//---------------------------------------------------------------------------
// This software is for educational purposes only. It should not be used
// to ilegally watch TV channels.
//---------------------------------------------------------------------------
#include "system_irdeto.h"
#include "emu.h"
#include <string.h>
const unsigned char table0[32] = {
0,1,2,3,4,5,6,7, 0,1,2,3,4,5,6,7,
0,1,2,3,4,5,6,7, 0,3,6,1,4,7,2,5
};
const unsigned char table1[256] = {
0xDA,0x26,0xE8,0x72,0x11,0x52,0x3E,0x46, 0x32,0xFF,0x8C,0x1E,0xA7,0xBE,0x2C,0x29,
0x5F,0x86,0x7E,0x75,0x0A,0x08,0xA5,0x21, 0x61,0xFB,0x7A,0x58,0x60,0xF7,0x81,0x4F,
0xE4,0xFC,0xDF,0xB1,0xBB,0x6A,0x02,0xB3, 0x0B,0x6E,0x5D,0x5C,0xD5,0xCF,0xCA,0x2A,
0x14,0xB7,0x90,0xF3,0xD9,0x37,0x3A,0x59, 0x44,0x69,0xC9,0x78,0x30,0x16,0x39,0x9A,
0x0D,0x05,0x1F,0x8B,0x5E,0xEE,0x1B,0xC4, 0x76,0x43,0xBD,0xEB,0x42,0xEF,0xF9,0xD0,
0x4D,0xE3,0xF4,0x57,0x56,0xA3,0x0F,0xA6, 0x50,0xFD,0xDE,0xD2,0x80,0x4C,0xD3,0xCB,
0xF8,0x49,0x8F,0x22,0x71,0x84,0x33,0xE0, 0x47,0xC2,0x93,0xBC,0x7C,0x3B,0x9C,0x7D,
0xEC,0xC3,0xF1,0x89,0xCE,0x98,0xA2,0xE1, 0xC1,0xF2,0x27,0x12,0x01,0xEA,0xE5,0x9B,
0x25,0x87,0x96,0x7B,0x34,0x45,0xAD,0xD1, 0xB5,0xDB,0x83,0x55,0xB0,0x9E,0x19,0xD7,
0x17,0xC6,0x35,0xD8,0xF0,0xAE,0xD4,0x2B, 0x1D,0xA0,0x99,0x8A,0x15,0x00,0xAF,0x2D,
0x09,0xA8,0xF5,0x6C,0xA1,0x63,0x67,0x51, 0x3C,0xB2,0xC0,0xED,0x94,0x03,0x6F,0xBA,
0x3F,0x4E,0x62,0x92,0x85,0xDD,0xAB,0xFE, 0x10,0x2E,0x68,0x65,0xE7,0x04,0xF6,0x0C,
0x20,0x1C,0xA9,0x53,0x40,0x77,0x2F,0xA4, 0xFA,0x6D,0x73,0x28,0xE2,0xCD,0x79,0xC8,
0x97,0x66,0x8E,0x82,0x74,0x06,0xC7,0x88, 0x1A,0x4A,0x6B,0xCC,0x41,0xE9,0x9D,0xB8,
0x23,0x9F,0x3D,0xBF,0x8D,0x95,0xC5,0x13, 0xB9,0x24,0x5A,0xDC,0x64,0x18,0x38,0x91,
0x7F,0x5B,0x70,0x54,0x07,0xB6,0x4B,0x0E, 0x36,0xAC,0x31,0xE6,0xD6,0x48,0xAA,0xB4
};
const unsigned char table2[256] = {
0x8E,0xD5,0x32,0x53,0x4B,0x18,0x7F,0x95, 0xBE,0x30,0xF3,0xE0,0x22,0xE1,0x68,0x90,
0x82,0xC8,0xA8,0x57,0x21,0xC5,0x38,0x73, 0x61,0x5D,0x5A,0xD6,0x60,0xB7,0x48,0x70,
0x2B,0x7A,0x1D,0xD1,0xB1,0xEC,0x7C,0xAA, 0x2F,0x1F,0x37,0x58,0x72,0x88,0xFF,0x87,
0x1C,0xCB,0x00,0xE6,0x4E,0xAB,0xEB,0xB3, 0xF7,0x59,0x71,0x6A,0x64,0x2A,0x55,0x4D,
0xFC,0xC0,0x51,0x01,0x2D,0xC4,0x54,0xE2, 0x9F,0x26,0x16,0x27,0xF2,0x9C,0x86,0x11,
0x05,0x29,0xA2,0x78,0x49,0xB2,0xA6,0xCA, 0x96,0xE5,0x33,0x3F,0x46,0xBA,0xD0,0xBB,
0x5F,0x84,0x98,0xE4,0xF9,0x0A,0x62,0xEE, 0xF6,0xCF,0x94,0xF0,0xEA,0x1E,0xBF,0x07,
0x9B,0xD9,0xE9,0x74,0xC6,0xA4,0xB9,0x56, 0x3E,0xDB,0xC7,0x15,0xE3,0x80,0xD7,0xED,
