

80 70 34 70 32 64 21 2A F1 45 2D AB C7 AC F8 52

27 05 30 11 24 E5 58 0F 21 83 18 E3 C8 4F D1 56

0D F9 A7 C8 09 19 83 2B 70 27 1C AF 34 64 7E 97

C1 25 30 F1 EF 37 BD

---

80 <--- ECM type

70 34 <-- len

70 32 <-- data len (0x32 - 2 = 48)

64 <-- nano

21 <-- ? (ID)

2A F1 45 2D <--- ECM time (encrypted data)

AB C7 AC F8 52 27 05 30 <--- cw1 (encrypted data)

11 24 E5 58 0F 21 83 18 <--- cw0 (encrypted data)

E3 C8 4F D1 <--- Access criteria (encrypted data)

56 0D F9 A7 C8 09 19 83 2B 70 27 1C AF 34 64 7E 97 C1 25 30 <--- ECM gift (encrypted data)

F1 EF 37 <--- reserve (encrypted data)

BD <--- control summ (encrypted data)

data length = 48 and nano = 0x64 then equals TVCAS3

For ecm bin, you can find similarities in this line detail : 52 27 05 30 11 24 E5 58 0F 21 83 18 E3 C8 4F D1 ...

Display More

I’m implementing five algorithms inside the module:

// Method 1: Deep structural analysis based on TVCAS ECM patterns
// Method 2: XOR differential analysis between multiple ECMs
// Method 3: Statistical analysis of common TVCAS key patterns
// Method 4: Brute-force for common TVCAS key patterns
// Method 5: Fallback mechanisms

The goal is for the module itself to be able to extract the keys and automatically store them in the SoftCam file.

I’m also adding the ECMbin data to it, so the module can perform a deeper analysis.

Quote from didou

@Youchie

please open telegram

ok

Oscam brought the code but did not open the channel (FEED OCCAS HD) What's the problem with that?

https://wiki.streamboard.tv/wiki/OSCam/en/Config/oscam.conf#extended_cw_api

Helo Youchie, by any chance could you add OpenWRT mipsel build to your Oscam build list?

I'm using your builds on my TV-boxes, but none would work on my main client running on D-Link DIR-882 A1 and would love to use your builds also on OpenWRT, they are awesome!

Are there any settings present to enable online key update for AFN as in other oscam versions or isn't this feature included?

Every oscamemu supports updates from EMM

Don't know if I understand correctly but I meant the online updates from the AFN key thread and the keys provided by the users there. In my case with Youchies version I couldn't find any logs where it retreives or even asks for those keys.

The key changes every hour, and users don't always manage to publish it on the forum in time.