Irdeto ACS v5.0

Geremia · #1 (**permalink**) 10-11-2005

Hi all,

I've an Irdeto ACS v5.0 card of a local dvb-t provider that is not readable by any cardserver, logging with season betwen card and dvb-t decoder give me something i can't understand. I'm new in smartcard analizyng, just started studying this my first card 2 days ago, so i need more studying and a little advice please

ATR: 3B 9F 11 40 60 49 52 44 45 54 4F 20 41 43 53 20 56 35 2E 30

Convention: DIRECT
Protocol: T=0
TA1 = 11
TC1 = 60

Historical Bytes: 49 52 44 45 54 4F 20 41 43 53 20 56 35 2E 30
I R D E T O A C S V 5 . 0

Programming Voltage = 0.0 volts
Programming Current = 25ma
Maximum Clock Frequency = 5.0MHz

Assuming a 3.5790MHz clock:
Work ETU = 0.0001039396 seconds
Guard Time = 0.0112254815 seconds
Baud Rate After Reset = 9621

My dvb-t decoder have an oscillator of 3,376mhz, so i logged with unilogger at 9076 8E1. Parity even otherwse i get garbage data. Serial umber is ** for privacy.

[00.43.08]
00 3B ED F7 5A 61 D0 60 49 52 44 45 54 4F 20 41 43 53 20
56 35 2E 30

[00.43.08]
3B 9F 11 40 60 49 52 44 45 54 4F 20 41 43 53 20 56 35 2E
30

[00.43.08]
FF 10 11 FE FF 10 11 FE DD 26 00 00 03 26 10 01 40 90 09
F7 23 F7 23 F7 23 3B 9F 11 40 60 49 52 44 45 54 4F 20 41
43 53 20 56 35 2E 30

