Gast Geplaatst: 29 april 2004 Delen Geplaatst: 29 april 2004 Voor de mensen die in sky willen verdiepen. NDS Command Structure 2 v0.5 Card Version 2.0 This information is for academic interest and educational purposes only. There is nothing in this text that will enable decoding of NDS encryption. Illegal watching of encrypted TV is not condoned. 1. Introduction 2. Answer to Reset (ATR) 3. The Zero Knowledge Test (card verification) 4. The communication Protocol 5. The Entitlement Control Message (ECM) 6. The Entitlement Management Message (EMM) 7. The Instructions in detail 8. The signature 9. Codes 9.1 The Fuse Byte 9.2 The Rating Byte 9.3 The Parental Control Byte (PCB) 9.4 The Country Code. 9.5 The Regional code 9.6 The Bitmap algorithm 9.7 The keys 9.8 Structure of Date and Time 9.9 The Status Words 9.10 The Channel Entitlements 1.Introduction: The card is always asked by the ICAM to receive or send information. The card never asks the ICAM to do anything! To do this the ICAM always sends a 5 byte long command packet header to the card. Standard 5 byte ISO-7816 header : "CLASS INSTRUCTION PARAM1 PARAM2 PARAM3" With the introduction of the new card 2 new classes were introduced: Class Meaning D0/D1 Replaces 48 of the old card D2 appends a 16 byte signature on the instruction reply D3 Use an additional stream cipher to secure transmission between card and box (NOT using internal HashCircuit) (Class 48 is no longer supportet and causes the card to rerun part of the initialisation including the ATR output.) PARAM1 and PARAM2 are used differently and are often ignored. PARAM3 is the length of the packet to be send or expected to receive. The cards first reply is the instruction number which is a vital value for the ICAM. These instruction numbers are possibly contained in a jumptable in the ICAMs source leading to a specific offset where processing continues. 2.The Answer To Reset (ATR): Former ATR: 3F 7F 13 25 03 40 B0 0B 69 4C 4A 50 C0 00 00 53 59 00 00 00 New ATR : 3F 7F 13 25 03 33 B0 06 69 FF 4A 50 D0 00 00 53 59 00 00 00 3F TS - "3F" indicates inverse convention ("3B" would be direct convention) 7F T0 - "7" (0111...) indicates TA1,TB1,TC1 will be sent "F" (...1111) indicated that 15 historical bytes will be send. 13 TA1 \ 25 TB1 - used for baudrate calculation 03 TC1 / 33 B0 06 69 - version Info. Has been "40 B0 0B 69" FF - Has been ASIC reply. Now FF because he is no longer used due to multiple reasons 4A 50 C0 00 00 53 59 00 00 00 - the 15 historical bytes (system ID) 3. The Zero Knowledge Test (card verification) These three Instructions are sent to verify that the card in the decoder is a true NDS card Variables used: r - 512 bit random number n - 512 bit number which is the product of two large prime numbers;is constant;can be found in the ROM of the card and in the IRD firmware s - based on a complex function of n 3.1 generate a random number r >D1 4A 10 01 01 <4A - acknowledgement >01 - selects one of two seeds that is to be used for a random number r <90 20 - OK (90 00 not OK) 3.2 send 96-bit hash of r² MOD n to IRD >D1 5A 10 01 10 <5A - acknowledgement <F2 64 20 49 81 D4 14 86 E2 9A FE CA 00 00 00 00 - 96bit hash of r² MOD n <90 20 - OK (90 00 not OK) 3.3 send either r*s MOD n or r to IRD 3.3.1 IRD asks for r >48 5A 10 02 40 <5A <bd fa d2 2d ef 2b 63 fa c7 b2 68 82 9c 5d 13 31 <33 f5 99 a1 63 cb aa cf 41 c9 b0 78 d4 c4 42 f1 <1f d8 93 b9 bb 3b 6f 6f 62 2f c7 2f 06 d3 c4 1d <48 84 d7 b2 c1 64 6e 7c 05 56 f1 29 61 bc c7 00 <90 20 - OK (90 00 not OK) 3.3.2 IRD asks for r*s mod n >48 5A 11 02 40 <5A <71 94 69 64 7F 84 B2 EA 1D E2 16 E9 AE 79 F2 49 <CC 64 42 FE 36 52 44 90 FA C5 E9 C9 72 66 71 