Add Cardreader to CW4000HD; Use your subbed ROM card !!! - FTA Files Community Forums for Satellite Equipment

**Zero Gravity** · #1 (**permalink**) 04-09-2009, 12:20 AM

As many of you know, I have already described how to convert the CW3k/4K so that it can be used as a network client to share your legitimately subscribed ROM card using a different STB (such as the Dreambox) as the cardserver: http://www.ftaprofessionals.tv/capti...t-success.html

The next project was for me to figure out how to add a card reader to the CW3K/4K so that it can be used as a replacement STB that you can temporarily insert your legitimately subscribed ROM card, just in case something happens to your provider box, or if you just want to take advantage of the multimedia applications of the CW3K/4K as a replacement for the provider box. Since the two projects are along the same lines, there will be some copy and pasting of information from that previous post.

First My Disclaimer:

"This information is for educational purposes only!!! I do not endorse the use of this information being used for signal theft or any other illegal activity. The purpose of this information is intended to be for those who have broken or older and much slower basic provider equipment, and they want to upgrade to using the superior equipment and features of the CW4000HD for their legitimately subscribed N2 or N3 ROM card---as a temporary replacement of the provider box. I take no responsibility for people who abuse this information by taking their legal or illegally programmed ROM cards and using it to illegally "share" it over the internet or for any other illegal activity. Also, I will take no responsibility for anyone who breaks or ruin their equipment trying to perform this feat. I can only assure you that this how-to worked for me, and it is reasonably safe!"

With that out of the way---on we go!

1) First step is to give thanks to all who have provided the tools that we have available for cardsharing already---the butter team for newcs, the wonderful coders of vdr-sc/Open-SASC-ng/EMUNATION etc… and other open-source DVB-card emus that created the necessary libraries/plugins that allow us to take advantage of the cardsharing on the CW3000/4000, and all coders etc, involved with softwares/blockers/ 3Ms for programming the ROM card. Also, I’d like to thank Chavonbravo, AHha, and Pop_eye for their helpful suggestions in getting this worked out, and all others like Roacher1, eyeamok, and ps2002 who seem to be dedicated to making the CW3K/4K a top player in this game. Finally, I'd like to give a special thanks to Raton Craquero and others who have contributed to the RQCS cardserver program---which is the first to handle the new N3 (ROM24x) cards here in North America.

2) I will not discuss card programming here which can be deemed illegal…you will have to go elsewhere for that. Also, I will mention that not all blockers will work with newcs and RQcs for cardsharing. In fact, only a few blockers (autoroll and non-autoroll) will work. I don’t mess with card programming or anything illegal like that, but a little birdie told me that WGFB blocker works well and autorolls. You will need to ensure that your card works in the card-server first before attempting anything past this point, and if you already have a cardshare network going, then you are more than halfway there with that knowledge. As I mentioned, this is intended for legally subbed N2 cards (Newcs and RQcs) and N3(RQcs) cards. Please note: I have not personally tested all flavors of N2 and N3 cards! It is possible that some may not work!!! However, if you can get it working on other boxes (ie dreamboxes and triple dragons), you have an excellent chance that it will work here!

3) Familiarize yourself with FTP/Telnet programs for the CW3000/4000HD. The CW3000/4000 uses WinSCP as the FTP program, and uses PuTtY as the Telnet program. You can download all these programs freely---just Google them. Also, if you put the PuTtY .exe file in the same folder as WinSCP, it can be activated as a sub-routine in WinSCP.

4) For trouble-shooting purposes, it is a good idea to turn on logging on your CW3000/4000. As a default, these options are turned off because the logs can quickly become large and bog down the compact flash on the CW3000/4000. To enable logging on the CW3000/4000:

a.Open WinSCP and log into your CW3/4K.
b.Go into PuTtY and type rwroot in the command line to enable read-write capabilities in the root directory. ***Make sure you remember to disable this when you are complete with this exercise by typing roroot in the command line.
c.Starting from the root directory, go to /usr/local/bin folder and about 1/3 the way down, you will see a file called fix_sc. Open this file and “comment out” (add a # symbol in front of) the lines “clear_sc_entries” and “disable_logging” located at the end of the file. It should look like this when you are done:

Code:

 
  check_hd
  #clear_sc_entries
  check_adapters
  modify_sc_caps
  #disable_logging