[00.43.12]
D2 04 03 00 01 04 3D 60 90 19 D2 FE 03 00 19 FE 01 02 00
00 02 03 00 10 06 05 12 06 19 06 20 06 21 06 22 00 00 49
54 41 5A 90 00 D2 00 03 00 01 00 3F 60 90 1D D2 FE 03 00
1D FE 01 02 00 00 00 03 00 14 34 ** ** ** ** ** ** ** **
** ** ** ** ** ** ** ** 00 00 00 0C 90 00 D2 02 03 00 01
02 3E 60 90 19 D2 FE 03 00 19 FE 01 02 00 00 01 03 00 10
FF FF FF 00 00 00 00 00 00 00 04 07 CD 13 F7 18 E3 90 00
D2 06 03 00 01 06 3C 60 90 21 D2 FE 03 00 21 FE 01 02 00
00 03 03 00 18 00 06 63 5A 00 00 00 00 00 00 01 37 01 01
2D 2D 2D 82 62 00 00 00 00 00 E0 90 00 D2 06 03 01 01 06
3D 60 90 21 D2 FE 03 01 21 FE 01 02 00 00 03 03 01 18 01
00 04 00 00 00 00 00 00 00 00 00 00 00 2D 2D 2D 82 62 00
00 00 00 00 ED 90 00 D2 06 03 02 01 06 3E 60 90 21 D2 FE
03 02 21 FE 01 02 00 00 03 03 02 18 02 FF FF FF 00 00 00
00 00 00 00 00 00 00 00 00 00 82 62 00 00 00 00 00 3B 90
00 D2 06 03 03 01 06 3F 60 90 21 D2 FE 03 03 21 FE 01 02
00 00 03 03 03 18 03 FF FF FF 00 00 00 00 00 00 00 00 00
00 00 00 00 82 62 00 00 00 00 00 3B 90 00 D2 38 03 00 01
38 23 60 90 10 D2 FE 03 00 10 FE 01 02 00 00 1C 03 00 07
00 00 00 00 00 00 00 24 90 00 D2 06 03 00 01 06 3C 60 90
21 D2 FE 03 00 21 FE 01 02 00 00 03 03 00 18 00 06 63 5A
00 00 00 00 00 00 01 37 01 01 2D 2D 2D 82 62 00 00 00 00
00 E0 90 00 D2 38 03 01 01 38 22 60 90 10 D2 FE 03 01 10
FE 01 02 00 00 1C 03 01 07 00 00 00 00 00 00 00 25 90 00
D2 08 00 00 02 08 00 39 60 90 45 D2 FE 00 00 45 FE 01 02
00 00 04 00 00 3C 00 02 01 37 D2 00 00 31 00 92 D2 00 00
16 00 C1 1E 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF 5A 90 00 D2 38 03 02 01 38 21
60 90 10 D2 FE 03 02 10 FE 01 02 00 00 1C 03 02 07 00 00
00 00 00 00 00 26 90 00 D2 46 00 00 01 46 1F 60 90 09 D2
FE 00 00 09 FE 01 02 00 50 23 00 00 00 4F 90 00 D2 46 00
00 01 46 1F 60 90 09 D2 FE 00 00 09 FE 01 02 00 50 23 00
00 00 4F 90 00 D2 46 00 00 01 46 1F 60 90 09 D2 FE 00 00
09 FE 01 02 00 50 23 00 00 00 4F 90 00 D2 38 03 03 01 38
20 60 90 10 D2 FE 03 03 10 FE 01 02 00 00 1C 03 03 07 00
00 00 00 00 00 00 27 90 00 D2 46 00 00 01 46 1F 60 90 09
D2 FE 00 00 09 FE 01 02 00 50 23 00 00 00 4F 90 00 D2 46
00 00 01 46 1F 60 90 09 D2 FE 00 00 09 FE 01 02 00 50 23
00 00 00 4F 90 00 D2 46 00 00 01 46 1F 60 90 09 D2 FE 00
00 09 FE 01 02 00 50 23 00 00 00 4F 90 00 D2 10 03 00 01
10 37 60 90 49 D2 FE 03 00 49 FE 01 02 00 00 08 03 00 40
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 77 90 00 D2 46 00 01 01 46 1E 60 90
09 D2 FE 00 01 09 FE 01 02 00 50 23 00 01 00 4E 90 00 D2
46 00 01 01 46 1E 60 90 09 D2 FE 00 01 09 FE 01 02 00 50
23 00 01 00 4E 90 00 D2 46 00 01 01 46 1E 60 90 09 D2 FE
00 01 09 FE 01 02 00 50 23 00 01 00 4E 90 00 D2 2A 00 00
01 2A 29 60 90 89 D2 FE 00 00 89 FE 01 02 00 00 15 00 00
80 75 14 C6 27 F1 FF 40 B6 93 8B FE EB A6 1C 0C 94 AF 89
5D 2A B1 86 70 EE 53 8C A4 46 AA 7C 83 D6 13 E6 7F 4B FC
99 23 4E CE 6D 87 D3 D8 74 CF CC 08 4A 6B 7B EA F8 39 9A
34 10 62 E3 37 4B 54 47 E7 7F F3 B3 F6 76 0C 42 E7 63 3C
61 41 0E 9B 2C 0A 82 47 BA 35 1D 3D 1A EA E1 89 40 2F 9E
AB 48 60 BA 1C 87 A2 6F C6 0B FE 91 BE 29 6C A8 8E 09 EF
BE 11 5A E4 81 02 6E FE C5 72 8E 54 16 1F 61 CF 90 00 D2
46 00 02 01 46 1D 60 90 09 D2 FE 00 02 09 FE 01 02 00 50
23 00 02 00 4D 90 00 D2 46 00 02 01 46 1D 60 90 09 D2 FE
00 02 09 FE 01 02 00 50 23 00 02 00 4D 90 00 D2 46 00 02
01 46 1D 60 90 09 D2 FE 00 02 09 FE 01 02 00 50 23 00 02
00 4D 90 00 D2 1C 02 00 01 1C 30 60 90 49 D2 FE 02 00 49
FE 01 02 00 00 0E 02 00 40 C2 3E 9D 9D D1 82 87 F6 A7 5D
6F 84 82 46 E3 CE 61 3C B8 18 BA 62 20 C7 4D F3 CE 5E BB
DE 6A B8 9C 0A 7B 7F 79 50 F1 E0 2E 9B 8E 65 3F 03 9C F2
FF 83 D5 00 96 B2 06 85 98 3E 69 CF 13 69 1A 61 A4 90 00
D2 46 00 03 01 46 1C 60 90 09 D2 FE 00 03 09 FE 01 02 00
50 23 00 03 00 4C 90 00 D2 46 00 03 01 46 1C 60 90 09 D2
FE 00 03 09 FE 01 02 00 50 23 00 03 00 4C 90 00 D2 46 00
03 01 46 1C 60 90 09 D2 FE 00 03 09 FE 01 02 00 50 23 00
03 00 4C 90 00 D2 1C 03 00 01 1C 31 60 90 49 D2 FE 03 00
49 FE 01 02 00 00 0E 03 00 40 19 39 A1 DC FA 91 3F 12 44
45 E2 F1 39 90 21 D0 5E 99 2A BD 71 3B 4D 47 B6 2E F0 4A
A8 47 74 95 78 D7 CE CF 52 43 D1 FC 85 06 4E CC 1F E4 82
7B B5 37 0D 81 BC 7B 92 F8 53 08 92 73 09 8B 89 F7 68 90
00 D2 12 03 01 41 12 3C 6C 64 84 5F B1 A7 5F AC 7A 48 9B
FE 8F 7C 13 88 A2 3E 22 C2 DE 52 AD 44 54 CE B8 98 71 EB
CE 6B 31 50 38 26 93 E1 D7 DD 96 0E 55 30 EC E9 CF 0C 6D
6F 97 DE C6 1E 8A 7B C0 81 87 4E 47 39 E9 9F 60 90 09 D2
FE 03 01 09 FE 01 02 55 00 09 03 01 00 62 90 00 D2 40 00
00 11 40 02 1A 00 01 01 00 00 00 00 01 00 00 00 00 00 00
15 60 90 09 D2 FE 00 00 09 FE 01 02 00 00 20 00 00 00 1C
90 00 D2 3C 00 00 01 3C 22 60 90 15 D2 FE 00 00 15 FE 01
02 00 00 1E 00 00 0C 50 53 01 0E 00 03 00 00 00 00 00 00
21 90 00 D2 3E 00 00 01 3E 23 60 90 0B D2 FE 00 00 0B FE
01 02 00 00 1F 00 00 02 00 82 A3 90 00 D2 10 03 00 01 10
37 60 90 49 D2 FE 03 00 49 FE 01 02 00 00 08 03 00 40 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 77 90 00

