[linux-dvb] Technisat SkyStar 1 CI: How to descramble?

Andreas U. Trottmann andreas.trottmann at werft22.com
Tue Oct 11 23:04:17 CEST 2005


Hello linux-dvb,

I'm using a Terratec SkyStar 1 CI card. The card works very fine
to receive any unencrypted channels - so, thank you very much for
a great driver!

However, I'd like also to use the CI to decrypt relevant
channels. Right now the target is swiss national TV.

I've got the right crypto module (Viaccess) and a working
Keycard: If I insert the bundle in a set-top-box, I can watch the
encrypted channels.


Now, I do the following:

1. load the driver (from linuxtv CVS as of today, Oct 11 2005)

# modprobe dvb-bt8xx

This yields the following result in the syslog

Oct 11 20:10:34 localhost kernel: DVB: registering new adapter (bttv0).
Oct 11 20:10:35 localhost kernel: dst_get_device_id: Recognise [DSTMCI]
Oct 11 20:10:35 localhost kernel:
Oct 11 20:10:35 localhost kernel: DST type flags : 0x1 newtuner 0x10 firmware version = 2
Oct 11 20:10:35 localhost kernel: dst_get_mac: MAC Address=[00:08:ca:16:1f:00]
Oct 11 20:10:43 localhost kernel: dst_ca_attach: registering DST-CA device
Oct 11 20:10:43 localhost kernel: DVB: registering frontend 0 (DST DVB-S)...

-> so far, looks good to me

2. tune the channel (szap from linuxtv CVS as of today)

# szap -c channels-plain.conf -r SF1
reading channels from file 'channels-plain.conf'
zapping to 517 'SF1':
sat 0, frequency = 12398 MHz H, symbolrate 27500000, vpid = 0x00a0, apid = 0x0050 sid = 0x0385
using '/dev/dvb/adapter0/frontend0' and '/dev/dvb/adapter0/demux0'
status 1f | signal 5700 | snr 1928 | ber fffffffe | unc fffffffe | FE_HAS_LOCK
status 1f | signal 5700 | snr 1926 | ber fffffffe | unc fffffffe | FE_HAS_LOCK
(...)

-> that looks fine as well

3. start the descrambler (ca_zap from linuxtv CVS as of today)

# ca_zap -t sat -c channels-plain.conf -n SF1
Using Adpater=[/dev/dvb/adapter0]
 Frontend=[/dev/dvb/adapter0/frontend0]
 Demux=[/dev/dvb/adapter0/demux0]
 Slot=[/dev/dvb/adapter0/ca0]
Parsing channels-plain.conf
Satellite frontend
parse_sat_channel_list: Channel=[SF1], Frequency=[12398], Satellite=[0], Symbol Rate=[27500], Video=[160], Audio=[80], Service=[901]
Service ID=[901]
parse_pat: ----------------->parse PAT section
parse_pat: PAT => Section Length=[105], TS ID=[8500]
parse_si: PMT PID = [400]
parse_si: PAT: Close Demux /dev/dvb/adapter0/demux0
parse_pmt: PMT Words=[ 02 b0 9a 03 85 d7 00 00 e0 a0 f0 00 02 e0 a0 f0 17 52 01 01 11 01 ff 09 0f 05 00 e2 c3 10 01 00 13 01 20 14 03 00 94 0c 06 e0 20 f0 2e 52 01 05 56 0a 64 65 75 09 00 64 65 75 17 77 45 1d
01 18 e7 e8 e9 ea eb ec ed ee ef f3 f4 f5 c7 c8 c9 ca cb cc cd ce cf d3 d4 d5 04 01 f0 03 e0 50 f0 1a 52 01 02 0a 04 64 65 75 01 09 0f 05 00 e2 c3 10 01 00 13 01 20 14 03 00 94 0c 03 e0 51 f0 1a 52 01 03 0a 04
 65 6e 67 01 09 0f 05 00 e2 c3 10 01 00 13 01 20 14 03 00 94 0c cf f3 24 8f ]

parse_pmt: ----------->parse PMT section, PMT PID=[400], bytes=[157]
parse_pmt_header: Table ID=[2], Section Length=[154], Program Number=[901], Section Number=[0], PCR PID=[160], Program info length=[0]
parse_pmt: Program info length=[0]

        parse_streams: Elements=[ 02 e0 a0 f0 17 52 01 01 11 01 ff 09 0f 05 00 e2 c3 10 01 00 13 01 20 14 03 00 94 0c]
        parse_streams: Stream=[0], Stream Type=[2], Elementary PID=[160], ES info length=[23]
INFO:: Parsing descriptor: parse_ca_descriptor, Tag=[09], Length=[15]
parse_ca_descriptor: Tag=[09], Length=[0f], CA System=[500], CA PID=[2c3]
parse_ca_descriptor: CA Private Data=[ 10 01 00 13 01 20 14 03 00 94 0c ]
parse_ca_descriptor: Pos=[40]
INFO:: Parsing descriptor: parse_data_stream_alignment_descriptor, Tag=[06], Length=[224]