5) Next, enable logging by going into the “user” profile and “satellite TV” as if you are watching TV. Press the “menu” button on your remote and follow the menu options “system”---“system setup”---“VDR installation”---“7 plugins setup”-“--1 SC (0.9.0 Unknown)”---“message logging”. Change “log file” to yes; “show user messages” yes; and reset all modules to default (it will ask you if you are sure, press OK on your keyboard.) This will send you back to the “SC (0.9.0 Unknown)” menu. In this menu, select “cryptosystem options” and make sure that “cardclient: connect immediately” is set to “yes”. Now you are ready to make changes.

a. Back in WinSCP, browse to the /captive/vdr/plugins/sc folder and disable your EMU (if it is currently working) by renaming the Softcam.Key file to something else like “modSoftcam.Key”. Make sure that you do not delete it!!! Ensure that it is not working by trying to watch TV. Unlike other discussion’s instructions, DO NOT TOUCH OR DISABLE THE ecm.cache file!!!! After many many days of failures, I discovered that this file is critical for decryption during cardsharing as well as software decryption by vdr-sc!!!

b. Browse back to/captive/vdr/plugins/sc folder and rename the cardclient.conf.example file to “cardclient.conf”. Edit this file for setting up the CW3k/4k as a newcamd client by adding the following line (This is a working example):

Code:

 
newcamd:192.168.1.210:12000:0/1800/FF00:localhost:localhost:0102030405060708091011121314

* You don’t have to use localhost as the user/passwd; you can use what you want.

**THE IP ADDRESS MUST BE THE IP ADDRESS THAT YOU SET UP AND USE FOR THE CW3K/4K IN THE "NETWORK SETTINGS" SECTION OF THE ADMIN PROFILE. It may be possible to use the default ip address 127.0.0.1 that is assigned to the local device. I have not tested using the default IP, but I have a feeling that it will work fine!

***It seems that ONLY FF00 (FF, zero zero) works as a CAID MASK value. I have tried other values, but the CW3k/4k connects to the network, but does not send/receive EMMs/ECMs. I cannot explain why only FF00 works---perhaps someone else can explain that one!

****I have not tried using radegast as the connection protocol. I tried using Radegast for setting up the CW3K/4K as a cardshare client using 192.168.1.208:10001:1/1800/FF00 as the Radegast protocol line. It seemed like it would start the decoding process, but would only end up crashing newcs running on the dreambox. This may just be a bug, but only FF00 as a CAID MASK caused this issue---but other values such as FFF0 did nothing although it did connect to newcs. I have not tried this with RQcs since it only supports newcamd protocol as of now.

Be sure to save your changes!

A) Setting up the hardware:

I had a very difficult time trying to get this to work with USB cardreaders. It appears that the version of Gentoo has been stripped of the critical elements necessary to get proper communication with USB based cardreaders. I will continue to try in the future, but perhaps a Linux guru can point me to the right path! You will have to use a serial card reader in phoenix mode. The information here pertains to the CW4000HD---I am not sure about the CW3000 boxes, but I think the same info applies. The CW4000HD does not have a serial port, but it does have a header built in the mother board for adding a 9 pin COM port:

This image has been resized. Click this bar to view the full image. The original image is sized 960x720 and weights 73KB.

A closer look:

This image has been resized. Click this bar to view the full image. The original image is sized 960x720 and weights 40KB.

You will need to purchase a serial add-a-port adaptor such as the one shown here:

hxxp://www.provantage.com/cables-go-09480~7CBTR00L.htm

*Note: I don't remember the name brand of the one I have...I had gotten it some time back. Also, I don't know for sure if it is cross-over or straight through--although I think it is cross over. Perhaps an expert of COM ports can chime in? Also, since the CW4000HD is a small-form factor motherboard, you will have to remove the bracket from the add-a-port adaptor and use the cheap one that is over the last empty PCI slot of the CW4K. You will need to punch out the divot. You can install the serial port adaptor neatly in this spot behind the last PCI slot of the CW4K. The serial port drivers are already included in the kernal drives of the CW4K OS and there is no need to add them!

Once you have the 9 pin serial port adaptor installed, you can now attach your phoenix style iso7816 compliant card reader. It is critical that your card reader is up to par for the N2 and N3 cards here in north america. First: LOADERS WILL NOT WORK!!! even ones that can double as a reader will not work properly. You will need a phoenix-style card reader that has a true 3.68 crystal speed to read the North American provider's cards. The cardservers (Newcs and RQcs) have many timing issues with external card readers, so it is imperative that it is up to snuff!!! I had many many failures trying to use a card reader that I had built a few years back for Dave/Rom3 cards that did well with programming and even ST19XL emulation experiments; However, I could not get it going in this instance and had to purchase new one. I had ordered a infinity-phoenix USB reader---but it never arrived here after almost a month! I ended up buying a no-name one from she-bay that works fine! If you cannot get this to work and you followed every step in this How-to, then I would suspect the card reader!