I've interpreted like this, and tried to reproduce with winexplorer 9600 8E1, 0,0112 byte delay (according to ATR info) and phoenix at 3,579mhz

D2 04 03 00 01 3D
reply 60 90 19 (same as log)

D2 FE 03 00 19 01 02 00 00 02 03 00 10 06 05 12 06 19 06 20 06 21 06 22 00 00 49 54 41 5A
reply 90 09 (in log was 90 00)(Type 0605,country ITA), this seems to be from card to CAM

D2 00 03 00 01 3F
reply 60 90 1D (same as log)

D2 FE 03 00 1D 01 02 00 00 00 03 00 14 34 30 ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** 00 00 00 0C
reply 90 09 (in log was 90 00)(serial number) this seems from card to CAM

i'm not good in smartcard, do you see something interesting? In irdeto documents i've read, all commands starts with something like 01 01 xx xx xx..., here it seems that those commands are something like incapsulated in D2 class commands?!??

I can't understand the first command D2 04 03 00 01 3D , it has to be from CAM to card, because if i reproduce with winexplorer i've the same answere (60 90 19), but i can't undestand how the second command (from card to CAM) come out, because nothing appens more in winexplorer.
It's difficult to understand what command goes out or in, because any of the D2 class commands sent to the card give me back an ACK.
60 90 xx reply: xx seems to be the lengt of the next D2 class command...

didn't know anything about smartcards prior to the last 2 days, i'm confused, it's the first card i try to analize and i need some reference to other irdeto card raw log, any advice?

Maybe my log was bad? Card is T=0 asynchronous half duplex character transmission protocol, what means? maybe cards sends byte at a boud rate different from what the decoder sends? something wrong with parity?!?!?

Geremia · #2 (**permalink**) 10-11-2005

Now i got something more:

to card D2 04 03 00 01 3D
reply 60 90 19

to card D2 FE 03 00 19
reply 01 02 00 00 02 03 00 10 06 05 12 06 19 06 20 06 21 06 22 00 00 49 54 41 5A 90 00
(Type 0605,country ITA)

to card D2 00 03 00 01 3F
reply 60 90 1D

to card D2 FE 03 00 1D
reply 01 02 00 00 00 03 00 14 34 30 30 37 33 31 37 31 37 ** ** ** ** ** ** ** ** 00 00 00 0C 90 00
(ASCII serial number)

Reply seems standard irdeto reply, right?

De_Belg · #3 (**permalink**) 10-13-2005

This is interesting, I will keep on watching your development.

007.4 · #4 (**permalink**) 10-13-2005

Quote:

Originally Posted by Geremia

Reply seems standard irdeto reply, right?

