Hi

I would like you guys to enjoy the nagra2 channels.

Mike Lee

Here is a nagra2 code working on hispa and dishnetworks.
Please capture the provider id 1801 and 1810 when parsing the pmt table
define MAX_RSA_MODULUS_BITS as 1040 (Maximum length in digits should be 34)
and ignore cw swap right now.
This code is working well, but I have a better code.
If someone have some source codes related to hacking,
please email me as [email protected].
I will release nagra2 code that can open bell express vu soon.

U8 mod[][0x40]=
{
{
0xD9,0x1F,0xB4,0x82,0xF5,0x4C,0x45,0x35,0x62,0x1D, 0x84,0x5F,0x7E,0xC4,0xAB,0x4D, // D+
0xC9,0x30,0x9D,0xED,0x26,0xB5,0x40,0x30,0x84,0x8E, 0xB6,0x39,0x68,0x97,0x75,0x29,
0xFE,0x8F,0xF1,0x86,0x13,0x27,0x61,0x71,0xE5,0x7B, 0xDA,0x8A,0x47,0xAC,0x99,0x37,
0x03,0xCC,0xE2,0xA1,0xCB,0x07,0x19,0x98,0xEC,0xCB, 0x32,0x7E,0xF6,0x3C,0xCE,0xA7
},
{
0xAB,0xC5,0x7C,0xFA,0x14,0xC4,0x14,0xA8,0x4C,0x3E, 0xB1,0x96,0x9F,0x5F,0x99,0x93, // Dishnetworks
0x62,0x19,0xB4,0x85,0xE9,0xB9,0x6A,0x20,0xC3,0x31, 0x95,0x63,0xC8,0x0D,0x13,0x74,
0x3C,0xCD,0xDE,0xDF,0x67,0x1B,0xBE,0xDC,0x9C,0x5D, 0x31,0xEB,0xA5,0xBA,0xE2,0x60,
0x42,0x39,0xC6,0xE7,0x07,0x29,0xE9,0x99,0x91,0x71, 0xBD,0x0F,0xFE,0x37,0x5F,0xBA
}
};
U8 exp[]={0x03};

void nagra2RSA (U8 *msg, U8 prov) { // RAM:C0108AA5

NN_DIGIT E[0x22], N[0x22], MSG[0x22], M[0x22*4];
int nDigits, eDigits;

NN_DecodeLE(MSG, 0x22, msg, sizeof(mod[prov]));
NN_DecodeLE(E, 0x22, exp, sizeof(exp));
NN_DecodeLE(N, 0x22, mod[prov], sizeof(mod[prov]));

nDigits = NN_Digits(MSG, 0x22);
eDigits = NN_Digits(E, 0x22);
R_memset((POINTER)M, 0, sizeof(M)/*0x22*4*/);

S_NN_ModExp(M, MSG, E, eDigits, N, nDigits);
#if 0 //Original
NN_EncodeLE(msg, sizeof(MSG), M, 0x22);
#else
NN_EncodeLE(msg, 0x40, M, 0x22);
#endif
return;
}

U8 nagra2_ecm (U8 *ecm, U8 *ecw, U8 *ocw)
{
U8 key[][0x10] =
{
{
0xF5,0x36,0x55,0x68,0xF5,0x46,0x63,0x32,0x52,0xEE, 0xD5,0x00,0x88,0x1E,0x5A,0x37 // D+
},
{
0xC3,0xAE,0x57,0x16,0x02,0x9E,0xD0,0x00,0x5F,0x24, 0xB1,0xE9,0x9C,0xD3,0xEA,0xDC // Dishnetworks
}
};
U8 prov;
U8 tempBUF[0x40];
#if 0 //Original
int i,j,k;
#else
int i,j,k,len=ecm[4]-5, idealen=len/8;
#endif
U16 EK[IDEAKEYLEN];

debug1 (("\n nagra2_ecm of prov id = %02x %02x", ecm[5], ecm[6]));

if (len < 64)
{
debug1(("\n nagra2_ecm: short ecm length %d\n", len));
return 0;
}

if ( ((ecm[5] == 0x40) || (ecm[5] == 0x41)) && (ecm[6] == 0x01) )
prov = 0; // D+
else if ( ((ecm[5] == 0x00) || (ecm[5] == 0x01)) && (ecm[6] == 0x01) )
prov = 1; // Dishnetworks
else
return 0;

nagra2RSA (ecm+0xa, prov);
ecm[0x49] |= (ecm[9] & 0x80);
ideaExpandKey (key[prov], EK);
#if 0 //Original
for (i=7; i>-1; i--)
#else
for (i=idealen-1; i>-1; i--)
#endif
{
ideaCipher (ecm+0xa+(i*, ecm+0xa+(i*, EK);
if (i>0)
for (j=0; j<8; j++) ecm[(i*+j+0xa] ^= ecm[(i-1)*8+j+0xa];
}

nagra2RSA (ecm+0xa, prov);

for (i=0; i<0x40; i++)
tempBUF[i] = ecm[0x3Ff+0x0a-i];
memcpy (ecm+0xa, tempBUF, 0x40);

k = 0; // cw found
for (i=10; i<len-11; i++)
{
if(ecm[i] == 0x10 && ecm[i+1] == 0x09 && ecm[i+2] == 0)
{
if (1)/*(ecm[1]&0xf0)==0x70)*/ memcpy(ocw/*dw+8*/, ecm+i+3, ;
else memcpy(ecw/*dw*/, ecm+i+3, ;
i+=10;
k++;
}
if (ecm[i] == 0x11 && ecm[i+1] == 0x09 && ecm[i+2] == 0)
{
if (1)/*(ecm[1]&0xf0)==0x70)*/ memcpy(ecw/*dw*/, ecm+i+3, ;
else memcpy(ocw/*dw+8*/, ecm+i+3, ;
i+=10;
k++;
}
}

if (k) return 1;
else return 0;
}
#endif // #if defined(NAGRA2_ENABLE)

[/code]