copy_en50221_pmt_object: Copying EN50221 Header
copy_en50221_pmt_object: Program Number=[901], Program info length=[0]
copy_en50221_pmt_object: Program level descriptor count=[0]
copy_en50221_stream_object: Stream Type=[2], Elementary PID=[160], ES length=[23], Number of descriptors=[0]
do_en50221_pmt_object: CA PMT List Management=[03]
set_pmt_command: Setting PMT Command
do_en50221_pmt_object: Object length=[88], Total length=[11]
asn_1_encode: Length=[11]
asn_1_encode: length indicator=[0b]
do_en50221_pmt_object: ASN.1 words=[1], Length Array=[  11 ]
en50221_encode_header: CA PMT List Mgmt=[3], Program Number=[901], Program info length=[0]
write_en50221_pmt_object: EN50221 header encoded
en50221_encode_streams: Stream type=[02], ES PID=[a0], ES Info length=[17]
debug_message: CA MESSAGE=[ 9f 80 32 0b 03 03 85 ed 10 00 02 e0 a0 f0 00  ]

This yields the following result in the syslog
Oct 11 22:30:00 localhost kernel: dst_ca_open:  Device opened [f74de380]
Oct 11 22:30:00 localhost kernel: dst_ca_ioctl:  Sending message
Oct 11 22:30:00 localhost kernel: ca_send_message:
Oct 11 22:30:00 localhost kernel: ca_send_message:  Command=[0x9f8032]
Oct 11 22:30:00 localhost kernel:
Oct 11 22:30:00 localhost kernel: ca_send_message: Command = SEND_CA_PMT
Oct 11 22:30:00 localhost kernel: asn_1_decode:  Length field=[0b]
Oct 11 22:30:00 localhost kernel: asn_1_decode:  Length=[0b]
Oct 11 22:30:00 localhost kernel:
Oct 11 22:30:00 localhost kernel: ca_set_pmt:  CA Message length=[11]
Oct 11 22:30:00 localhost kernel:  String=[ 03 03 85 ed 10 00 02 e0 a0 f0 00 ]
Oct 11 22:30:00 localhost kernel: put_checksum:  Computing string checksum.
Oct 11 22:30:00 localhost kernel: put_checksum:   -> string length : 0x12
Oct 11 22:30:00 localhost kernel: put_checksum:   -> checksum      : 0xa3
Oct 11 22:30:00 localhost kernel:  String=[ 12 40 03 00 03 0b 00 03 03 85 ed 10 00 02 e0 a0 f0 00 a3 ]
Oct 11 22:30:00 localhost kernel: dst_put_ci:  Put Command
Oct 11 22:30:00 localhost kernel: write_to_8820:  DST-CI Command succes.
Oct 11 22:30:00 localhost kernel: ca_send_message:  -->CA_PMT Success !
Oct 11 22:30:00 localhost kernel: dst_ca_release:  Device closed.




This looks like a success at first, but the stream that I can
take from /dev/dvb/adapter0/dvr0 doesn't seem to be playable.


Now, I've used the same channels-plain.conf for both szap and
ca_zap. It contains the following relevant line:

SF1:12398:h:0:27500:160:80:901

The documentation for ca_zap from dvb/ci.txt suggests to add the
PMT PID right after the symbol rate. According to
http://www.satcodx1.com/0130/deu/, SF1 uses a PMT PID of 32. But,
putting the following line into channels-pmt.conf

SF1:12398:h:0:27500:32:160:80:901

and running ca_zap yields an interesting result:

# ca_zap -t sat -c channels-pmt.conf -n SF1
Using Adpater=[/dev/dvb/adapter0]
 Frontend=[/dev/dvb/adapter0/frontend0]
 Demux=[/dev/dvb/adapter0/demux0]
 Slot=[/dev/dvb/adapter0/ca0]
Parsing /home/admin/channels-conf-srg-pmt
Satellite frontend
parse_sat_channel_list: Channel=[SF1], Frequency=[12398], Satellite=[0], Symbol Rate=[27500], Video=[32], Audio=[160], Service=[80]
Service ID=[80]
parse_pat: ----------------->parse PAT section
parse_pat: PAT => Section Length=[105], TS ID=[8500]
parse_si: PAT: Close Demux /dev/dvb/adapter0/demux0

After this, ca_zap hangs. A strace shows:

(...)
write(1, "parse_si: PAT: Close Demux /dev/"..., 52parse_si: PAT: Close Demux /dev/dvb/adapter0/demux0) = 52
close(3)                                = 0
open("/dev/dvb/adapter0/demux0", O_RDWR) = 3
ioctl(3, 0x403c6f2b, 0xbfacfdf0)        = 0
read(3,  <unfinished ...>

which means that apparently, after opening, reading and closing
/dev/dvb/adapter0/demux0 once, it doesn't get anything anymore from it.



Is there anything I've done wrong?


-- 
Andreas Trottmann
Werft22 AG
Tel    +41 (0)56 210 91 37
Fax    +41 (0)56 210 91 34
Mobile +41 (0)79 229 88 55



More information about the linux-dvb mailing list