Yes.
From a document (someone not far away wrote a long time ago) : -

Reply : Country Code
01 02 00 00 02 03 00 10
02 01 99 17 01 17 02 17 03 17 04 07 41 44 45 55 A1 ;Type 02 01 (DEU)

Reply : Cards ASCII Serial Number
01 02 00 00 00 03 00 14
3x 3x 3x 3x 3x 3x 3x 3x 3x 3x 43 36 34 32 30 33 41 20 20 20 30

It would seem likely your data is partially corrupt due to incorrect baud. Irdeto generally use a 6Mhz oscillator.
Try interrogating your card with FMcard.exe. You can use a 3.57Mhz osc. in your programmer with that.
HTH

Cheers
007.4

telnet · #5 (**permalink**) 10-13-2005

..I,ve logged many time ago the same c@rds of you (ACS V5.0) with Wallbanger set to 9600 8N1 and a passive season:

Incoming ECM Instruction
01 05 CB 1E 80 78
00 00 0E 00 02 00 33 FF FB 63 18 FB E5 8B 8C FE
E4 0C 92 1B 3D A2 00 95 00 00 00 6F 00 00 02 00
08 07 87 71 90 0E F7 37 7F AB 77 C7 7C 02 01 85
94 B7 DD F5 9A F0 07 75 E2 92 6F B7 7E 7E 69 F5
97 1C F6 0B 57 5F 71 9D 7A B7 7D EF 6E E7 F7 BF
D1 B1 0B EA 67 3F E5 E0 FF 10 7B F8 95 FE 00 00
17 E7 01 05 CB 1E 80 78 01 00 0E 00 02 00 12 FB
FB 63 EC 18 E2 E1 08 71 6B
Signature OK!!
01 01 00 00 7F 03 30 80
03 03 38 80 00 03 03 3A 80 95 00 00 00 6F 00 00
02 00 08 07 87 71 E7 E3 07 A7 BC BA F9 F7 B7 78
66 71 83 77 90 0D 97 EC 37 70 F6 E5 17 7D 16 0B
7C 47 72 84 1E 47 7E ED D6 0F 1A 0C 57 3C E0 76
E4 17 19 E7 71 DE FF E0 FF 10 7B F8 95 FE 00 00
17 E7 01 05 CB 1E 80 78 00 00 0E 00 02 00 13 FF
FB 13 B9 73 E7 E0 7B 8C EF B4 74 10 03 F8 95 00
00 00 6F 00 00 02 00 08 07 87 71 F2 F6 F7 73 47
78

..another set:

Incoming ECM Instruction
01 05 03 1A 80 00 00
Signature Wrong!!
01 05 03 1A 80 00 00 02 00 69 03
Incoming ECM Instruction
01 05 03 1A 80 00 00
Signature Wrong!!
01 05 03 1A 80 00 00 02 00 69 03

..another set:

Incoming EMM Instruction
01 01 00 00 7F 03
30 80 03 03
Signature OK!!
01 01 00 00 7F 03 38 80
03 03 30 80 00 03 03 1A 80 95 00 00 02 6F 00 00
02 00 08 07 87 71 EB 69 7E 87 74 0B 75 E1 18 C7
39 CE F3 84 7F 01 87 1E E4 6C 57 DC 73 71 ED E7
7B AC EB E7 77 FC 67 F7 BC EB 09 A7 BF 81 7C 7C
73 07 9C D6 66 17 7E 69 E0 FF 10 FB FC 95 FE 00
02 1F FE 01 05 CB 1E 80 78 01 02 16 00 02 00 13
FF FB 83 1D E3 03 33 96 0B 8D 6C 3A 76 F9 FE 3B
BB 7A 84 1D 8B 1A C2 10 03 F8 95 00 00 00 6F 00
00
Signature OK!!
01 01 00 00 7F 03 30 80
03 03 38 80 00 03 03 1A 80 B5 00 00 00 6F 00 00
02 00 08 07 87 71 E2 05 81 ED 67 70 7F E0 0E F7
7C 7F 1E 9F 77 7D 0D F8 F7 75 74 7A F0 1E 67 BF
79 A5 13 E7 0E 72 03 7B 87 7B 97 13 7F 17 72 A7
9B 87 9E 72 9B EE E7 71 8A E0 FF 10 7B F8 95 FE
00 00 17 E7 01 05 CB 1E 80 78 00 00 0E 00 02 00
13 FF FB F3 9E 8C 93 FB F7 77 3B 08 83 77 0E D9
00 95 00 00 00 6F 00 00 02 00 08 07 87 71 E3 13
E0

..seem the baud-rate isn't suitable for logging (due the clock of the box).
Work around the appropriate baud-rate many times but without success.

I think that whe need a active season (with a programmable clock) for the job.

Ciao.