25 <6E 6A 82 D9 B5 7B 1C EE 21 1C 55 0B BF DE 51 B4 <A0 F0 98 BD 19 E8 AD 9C C0 61 E2 B1 DA 39 02 00 <90 20 - OK (90 00 not OK) 4.The communication Protocol: 4.1 Instruction Overview Instruction Meaning 02 BSkyB identifier "SYAV" and ROM version 02.00 04 receives one byte and writes it to 8022h 06 sends the byte at 8022h 0E sends one byte (09) - unknown 12 sends encrypted chip information 1E sends 9 bytes - unkown 28 2A sends detailed card information (mostly from EEPROM) 40 makes it possible to process commands 42 4C 4.2 Command Overview The values in brackets indicate the fixed length byte for this command. The remaining commands have all a variable length. Red - commands are processed in realtime (no matter if signature is correct or not) Fuchsia - commands are buffered and executed via the deferred command buffer only if the signature is correct Lime - command is processed in real time but don't change anything. Only important for ASIC. Blue - Teal - Black - handled seperatly Basic command set: 00 [00] - No Operation 01 [04] - Sets Date/Time 02 [01] - Sets rating byte, marks message as ECM 03 [03] - checks channel entitlements 04 [00] - set bit 2Ah.0 05 [00] - clear bit 2Ah.0 06 [0B] - compares Postal code, opens card filter if they match 07 LE - set bit 2Ch.6 08 LE - Bogus! 09 [03] - initialise ASIC with specified key, flushes the command buffer (nanos which need no signature stay) 0A [05] - Bogus! 0B LE - write 14 bytes to 9E36h 0C [00] - 0D [00] - Bogus! 0E [00] - Bogus! 0F [04] - Bogus! 10 [02] - Bogus! 11 [04] - Bogus! 12 [12] - set Blackout bits 13 [02] - Bogus! 14 [01] - clear Blackout bits 15 LE - Bogus! 16 [07] - Bogus! 17 LE - Bogus! 18 [03] - 19 [01] - stores the Time Zone in EEPROM (9CC9h) 1A [04] - Bogus! 1B [03] - Bogus! 1C [00] - Bogus! 1D LE - stores the Zip Code in EEPROM (9CA8h) 1E [08] - set the PostCode 1F LE - 20 [00] - Bogus! 21 [00] - Bogus! 22 [00] - Bogus! 23 [00] - Bogus! 24 [00] - Close Filter 25 [00] - Flip filter, from open to closed or vice versa 26 [01] - 27 [0D] - Card Swap! (write cardswap key to 9FF5h/Date stamp to 9CA0h/update fuse) 28 [07] - Bogus! 29 [08] - something to do with PPV (add entry to purchase list?) 2A [01] - Bogus! 2B [02] - UnSwap card! (write cardswap send key to 9FF5h/Date stamp to 9CA0h/update fuse) 2C [04] - Bogus! 2D [04] - sets Activation Date/Time 2E [08] - Bogus! 2F LE - Bogus! 30 [00] - 31 [03] - checks Serial Number 32 [03] - checks Shared Address (whole card group) 33 LE - checks Shared Address, processes bitmap 34 LE - Bogus! 35 [00] - Bogus! 36 [00] - Bogus! 37 LE - Bogus! 38 [00] - checks Postal Code 39 [00] - Bogus! 3A [00] - Bogus! 3B LE - Bogus! 3C LE - Bogus! 3D [02] - activates card and write PPV spending limit 3E [00] - deacivate card 3F [02] - Bogus! 40 [00] - 41 [05] - add/update channel entitlements (tier) 42 [02] - drop channel entitlement (tier) 43 [02] - Bogus! 44 [04] - 45 [05] - Bogus! 46 LE - Bogus! 47 [01] - Bogus! 48 [00] - 49 [02] - Bogus! 4A [05] - Bogus! 4B [04] - Bogus! 4C LE - Bogus! 4D [00] - sets some data, PPV related, both in PPV ECM and EMM 4E [04] - writes four bytes 4F [14] - Bogus! 50 LE - Bogus! 51 LE - Bogus! 52 LE - Bogus! 53 LE - 54 LE - same as cmd53 55 LE - Bogus! 56 LE - Bogus! 57 LE - 58 [00] - 59 LE - 5A LE - Bogus! 5B LE - 5C LE - Bogus! 5D LE - 5E LE - Bogus! 5F LE - 60 LE - Bogus! 61 LE - Bogus! 62 LE - Bogus! 63 LE - Bogus! 64 LE - Bogus! 65 LE - Bogus! 66 LE - Bogus! 67 LE - contains signature to authorise packet 68 LE - 69 LE - Bogus! 6A LE - Bogus! 6B LE - Bogus! 6C LE - Bogus! 6D LE - sets some data, unknown, values can be read with INS78 6E LE - same as cmd6D 6F LE - Bogus! 70 LE - Bogus! 