Pioneer Software For TS6 BCT-1610/1620/1630 DBR120XX DBR220XX

!!!You don't need JTAG to load this firmware - just use LPT+COM with Pioneero or!!!
!!!GGF1367.exe (for DOS) like for 1430 and follow instuction mode DL K2002.     !!! 
!!!If you load this alternative firware for the first time in your box (in box  !!!
!!!was current firmware is oryginal from provider) you must erase eeprom or go  !!!
!!!in the K7003 mode                                                            !!!
_____________________________________________________________________________________
Version 6.33

1. Fixed Nagra.

2. Added diseqc 1.2 positioner menu. You can't store position in the channels list at
   the moment. You can control your positioner only from positioner menu (7-c).
_____________________________________________________________________________________
Version 6.32

1. Fixed Nagra update.

2. Added DiseqC 4x1 commands for - now supported and DiseqC and tone burst.
   Scaning from menu now scan only one Dish which you select.

3. Low symbol rates now 8000 maybe little lower.

4. Added letter box function for 16/9 picture.

5. NTCS support - for this mode you must set PAL in menu 8 and box switch to NTSC 
   automaticly. Menu in NTSC mode look disturbed - thay not patched yet for NTSC.
_____________________________________________________________________________________
Version 6.31

1. Fixed Viaccess update on ASTRA sattelite.

2. Fixed CABO and DIGITAL+ update. Now used new algo - all decrypted EMM saved in the
   data flash, so one EMM instruction decrypted only ones. Now, I suppose, you can 
   watch on 1330 model nagra providers with update ON, you just need to wait when all
   EMM (signatures) will be saved in DATA flash and watch then without interrupts until
   new key will arrived. DATA flash can save up to 100 signatures for each provider - 
   I hope it would be enough - if buffer overflow all starts from the beginning. 
   Signature of EMM with key saved separately, but if you delete new key from the EMU
   menu and press C button - "save" - all key signature will be reseted, and you be 
   able to ketch new keys again. This new algo needs to be tested more, so post 
   feedback on the message board.
_____________________________________________________________________________________
Version 6.30

1. Fixed Polsat 7101 update.
_____________________________________________________________________________________
Version 6.29

1. Fixed seca 82 ins to card number.
_____________________________________________________________________________________
Version 6.28

1. Fixed CABO 4901 update.
_____________________________________________________________________________________
Version 6.27

1. Fixed nagravision update for 4001 and 4801 providers. Added in secondary menu
   switch for nagravision EMM - if you have problems in the future with nagravision
   EMM you can switch it of now.
_____________________________________________________________________________________
Version 6.26 beta

1. Fixed problem with irdeto and conax radio channels.

2. Added simulator for nagra update - now update should work on 4001 4801 7001 7401 
   providers. If you have autoupdate keys for other providers then report it on the
   board http://www.host17.org/dynamit/forum/forumdisplay.php?s=&forumid=2 and we 
   insert them.
_____________________________________________________________________________________
Version 6.25 beta

1. Optimazed RSA conax/nagra algo - now it works faster.
_____________________________________________________________________________________
Version 6.24 beta

1. Fixed irdeto PROV ID update. Now not necessary to put PRov ID 
   with xx xx 00 - zeros at the end. HMK must be preXORed.
_____________________________________________________________________________________
Version 6.23 beta

1. Added seca update inside.
   - for update you must define PPUA and MK01 and maybe MK11 for some providers.

2. Added card support for all EMMs - like before all non seca EMM goes to fake seca 
   provider BEEF, but UA, PPUA, ProvID, Hex serial for other system then seca must be 
   defied only in EMU menu 9. All EMMs goes to card when on card exist fake provider 
   BEEF, even if internal EMU update was successful/unsuccessful. About seca EMM that 
   go card:
   - if you define PPUA for seca ident in menu 9 and on card you have this IDENT - you 
   instruction filtered by this PPUA to the EMU and to card also. If you have same 
   idents on the card and in menu 9 and in menu 9 for this ident PPUA<>0 - then you 
   get instructions addressed to this provider by PPUA in menu 9 only and you loose 
   instruction addressed to this provider by PPUA in the card.