B) Setting up your CW3000HD and CW4000HD as a cardserver using NewCS1.62 and up (N2 cards for now!)

1) First, you must download, unzip and add the proper Newcs 1.62 components to the CW3K/4K. After package is unzipped, you must manually copy the correct newcs 1.62 binary [newcs.i686] to the usr/local/bin directory of the CW3K/4K; and then copy the newcs.xml.phoenix file from the "configs" folder of the newcs 1.62 package and put it in the etc folder of the CW3K/4K. You must first be sure that you did the rwroot command in PutTy as described above or you will not be able to add files to root-level folders! After the files are copied to the target directories, rename the "newcs.i686" binary to newcs and change permissions to 755 by right-clicking and going to "properties".

Rename the "newcs.xml.phoenix" to newcs.xml , then edit the newcs.xml to allow the VDR-SC to connect to it locally via newcamd protocol listed in your cardclient file (see above newcamd line). The example that I will provide below is a working example for my Dish ROM 102 card---I have not tested it with any other ROM card (ROM 103,SOx), but they should work as well. FEEL FREE TO COPY THE XML TEXT AND PASTE IT INTO YOUR XML FILE. YOU WILL NEED YOUR OWN BOX KEYS!!!! Also, you may choose block sa, ua, and ga EMMs.

newcs.xml

Code:

 
<?xml version="1.0"?>
<!--
 
For setup-issues, look in readme.txt!
If there are other troubles, try different forums or irc channels around :o)
 
The configfile are NOT case-sensitive, and shouldnt care about dos/unix cr/lf.
 
** This is the example file for Phoenix Interface on Windows.
 
-->
 
<newCSconfig>
        <globals>
<!-- valid value for listening-ip are:
IPv4 adress of local interface.  -->
<listening-ip>192.168.1.210</listening-ip>
</globals>
<readers name="Phoenix">
<device>
<name>lower</name>
<type>phoenix</type>
<mhz>357</mhz>
<node>/dev/ttyS0</node>
<parity>odd</parity>
<reset>normal</reset>
<export>Yes</export>
<enabled>Yes</enabled>
<blocksa>No</blocksa>
<blockua>No</blockua>
<blockga>No</blockga>
<boxkey>XXXXXXXXXXXXXXXX</boxkey>
<!-- <rsa>00000000000</rsa> -->
<irdeto-camkey>0000000000000000</irdeto-camkey>
<irdeto-camkey-data>0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000</irdeto-camkey-data>
<crypto-special>No</crypto-special>
<ipk>0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000</ipk>
<ucpk>0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000</ucpk>
<PTShandshake>No</PTShandshake>
<carddetect>no</carddetect>
<newcamd_port>12000</newcamd_port>
<autosid>Yes</autosid>
<Seca-PPV>no</Seca-PPV>
<pincode>0000</pincode>
<priority>round</priority>
</device>
</readers>
<radegastserver>
<enabled>No</enabled>
<port>16000</port>
<allow>
<hostname>localhost</hostname>
</allow>
</radegastserver>
<cache>
<emm>20</emm>
<ecm>-1</ecm>
</cache> 
<debug>
<password>NewCSpwd</password> 
<level>spam</level>
<type>init</type>
<output>all</output>
                     <logfile>/var/log/newcs.txt</logfile>
<console_options>normal,init</console_options>
<tcp_port>1001</tcp_port>
<tcp_options>normal,init</tcp_options>
</debug>
<newcamdserver>
<enabled>Yes</enabled>
<name>localhost</name>
<deskey>01 02 03 04 05 06 07 08 09 10 11 12 13 14</deskey>
                <user>
<name>localhost</name>
<password>localhost</password>
<allow>lower</allow>
                        <au>on</au>
                </user> 
 
        <rate>2</rate>
</user>
</newcamdserver>
</newCSconfig>

Some critical key points:

* Make sure that there are no "comment" brackets around the Box Key input line. the comment brackets are shown as  around the text. I went through DAYS of frustration trying to figure out why I kept getting "DT$08 not defined" errors even after I got in my new card reader. For some strange reason, the box key line is written as  and the RSA line is written as . These are read as comment lines by the Newcs program and are ignored! No matter what I did (even testing different cards that worked in different boxes!), I kept getting the error with newcs hanging up with the "DT$08 not defined" issue. I was starting to get pissed thinking that it wasn't my cardreader after all! After I realized the comment line issue, I removed them form the box key line in the newcs file, and bam---success! I did not have to worry about the RSA key for my ROM card. I will not go into detail here about getting the box keys. If you do not have them, you will have to get them from your IRD using a jtag, or extract the box keys for your particular card from the card image. The card image approach will not work on N3 cards until they are dumped---so you will have to jtag in that case!