71 LE - Bogus! 72 LE - sets some data, unknown 73 LE - 74 LE - 75 LE - writes some data including Local Region Code. Values can be read with INS58 76 LE - Bogus! 77 LE - Bogus! Extended command set: 7E LE - sets signature and key adjustment bytes 7F LE - sets signature and key adjustment bytes (bridges gap between 1.X and 2.0 cards) CB 02 - sets two bytes, unknown 4.3. Card initialisation: The following Instructions are issued by the box during initialisation: 1. Ins48 2. Ins4C ???? D1 48 00 00 36 D1 4C 00 00 09 D1 40 40 80 4A D1 42 00 00 16 D1 5C 00 00 04 3. The IRD then askes to send 09 bytes with 48 4C 00 00 09 >D1 4C 00 00 09 <4C card acknowledges Instruction >IN IN IN IN IRD Serial Number >02 00 00 D8 02 unknown <90 20 correctly married If the card belongs to this box it replies 90 20 (OK). If the card does not belong to this box it replies 90 00 (Not OK). If the card has the fuse byte set but is previously unmarried, this command writes the IRD number to the card, thereby completing the marriage (sw1/2 = 90 a1). If the card is deactivated and this command arrives the IRD Serial Number is written to the cards EEPROM too (sw1/2 = 90 20). If the IRD number is set to 00 00 00 00 it will be accepted by any box. eg an engineer's card. The card must receive the correct IRD number before it will give valid responses to ECMs and EMMs. 4. The card is then asked for 09 bytes with 48 2C 00 00 09. >48 2C 00 00 09 <2C card acknowledges Instruction <00 00 convert to HEX and add then 8000h - this is your PIN <XX XX 00 00 on active card: FF FF 00 00, on deactivated card: 00 00 00 00 <00 Parental Control Byte (PCB) - see below <00 00 unknown <90 20 sw1/sw2 We can change the PIN using command 48 2e 80 00 09. 5. Next we have an often repeated cmd 48 5C 00 00 04. It's a bogus instruction. Nothing is done although the box knows the card is still present and working. >48 5C 00 00 04 <5C card acknowledges Instruction <00 00 00 00 allways zero <90 20 The command flushes a buffer containing the 7E nano. So don't issue INS5C if you haven't allready asked for the key (issued INS54) after sending an ECM to the card. You would get a totally wrong key. 5. The Entitlement Control 5.1. The Entitlement Control Message (ECM) The following is a sample ECM packet logged with a DVBs. You'll see that only the last part is actually passed on to the smartcard. The first part is processed by the Box. 81 70 5C 00 00 01 0E 4D 1D 69 78 FF FF 19 25 01 20 01 00 00 B8 49 7E 12 00 00 00 00 00 00 00 00 E0 17 EA C7 14 8E 45 23 00 00 7F 12 E0 C0 32 4E 1A F8 5F 1A D6 78 DF F0 92 F1 BE 56 DD F7 09 10 10 00 01 4D 1D 69 78 CB 02 FF FF 02 00 03 00 10 00 03 B8 69 00 67 08 5D E7 B2 D3 82 0B 2F 70 Processed ONLY by the Box: 81 70 - packet separator, first byte alternates between 80 and 81 indicating even and odd CW 5C - length of the whole packet 00 00 01 - allways the same 0E - Header length 4D 1D 69 78 - Date and Time FF FF - different on BOX office but usually FF FF 19 25 - 9th and 10th byte of key returned by INS54 01 - either 01 or 11 indicating plain CW or encrypted CW is returned by card 20 01 00 00 - allways the same B8 - Checksum (00+00+01+0E+4D+1D+69+78+FF+FF+19+25+01+20+01+00+0 0=...B 49 - length of the packet send to the SmartCard Processed ONLY by then SmartCard: >D1 40 00 00 41 generated instruction header from the ICAM <40 >00 - dummy send by the ICAM too >7E 12 00 00 00 00 00 00 00 00 E0 17 EA C7 14 8E 45 23 00 00 - signature and key adjustment >7F 12 E0 C0 32 4E 1A F8 5F 1A D6 78 DF F0 92 F1 BE 56 DD F7 - signature and key adjustment (bridge gap between 1.X and 2.0 cards) >09 10 10 00 - set key >01 4D 1D 69 78 - current Date and Time >CB 