3. Switch EMM to EMU - still not supported 

4. Channel list included just for example.

_____________________________________________________________________________________
Version 6.22 beta

1. All EMM goes to internal EMU. In secondary menu 7-0 you can select EMM info mode 
       NEW - show only new key in EMM info window
       ON - show all keys, even existing key in EMM info window. 
   - in menu 7-1 you can switch off EMM info window.
   - update always on and you can't switch it of by 7-0 menu "off" - this feature 
     don't work 

2. Viaccess update: 
   - for update though UA you must define valid UA and keys what provider uses (usialy 
     it is MK00 
   - for update though CGA (PPUA) you must define valid CGA (PPUA) and keys what 
     provider uses (usially it is MK01 or MK04). Cust WP by fours byte in CGA don't work
     so you will be receiving and processing all EMM for CGA (and fours in CGA don't
     matter)
   - for update though ISSUER you must define your ISSUER like normal provider. You can
     define two ISSUERS with same ident, but only first will be working.

3. Irdeto update:
   - for update trough HMK you must define HEX serial and HMK key. HMK key must be not 
     XORed and you get new PMK key.
   - for update trough PMK you must have ID prov and PK key. Last byte in ID prov must 
     be zeros XX XX 00. For same reason you receive update for all group.

4. Nagravision update:
   - keys for POLSAT (7001, 7101) and for STARDIGITAL (7401, 7501) already inside.
     You only must define in Nagra menu idents 7101 and 7501 and wait for update.
   
5. EPG Menu added. You can define for "OTHER" provider EPG (must work on conax, but 
   I can't receive this channel so I can't test it).

6. Inserted CALLBACK feature by "0" button - you can jump with it to last watched
   channel. 
____________________________________________________________________________________
Version 6.17 beta

1. You can edit conax key in menu 9.
_____________________________________________________________________________________
Version 6.16 beta

1. Optimazed conax RSA one more time. Now it runs faster.

2. Added support for Nagra MECM only for Polsat 7001 - key already inside.
_____________________________________________________________________________________
Version 6.15 beta

1. Added conax algo inside the box (3 sec max on 16xx model). Key inside only for one 
   provider "1 west - THOR" and you can't change them from menu. If inside algo give 
   signature wrong then all ECM goes to card, but if you want to use some PC emulator 
   for conax and want speed up the proccess, then in menu 9 you can on/off conax inside
   EMU and all ECM goes directly to card without processing in inside EMU algo.

2. Added info menu 6 in secondary menu - you can see now PMT table, last ECM and state 
   of last decrypted ECM in inside EMU.
_____________________________________________________________________________________
Version 6.12 beta

1. Added irdto/betacrypt algo inside the box, no update at this moment, 
   but if key is not valid (old key - decrypt fail),then ECM go to the card. 
   You must define in menu 9 keys,
   All keys written in DATA flash (lenght=0x1000) in EMU folder in this format:
   address: 0x0210  -  key in this format
                       40 01 00 11 22 33 44 55 66 77 88
                       1 byte (30) - ident irdeto
                       1 byte (01) - provider number
                       1 byte (00) - No. keys
                       8 bytes - key
   address: 0x0FFE  -  address of the last key in the list of keys (end of keys)

_____________________________________________________________________________________
Version 6.10 beta

1. Added nagravision algo inside the box. MECM not supported, no update at this moment, 
   but if key is not valid (old key - decrypt fail),then ECM go to the card. 
   You must define in menu 9 Ident and keys, Verify key is not important.
   All keys written in DATA flash (lenght=0x1000) in EMU folder in this format:
   First goes blocks with ID for 5 providers nagravision:
   address: 0x0120  -  4101 4901 7501 ......
   address: 0x0210  -  key in this format
                       30 01 00 11 22 33 44 55 66 77 88
                       1 byte (30) - ident nagravision
                       1 byte (01) - provider number
                       1 byte (00) - No. keys
                       8 bytes - key
   address: 0x0FFE  -  address of the last key in the list of keys (end of keys)

2. Fixed minor bugs in viaccess algo.
_____________________________________________________________________________________
Version 6.09 beta

1. Fixed delete key feature in menu 9. Thanks to Piotr one more time for that.
_____________________________________________________________________________________
Version 6.08 beta

1. Added Viaccess menu, format of the keys the same, but now it is in Data flash with
   seca key in EMU section.

2. You can load keys by PC with LPT+COM together with channel list. In this archive you
   find example of that list. If you use eeprom439.txt then active blocks in DATA flash 
   are 
   0x00000
   0x10000
   0x30000
   0x40000
   You should put in this blocks TSC TPT EMU TSR sections. 

3. To edit key from menu you should enter key in hex values, so use buttons 
   0...9,a,b,c,d,e and left button on the top of the remote - "PILOT" for 0xF value.
_____________________________________________________________________________________

Version 6.07 beta

1. Fixed viaccess EMM one more time, but still have small bugs....For now tested on
   Viasat, SVT europe, SRG swiss, Slo TV and work OK.

