|
Part 5:
-----------------------------------------------------------------------------------
Initial Cam / Card Exchanges
When the decoder is first switched on or the cam is reset there is an exchange of data between the cam and the card. The cam makes the requests and the card, the replys, as follows:-
Request : Country Code
01 02 02 03 00 00 3D
Reply : Country Code
01 02 00 00 02 03 00 10
02 01 99 17 01 17 02 17 03 17 04 07 41 44 45 55 (DEU)
A1
Request : Cards ASCII Serial Number
01 02 00 03 00 00 3F
Reply : Cards ASCII Serial Number
01 02 00 00 00 03 00 14
3x 3x 3x 3x 3x 3x 3x 3x 3x 3x 43 36 34 32 30 33
41 20 20 20 30
Request : Cards HEX Serial Number
01 02 01 03 00 00 3E
Reply : Cards HEX Serial Number
01 02 00 00 01 03 00 10
00 17 00 00 01 00 17 00 00 01 02 00 xx xx xx 18
B9
Request : Cards Provider ID 00
01 02 03 03 00 00 3C
Reply : Cards Provider ID 00
01 02 00 00 03 03 00 18
00 p0 p0 p0 00 00 00 00 00 00 03 12 00 00 00 00
00 00 00 00 00 00 00 00 36
Request : Cards Provider ID 10
01 02 03 03 01 00 3D
Reply : Cards Provider ID 10
01 02 00 00 03 03 01 18
11 p1 p1 p1 00 00 00 00 00 00 03 18 00 00 00 00
00 00 00 00 00 00 00 00 2B
Request : Cards HEX Serial Number
01 02 01 03 00 00 3E
Reply : Cards HEX Serial Number
01 02 00 00 01 03 00 10
00 17 00 00 01 00 17 00 00 01 02 00 xx xx xx 18
B9
Request : Card File 1
01 02 0E 02 00 00 30
Reply : Card File 1
01 02 00 00 0E 02 00 40
D9 F9 0B 14 20 F1 AA 7D 0E 84 BE C2 FD E3 54 DE
F0 C8 FC BE B1 BA DD 43 78 68 45 99 07 7C 6B 6C
39 9A 07 E0 BC 35 E5 11 C3 01 9F 0D F1 C7 91 67
37 89 32 AB 44 65 CA AC B1 80 42 85 99 E7 21 C1
D5
Request : Card File 2
01 02 0E 03 00 00 31
Reply : Card File 2
01 02 00 00 0E 03 00 40
3F 5E 10 0D EB 30 4B 05 22 5D DB CA FE 24 26 7E
CF 78 0C 69 D1 75 7A 67 84 1F 2C A6 75 F6 0F 59
1E E0 18 FE A8 71 DD 25 D6 3F 6B 4E 05 67 1E D7
76 41 03 1B 31 17 6D B0 F6 2E F6 8A 39 67 7B E6
36
Request : Country Code
01 02 02 03 00 00 3D
Reply : Country Code
01 02 00 00 02 03 00 10
02 01 99 17 01 17 02 17 03 17 04 07 41 44 45 55 (DEU)
A1
Request : Cards HEX Serial Number
01 02 01 03 00 00 3E
Reply : Cards HEX Serial Number
01 02 00 00 01 03 00 10
00 17 00 00 01 00 17 00 00 01 02 00 xx xx xx 18
B9
Sending: IRD/Cam Key
01 02 09 03 00 40
B4 3C 56 92 CB 91 89 1E 9C A2 F1 C5 DF A0 11 E8
7D AB BF 23 DB CF 82 0A 5D E1 52 0B 2E 26 5F FC
D1 83 07 7A 92 4A 43 05 4B 3B FA 30 4D C8 1C BB
C7 C8 9C 51 22 2E 86 14 A2 41 72 24 0F 00 D2 81
7F
Card Accepting IRD/Cam Key
01 02 55 00 09 03 00 00 63
Request : Cards HEX Serial Number
01 02 01 03 00 00 3E
Reply : Cards HEX Serial Number
01 02 00 00 01 03 00 10
00 17 00 00 01 00 17 00 00 01 02 00 xx xx xx 18
B9
Request : Cards HEX Serial Number
01 02 01 03 00 00 3E
Reply : Cards HEX Serial Number
01 02 00 00 01 03 00 10
00 17 00 00 01 00 17 00 00 01 02 00 xx xx xx 18
B9
Request : Cards Provider ID 00
01 02 03 03 00 00 3C
Reply : Cards Provider ID 00
01 02 00 00 03 03 00 18
00 p0 p0 p0 00 00 00 00 00 00 03 12 00 00 00 00
00 00 00 00 00 00 00 00 36
Request : Cards Provider ID 10
01 02 03 03 01 00 3D
Reply : Cards Provider ID 10
01 02 00 00 03 03 01 18
11 p1 p1 p1 00 00 00 00 00 00 03 18 00 00 00 00
00 00 00 00 00 00 00 00 2B
Request : Cards HEX Serial Number
01 02 01 03 00 00 3E
Reply : Cards HEX Serial Number
01 02 00 00 01 03 00 10
00 17 00 00 01 00 17 00 00 01 02 00 xx xx xx 18
B9
Sending: Key Packet
01 05 00 00 02 23
Ch ID 10 06 00 1D 78 12 06 12 B6 A7 75 3B 90 1C
00 DB AA 05 82 FF F9 3E C6 C9 40 02 03 18 0C DD
61 22 7A 1C
Reply : Key Packet / Decrypted
01 05 9D 00 38 00 02 16
Ch ID 00 12 FF FF 61 14 BE E6 60 FD 45 F6 BB 09
EA ED 79 58 82 25 78
You can see that most of the data is requested and sent more than once. The last byte of each reply packet is a checksum.
A decrypted key packet is repeatedly sent about every 10- 20 seconds. The same key packets can be sent consecutatively up to ten times, depending upon the Provider. Then they change.
Some decoders/firmware have a different set of initial exchange commands. Some (in particular the UEC) send a whole string of commands if the number of providers on the card is more than 02 (as determined by the HexSN string). Other cams will accept only a maximum of 04 providers.
--------------------------------------------------------------------
|