02 FF FF - sets two bytes >02 00 - current rating byte for the film >03 00 10 00 - Check for Channel "00 10" entitlement entry >03 B8 69 00 - Check for Channel "B8 69" entitlement entry >67 08 5D E7 B2 D3 82 0B 2F 70 - signature <90 00 - sw1/sw2 5.2 Generation and output of the key (which includes the CW) >D3 54 00 00 3C <54 - Box acknowledges instruction <XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX \ <XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX - encrypted data <XX XX XX XX XX XX XX XX XX XX XX XX XX / <XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX encrypted signature <90 20 - Sw1/Sw2 6. The Entitlement Management Message (EMM) 9. The interesting EMMs 48_42. These are variable length 16h, 22h, 30h, 31h, 35h or 3Eh etc. They can be addressed to all cards using public key 10 (sometimes using a post-code filter), a group of cards (using shared address/CUSTWP bitmap and group key 12), or to a single card using private key 14 and unique address. EMM length 16h This seems to be used for setting the date and time. >09 10 00 00 initialise ASIC with selected 10 (public key - all cards) >01 36 15 91 1d Set date and time >10 cc 33 10 nano and two data bytes that increment on each successive EMM >67_08 Signature nano >d8 2f 9a 8e 40 0b 3e 6a Digital signature (not neccessary for the included nanos) <90 20 EMM length 30h >09_10 00 00 initialise ASIC with selected 10 (public key - all cards) >24 Flag, Close Filter >38_09 postal code address nano >06 Opens card filter if this is the post code..... >48 52 33 20 20 35 51 41 "HR3 5QA" postal code >6d_09 nano and length >01 08 00 73 17 92 9f ff ff data - always the same?? This is found in the 48_78 string. >6d_09 nano >02 03 45 57 60 00 ff ff ff data - always the same?? >67_08 signature nano >60 7f c9 6b dd f4 8c e6 signature EMM length 31h. This EMM sets the Time Zone and Region Code >09 10 00 00 initialise ASIC with selected 10 (public key - all cards) >24 Flag, Close Filter >38_09 postal code address nano >06 Opens card filter if this is the post code..... >4c 4e 32 20 20 34 50 5a "LN2 4PZ" >19 00 Set time zone to 00 (GMT) >75_13 Nano and length >00 47 42 52 XX 00 00 00 00 00 00 00 00 00 00 00 00 00 00 GBR Region byte >67_08 >59 16 84 78 a0 d5 ef 8a sig EMM length 35h >09 10 00 00 initialise ASIC with selected 10 (public key - all cards) >24 Flag, Close Filter >38 09 postal code address nano >06 opens card filter if this is the post code..... >4c 53 31 37 20 38 42 51 "LS17 8BQ" >6e_07 6e_07 Nano >06 01 01 01 01 20 08 data, unknown >6e_07 6e_07 Nano >07 01 01 01 01 8f 00 data, unknown >6e_07 6e_07 Nano >08 01 01 01 01 20 00 data, unknown >67_08 signature nano >7a ee 04 4c 88 66 db 0a signature EMM length 3Eh >09 10 00 00 initialise ASIC with selected 10 (public key - all cards) >24 Flag, Close Filter >38 09 postal code address nano >06 Opens card filter if this is the post code..... >47 4c 37 20 20 33 53 44 "GL7 3SD" >6e_07 6e_07 Nano >01 01 01 01 01 8f 00 data, unknown >6e_07 6e_07 Nano >02 01 01 01 01 8f 00 data, unknown >6e_07 6e_07 Nano >03 01 01 01 01 8f 00 data, unknown >6e_07 6e_07 Nano >05 01 01 01 01 8f 00 data, unknown >67_08 signature nano >e1 29 d2 77 3c 0d f3 11 signature ----------- The following seem to be the activation EMMs. Usually addressed to a Shared Address/CUSTWP bitmap. These occur about every ten minutes. The channel entitlements seem to be activated one at a time. This explains why when a card is activated the channels do not all get switched on at the same time. EMM addressed to SA/CUSTWP bitmap Expired Card >48 42 00 00 3c <42 card acknowledges Instruction >09 12 00 00 initialise ASIC with non-public (group) key 