2. Added EMU menu for editing seca key to work with seca inside algo. Seca algo is 
   very lame (don't check signature, don't support superencryption), if you have any 
   problems with seca algo just delete seca provider or key and ECM then go to card.
   All keys written in DATA flash (lenght=0x1000) in EMU folder in this format:
   First goes blocks with ID and PPUA for 8 providers SECA:
   address: 0x0000  -  0019 0012 0025 ......
   address: 0x0010  -  PPUA1 PPUA2 PPUA3 PPUA4 PPUA5 PPUA6 PPUA7 PPUA8
   address: 0x0210  -  key in this format
                       10 01 0C 11 22 33 44 55 66 77 88
                       1 byte (10) - ident seca
                       1 byte (01) - provider number
                       1 byte (0C) - No. keys
                       8 bytes - key
   address: 0x0FFE  -  address of the last key in the list of keys (end of keys)

3. Added viaccess algo inside the box. Viaccess algo writen very good - check Hash 
   (signature) - no update at this moment, but if key is not valid (old key - 
   bad signature),then ECM go to the card. About TPS - this version support TPS, 
   but if key is not valid (bad signature), then to card goes clean ECM (without 
   TPS proccessing).
   All keys written in firware flash (lenght=0x1000) at 0x7FF60000 in this format:
   First goes blocks with ID for 32 providers Viaccess:
   address: 0x0030  -  007800 008000 008C00 ......
   address: 0x0210  -  key in this format
                       20 01 08 11 22 33 44 55 66 77 88
                       1 byte (20) - ident Viaccess
                       1 byte (01) - provider number
                       1 byte (08) - No. keys
                       8 bytes - key
   address: 0x0FFE  -  address of the last key in the list of keys (end of keys)

Credits: Piotr - for the Seca menu (MHW part)
____________________________________________________________________________________
Version 6.01 test

1. Suported 16 seca providers inside. If box can't find seca provider, than ECM goes 
to card as usial.

2. Key in firmware at offset address 0x15FFE0 (0x7FF5FFE0). Providers 0019 0025 and 0012
already inside. 

3. EMM at the moment go only to card.
_____________________________________________________________________________________
Version 6.00 test - only for testing - not very practical

1. Seca work inside the box ("softcam" or "virtual card"). You can define one seca
provider. Key 00 - 0F on address 7FF7FA00 - (key for 00 19 Canal+ Digitaal already 
inserted for december-january). You must define Primary and Secondary key, if provider
don't use Secondary key insert Primary instead. Key loaded with firmware and you can't
change them from menu and autoupdate is not working too, at the moment, I hope soon it
will be. 

2. You steel need card for ini and startup staff of the box, but seca work inside free 
from hanginup and much faster than on card. 

_____________________________________________________________________________________
Version 5.11 beta

1. Supported Nagravision EMM - only 82 instruction work. See log in this archive.

Note: I am not an expert in Nagravision so I don't know if this EMM are OK, but 
it is an open project so anyone can look for yourself and make comments on the
board (forum). 
_____________________________________________________________________________________
Version 5.10 beta

1. Added full support for viaccess update - work all instructions.

2. Changed description of CA parameter for Group update

C1 40 0Z CA LL

C1 40 - emm instruction
0Z - number of provider BEEF on the card
CA - irdeto - 06; viaccess address update (UA-88|ins) - 05; viaccess Group 
update (PPUA-8E|ins) - 04. 
LL - length of EMM instruction. 

3. Example of Group update (PPUA=12 53 45 XX; Provider=01 0C 40; using ISSUER=FF F4 00
and key 06 for update:

C1 40 06 04 54 
Received Encrypted Data
00 12 53 45 02 90 03 FF F4 06 9E 20 FF FA 3B FF 
FF FF FF FF FF FF FF EF E3 75 C4 3F 8F FF FF FD 
7F FD FF FF FF FF F7 EF FF 6D E4 CD A1 03 01 0C 
4C EF 08 62 F8 98 AB B3 60 47 05 A1 03 01 0C 4D 
EF 08 20 76 F5 E9 FD 20 A9 C1 F0 08 4F 53 47 2E 
E0 7E 2E 62 

4. Example of Address update (UA=01 12 51 C1 33; Provider=01 0C 30; using ISSUER=FF F4 00
and key 05 for update: (nothing changed - like before)

Incoming EMM Instruction
C1 40 06 05 32 
Received Encrypted Data
01 12 51 C1 33 90 03 FF F4 05 A1 03 01 0C 3A EF 
08 83 54 75 1F 1D C6 7F CC A1 03 01 0C 3B EF 08 
2C 5E FB 35 32 30 99 B6 F0 08 7B 80 BF E0 FA E4 
C1 64 
_____________________________________________________________________________________
Version 5.08 beta

