local operator secet in details

[sathacker]

local operator secet in details

First of all: The card is always asked by the ICAM to receive or send information. The card never asks the ICAM to do anything! To do this the ICAM always sends a 5 byte long command packet header to the card. Example: 48 INS P1 P2 P3 The first byte is always 48 (command class) followed by the instruction number. The last 3 bytes are the parameters. P1 and P2 are used differently and are often ignored. P3 is the length of the packet to be send or expected to receive. The cards first reply is the instruction number which is a vital value for the ICAM. These instruction numbers are possibly contained in a jumptable in the ICAMs source leading to a specific offset where processing continues.

 

[sathacker]

more pg2

The Answer To Reset (ATR): 3F 7F 13 25 03 40 B0 0B 69 4C 4A 50 C0 00 00 53 59 00 00 00 3F TS - "3F" indicates inverse convention ("3B" would be direct convention) 7F T0 - "7" (0111...) indicates TA1,TB1,TC1 will be sent "F" (...1111) indicated that 15 historical bytes will be send. 13 TA1 25 TB1 03 TC1 40 B0 0B 69 4C 4A 50 C0 00 00 53 59 00 00 00 the 15 historical bytes 1. On start up we get 48 52 00 00 14. This asks the card for 14h bytes. >48 52 00 00 14 <52 card replies command for ICAM <SN SN SN SN card SN (unique address) <00 A status byte? <01 19 11 00 0C 09 00 01 02 03 04 10 01 00 00 always the same? <90 00 sw1/sw2 2. The next cmd is 48 58 00 00 35. This asks the card for 35h bytes. >48 58 00 00 35 <58 card replies command for ICAM <00 fuse byte (see below) <01 09 60 always the same <00 SN SN SN card SN (unique address) <ff ff ff ff unknown <00 SN SN three bytes of card number (shared address) <00 ff ff ff 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 unknown <00 xx xx xx was written with the 4e nano on activation <47 42 52 "GBR" on British cards only <00 01 00 00 unknown <03 RC specific region code for local programming. See later under INS1C <00 00 00 00 unknown <90 00 sw1/sw2

 

[sathacker]

the key

The keys key 10 is the primary public key key 11 is the seconday public key key 12 is the primary group key key 13 is the secondary group key key 14 is the primary private key key 15 is the secondary private key public key: same on every card, so signature is valid for every card group key: same on a group of 256 cards, signature is valid for any card in this group private key: unique to every card, signature is valid for ony one card, this is mainly used for activation Note that nanos 31, 32 and 33 are used in these activation messages too. These are believed to stop processing if the serial number (or shared address) does not match. This gives additonal protection because you don't know your own private key to calculate the valid signature. (Just in case the signature algorithm and the public key is known.)

 

[sathacker]

בדיקה כל 3 דקות כדי לודא שהכרטיס

The Status Words בממיר ושהכרטיס אמיתי ונכון At the end of every instruction the card generates two bytes known as the status words sw1/sw2. These indicate whether or not the instruction has been accepted or not and other things about the card's status. The first byte is either 90h or 91h - depending if a certain flag byte is non-zero. The second byte can have the following values:- 00h, 01h, 20h, 21h, 80h, 81h, A0h or A1h again, depending upon whether certain flag bits are set or not. If the "filters open flag" is set at the end of the instruction, then we get 8xh or Axh, otherwise it will be 0xh or 2xh. If the "IRD match flag" is set (correct card in IRD) then we will get either 2xh or Axh, otherwise 0xh or 8xh. x is either 1 or 0 depending upon whether another flag bit is set or not. ============================================================================================= The Zero Knowledge Test card verification. [This section abridged from ZKT.doc found at http://www.docdebug.com/zeroknow.htm ] These three cmds are frequently sent (about every minute) to verify that the card in the decoder is a true NDS card. 9. 48_4A 10 01 01 (01) The IRD sends one byte (always 01?) to the card. This selects which one of two seeds that is to be used for a random number "R" to be generated by the card. So far it looks like only one seed is ever used in the PRNG. [90 00 not OK, 90 20 OK]. 10.48_5A. Next the IRD asks the card to send a 64-bit hash of R^2 mod N (where N is a 512 bit number which is the product of two large prime numbers, P and Q (N = P*Q). N is constant and can be found both in the ROM of the card and in the IRD firmware. 48 5a 10 01 10 [5a] f2 64 20 49 81 d4 14 86 e2 9a fe ca 00 00 00 00 90 00 However, with the Sk* card we get 0Ch bytes rather than 08 bytes? 11. Finally the IRD asks the card for either R or R*S mod N (Where S is based on a complex function of N). It seems to alternate between these on each request. a) IRD asks for R 48 5A 10 02 40 Card->IRD: Sends the value of R (512 bits/64 bytes) 48 5A 10 02 40 [5a] bd fa d2 2d ef 2b 63 fa c7 b2 68 82 9c 5d 13 31 33 f5 99 a1 63 cb aa cf 41 c9 b0 78 d4 c4 42 f1 1f d8 93 b9 bb 3b 6f 6f 62 2f c7 2f 06 d3 c4 1d 48 84 d7 b2 c1 64 6e 7c 05 56 f1 29 61 bc c7 00 90 01 b) IRD asks for R*S mod N 48 5A 11 02 40 Card->IRD: Sends the value of R*S mod N (512 bits/64 bytes) 48 5A 11 02 40 [5a] 71 94 69 64 7f 84 b2 ea 1d e2 16 e9 ae 79 f2 49 cc 64 42 fe 36 52 44 90 fa c5 e9 c9 72 66 71 25 6e 6a 82 d9 b5 7b 1c ee 21 1c 55 0b bf de 51 b4 a0 f0 98 bd 19 e8 ad 9c d0 61 e2 b1 da 39 02 00 90 20 The last byte of the returned value always seems to be 00. The return codes sw1/sw2 90 00 and 90 01 indicate that the card is not valid. For a valid card the return codes are 90 20 and 90 21.

 

[sathacker]

עבור סקאי סטאר nds cam emulator

http://nds.host.sk/?action=dwn&subor=861NDS_camemu.zip עובד עם כרטיסי מחשב שונים אפשר לשכפל את הכרטיסים אבל צריך קודם כל לאפס אותם לפני כן בתוכנה אפשר גם לערוך את הכרטיס בתוכנת nds editor winexplorer מאפשר לך לעשות את מה שנשאר חובה לקרוא היטב את המדריכים לפני שעושים משהו צריך לדעת את id המקומי +שאר הדברים כמו קוד אזורי ועוד.... אחרת זה לא יעבוד לכן יותר טוב להתעסק עם סקאי כי למקומי עדיף לשלם אם בכלל אתם צופים בו בקיצור ולעניין לבעלי ידע טכנאי רב אפשר לעשות את זה לכל המתחילים והשאר לא כדאי להתעסק הנזק גדול מהתועלת. הכל לצרכי למידה בלבד, כמובן שלא כתבתי שום תוכנה ואף לו קוד ואין לי שום קשר לדברים הנ"ל. סתם מתוך סקרנות............