0xEF,0x13,0xAC,0xA1,0x91,0xC2,0x89,0x5B, 0x08,0x0B,0x4C,0x02,0x3A,0x5C,0xA9,0x3B,
0xCE,0x6B,0xA7,0xE7,0xCD,0x7B,0xA0,0x47, 0x09,0x6D,0xF8,0xF1,0x8B,0xB0,0x12,0x42,
0x4A,0x9A,0x17,0xB4,0x7E,0xAD,0xFE,0xFD, 0x2C,0xD3,0xF4,0xB6,0xA3,0xFA,0xDF,0xB8,
0xD4,0xDA,0x0F,0x50,0x93,0x66,0x6C,0x20, 0xD8,0x8A,0xDD,0x31,0x1A,0x8C,0x06,0xD2,
0x44,0xE8,0x23,0x43,0x6E,0x10,0x69,0x36, 0xBC,0x19,0x8D,0x24,0x81,0x14,0x40,0xC9,
0x6F,0x2E,0x45,0x52,0x41,0x92,0x34,0xFB, 0x5E,0x0D,0xF5,0x76,0x25,0x77,0x63,0x65,
0xAF,0x4F,0xCC,0x03,0x9D,0x0C,0x28,0x39, 0x85,0xDE,0xB5,0x7D,0x67,0x83,0xBD,0xC3,
0xDC,0x3C,0xAE,0x99,0x04,0x75,0x8F,0x97, 0xC1,0xA5,0x9E,0x35,0x0E,0x3D,0x1B,0x79
};
// -- cSystemIrd ---------------------------------------------------------------
int irdeto_ecm (const byte *source, byte *dw, byte *emu_buf){
byte *keys;
int keyIdx, key_end, retval=0;
keyIdx=*(source+9);
key_end= ((*(emu_buf+OPKEY_END))<<8)|(*(emu_buf+OPKEY_END+1 ));
keys=emu_buf+OPKEY_OFFSET;
while (keys <(emu_buf+key_end))
{
if((*keys==0x40)&&(*(keys+2)==keyIdx)) retval = irdeto_decode(source+6,keys+3,dw);
if(retval) break;
keys += OPKEY_LEN;
}
return retval;
}
int irdeto_EMM (const byte *source, byte *emu_buf) {
int length=source[5]+6-5; // 6 header bytes - 5 signature bytes
int data_pos=0, data_ind=0, j;
int provN=0, ident,ident_len, isPMKupdate=0;
byte date[2];
int len, param, index;
byte data[36], tmp[128], mkey[8], provid[IRD_PG_LEN+1];
/* begin decrypt */
provid[0]=0;
memset(data,0,sizeof(data));
for(index=6 ; index<length

{
param=source[index++];
len =source[index++] & 0x3f;
switch(param) {
case 0x10: /* OP keys update */
case 0x50:
case 0x28: /* PMK update */
case 0x48:
case 0x68:
data_pos = index;
break;
case 0x00:
case 0x40:
memcpy(date,&source[index],2);
break;
}
index+=len;
}
if((!data_pos)) return 1; /* no key update in current EMM */
if (source[0]==0xC3) /* addressing by HexSerial */
{
ident=IRD_HSN_OFFSET;
ident_len=IRD_HSN_LEN;
isPMKupdate=1;
}
else
{
ident=IRD_PG_OFFSET;
ident_len=IRD_PG_LEN;
}
/* search provNum in the list of irdeto providers */
for(; provN < 9; provN++){
j=0;
for (;j<ident_len;j++)
{
if(*(emu_buf+ident+ident_len*provN+j) != *(source+1+j)) break;
}
if(j==ident_len) break; /* ident found */
if((j==2) && (!isPMKupdate)) break; /* ident for opkeys update - 2 bytes */
}
if (provN == 9) return 0; /* provider or hex serial not found in list */
if (source[0]==0xC3) /* addressing by HexSerial */
{