1. Added TPS crypt algorithm inside the box - TPS channels work like usual viaccess 
channels.
_____________________________________________________________________________________
Version 5.07 beta

1. Support autoupdate on Irdeto/Betacrypt and Viaccess.

2. EMM pids set only on seca[01XX], viaccess[05XX], irdeto[06XX], betacrypt[17XX]
nagravison [18XX]

3. Filter for EMM work on Irdeto/Batacrypt and Viaccess and adjusted by PPUA. On 
card must exist seca fake provider BEEF. You can define 6 provider in irdeto/betacrypt 
and 6 provider in viaccess for EMM filter. If you want to disable filter put zeros in 
seca PPUA responsible for filtering (PPUA = 00 00 00 00). Don't overload filter - don't 
put to much PPUA on some channel - could be a problem. Every PPUA set filter for every 
EMM pid finded on transponder. For example if you set three viaccess PPUA and put box 
on the channel with four viaccess EMM pid box set 4*3=12 filters plus you may have on 
this transponder some other seca EMM pids that also set. Box can handle simultaneously
32 filter.

a) Irdeto/Beatcrypt - FINAL!!!
irdeto ProviderID = AA AA XX - two byte filration:
seca PPUA = 00 AA AA XX - put this PPUA on seca providers from 0xA to 0xF;

irdeto HexSerial = AA AA AA - three byte filration:
seca PPUA = 01 AA AA AA - put this PPUA on seca providers from 0xA to 0xF;
First byte in PPUA control filter byte: 0 - two byte filter; 1 - three byte filter.

b) Viaccess - only instruction 88 work
viaccess card number = XX AA AA AA AA
seca PPUA = AA AA AA AA - put this PPUA on seca providers from 0x4 to 0x9

In seca 16 provider work in autoupadate mode as before just put seca PPUA.

All non seca EMM sends to fake provider BEEF.

4. Building EMM

C1 40 0Z CA LL

C1 40 - emm instruction
0Z - number of provider BEEF on the card
CA - - irdeto - 06; viaccess - 05. 
LL - lenght of EMM instruction. 

In irdeto/betacrypt mode box formed EMM in this format:

C1 40 0Z CA LL
				AA BB BB BB 00 LL
									[copy of EMM insrtuction]

AA - control byte (type of update)
BB BB BB - ProvID or HexSerial
Just like on irdeto box only header is modified.

Example 

12515 H - ASTRA 19E CANAL DIGITAAL Idreto

irdeto Provider ID = 05 A7 XX 
seca PPUA = 00 05 A7 XX

Incoming EMM Instruction - from satellite - instruction 82
82 40 24 02 05 A7 01 00 00 1D 40 02 08 AA 50 52 
02 C3 78 62 77 5D CF 16 84 04 C3 78 62 77 5D CF 
16 84 51 87 02 21 E1 


Incoming EMM Instruction - to card
C1 40 06 06 23 
Received Encrypted Data
02 05 A7 00 00 1D 40 02 08 AA 50 52 02 C3 78 62 
77 5D CF 16 84 04 C3 78 62 77 5D CF 16 84 51 87 
02 21 E1 

In viaccess mode box formed EMM in this format:

C1 40 0Z CA LL
				[copy of EMM insrtuction]

Example

12054 - surius 5E VIASAT viaccess

viaccess Card Number = 01 12 5B 9A 45
seca PPUA = 12 5B 9A 45

Incoming EMM Instruction - from satellite
88 70 32 01 12 5B 9A 45 90 03 FF F4 05 A1 03 01 
0C 3D EF 08 94 B4 ED B6 9E F7 C6 3D A1 03 01 0C 
3E EF 08 F2 59 F9 20 45 60 D2 32 F0 08 2B 32 0D 
FC A1 0E 3F 60 


Incoming EMM Instruction
C1 40 06 05 32 
Received Encrypted Data - to card
01 12 5B 9A 45 90 03 FF F4 05 A1 03 01 0C 3D EF 
08 94 B4 ED B6 9E F7 C6 3D A1 03 01 0C 3E EF 08 
F2 59 F9 20 45 60 D2 32 F0 08 2B 32 0D FC A1 0E 
3F 60 


Incoming EMM Instruction
C1 40 06 05 32 
Received Encrypted Data
01 12 5B 9A 45 90 03 FF F4 05 A1 03 01 0C 3D EF 
08 94 B4 ED B6 9E F7 C6 3D A1 03 01 0C 3E EF 08 
F2 59 F9 20 45 60 D2 32 F0 08 2B 32 0D FC A1 0E 
3F 60 