12 >33 33 nano >00 SN SN 1st three bytes of SN (Shared Address) >00 02 00 00 00 00 00 00 00 00 0c 00 00 00 02 80 >10 00 00 00 02 00 00 00 00 00 00 02 00 00 80 20 CUSTWP bitmap >41 b7 21 38 06 C0 Channel Entitlement update and expiry date >25 Flip filter cmd from open to closed or vice versa >42 b7 21 Delete Channel Entitlement >67_08 signature nano >97 d2 a5 bd df 5f e7 eb signature <90 80 Not OK. EMM addressed to SA/CUSTWP bitmap Valid Card >48 42 00 00 3c <42 card acknowledges Instruction >09 12 00 00 initialise ASIC with non-public (group) key 12 >33 33 nano >00 SN SN 1st three bytes of SN >00 00 22 00 00 06 02 30 84 40 02 00 00 00 10 00 >00 40 00 40 00 00 04 20 40 00 10 00 00 00 20 00 CUSTWP bitmap >41 b7 77 38 0f C0 Channel Entitlement update and expiry date >25 Flip filter cmd from open to closed or vice versa >42 b7 77 Delete Channel Entitlement >67_08 >1a 56 57 00 de 40 64 74 <90 a0 Not OK. Not in valid bitmap. Same Card ten minutes later: >48 42 00 00 3c <42 card acknowledges Instruction >09 12 00 00 initialise ASIC with non-public (group) key 12 >33 33 nano >00 SN SN 1st three bytes of SN (Shared Address) >00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 CUSTWP bitmap (Only one card addressed) >41 b8 2d 38 09 C0 Another Channel Entitlement update and expiry date >25 Flip filter cmd from open to closed or vice versa >42 b8 2d Delete Channel Entitlement >67_08 signature nano >ae d2 35 47 a7 46 66 f0 signature <90 a0 Not OK. Is not to be written to the card as not entitled. A successful entitlement update: >48 42 00 00 3c <42 card acknowledges Instruction >09 12 00 00 initialise ASIC with non-public (group) key 12 >33 33 nano >00 SN SN 1st three bytes of SN (Shared Address) >ff 7e 1f ec d8 3c 29 b9 c9 ab e9 a2 fc 58 cf 6d >9d fd 1e 9c 2b ed 73 e4 e2 f6 34 cb 36 1f 7e 39 CUSTWP bitmap >41 00 1d 38 1b C0 BBC channel entitlement ID >25 Flip filter cmd from open to closed or vice versa >42 00 1d Delete Channel Entitlement >67_08 signature nano >e4 5c eb c7 64 2c 97 31 signature <90 21 OK. Accepted Another type of group update addresses the card by its shared address but uses the 32 nano without a CUSTWP bitmap. This is another way of updating a whole group of cards. >48 42 00 00 15 <42 >09 12 00 00 Initialise ASIC with non-public (group) key 12 >32 Open filter for whole card group >SN SN SN SN of card group >42 b7 82 Delete Channel Entitlement >67 08 >30 51 8c a7 eb 0a 32 c8 >90 a0 Not OK. Update not needed as Channel Entitlement did not exist? The PPV EMMs seem to use INS46 >48 46 20 01 3E <46 card acknowledges Instruction >1f 08 unknown >09 10 00 00 initialise ASIC with selected 10 (public key - all cards) >01 39 04 0c 70 Set date and time >02 52 rating byte >38_03 08 00 cc nano and data (length can also be 05 or 07) >25 Flip filter cmd from open to closed or vice versa >04 Flag, unknown >4d_0e 1e 00 39 10 00 65 06 00 00 a3 e3 00 d9 e4 unknown, same as in PPV ECM >4d_0e 1e 00 39 10 00 65 06 00 01 45 e3 01 b1 e4 unknown, same as in PPV ECM >67_08 signature nano >f1 54 d4 97 66 c3 7b 37 signature <90 a0 Not OK ================================================== =========================================== 12. Occasionally we get a 48 5e 00 0b 01. Reads one status byte from card. 48 5e 00 0b 01 5e card acknowledges Instruction 03 03=valid?, 00=invalid? 90 20 sw1/sw2 [see also additional INS 48 5e 00 0e 62] This cmd always seems to be followed by the next one:- 13. Another occasional cmd. 48_78. This seems to follow the 48_5e. Are they related? 