OSCam Cardless CAS Integration – Looking for Guidance & Collaboration

• Hi all,

  I'm currently working on integrating OSCam with a cardless CAS system — the goal is to enable ECM processing and CW extraction directly from the internal CAS, without the need for a physical smartcard.

  🛠️ Project Objective:

  To create a softcam-like solution where OSCam communicates with the built-in cardless CAS of the device. The idea is to send ECMs to the native CAS, get back CWs, and use/share them just like a traditional card setup.

  🔍 Progress So Far:

  • Extracted binaries from the device firmware
  • Identified functions that handle ECM and CW operations
  • Investigating methods to hook or communicate with the CAS interface

  📌 Looking For:

  • Advice on building custom readers or protocols within OSCam
  • Examples of cardless CAS integration (e.g., for IPTV or embedded systems)
  • Debugging tips for working with closed-source CAS libraries
  • Any tools or methods for tracing CW responses or analyzing memory

  If you've worked on OSCam modifications, cardless systems, or CAS reverse engineering, I'd love to exchange ideas. Open to collaboration or any direction you can offer.

Quote from frnokia

Ciao, abbiamo studiato un sistema per Tivusat e abbiamo creato un'emulazione di carta su ESP32. Non conoscendo gli algoritmi di codifica, estrazione e gestione per ECM ed EMM, ci limitiamo a emulare con risposte false, che vengono utilizzate per ricevere gli EMM su una cam ufficiale e aggiornare i diritti sulla scheda 183e nei ricevitori con oscam. Stiamo anche testando un emulatore con CCCAM che invia tutto al server OSCAM. Riusciamo a rimettere in chiaro il segnale su sistemi OSCAM tramite l'emulatore, ma non sulle cam ufficiali, perché utilizzano una chiave IDEA diversa da quella calcolata da OSCAM e non abbiamo ancora scoperto come decodificarla dal flusso dei dati tra carta e cam..

google translate.
Hi, we've been working on a system for Tivusat and have created a card emulation on an ESP32. Since we don't know the encoding, extraction, and management algorithms for ECM and EMM, we're limiting ourselves to emulating with fake responses, which are used to receive EMMs on an official cam and update the rights on the 183e card in receivers with OSCAM. We're also testing an emulator with CCCAM that sends everything to the OSCAM server. We can unencrypt the signal on OSCAM systems using the emulator, but not on official cams, because they use a different IDEA key than the one calculated by OSCAM, and we haven't yet figured out how to decode it from the data flow between card and cam.

Let’s work on this together.