5. Disabled update on seca through 82 instruction (card number)

6. Fixed problem with 127 transponders - now you can use 255 transporders.

Suggestions about EMM filtration welcome - you can write also on forum
http://pub129.ezboard.com/bpioneerreverceengineering

_____________________________________________________________________________________
Version 4.41

1. ECM buffer extendet to 0xD2 byte.

2. Symbolrate fixed in menu "+" - "b" - "5"

_____________________________________________________________________________________
Version 4.40 

1. Fixed problem with long ECM on POLSAT.

2. Added Symbolrate MENU - 5 - 6 You can edit symbolrates now, but remember you need 
edit it according to your list (numbering is important). After Editing you need to reboot
your box. Now you can insert any symbolrates in range 4097-32000 but for some reason
work only 9100-32000. I work on that.

3. Added transponder edit menu + - b - 5. You can edit transponders. When you store
transponder in new space old transponder is erase with channel attached to it and channels 
from new transponder assigned to new transponder number. So problem with 127 limitation 
partially solved - you can copy transponders above 127 to lower numbers in unwanted
transponders. Also some KU channels work in C mode (like DUBAI-11744 on 13E and MTVitaly
11080 on 16E) so you need to add this transponders manually with C mode.

4. Added single transponder scan menu 5 -7 - scans on entered frequency all symbolrates 
in list in KU mode. 
_____________________________________________________________________________________
Version 4.37

1. Added in secondary menu some staff 
   - all self-explanatory 
   - you can edit channels 
   - look on PBM 
   - look witch channels assigned to the transponder and more 
   - add channels manually.

2, Added function "Auto System". 
    a) If channel don't have Seca ECM and ECM=0xFFFF than box change to first available 
       non Seca ECM pids from PMT table automatically.
    b) If channel don't have Seca ECM and ECM<>0xFFFF than box don't change ECM pids
       automatically.  
    c) If choused "SECA" - than if on channel exist seca ECM pids, box change to SECA 
       ECM pids automatically (even on card we don't have this Ident), 
    d) If choused "NONE" - than if on channel exist seca ECM pids, box don't change  
       ECM pids automatically. You can always change ECM pids from "ECM PMT SCAN MENU". 
       Useful if channel transmit in Seca and you want to watch this channel in other 
       systems than Seca.

3. Changed SR one more time - added 22500 on 42 EAST and 18386 on 15 WEST.
   22000...................................
   25550...................................
   27500...................................
   22500...................................
   18056...................................
   18386...................................
   28125...................................
   30000...................................

4. Very colourful secondary menu.

5. Cyfra+ now in SECA2 so Polish fonts replaced by French fonts. Who want polish fonts
   use Polish version Multicam 2.1 - very good for that - (recomended). 
_____________________________________________________________________________________
Verision 4.32


1.Added ECM menu - now you can choose any ECM from Menu, but work only seca cards on
  seca and Multicam FUN card on other encryption from Polish Multicam project.

2. New SR are 

00=22000
01=25550
02=27500
03=20000
04=18056
05=29900
06=28125
07=30000

28125 for Nagra channel on 30 WEST

_____________________________________________________________________________________
Version 4.30 

1. Fixed something.

NOTE : if you use files 3in1 or 5in1 (ALLCAM files) second seca ident on the card 
       should be free (any unreal seca ident for example ID=23 23).
       For TPS pack you should load channel list by computer with right ECM pids - my
       list don't have right ECM pids, so you have to edit tham - my list it is just 
       like example for training to load channel lists.
_____________________________________________________________________________________

Version 4.29 

1. Fixed second iden check. You don't need to put falsh Ident to the card ( like for 
Viaccess 01 90 and 00 90 )

2. Some fix on 2000 channels.

3. If you have problems with Palco I have quick fix, but not very nise - go to address
0xD5AC8 and change 0x3B to 0x00 - interactive services would be off.

_____________________________________________________________________________________

Version 4.28 

1. Added 2000 channel. Don't go on interactive services - you loose last 1000 channel.
Or download version 425 with 1000 channel.

2. Cool Volume banner.

3. Added Irdeto and Betacrypt.

4. You don't need any more put Ident 10 01 on the card for viaccess.
______________________________________________________________________________________

Version 4.25

This version can set RIGHT ECM to this encryptions. Go to Menu 4 and set the encryption.