48 78 03 00 14 78 card acknowledges Instruction 08 00 73 17 92 9F FF FF 01 08 00 73 17 92 9F FF FF 01 8F 00 pink string was written with the 6D_09 nano 90 20 OK 48 78 08 00 14 78 card acknowledges Instruction 08 00 73 17 92 9F FF FF 01 08 00 73 17 92 9F FF FF 01 20 00 pink string was written with the 6D_09 nano 90 20 OK ================================================== =========================================== The Switch-On Commands This is a log of the activation of a BBC card. They use the private key 14 and address the card by its unique address using nano 31. These commands follow the activation EMMs for the card's postcode area. This is why you have to wait for the commands to be sent. Three of the EMMs are repeated a number of times, at about 20 minute intervals, over a period (24 hours?). This is the first activation command: >48 42 00 00 16 <42 card acknowledges Instruction >09 14 00 00 initialise ASIC with private key 14 >31 checks Serial Number nano >00 SN SN SN Serial Number >3D 03 ec sets PPV spending limit and activates card (fuse byte now 05) >67_08 signature nano >01 02 03 04 05 06 07 08 signature <91 81 successfully written The greater the values set with the 3D the greater the fuse value? The IRD then sends this request: >48 58 00 00 35 <58 card acknowledges Instruction >05 Fuse byte >01 09 60 always the same >SN SN SN SN card SN (unique address) >ff ff ff ff unknown >SN SN SN three bytes of card number (shared address) >00 ff ff ff 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 unknown >00 00 00 00 will be written with the 4e nano on activation (still zero) >47 42 52 "GBR" on British cards only >00 01 00 00 0X 0X 00 00 00 00 unknown <91 80 OK Note the sw1/2 has changed from 90 00 on a virgin card to 91 80 now that the fuse byte has been set and the region code is intact. Next comes the IRD number. >48 4C 00 00 09 <4C card acknowledges Instruction >IN IN IN IN IRD Serial Number >02 00 00 58 02 unknown <90 A1 IRD number saved successfully/correctly married It would seem that when the fuse byte has been set, the first time the card receives this IRD number test command, the IRD number is written to the card. The sw1/2 is 90 a1. Next, request the PIN and Parental control rating byte (3F). >48 2c 00 00 09 <2C card acknowledges Instruction <84 d2 convert to HEX and add then 8000h - this is your PIN <FF FF 00 00 on deactivated card: 00 00 00 00 <3F Parental Control Byte (3F - unrestricted) <00 00 unknown <90 a0 sw1/sw2 Request region code. Note at this stage the specific region byte is still zero. >48 1C 00 00 20 <1C card acknowledges Instruction <47 42 52 "GBR" on British cards. <00 Region code is still not set! <00 00 00 00 00 00 00 00 00 00 00 00 00 00 unknown <00 00 00 00 00 00 00 00 00 00 00 00 01 00 will be written with the 75 0F nano on intital activation, zero on virgin cards <90 20 OK The next command seems to have six functions: >48 42 00 00 32 <42 card acknowledges Instruction >09 14 00 00 initialise ASIC with private key 14 >31 checks Serial Number nano >SN SN SN SN Serial Number >3d 03 EC sets PPV spending limit and activates card (fuse byte now 05) >2d 3A xx xx xx Set activation date and time >1e PC PC PC PC PC PC PC PC Set the PostCode >4e 00 6c 4d 58 writes the four bytes " IMX" to before the region code in the 48_58 string (can vary) >2b 03 EB writes "03 eb" to the 48_36 string. Some form of counter? >41 B7 65 3A 1F c0 Add channel entitlement b7 65 (expiry date 3A 1F) >67 08 signature nano >01 02 03 04 05 06 07 08 example signature <91 a1 Write cmd accepted Add channel entitlements 00 1d, b7 66, b7 72 and b7 73 using 41 nano: >48 42 00 00 2f <42 card replys command for ICAM >09 14 00 00 initialise ASIC with private key 14 >31 checks Serial Number nano >SN SN SN SN Serial Number >41 00 1d 3A 1F C0 Add channel entitlement 