**For some strange reason, I had to turn the "card detect" option off by selecting the 'no' option (see above). With phoenix-style card readers, newcs tends to give a "card removed" error and kills the server after you get the "[NewCS] Ready To GO! message. This was another problem that did not have an easy to figure out solution. After much trouble shooting and turning off "card detect", everything works great!

***Until you get the kinks worked out, it is a good ideal to make sure you enable "log file" option. I have a file as /var/log/newcs.txt. When things are working, it will be a good ideal to disable the logfile option to avoid potential space and memory problems.

Now you are ready to roll:

Make sure you have disabled VDR-sc softcam emulation by method described above, and that you are logged out of any of the USER profiles on you CW box. Open a PuTty session and enter your CW root password (captive or CW3000HD---default are pws). From the command prompt, type the follwing command:
/usr/local/bin/newcs &

If successful, you should see something like this:

NewCS1.62 Log

Code:

 
cw-lmc ~ # This is NewCS 1.62 - the New CardServer by the Butter-team..
Compiled on Aug 27 2008 at 16:40:27
Reading Config file from /etc/newcs.xml
NewCS is trying to bind to IP: 192.168.1.210
TCP-log password is enabled, set to: NewCSpwd
TCP-log set to simple mode
level: spam
type: init
output: all
logger config: level 3 type 3 output 255
Console log options: level 1 type 3
log file: /var/log/newcs.txt
File log options: level 3 type 3
logger: no udp host defined, udp log disabled
TCP log options: level 1 type 3
[ 02:54:51 ] [ Box detect ] Box type 1 (General Boxtype - PC compatible)
[ 02:54:51 ] [ Config ] Option <blockc0> for device 0 (lower) not present, defaulting to NO
[ 02:54:51 ] [ Config ] Value in <ipk> for device 0 (lower) is INVALID, skipping...
[ 02:54:51 ] [ Config ] Value in <ucpk> for device 0 (lower) is INVALID, skipping...
[ 02:54:51 ] [ Config ] Pincode for device 0 (lower): 0000
[ 02:54:51 ] [ Config ] /dev/ttyS0 ECM priority: round
[ 02:54:51 ] [ Config ] Option <spider> not present for User: localhost, defaulting to NO
[ 02:54:51 ] [ EMM Cache ] Initialising dynamic Cache
[ 02:54:51 ] [ ECM Cache ] Initialising dynamic Cache
[ NewCS ] Process ID is: 8437
[ 02:54:51 ] [ Loader ] Starting Telnet on port 1001
[ 02:54:51 ] [ Loader ] Reader type 2 on node /dev/ttyS0
[ 02:54:51 ] [ Phoenix ] Opening device /dev/ttyS0
[ 02:54:51 ] [ Phoenix ] Setting Parity to: ODD
[ 02:54:51 ] [ Phoenix ] Setting 2 Stop bits on node /dev/ttyS0
[ 02:54:51 ] [ Phoenix ] Setting Baud to standard 9600
[ 02:54:51 ] [ Phoenix ] Normal RESET on node /dev/ttyS0
[ 02:54:53 ] [ ATR ] T=1  1etu=8.96us  Guardtime:11etu  CWT:139etu  BWT:15371etu  WWT:153600etu
[ 02:54:53 ] [ ATR ] Historical bytes: D N A S P 1 0 2   R e v 1 0 C
[ 02:54:53 ] [ Loader ] Init Nagra card
[ 02:54:53 ] [ Phoenix ] Setting Parity to: ODD
[ 02:54:53 ] [ Phoenix ] Setting 2 Stop bits on node /dev/ttyS0
[ 02:54:53 ] [ Phoenix ] Setting Baud to standard 115200
[ 02:54:53 ] [ Keyman ] Adding key 0000000XXXXXX type 0 on Provider 000000 for caid 1800 ID=0
[ 02:54:53 ] [ Keyman ] Adding key 0000000XXXXXX type 1 on Provider 000001 for caid 1801 ID=0
[ 02:54:53 ] [ Keyman ] Adding key 0000000XXXXXX type 1 on Provider 000101 for caid 1801 ID=0
[ 02:54:53 ] [ Keyman ] Adding key 0000000XXXXXX type 1 on Provider 000101 for caid 1801 ID=0
[ 02:54:54 ] [ Loader ] Card 1801 on port /dev/ttyS0 ready
[ 02:54:54 ] [ Loader ] Starting Newcamd Server on port 12000
[ 02:54:54 ] [ Newcamd ] Newcamd thread Server started on port 12000
[ 02:54:54 ] [ NewCS ] Ready to GO! :)