Geremia · #6 (**permalink**) 10-14-2005

what i logged is what i can reproduce with winexplorer, so baud are correct, commands are correct.
This card have different atr from standard irdeto.
I've protocol T=0, TA1=11, so according to iso7816-3 max 5mhz clock, ant TC1=60 (byte delay), so:

For external clock cards:

initial etu = 372/fi s work etu = (1/D)*(F/fs) s

in my case (1/1)*(372/3579000) = 0.0001039396 duration in second of a bit

1second/0.0001039396 = 9620 bits per second

i've measured the clockrate of my dvb-t box and it's 3,376MHz,
so work etu (1/1)*(372/3376000) = 0.0001101895 seconds
1/0.0001101895 = 9075 bits per second

don't really know how loggin software consider their baudrate settings, maybe there is a 9th bit (initial bit?!?!!?, don't know), but 9075/9*8=8866
I logged with unilogger at 8860 8E2 direct, and what i logged i can reproduce with winexlorer at 9600 8E2 direct with 11220 microseconds of byte delay:

Trying to reset card...
Reset Successful

RX ATR : 3B 9F 11 40 60 49 52 44 45 54 4F 20 41 43 53 20 56 35 2E 30
TX Data : D2 04 03 00 01 3D
RX Data : 3D 60 90 19
TX Data : D2 FE 03 00 19
RX Data : FE 01 02 00 00 02 03 00 10 06 05 12 06 19 06 20
06 21 06 22 00 00 49 54 41 5A 90 00
TX Data : D2 00 03 00 01 3F
RX Data : 3F 60 90 1D
TX Data : D2 FE 03 00 1D
RX Data : FE 01 02 00 00 00 03 00 14 34 30 30 37 33 31 37
31 37 30 xx xx xx xx xx xx xx 00 00 00 0C 90 00
TX Data : D2 02 03 00 01 3E
RX Data : 3E 60 90 19
TX Data : D2 FE 03 00 19
RX Data : FE 01 02 00 00 01 03 00 10 FF FF FF 00 00 00 00
00 00 00 04 07 xx xx xx xx xx 90 00

007.4 · #7 (**permalink**) 10-14-2005

I'm sorry, but unless this a completely new version of Irdeto (which I doubt) then your data still looks partially corrupted.

The checksums are wrong. Compare these:-
TX Data : D2 00 03 00 01 3F
TX Data : D2 02 03 00 01 3E

They should by 0xEF and 0xED respectively.

In some cases the RX data is echoing the previous CS and in some cases echoing the INS. This is not normal.

Irdeto cmd headers are normally six bytes long (plus Checksum)

CLA INS p1 p2 p3 LL (CS)

It all seems a bit too strange.

Geremia · #8 (**permalink**) 10-14-2005

There is no checksum at the end of each command, this card, as described in ATR, uses T=0 protocol, so uses ACKs instead of checksum.
At soon as the interface send to the card CLA,INS,P1,P2,P3/LEN, the card send back an ack, the ack has the same HEX value as the INS, according to the iso7816 standard for T=0 protocol.

TX Data : D2 04 03 00 01 3D <-this is something that maybe stay instead of the common irdeto card requests, here only response is standard
there is also a 04 ACK from card just before 3D, winexplorer flushed it
RX Data : 3D 60 90 19 <-here 3D is echoed by the phoenix, there is not in log
TX Data : D2 FE 03 00 19
RX Data : FE 01 02 00 00 02 03 00 10 06 05 12 06 19 06 20
here FE is the ACK sent back by the card

In this card, if i want to request for prov ID 00 with winexplorer, i just make this, and the same occurs in season log:

This is a raw winexplorer log not flushed of echoed bytes

Trying to reset card...
Reset Successful

RX ATR : 3B 9F 11 40 60 49 52 44 45 54 4F 20 41 43 53 20 56 35 2E 30
TX Data : D2 06 03 00 01 3C
RX Data : D2 06 03 00 01 06 3C 60 90 21
TX Data : D2 FE 03 00 21
RX Data : D2 FE 03 00 21 FE 01 02 00 00 03 03 00 18 00 06
63 5A 00 00 00 00 00 00 01 3C 01 01 2D 2D 2D 82
62 00 00 00 00 00 EB 90 00

This is not a standard irdeto card for standard irdeto cams, it's an italian dvb-t ppv card that works only with italian dvb-t decoder with interactive MHP protocol

007.4 · #9 (**permalink**) 10-14-2005

Quote:

Originally Posted by Geremia

This is not a standard irdeto card for standard irdeto cams

I agree!
I've not seen anything like it before.
Good luck in your investigations.

mrtoolate · #10 (**permalink**) 10-16-2005

Code:

//Requst country code
---------------------
TX-> D2 04 03 00 01  
RX-> 04 
TX-> [3D] 
RX-> 60 90 19 
TX-> D2 FE 03 00 19 
RX-> FE 01 02 00 00 02 03 00 10 
     06 05 12 06 19 06 20 06 21 06 22 00 00 49 54 41 [5A] 90 00 


//Requst ascii serial
---------------------
TX-> D2 00 03 00 01  
RX-> 00 
TX-> [3F] 
RX-> 60 90 1D 
TX-> D2 FE 03 00 1D 
RX-> FE 01 02 00 00 00 03 00 14 
     34 30 30 ** ** ** ** ** ** ** ** ** ** ** ** ** ** 00 00 00 [0C] 90 00 