00 1D (expiry date 3A 1F) >41 b7 66 3A 1F C0 Add channel entitlement B7 66 (expiry date 3A 1F) >41 b7 72 3A 1F C0 Add channel entitlement B7 72 (expiry date 3A 1F) >41 b7 73 3A 1F C0 Add channel entitlement B7 73 (expiry date 3A 1F) >72_02 00 01 unknown propose >67_08 signature nano >01 02 03 04 05 06 07 08 example signature <91 A1 Write cmd accepted Next EMM: 48 42 00 00 24 <42 card replys command for ICAM >09 14 00 00 initialise ASIC with private key 14 >31 checks Serial Number nano >SN SN SN SN Serial Number 75 0F 75_0F nano 12 01 06 02 00 00 00 00 00 00 00 08 00 03 0D is being written to the Region code string >67_08 signature nano >01 02 03 04 05 06 07 08 example signature <91 A1 Write cmd accepted IRD requests again: >48 58 00 00 35 <58 card replys command for ICAM <05 fuse byte <01 09 60 always the same <SN SN SN SN card SN (unique address) <FF FF FF FF unknown <SN SN SN three bytes of card number (shared address) <00 FF FF FF 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 unknown <00 6c 4d 58 was written with the 4e nano on activation <47 42 52 "GBR" on British cards only <00 01 00 00 03 0D 00 00 00 00 unknown <91 A0 sw1/sw2 The sw1/2 has changed again to 91 A0. Test IRD number again. This time the sw1/sw2 is 90 A0. >48 4C 00 00 09 <4C card replys command for ICAM >IN IN IN IN IRD Serial Number >02 00 00 58 02 unknown <90 A0 IRD number saved successfully/correctly married Request PIN/Parental control byte again. >48 2c 00 00 09 <2C card replys command for ICAM <84 D2 convert to HEX and add then 8000h - this is your PIN <FF FF 00 00 on deactivated card: 00 00 00 00 <3F Parental Control Byte (3F - unrestricted) <00 00 unknown <90 A0 sw1/sw2 Request region code again. >48 1C 00 00 20 <1C card replys command for ICAM <47 42 52 "GBR" on British cards. <00 Region code is still not set! <00 00 00 00 00 00 00 00 00 00 00 00 00 00 unknown <01 06 02 00 00 00 00 00 00 00 08 00 03 0d was written with the 75 0F nano on intital activation, zero on virgin cards <90 20 OK At this stage the card is married to the box and will open the FTV channels except BBC1 as the specific region code byte (00)has not been set. A few hours later the card received this PostCode addressed cmd which sets the Region Code byte using the 75_13 nano. Note the first time this is received the region specifc byte is set and the sw1/2 is 91 a1. If we send this cmd again the sw1/2 is 90 80. >48 42 00 00 31 <42 card replys command for ICAM >09 10 00 00 initialise ASIC with public key 10 (all cards) >24 Flag, Close Filter >38_09 postal code address nano >06 Opens card filter if this is the post code..... >PC PC PC 20 20 20 20 20 post code >19 00 sets time zone (00=GMT) >75_13 75_13 nano >00 47 42 52 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 GBR Region byte >67_08 signature nano >01 02 03 04 05 06 07 08 sample signature <91 a1 Write cmd accepted The card will then open on BBC1. This seems to complete the sequence of switch-on commands. Sending these cmds again to the card results in different sw1/sw2 (eg 90 a0 instead of 90 a1)which suggests re-write protection flags are set. 7. The Instructions in detail 7.1 INS02: Send ID and ROM Version >D1 02 00 00 08 <02 <53 59 41 56 02 00 00 00 BSK*B identifier "SYAV"; ROM version 02.00 <90 00 7.2 INS04: Write XX to 2016h >D1 04 00 00 01 <04 >XX <90 00 7.3 INS06: Reads byte from 2016h >D1 06 00 00 01 <06 <XX <90 00 7.4 INS0E: does something >D1 0E FF 02 01 <0E <09 <90 00 7.5 INS12: Reads technical information from the top of EEPROM >D1 12 00 00 08 <12 <01 CMS Version <13 2F 10 Batch number <05 Wafer number <1B 15 Die position <02 Microcode ROM version <90 00 7.6 INS1E: does