PowerVu nano 01 Discussion/Exploration

There are 67 replies in this Thread which was already clicked 12,161 times. The last Post () by Fenix11.

    Mad scientists are what this hobby is all about!


    So it does have a JTAG? If I can get root access that will be almost as if not more interesting as it should allow finding a way to get into the trustzone key storage and such.


    Thanks for sharing! I really hope UPS doesn't act like USPS and deliver 1+ week late - they usually do better so it should be here tomorrow.

    Quote from ray34

    Do not share the information you have accessed or are trying to access in the open area and share the file in an encrypted form as WinRAR. If others see it and leak information to the center, the administrators will take precautions and patch it, it is always like this.

    Those are exposed on google search already - but if firmware dumps are shared we may be better off doing that via DM or a private thread if possible.

    Fenix11 if you do have dumps of the firmware - 2.90 or whatever, I can probably take those apart...I'm decent with reversing software, but not so much an expert on satellites - like I don't even know the NetId of Anuvu/MTI to test that mux with my receiver.

    Quote from ilikenwf

    Fenix11 if you do have dumps of the firmware - 2.90 or whatever, I can probably take those apart...I'm decent with reversing software, but not so much an expert on satellites - like I don't even know the NetId of Anuvu/MTI to test that mux with my receiver.

    Everything is ready, I hope they are of some use to you in your projects.

    After reskimming Colibri's work and looking at these dumps, I suspect this thing runs some kind of MIPS RTOS. There's not any truly discernable binaries at a cursory look that do a lot in terms of encryption, I believe the ISC (integrated security chip) is responsible for that.

    In the PowerVuSecrets.pdf by colibri he shows how he managed to talk to the ISC.


    Has anyone tried getting in touch with Colibri about this before?

    This one...it had a sticker on top with the UA of the receiver (which is a new addition - this is PowerVu Plus and nano01 most likely! - AES 128 + using the UA in the hash somehow) - see Colibri's work on what this thing is. I'm sure it probably speaks the same protocol (logic analyzer may be easier than a custom board?)


    If we can poke these and figure out the hashing method and reproduce everything in a softcam with a given UA, then for any given stream, the cracking method would involve using CUDA and a capture of the TS with EMM's to test every possible 8 byte UA until we find one that is authorized...I theorize anyway.


    I know enough to be dangerous but we may need some help from people who have done a lot in this space in order to figure it out.


    pasted-from-clipboard.pngpasted-from-clipboard.png

    • Official Post
    Quote from ilikenwf

    For MTN/Anuvu do any of you know how to determine the NetId of the MTN mux?

    Dvbsnoop should reveal that (I'm on my mobile otherwise would link to it)


    I agree we should keep dumps private

    There's no need to attract unwanted attention. :goodluck:

    Hello friends.

    I have observed something in the nano 01 hash and that is that the emulator is forced to continue doing autoroll in each valid UA it finds despite already having the valid key and I also saw that there is a UA or EMM that launches an ECM 00 and 01 different from the valid ECM of the same MUX. it seems very strange to me that if you have for example 10 valid or active EMMs in your softcam, the emulator with the new powervu does autoroll over and over again until it reaches the 10 ECMs of the 10 EMMs including the unknown ECM key, this key has the same digits as in index 00 and 01. this detail must be investigated because the emulator is forced to produce repeated keys with this new powervu system of the nanos 01. here I show you the universal studio keys of the 58w observe the keys that the emulator gave. I removed the UA that gave me those false keys 🔑 because I suspected that it paralyzed the emulator but as if the valid keys were repeating for the different EMMs.


    It seems that the generated keys expire instantly, and the emulator starts autorolling again, launching the same keys but from different EMMs. I also noticed on one channel of the 55w PFCi HD that there was an EMM key that, when autorolled, would stop the entire emulator. After deleting the key and leaving only the others, the problem was resolved. It was quite similar to the problem with the Nano01 on the 58w Universal Studio.


    Has anyone else noticed this on softcams or the receivers they autoroll?

    fairbird sorry to ping you but I think that nano01 may actually be an optional use of AES256, but more importantly, the addition of an 8 byte UA instead of just a 4 byte UA...see the example posted earlier in the thread with the nano00 vs nano01 comparison...the 4 extra bytes appear to just be the new use of longer UA's?

    I only know this from a high level view right now, is this something we could pound out/test/investiagate? I wonder if this thread may need to be private or if instead we should talk on TG or Discord?

    Edited 2 times, last by ilikenwf ().

Your resource for Ncam softcam.

Find configs, tools, downloads, and community support for setup, optimization, and card/server management. Master modern card sharing with Ncam. Access configurations, tools, downloads, and dedicated support for efficient Enigma2 server/client setup.

Participate now!

Don’t have an account yet? Register yourself now and be a part of our community!

Register Yourself Login