//Requst Hex serial
---------------------
TX-> D2 02 03 00 01 
RX-> 02 
TX-> [3E] 
RX-> 60 90 19 
TX-> D2 FE 03 00 19 
RX-> FE 01 02 00 00 01 03 00 10 
     FF FF FF 00 00 00 00 00 00 00 04 07 CD 13 F7 18 [E3] 90 00 


//Requst provider 0
----------------------
TX-> D2 06 03 00 01 
RX-> 06 
TX-> [3C] 
RX-> 60 90 21 
TX-> D2 FE 03 00 21 
RX-> FE 01 02 00 00 03 03 00 18 
     00 06 63 5A 00 00 00 00 00 00 01 37 01 01 2D 2D 2D 82 62 00 00 00 00 00 [E0] 90 00 


//Requst provider 1
----------------------
TX-> D2 06 03 01 01 
RX-> 06 
TX-> [3D] 
RX-> 60 90 21 
TX-> D2 FE 03 01 21 
RX-> FE 01 02 00 00 03 03 01 18 
     01 00 04 00 00 00 00 00 00 00 00 00 00 00 2D 2D 2D 82 62 00 00 00 00 00 [ED] 90 00 


//Requst provider 2
----------------------
TX-> D2 06 03 02 01 
RX-> 06 
TX-> [3E] 
RX-> 60 90 21 
TX-> D2 FE 03 02 21 
RX-> FE 01 02 00 00 03 03 02 18 
     02 FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 82 62 00 00 00 00 00 [3B] 90 00 


//Requst provider 3
----------------------
TX-> D2 06 03 03 01 
RX-> 06 
TX-> [3F] 
RX-> 60 90 21 
TX-> D2 FE 03 03 21 
RX-> FE 01 02 00 00 03 03 03 18 
     03 FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 82 62 00 00 00 00 00 [3B] 90 00 


//
----------------------
TX-> D2 38 03 00 01  
RX-> 38 
TX-> [23] 
RX-> 60 90 10 
TX-> D2 FE 03 00 10 
RX-> FE 01 02 00 00 1C 03 00 07 00 00 00 00 00 00 00 [24] 90 00 


//Requst provider 0 again
--------------------------
TX-> D2 06 03 00 01 
RX-> 06 
TX-> [3C] 
RX-> 60 90 21 
TX-> D2 FE 03 00 21 
RX-> FE 01 02 00 00 03 03 00 18 
     00 06 63 5A 00 00 00 00 00 00 01 37 01 01 2D 2D 2D 82 62 00 00 00 00 00 [E0] 90 00 



//
-------------------------
TX-> D2 38 03 01 01  
RX-> 38 
TX-> [22] 
RX-> 60 90 10 
TX-> D2 FE 03 01 10 
RX-> FE 01 02 00 00 1C 03 01 07  00 00 00 00 00 00 00 [25] 90 00



// chids 
----------------------
TX-> D2 08 00 00 02   
RX-> 08 
TX-> 00 [39]
RX-> 60 90 45 
TX-> D2 FE 00 00 45 
RX-> FE 01 02 00 00 04 00 00 3C 
     00 02 01 37 D2 00 00 31 00 92 D2 00 00 16 00 C1 1E 00 FF FF FF FF FF FF FF 
     FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 
     FF FF FF FF FF FF FF FF FF FF [5A] 90 00 


//
-------------------------
TX-> D2 38 03 02 01  
RX-> 38 
TX-> [21] 
RX-> 60 90 10 
TX-> D2 FE 03 02 10 
RX-> FE 01 02 00 00 1C 03 02 07 00 00 00 00 00 00 00 [26] 90 00 


//
-------------------------
TX-> D2 46 00 00 01 
RX-> 46
TX-> [1F]
RX-> 60 90 09 
TX-> D2 FE 00 00 09 
RX-> FE 01 02 00 50 23 00 00 00 [4F] 90 00 


//
-------------------------
TX-> D2 46 00 00 01  
RX-> 46
TX-> [1F]
RX-> 60 90 09 
TX-> D2 FE 00 00 09 
RX-> FE 01 02 00 50 23 00 00 00 [4F] 90 00 


//
-------------------------
TX-> D2 46 00 00 01 
RX-> 46
TX-> [1F]
RX-> 60 90 09 
TX-> D2 FE 00 00 09 
RX-> FE 01 02 00 50 23 00 00 00 [4F] 90 00 