If all goes well, log onto a USER profile and watch TV! If your ROM card has current keys, everything should work and you will see something like this in PuTty:

Code:

 
[ 02:54:55 ] [ Newcamd:12000 ] User localhost logged in, client: VDR-SC
[ 02:54:55 ] [ Newcamd ] ECM -> localhost (OK) 1801 0000 00B0
[ 02:55:07 ] [ Newcamd ] ECM -> localhost (OK) 1801 0000 00B0
[ 02:55:23 ] [ Newcamd ] ECM -> localhost (OK) 1801 0000 00B0
[ 02:55:39 ] [ Newcamd ] ECM -> localhost (OK) 1801 0000 00B0
[ 02:55:55 ] [ Newcamd ] ECM -> localhost (OK) 1801 0000 00B0
[ 02:56:11 ] [ Newcamd ] ECM -> localhost (OK) 1801 0000 00B0
[ 02:56:27 ] [ Newcamd ] ECM -> localhost (OK) 1801 0000 00B0
[ 02:56:43 ] [ Newcamd ] ECM -> localhost (OK) 1801 0000 00B0
[ 02:56:59 ] [ Nagra ] using rsa key from config.
[ 02:56:59 ] [ Newcamd ] ECM -> localhost (OK) 1801 0000 00B0
[ 02:57:15 ] [ Newcamd ] ECM -> localhost (OK) 1801 0000 00B0
[ 02:57:31 ] [ Newcamd ] ECM -> localhost (OK) 1801 0000 00B0

You may have to change channels to get things started.

PART 2 next post!!!

c/p from wderbi

**Zero Gravity** · #2 (**permalink**) 04-09-2009, 12:25 AM

PART 2 of 2

C) Setting up your CW3000HD and CW4000HD as a cardserver using RQcs 1.04 and up (N2 and N3 cards )

This is pretty much the same as above, so a lot of cut and paste!

1) First, you must download, unzip and add the proper RQcs 1.04 components to the CW3K/4K. After package is unzipped, you must manually copy the correct RQcs binary [rqcs.x86] to the usr/local/bin directory of the CW3K/4K; and then copy the rcqs.conf file from the "configs" folder of the RQcs 1.04 package and put it in the etc folder of the CW3K/4K. You must first be sure that you did the rwroot command in PutTy as described above or you will not be able to add files to root-level folders! After the files are copied to the target directories, rename the "rqcs.x86" binary to rqcs and change permissions to 755 by right-clicking and going to "properties".

Edit the rqcs.conf to allow the VDR-SC to connect to it locally via newcamd protocol listed in your cardclient file (see above newcamd line). The example that I will provide below is a working example for my Dish ROM 102 card---I have not tested it with any other ROM card (ROM 103,SOx), but they should work as well. According to Raton's READ ME of RQcs, it should work with ROM103 cards and with ROM24x cards!!! FEEL FREE TO COPY THE RQCS.CONF TEXT AND PASTE IT INTO YOUR RQCS.CONF FILE. YOU WILL NEED YOUR OWN BOX KEYS!!!!

rqcs.conf file

Code:

 
###############################################################################
# rqcs configuration file                                                     #
# All configuration options in this file observe the same format:             #
#     <configuration_name>=<configuration_value>                              #
#                                                                             #
# No white space is allowed in any place or the configuration entry will be   #
# ignored.                                                                    #
###############################################################################

########################### general configuration #############################
[General]
# This sets the box type the card server will run on. Compatible boxes are:
# 0 - Dreambox
# 1 - Triple Dragon
# 2 - DGStation (Mutant/Relook/CubeCafe)
# 3 - Linux x86 PC
#
# NOTE: Ignored in the WIN32 version.
box_type=3