01 00 SECA 
0B 00 CONAX
0E 00 Power WU
18 00 Nagravision
0D 00 Cryptoworks 1
05 00 Viaccess

Now I think box is ready to work with all providers in the list, but not on original 
card (like it is done in 5in1 for Humax 5400 on Piccard2 or FUN or .....). 
We need to write now special card for this. Off all providers Nagravision is only 
one that already hacked - so I think on the next step we need to write special card 
for Nagravision.

This is PMT from some channels 

intertrack - POWER WU
02 B0 23 (0046) DF 00

00 (E938 ) F0 (0C->0F 04 53 41 50 53 09(->04(0E00)(E7B6)))

02 (E938 ) F0 00

04 (E910) F0 00

A4 9D 10 65

NBC FEED - POWER WU
02 B0 23 (000D) C3 00

00 (E5B4) F0 (0C->0F 04 53 41 50 53 09(04->(0E00)(F77D)))

02 (E5B4) F0 00

04 (E58C) F0 00

02 24 3B DC

B4U - CONAX
02 B0 23 (0004) C1 00

00 (E320) F0 (06->09(04->(0B00)(E02C)))

02 (E320) F0 (03->52 01 00)

04 (E321) F0 (03->52 01 01)

E0 DC 0B 3E

ZTV SWERIGE - VIACCESS
02 B0 4A (0488 ) D3 00

00 (E489) F0 00

02 (E489) F0 (14->11 01 FF 09(0F->(0500)(E618 ) 10 01 00 13 01 20 14 03 (010C09)))

03 (E48A) F0 (11->09(0F->(0500)(E618 ) 10 01 00 13 01 20 14 03 (010C09)))

05 (E490) F0 (09->0F 04 00 00 00 56 90 01 86)

DB 02 A0 A4

MTV NORDIC - VIACCESS
02 B0 6D (0866) C7 00

00 (E867) F0 (22->09(0F->(0500)(E9F6) 10 01 00 13 01 20 14 03 (010C09))
09(0F->(0500)(E9F7) 10 01 00 13 01 20 14 03 (010C29)))

03 (E868 ) F0 (28->0A (04->65 6E 67 00) 09(0F->(0500)(E9F6) 10 01 00 13 01 20 14 03 (010C09))
09(0F->(0500)(E9F7) 10 01 00 13 01 20 14 03 (010C29)))

06 (E869) F0 (07->56 (05->65 6E 67 09 00)) /eng

DE E9 DD D7

POLSAT1 - NAGRAVISION
02 B0 41 (1C87) E9 00

00 (E121) F0 00

06 (E123) F0 (0D->0A (04->70 6F 6C 00) 56 (05->70 6F 6C 09 00)) /pol eng

02 (E121) FO (0C->09(04->(1800)(E120)) 0A (04->65 6E 67 00)) /eng

04 (E122) FO (0C->09(04->(1800)(E120)) 0A (04->70 6F 6C 00)) /pol

03 E3 EB 37

MTV2 - SECA-VIACCESS-CRYPTOWORKS1,2
02 B1 0D (6FE9) D7 00

00 (EC13) F0 00

02 (EC13) F0 (44->09(11->(0100)(E532)(000C)(FF00000000000000)(40183D)) 52 01 01
09(0F->(0500)(E533) 10 01 00 13 01 20 14 03 (007800))
09(04->(0D00)(E534))
09(04->(0D02)(E61A))
09(0F->(0500)(E535) 10 01 00 13 01 20 14 03 (008000)))

03 (EC14) F0 (44->09(11->(0100)(E532)(000C)(FF00000000000000)(40183D)) 52 01 02
09(0F->(0500)(E535) 10 01 00 13 01 20 14 03 (008000))
09(0F->(0500)(E533) 10 01 00 13 01 20 14 03 (007800))
09(04->(0D00)(E534))
09(04->(0D02)(E61A)))

C0 (E12D) F0 (41->C6 05 01 00 05 03 FF C2
(38->43 53 45 5F 50 49 4C 31 43 53 45 5F 43 48 41 4E 43 53 45 5F
50 49 4C 32 43 53 45 5F 53 45 53 00 43 53 45 5F 45 50 47 00
43 53 45 5F 46 55 54 31 43 53 45 5F 46 55 54 32))
/CSE_PIL1CSE_CHANCSE_PIL2CSE_SES.CSE_EPG.CSE_FUT1CSE_FUT2

C1 (E12C) F0 (0A->C2 (08->50 49 4C 4F 54 45 00 00)) /PILOTE.

C0 (E0DE) F0 (0A->C2 (08->43 48 41 49 4E 45 00 00)) /CHAINE.