//
-------------------------
TX-> D2 38 03 03 01 
RX-> 38
TX-> [20]
RX-> 60 90 10 
TX-> D2 FE 03 03 10 
RX-> FE 01 02 00 00 1C 03 03 07 00 00 00 00 00 00 00 [27] 90 00 

//
-------------------------
TX-> D2 46 00 00 01 
RX-> 46
TX-> [1F]
RX-> 60 90 09 
TX-> D2 FE 00 00 09 
RX-> FE 01 02 00 50 23 00 00 00 [4F] 90 00 

//
-------------------------
TX-> D2 46 00 00 01 
RX-> 46
TX-> [1F]
RX-> 60 90 09 
TX-> D2 FE 00 00 09 
RX-> FE 01 02 00 50 23 00 00 00 [4F] 90 00 


//
-------------------------
TX-> D2 46 00 00 01 
RX-> 46
TX-> [1F]
RX-> 60 90 09 
TX-> D2 FE 00 00 09 
RX-> FE 01 02 00 50 23 00 00 00 [4F] 90 00 



//
-------------------------
TX-> D2 10 03 00 01 
RX-> 10
TX-> [37]
RX-> 60 90 49 
TX-> D2 FE 03 00 49 
RX-> FE 01 02 00 00 08 03 00 40 
     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [77] 90 00 



//
-------------------------
TX-> D2 46 00 01 01  
RX-> 46
TX-> [1E]
RX-> 60 90 09 
TX-> D2 FE 00 01 09 
RX-> FE 01 02 00 50 23 00 01 00 [4E] 90 00 

//
-------------------------
TX-> D2 46 00 01 01 
RX-> 46
TX-> [1E]
RX-> 60 90 09 
TX-> D2 FE 00 01 09 
RX-> FE 01 02 00 50 23 00 01 00 [4E] 90 00 

//
-------------------------
TX-> D2 46 00 01 01 
RX-> 46
TX-> [1E]
RX-> 60 90 09 
TX-> D2 FE 00 01 09 
RX-> FE 01 02 00 50 23 00 01 00 [4E] 90 00 


//Register 15
----------------------
TX-> D2 2A 00 00 01 
RX-> 2A
TX-> [29]
RX-> 60 90 89 
TX-> D2 FE 00 00 89 
RX-> FE 01 02 00 00 15 00 00 80 
     75 14 C6 27 F1 FF 40 B6 93 8B FE EB A6 1C 0C 94 AF 89 5D 2A B1 86 70 
     EE 53 8C A4 46 AA 7C 83 D6 13 E6 7F 4B FC 99 23 4E CE 6D 87 D3 D8 74 
     CF CC 08 4A 6B 7B EA F8 39 9A 34 10 62 E3 37 4B 54 47 E7 7F F3 B3 F6 
     76 0C 42 E7 63 3C 61 41 0E 9B 2C 0A 82 47 BA 35 1D 3D 1A EA E1 89 40 
     2F 9E AB 48 60 BA 1C 87 A2 6F C6 0B FE 91 BE 29 6C A8 8E 09 EF BE 11 
     5A E4 81 02 6E FE C5 72 8E 54 16 1F 61 [CF] 90 00 




//
-------------------------
TX-> D2 46 00 02 01 
RX-> 46
TX-> [1D]
RX-> 60 90 09 
TX-> D2 FE 00 02 09 
RX-> FE 01 02 00 50 23 00 02 00 [4D] 90 00 

//
-------------------------
TX-> D2 46 00 02 01 
RX-> 46
TX-> [1D]
RX-> 60 90 09 
TX-> D2 FE 00 02 09 
RX-> FE 01 02 00 50 23 00 02 00 [4D] 90 00 


//
-------------------------
TX-> D2 46 00 02 01 
RX-> 46
TX-> [1D]
RX-> 60 90 09 
TX-> D2 FE 00 02 09 
RX-> FE 01 02 00 50 23 00 02 00 [4D] 90 00 



//Request Card File 1
---------------------
TX-> D2 1C 02 00 01 
RX-> 1C
TX-> [30]
RX-> 60 90 49 
TX-> D2 FE 02 00 49 
RX-> FE 01 02 00 00 0E 02 00 40 
     C2 3E 9D 9D D1 82 87 F6 A7 5D 6F 84 82 46 E3 CE 61 3C B8 18 BA 62 20 
     C7 4D F3 CE 5E BB DE 6A B8 9C 0A 7B 7F 79 50 F1 E0 2E 9B 8E 65 3F 03 
     9C F2 FF 83 D5 00 96 B2 06 85 98 3E 69 CF 13 69 1A 61 [A4] 90 00 