# Enable or disable background execution
# 0 - Disable
# 1 - Enable
#
# NOTE: Ignored in the WIN32 version.
background_execution=1

# This sets the level of console output for debugging:
# 0 - Silent, 1 - Basic debug info, 2 - Extended debug info,
# 3 - Show all debug info
debug_level=2

# This option enables or disables the writing of debug information to the
# console.
log_to_console=1

# This option enables or disables the writing of console output to a log file
log_to_file=1

# When log_to_file is set to 1, this is the path and filename to write console
# ouput to.
#
# NOTE: In the WIN32 version, if enabled, this should be set to a valid
#       Windows/DOS path.
logfile_name=/var/log/rqcs.txt

############################# slot configuration ##############################
# Logical slots are a combination of a physical slot/interface, card, and     #
# protocol server. There is no limit to how many logical slots can be added,  #
# except for those imposed by the device where it is running.                 #
###############################################################################
[Logical-Slot:Lower]
# Enable/Disable this logical slot. If disabled it will be completely ignored.
# 0 - Disabled, 1 - Enabled
enabled=1

# Sets the type of smartcard interface.
# 0 - ISO7816 Smartcard Interface.
# 1 - Phoenix type connected to RS232 serial port.
#
# NOTE: Ignored in the WIN32 version. Always uses Phoenix interface.
sci_type=1

# The numeric identifier of the smartcard interface
# eg: for internal iso7816 slots: 0 = sci0, 1 = sci1, 2 = sci2 and so on...
#     for rs232 serial ports: 0 = ttyS0, 1 = ttyS1, 2 = ttyS2 and so on...
#
# NOTE: There's a small difference in the WIN32 version:
#       0 = COM1, 1 = COM2, 2 = COM3 and so on...
sci_ordinal=0

# Clock frequency of the internal box smartcard interface, in Hertz.
# This is only used when ISO7816 smartcard interface is selected.
sci_clock_frequency=3574595

# ECMs received in shorter intervals that what is specified in this parameter
# (in seconds), will be rejected. [This is currently not implemented!]
maximum_ecm_rate=2

# Block Global/Shared/Unique EMM's [This is currently not implemented!]
block_emm_g=0
block_emm_s=0
block_emm_u=0

# A list of SIDs to allow in this slot. If this is left empty, all sids are 
# allowed. Format: <sid_1>|<sid_2>|<sid_3> ... and so on.
#
allow_sids=

# A list of SIDs to deny in this slot. Leaving this parameter empty has no
# special meaning. Format: <sid_1>|<sid_2>|<sid_3> ... and so on.
deny_sids=

# For Nagra cards, if they use the DT08 session negotiation method, you 
# must configure the IRD box key.
box_key=XXXXXXXXXXXXXXXX

# For Nagra cards, if they use the secondary key session negotiation
# method, you must configure the IRD secondary key.
#
# If the secondary key value is empty, the DT08 method will be attempted with
# the provided box key. If this value is specified, the box key will be 
# ignored (as the secondary key has the box key embedded) and the secondary key
# session negotiation method will be attempted instead.
# 
# The secondary key is 96 bytes long and has the following structure:
#
# II II II II XX XX XX XX XX XX XX XX XX XX Y1 Y1 Y1 Y1 Y1 Y1 Y1 Y1 
# SK SK SK SK SK SK SK SK SK SK SK SK SK SK SK SK 
# SK SK SK SK SK SK SK SK SK SK SK SK SK SK SK SK 
# SK SK SK SK SK SK SK SK SK SK SK SK SK SK SK SK 
# SK SK SK SK SK SK SK SK SK SK SK SK SK SK SK SK 
# Y2 Y2 Y2 Y2 Y2 Y2 Y2 Y2 CS CS 
#
# II     = IRD serial number.
# XX     = Unimportant.
# Y1, Y2 = SK signature and also used to calculate the box key.
# SK     = Actual secondary key data (CAM N, public modulus).
# CS     = Checksum.
#
# NOTE: The secondary key should be specified as a single line without spaces
# (like the box key), and should be the exact 96 bytes as extracted from the IRD.
secondary_key=

# Optional. Card provider's IRD RSA key.
rsa_key=

# The protocol with which the logical slot will communicate with the
# clients.
# 0 - Newcamd protocol.
protocol_server_type=0

# The port on which the logical slot's protocol server will be listening.
protocol_server_port=12000

# If the Newcamd protocol is selected, you must configure here the des
# key to be used for encrypting communication.
protocol_server_newcamd_des_key=0102030405060708091011121314