C0 (E0C3) F0 00

81 (E021) F0 00

56 36 E5 F1

IRDETO

***09(04->(0602)(****)) 

As you can see only Viaccess and Seca have Ident in PMT, all other encryption don't have Ident in PMT and on this idents box don't check ident from card or set checking for ident 00 00 - that ident have all Seca card and thats why it is work - I try before also delete all provider except 00 00 and it is work too.

And box have problem with CA system id with idents that don't have zeros at the end XX 00 - Irdeto and crypto have XX 02 and XX 03 and thay don't work.

I think for nagravision box is ready or at least we don't need to patch basic - maybe we need to patch cardl, but not basic. That's why differences between Seca and Conax MHW in cardl, not in basic.

Off course for viaccess we need to redo some routing in basic for provider ident checking.

And this is more detailed description of PMT

MTV2 - SECA-VIACCESS-CRYPTOWORKS1,2

02 B(1 0D-number bites in PMT) (6FE9-servise_ID) D7 00

00 (EC13-Video pid) F0 00

02 (EC13-Video pid) F0 (44-number of bites in video pid ->09(11-number bites in CA routing->(0100-CA_system_id)(E532-ECMpid+0xE000)(000C-provider ident)(FF00000000000000-seca PBM)(40183D-seca subscription DATA)) 52 01 01
09(0F-number of bite in CA routing->(0500-CA system id)(E533-ECM pid) 10 01 00 13 01 20 14 03 (007800-provider id))
09(04-number of bite in CA routing->(0D00-ca system id)(E534-ECM pid))
09(04->(0D02)(E61A))
09(0F->(0500)(E535) 10 01 00 13 01 20 14 03 (008000)))

03 (EC14) F0 (44->09(11->(0100)(E532)(000C)(FF00000000000000)(40183D)) 52 01 02
09(0F->(0500)(E535) 10 01 00 13 01 20 14 03 (008000))
09(0F->(0500)(E533) 10 01 00 13 01 20 14 03 (007800))
09(04->(0D00)(E534))
09(04->(0D02)(E61A)))

C0 (E12D) F0 (41->C6 05 01 00 05 03 FF C2
(38->43 53 45 5F 50 49 4C 31 43 53 45 5F 43 48 41 4E 43 53 45 5F
50 49 4C 32 43 53 45 5F 53 45 53 00 43 53 45 5F 45 50 47 00
43 53 45 5F 46 55 54 31 43 53 45 5F 46 55 54 32))
/CSE_PIL1CSE_CHANCSE_PIL2CSE_SES.CSE_EPG.CSE_FUT1CSE_FUT2

C1 (E12C) F0 (0A->C2 (08->50 49 4C 4F 54 45 00 00)) /PILOTE.

C0 (E0DE) F0 (0A->C2 (08->43 48 41 49 4E 45 00 00)) /CHAINE.

C0 (E0C3) F0 00

81 (E021) F0 00

56 36 E5 F1


To be able to send ECM to the card box do two checking 

First it is checking is to set right ECM pids to existing on the card idents.
As you can see above Box do this checking only for Viaccess and seca all other 
providers don't transmit Idents in PMT. For example if you put on card ident 10 01 
and set encryption viaccess box - only than box sets right Viaccess ECM pids, for 
Nagra it is sets anyway - so this checking on nagra don't matter - ECM pids are set.

Second checking box do before send actual ECM to the card - box checks if on card 
exists current Ident, but box check it in seca format.

You need to log Nagra ECM and see what bite in ECM nagra 
stream XX XX XX (XX XX) XX XX ...... and put on the card ident bites in () - this is 
the place of seca IDENT - then box sends actual ECM instruction to the card - after 
that I don't know right now what we should do.

I try to disable this checking, but rigth now we can put this fake ident and box sends ECM. 

All this is already checking with Viaccess system.

If you put fake ident to the card 10 01 (for ECM pid checking PMT) 
and 01 90 (for ECM stream checking) - and put box on "AB Motors" box would send ECM 
to the card.
________________________________________________________________________________________

Version 4.22

I did not receive any smart IDEAs about buttons, everybody stupid or something.

1. Weekly EPG now is working, just press "e" button. 

2. DiseqC now is should work. If you ever load my eeprom in the past, now you need to erase your 
eeprom (write FF FF FF FF FF FF ........). And don't ever load my old eeproms again - you disable 
DiseqC and who knows what else. Or You need to load eeprom from this version.

3. Added second Pilote for German channels on ASTRA and Stream, TPS packedge on Hotbird - just
press "c" button.  
________________________________________________________________________________________________

Version 4.13

1. This is all in 7 buttons version. I try to do it more comfortable and I make all needed function 
when you watch TV in 7 button at the top of the remote. 
PILOT, PROGR, left/right/up/down buttons and OK. With this buttons you can cruise on channels, access
to all function in Pilot - two programm guide (more info included), access to channel list - and 
all old function like change volume.