memcpy(mkey,emu_buf+IRD_HMK_OFFSET+IRD_HMK_LEN*pro vN,8); /* 0..7 bytes of HMK */
memcpy(date,emu_buf+IRD_HMK_OFFSET+IRD_HMK_LEN*pro vN+8,2); /* 8..9 bytes of HMK */
/* prepare PreXORed HMK */
date[0]=date[0]^mkey[0];
date[1]=date[1]^mkey[1];
}
else
memcpy(mkey,emu_buf+IRD_PMK_OFFSET+IRD_PMK_LEN*pro vN,8);
j=0;
/* chk for void master key */
for(;j<8;j++)
if(mkey[j]) break;
if(j==8) return false; /* key is null */
memcpy(tmp,source,length); /* Make a copy we can work on */
for(index=6 ; index<length

{
param=tmp[index++];
len =source[index++] & 0x3f;
switch(param) {
case 0x10:
case 0x50:
for (j=0;j<len;j+=9) {
cIrdeto_SessionKeyCrypt(tmp+index+j+1,mkey,date);
memcpy(data+data_ind,tmp+index+j,9);
data_ind += 9;
}
break;
case 0x28: // pmk & provid update
case 0x48:
case 0x68:
cIrdeto_SessionKeyCrypt(tmp+index+2,mkey,date);
memcpy(data+data_ind,tmp+index+2,9);
if(len==0xD) {/* Prov ID update */
provid[0]=1;
memcpy(provid+1,tmp+index+10,3);
}
data_ind += 9;
}
index+=len;
}
if(!(cIrdeto_SignatureCheck(tmp,length,mkey,date,s ource+length))) return false;
if(isPMKupdate) {
j=0;
for (;j<8 ;j++)
{
if(emu_buf[provN*IRD_PMK_LEN+IRD_PMK_OFFSET+j] != data[j]) break;
}
if (j==8) return true; /* old key == new key */
/* insert new PMK */
memcpy(emu_buf+provN*IRD_PMK_LEN+IRD_PMK_OFFSET,da ta,8);
/* update prov ID */
if (provid[0])
memcpy(emu_buf+provN*IRD_PG_LEN+IRD_PG_OFFSET, provid+1,IRD_PG_LEN);
/* signal to MHW about update happend */
if(!emu_buf[SIG_UPD_OFFSET]){
emu_buf[SIG_UPD_OFFSET]=1;
emu_buf[KEY_IDX_OFFSET]=0x14;
}
return true;
}
/* else update opkeys */
j=0; /* number of new keys */
index=0;
while (data_ind)
{
if(update_keys(emu_buf,data+data_ind-9,(byte)(provN+1),IRDETO))
{
mkey[j]=data[data_ind-9]; /* index of new key */
j++;
}
data_ind -= 9;
index++;
}
/* signal to MHW about update happend */
if(!emu_buf[SIG_UPD_OFFSET]){
if((emu_buf[UPD_FLAG_OFFSET]==2)){
/* display only new keys */
emu_buf[SIG_UPD_OFFSET]=(byte)j;
while(j) {
j--;
switch (j)
{
case 0: emu_buf[KEY_IDX_OFFSET]=mkey[j];
break;
case 1: emu_buf[KEY_IDX2_OFFSET]=mkey[j];
break;
case 2: emu_buf[KEY_IDX3_OFFSET]=mkey[j];
break;
default: ;
}
}
}
else { /* all keys will be displayed */
emu_buf[SIG_UPD_OFFSET]=(byte)index;
emu_buf[KEY_IDX_OFFSET]=data[0];
index--;
if(index) {
emu_buf[KEY_IDX2_OFFSET]=data[9]; /* 2nd key */
index--;
if(index) emu_buf[KEY_IDX3_OFFSET]=data[18]; /* 3rd key */
}
}
}
return true;
}
// -- cIrdeto ------------------------------------------------------------------