# The user list that will be able to connect to the logical slot.
# Format: <username_0>:<password_0>|<username_1>:<password_1> ... and so on.
protocol_server_users=localhost:localhost|dummy_2:dummy_2|dummy_3:dummy_3

###############################################################################
[Logical-Slot:Upper]
enabled=1
sci_type=0
sci_ordinal=1
sci_clock_frequency=3574595
maximum_ecm_rate=2
block_emm_g=0
block_emm_s=0
block_emm_u=0
allow_sids=
deny_sids=
box_key=
secondary_key=
rsa_key=
protocol_server_type=0
protocol_server_port=15001
protocol_server_newcamd_des_key=0102030405060708091011121314
protocol_server_users=dummy:dummy

**Not a lot of issues with RQcs---it works well! I got all bugs worked out with NewCS so no real key points here.

***Until you get the kinks worked out, it is a good ideal to make sure you enable "log to file" option. I have a file as /var/log/rqcs.txt. When things are working, it will be a good ideal to disable the logfile option to avoid potential space and memory problems.

Now you are ready to roll:

Make sure you have disabled VDR-sc softcam emulation by method described above, and that you are logged out of any of the USER profiles on you CW box. Open a PuTty session and enter your CW root password (captive or CW3000HD---default are pws). From the command prompt, type the follwing command:
/usr/local/bin/rqcs &

If successful, you should see something like this:

RQcs 1.04 log

Code:

 
rqcs version 1.04, card server by raton_craquero.
rqcs is free software! -- visit the rqcs homepage at:
http://rqcamd.doesntexist.com

Usage: rqcs [OPTION] ...

These are the currently supported options for rqcs:
  -help             Show this information.

  -config <path>    Set a custom configuration file path.

  -debug-level <n>  Specifies the level of detail (n) when displaying debug
                    messages to the console (default is 1):
                      0 - Silent
                      1 - Basic information messages.
                      2 - Detailed debug information.
                      3 - Show all available debug info.

Read configuration settings from '/etc/rqcs.conf'

****************** Starting log on Fri Feb  6 03:14:46 2009 ******************

Configuration settings:
  Debug level: 2

Starting Logical Slot 'Lower' [Users: 3]
------------------------------------------------------------------------------
Device Path: /dev/ttyS0 | Listening Port: 12000
------------------------------------------------------------------------------

  Opening sci... Done
  Detecting card... Card present
  Resetting card... Done
  Identifying card type... 
    Historical bytes: D  N  A  S  P  1  0  2     R  e  v  1  0  C      
                      44 4E 41 53 50 31 30 32 20 52 65 76 31 30 43 
    Card type:        Nagra
    ROM Revision:     102
    EEPROM Revision:  Rev10C

  Configuring sci... 
    SCI | Conv: Inverse | Baud Rate: 115200 | Stop Bits: 2 | Parity: Odd

  Slot custom parameters:
    des_key: 0102030405060708091011121314
    box_key: XXXXXXXXXXXX
    secondary_key: 
    rsa_key: 
    
  Card start-up initialization...
    Using DT08 session negotiation:
    Setting Field Size:                 Done
    Retrieving IRD serial number:       XXXXXXXX
    Retrieving CAM serial number:       XXXXXX
    Retrieving System IDs:              0101,0106
    Retrieving CAM modulus (DT08):      Done
    Retrieving CAM challenge data:      Done
    Performing Session Key Negotiation: Successful
    
  Starting card worker thread...   Done
  Starting protocol server on port 12000 [newcamd protocol]
  
Logical Slot 'Lower' READY!
------------------------------------------------------------------------------

Starting Logical Slot 'Upper' [Users: 1]
------------------------------------------------------------------------------
Device Path: /dev/sci1 | Listening Port: 15001
------------------------------------------------------------------------------

  Opening sci... failed to open sci.

Logical Slot 'Upper' Disabled.
------------------------------------------------------------------------------

If all goes well, log onto a USER profile and watch TV! If your ROM card has current keys, everything should work and you will see something like this in PuTty:

Code:

 
CONNECT **** [Fri Feb  6 03:15:50 2009] Processing incoming connection...
  User 'localhost' authenticated successfully [Client: Unknown] | Clients: 1

DATA **** [Fri Feb  6 03:15:50 2009] Processing card data request...
  Username: localhost | Logical slot: 'Lower' | Card data sent successfully.