//
-------------------------
TX-> D2 46 00 03 01 
RX-> 46
TX-> [1C]
RX-> 60 90 09 
TX-> D2 FE 00 03 09 
RX-> FE 01 02 00 50 23 00 03 00 [4C] 90 00 

//
-------------------------
TX-> D2 46 00 03 01 
RX-> 46
TX-> [1C]
RX-> 60 90 09 
TX-> D2 FE 00 03 09 
RX-> FE 01 02 00 50 23 00 03 00 [4C] 90 00 

//
-------------------------
TX-> D2 46 00 03 01 
RX-> 46
TX-> [1C]
RX-> 60 90 09 
TX-> D2 FE 00 03 09 
RX-> FE 01 02 00 50 23 00 03 00 [4C] 90 00 


//Request Card File 2
-------------------
TX-> D2 1C 03 00 01  
RX-> 1C
TX-> [31]
RX-> 60 90 49 
TX-> D2 FE 03 00 49 
RX-> FE 01 02 00 00 0E 03 00 40 
     19 39 A1 DC FA 91 3F 12 44 45 E2 F1 39 90 21 D0 5E 99 2A BD 71 3B 4D 
     47 B6 2E F0 4A A8 47 74 95 78 D7 CE CF 52 43 D1 FC 85 06 4E CC 1F E4 
     82 7B B5 37 0D 81 BC 7B 92 F8 53 08 92 73 09 8B 89 F7 [68] 90 00 



//SET CAM KEY
-------------------------
TX-> D2 12 03 01 41 
RX-> 12 
TX-> 3C 6C 64 84 5F B1 A7 5F AC 7A 48 9B FE 8F 7C 13 
     88 A2 3E 22 C2 DE 52 AD 44 54 CE B8 98 71 EB CE 
     6B 31 50 38 26 93 E1 D7 DD 96 0E 55 30 EC E9 CF 
     0C 6D 6F 97 DE C6 1E 8A 7B C0 81 87 4E 47 39 E9 [9F]

RX-> 60 90 09 
TX-> D2 FE 03 01 09 
RX-> FE 01 02 55 00 09 03 01 00 [62] 90 00 



//
-------------------------
TX-> D2 40 00 00 11 
RX-> 40 
TX-> 02 1A 00 01 01 00 00 00 00 01 00 00 00 00 00 00 [15]
RX-> 60 90 09 
TX-> D2 FE 00 00 09 
RX-> FE 01 02 00 00 20 00 00 00 [1C] 90 00 


//
-------------------------
TX-> D2 3C 00 00 01  
RX-> 3C
TX-> [22]
RX-> 60 90 15 
TX-> D2 FE 00 00 15 
RX-> FE 01 02 00 00 1E 00 00 0C 50 53 01 0E 00 03 00 00 00 00 00 00 [21] 90 00 


//
-------------------------
TX-> D2 3E 00 00 01  
RX-> 3E
TX-> [23]
RX-> 60 90 0B 
TX-> D2 FE 00 00 0B 
RX-> FE 01 02 00 00 1F 00 00 02 00 82 [A3] 90 00 


//
-------------------------
TX-> D2 10 03 00 01  
RX-> 10
TX-> [37]
RX-> 60 90 49 
TX-> D2 FE 03 00 49 
RX-> FE 01 02 00 00 08 03 00 40 
     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [77] 90 00 





//command D5  ECM 
-------------------------
TX-> D5 00 00 00 37 
RX-> 00 
TX-> 00 02 00 08 8F 30 38 BB 20 21 68 9D 2F 07 18 C6 D7 5A 66 4C 4D 0A 
                       64 52 F2 E2 F7 65 F9 4A 80 37 B8 16 47 B9 EC 56 
                       BB 70 8B B0 80 AD 50 8C 88 D3 D2 15 08 09 B6 E8 [41]
RX-> 60 90 17 
TX-> D5 FE 00 00 17 
RX-> FE 01 05 9D 00 38 00 00 0E 00 02 00 13 FF FF D0 FE BC 3D A6 A8 BB 4D [D6] 90 00 




//command D1  EMM 
-------------------------
TX-> D1 00 00 00 3F 
RX-> 00 
TX-> 02 06 63 00 20 38 DB 83 D3 07 A6 94 14 A2 ED B0 8B 04 82 C0 DA 05 
                       C7 FA 4E 92 3D 7C 8A 05 B3 C1 79 85 F2 0D 65 A6 
                       A4 CC D1 8D F8 53 7B C1 EE 54 5E 09 D0 EA 0B 5A 
                       5B CD DE 3C 5D 59 F0 25 [A2]
RX-> 60 90 0C 
TX-> D1 FE 00 00 0C 
RX-> FE 01 01 00 00 3F 00 00 03 00 00 00 [03] 90 00