void cIrdeto_Rotate( byte *p) {
byte temp,i;
temp = p[9];
for (i=9; i>0; i--) p[i] = (p[i] >> 1) | (p[i-1] << 7);
p[0] = (p[0] >> 1) | (temp << 7);
}
int irdeto_decode (const byte *source, const byte *key, byte *cw) {
int length=source[5]+6-5; // 6 header bytes - 5 signature bytes
int data_pos=0;
byte date[2];
int len, param, index;
byte data[16], tmp[256];
for(index=6 ; index<length

{
param=source[index++];
len =source[index++] & 0x3f;
switch(param) {
case 0x78:
data_pos = index+2;
break;
case 0x00:
case 0x40:
memcpy(date,&source[index],2);
break;
}
index+=len;
}
if((!data_pos)) return -1;
memcpy(data,source+data_pos,16); /* copy the encrypted data*/
cIrdeto_SessionKeyCrypt(data,key,date);
cIrdeto_SessionKeyCrypt(data+8,key,date);
memcpy(tmp,source,length);
memcpy(tmp+data_pos, data, 16);
if(!(cIrdeto_SignatureCheck(tmp,length,key,date,&s ource[length]))) return false;
memcpy(cw,data,16); /* put the decrypted data to output buffer */
return true;
}
void cIrdeto_DecryptIrd (byte *data, byte *key, int rounds, int offset) {
int count,index;
byte d,k;
for (count=0; count<rounds; count++) {
#ifdef BCT1330
__asm { ldc 0xff; gintdis; };
#endif
index = count % 10;
#ifdef BCT1330
__asm { ldc 0xff; gintenb; };
#endif
if (index == 0) cIrdeto_Rotate(key);
k = key[index];
d = data[table0[(count & 0x0f) + offset]] ^ k;
if (k & 1) d = table1[d];
else d = table2[d];
data[table0[((count+1) & 0x0f) + offset]] ^= d;
}
}
void cIrdeto_SessionKeyCrypt (byte *data, const byte *key, byte *date) {
byte temp[10];
memcpy(temp,key,8);
temp[8]=((date[0])^(key[0]))&0xff;
temp[9]=((date[1])^(key[1]))&0xff;
cIrdeto_DecryptIrd(data,temp,128,16);
}
int cIrdeto_SignatureCheck (const byte *data,int length, const byte *key, byte *date,const byte *signature) {
byte temp[10], hash[8];
int rounds;
int i,j,k, tail;
for (i=0;i<8 ;i++)
hash[i]=0;
/* prepare key */
memcpy(temp,key,8);
temp[8]=date[0]^key[0];
temp[9]=date[1]^key[1];
k = 0x61; /* pad char */
i = 0;
while (length > 0)
{
tail = 0;
rounds = 40;
if(length < 8){
tail= 8 - length;
rounds = 104;
}
for (j=0; j<(8-tail); j++)
hash[j] ^= data[i+j]; /* xor hash with current block */
while (tail){
hash[8-tail] ^= k++;
tail--;
}
cIrdeto_DecryptIrd(hash,temp,rounds,0); /* decrypt hash */
i+= 8;
length -= 8;
cIrdeto_Rotate(temp); /* cIrdeto_Rotate key */
}
/*return memcmp(hash,signature,5)==0;*/
for(i=0;i<5;i++) if(hash[i] != signature[i]) return false;
return true;
}