ECM **** [Fri Feb  6 03:15:54 2009] Processing ECM request...
  Username: localhost (1 users) | SID: 0176 | Logical slot: 'Lower'
  Cache: Miss (1 elements) | Card: Valid control words returned. [757ms]
  CW0:CW1 | 1B045F7E7C9FE3FE:962AD7971840CF27
  
EMM **** [Fri Feb  6 03:15:55 2009] Processing EMM...
  EMM processed successfully by card [851ms].

EMM **** [Fri Feb  6 03:15:58 2009] Processing EMM...
  EMM processed successfully by card [850ms].

EMM **** [Fri Feb  6 03:16:01 2009] Processing EMM...
  EMM processed successfully by card [850ms].

ECM **** [Fri Feb  6 03:16:03 2009] Processing ECM request...
  Username: localhost (1 users) | SID: 0176 | Logical slot: 'Lower'
  Cache: Miss (2 elements) | Card: Valid control words returned. [748ms]
  CW0:CW1 | 1B045F7E7C9FE3FE:024E05552D04FC2D
  
EMM **** [Fri Feb  6 03:16:04 2009] Processing EMM...
  EMM processed successfully by card [851ms].

EMM **** [Fri Feb  6 03:16:07 2009] Processing EMM...
  EMM processed successfully by card [850ms].

EMM **** [Fri Feb  6 03:16:10 2009] Processing EMM...
  EMM processed successfully by card [851ms].

EMM **** [Fri Feb  6 03:16:13 2009] Processing EMM...
  EMM processed successfully by card [850ms].

You may have to change channels to get things started.

Some Key points:
As I mentioned above, the ecm.cache file is critical. After you tune to a channel for the first time, vdr-sc pulls this information for a particular SID from the datastream , and stores the “ecm” information for that channel in this file. For quicker channel changing information, vdr-sc then recalls this information from the ecm.cache whenever you tune back to that particular channel at a later time---which makes the channel changes much quicker in subsequent tune-ins. During card sharing on the CW3K/4K, the first time you tune to a channel that does not have the ecm information for that particular SID stored in the ecm.cache file, it may take up to a minute for that channel to come in. However, once the information is saved into the ecm.cache file, subsequent channel changes to that same channel are fast! This is a minor draw back to the cardsharing on the CW3k/4K.

Right now, vdr-sc will not default to card sharing if it goes down during a provider ECM attack. You will once again have to manually enable cardsharing by making sure that the Softcam.key file is disabled (renamed) to force local card-based decryption to be activated. Perhaps someone who knows linux can modify vdr-sc so that it will default to cardsharing if it cannot retrieve the proper CWs for decryption from the core (software). This would really improve the efficiency of this setup and make it the best of both worlds.

If you install a new fix softcam {SC update} fix (ie step up from the 1-31 fix to the 2-3 fix), the install process will add a new softcam.key file and a new “fix_sc” script. You will need to redo steps 4 and 5 to set up the CW3k/4k for local cardsharing.

Although it is not recommended and is probably illegal, you may be able to card share over the internet with this procedure. I don't condone illegal stuff!!! This is for educational purposes and for the reasons I described above only!

As of now, this set up is >95% stable. Depending upon your number of clients, network reliability, and ROM card image, you may from time-to-time have newcs/rqcs just crash and need to be restarted. Fortunately, this has happened only once on my setup. Perhaps some tweaking with the ecm/emm cache will help this out a bit.

If you are the type of person who shuts down the CW3K/4K every day, you will need to restart the card server (newcs or rqcs) through PutTy every time you startup your system---and before you log onto your USER profile. Also, you may have to update your card if the keys change while you are down.

Finally, once you are successful, make sure that you disable vdr-sc logging by undoing step 5 (except do not make changes in the "cryptosystem options" menu), otherwise vdr-sc will become unresponsive with a massive log file. Also make sure that you undo the rwroot command!

I hope this helps!!! Now if someone can somehow write a plugin for the VDR JAVA interface to automate this process----it would be awsome!!! Now on to my quest of adding a USB based card reader to the CW4000HD!!!

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Hauppaugge NOVA PCI Card for computer TV	cazurro	FTA General Discussion	16	04-09-2009 11:09 PM
N3 Card swap Pushed back	blizzard4dish	Nagravision 3 News	3	02-20-2009 11:34 AM
"Card Shareing" What Is It? A Form of "IKS"?	nunez110	FTA General Discussion	3	12-09-2008 10:16 PM
BEV Card Swap on the Way	FTA FILES	FTA General Discussion	0	09-09-2008 01:21 AM