- Button "PROGR" now work like button "E" before Channel List, button "E" now is free.

- When you go to Pilote function and use to press "+" button for more info, now I redo this 
function to "PROGR" button.  
 
- Added FREEZE function - you need to press "B" button for that.

- Added PIDs info in bunner "+" - so if you want to see PIDs on current channel just press "+" 
button when you watch channel

- also for many requests translated PILOT function to English.

- Channel List work now little different - to exit Cannel list press "PROGR" button 
or "Exit" button. "OK" button it is just to view Channel not view and exit like before.

Maybe some dudes with non Polish boxes don't understand what is "PROGR" and "PILOT" button, so
for this dudes I attached picture of the Polish remote so you can translate to your box. Or you 
can go to my pages and see this picture - link at the top of this file.

eeprom413.bin and also added eeprom.txt - eeprom setting files only for PIONERO - needed only 
if you want to load channel list.  

Happy Viewing and Happy NEW YEAR.
________________________________________________________________________________________________

Version 4.12

1. Deleted from bit map responsible for load applications from satellite bits for all providers 
except seca provider - now it is 3b 00 00 00 00 00 00 00. In this way satellite provider cannot load 
anything in your box (attacks, pid for Epg and other staff).

- now you can use ANY CARD, even one year old (attacks don't work).

- function "E" channel list now work on ANY CHANNEL (even if channel not assign to any provider)

- function "Pilot" (two program guide) work if it possible on ALL PROVIDERS, you don't have to reboot
box to go from one provider to another any more, it is just work if you press "Pilot" button on any channel
if that channel transmit two program guide.

- function "EPG" (weekly program guide) don't work any more (I work on that - maybe in next version)

- clock don't sets by satellite - you have to set it manually.


2. PPV works in event mode (even bit map is off) , but you need to load PPV event mode manually - you 
need to go on PPV channel and press "D" button. PPV work also in preview mode. For different mode you 
need different cards, for event mode use files for card like bacterio or electro or any piccard2 files.
Some PPV channels don't work in preview mode like playboy on kiosk and others, so that channel you
have to watch in event mode only.

3. PPV provider auto switch. Support all four PPV providers 00 04, 00 09, 00 0C, 00 10, all other provider
don't support. If it is would be needed I can do then. Don't need to reboot your box to change provider anymore*.

*- you can't load two or more PPV event mode from two or more different PPV providers when you watch 
in event mode, so you need to reboot your box to go from one provider to another if you watch in event
mode.

4. Deleted 27195 symbolrate from previous because transporder with this symbolrate don't work anymore.
Now it is like this.

22000=00
25550=01
27500=02
20000=03
18056=04
28000=05
19540=06
30000=07
29900=08
27800=09
26000=0A
22500=0B
24000=0C
24500=0D

24500, 22500, 27800, 28000, 26000 - 1 WEST
24000, 25550, 20000, 18056, 27500 - 5 EAST
30000, 27500 - 7 EAST
27500, 28000, 29900, 30000 - 13 EAST
27500, 30000 - 16 EAST
22000, 27500 - 19 EAST

On transporders with the same TRANSPORDER ID and NETWORK ID automatic scanning not work properly, 
it is skips, so if you want for sure to program this channels you need to program by computer.
For example on 5 EAST exists this transporders - 12303 and 12418 - this transporders have the 
same TR ID and NET ID and you have to program channels from that trnsporders in automatic scanning.
Work only last scanning transporder, so to watch channels from transporders with the same ID's
edit channel list with wrong ID's before putting in to box. You can see an example in my list.bin
on 5 EAST.

Also on 5 EAST exist very bad trasporder 11727 Horizontal - after that transporder 
box go "crazy" and cannot find any channels after that - so if you want search transporders after
this bad one you need to disconnect antenna when receiver scans 11727, and then connect again.

It is scans a little bit longer, but support this different symbolrates. If you want any 
other symbolrates let me know, but I don't know how about really slow symbolrates - I work on that.

5. You need to use Pionero 2.0 or 3.0 for loading software and setting eeprom (I don't have time to make it for GGF1367
but if you want to set eeprom with GGF1367 you need to convert files yourself) 


appli_p.rcu - software

list.rcu - channel list for 19 East, 13 East and 5 East (only channels I can receive in Ukraine).

eeprom.bin - eeprom setting file for pionero - needed only if you want to load channel list.


Reports are welcome. I really want to know what you think about this version, 
it is better or worse previous version or original version in your country???