something >D1 1E xx xx 09 <1E <XX XX XX XX 00 XX 00 00 00 <90 00 7.8 INS28: send 01 FF zu IRD >D1 28 00 00 02 <28 <01 FF <90 00 00 FC AA CD 0A card serial number plus ID byte 01 32 1E 20 09 00 10 allways the same 20 fuse byte 01 09 61 allways the same 00 FC AA CD card serial number FF FF FF FF 00 FC AA 00 shared address FF FF FF 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 47 42 52 00 01 00 00 01 00 00 00 00 00 00 00 00 01 IRD number 00 00 PPV Spending Limit 00 00 00 00 00 00 00 00 00 PPV Entitlements (empty=not entitled) 7.9 INS2A: Read detailed card data (mostly from EEPROM) >D1 2A 00 00 FF <2A <SN SN SN SN ID card serial number plus ID byte (9C88h) <01 32 1E 20 09 00 10 <05 fuse byte ( <01 09 61 has increased by one <SN SN SN SN Unique address <FF FF FF FF <SN SN SN 00 Shared Address <FF FF FF 00 00 00 00 00 00 00 00 00 08 00 00 00 <00 00 00 00 00 xx xx xx 47 42 52 00 01 00 00 03 <0D 00 00 00 00 <IN IN IN IN IRD Number (9CB0h) <03 EC PPV Spending Limit (9CB8h) <00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 PPV Entitlements (empty=not entitled) <00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00 00 00 00 <B7 65 3B D1 Channel Entitlements (2 bytes) and expiry date (2 bytes) <00 1D 3B D1 Channel Entitlements (2 bytes) and expiry date (2 bytes) <B7 66 3B D1 Channel Entitlements (2 bytes) and expiry date (2 bytes) <B7 72 3B D1 Channel Entitlements (2 bytes) and expiry date (2 bytes) <B7 73 3B D1 Channel Entitlements (2 bytes) and expiry date (2 bytes) <00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Empty Channel Entitlement Space <00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Empty Channel Entitlement Space <00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Empty Channel Entitlement Space <00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Empty Channel Entitlement Space <90 00 7.10 INS36: The "Phone Home" Data >D1 36 00 00 FF <36 <09 14 00 00 Use private key (14) <SN SN SN SN Card Serial Number <01 00 00 00 00 00 00 <FD_0F 00 65 00 09 00 01 xx xx 00 00 1A 00 00 00 the 48_20 string <FD_0F 01 00 6D 00 01 01 2C 07 D1 00 00 1A 00 00 00 old 48_20 string? <DE_04 00 00 00 00 on some cards two of the bytes are (PPV spend limit-1)?? <F8_14 0F 71 10 26 CE 01 2B 01 04 01 00 6D 32 84 00 00 32 A3 00 00 Unknown <F3 IN IN IN IN IRD number <F9 00 00 03 EA PPV spend limit <DF 26 15 00 00 last date phoned home? <FF_0A 00 PI PI FF FF 00 00 PC FF F1 the 48_2C string including the PIN and PCB <F6_02 00 00 unknown <FA 9x 6x 4x 3x 5x Cx 8x 8x data from INS5A? <67 08 30 36 E3 89 41 6F 1B BA generated signature <00 00 00.... <90 00 This "36" buffer seems to store some card data from the initial activation and PPV information. This is the data that may be returned from the card via the telephone line when the IRD "phones home" . On a virgin card the data after the FA nano is 00 01 02 03 04 05 06 07. This data is changed after the card is put in the IRD and can vary (as do the sig bytes) depending upon previous cmd sent to card. This may have something to do with one of the 5A INS. 7.11 INS40: CMD dispatch >D1 40 00 00 LE <40 >LE bytes processed as commands <90 00 7.12 INS42: CMD dispatch >D1 42 00 00 LE <40 >LE bytes processed as commands <90 00 7.13 INS44: receive card swap data >D1 42 00 00 LE <40 >card swap data (sent by INS56) <90 00 7.14 INS48: Send card information (mostly from EEPROM) >D1 48 00 00 36 <48 <48 1E xx xx xx xx xx xx xx xx ZipCode (9CA8h) <F3 IN IN IN IN Married IRD number (9CB0h) <4E 00 06 FD 39 Used by Ins44/56 and Cmd4E (9CA4h) <19 00 Timezone (9CC9h) <2D XX XX XX XX Activation Date String (9C98h) <72 02 00 01 Unknown (9E16h) <5D 01 00 Unknown (9CCAh) <40 40 40 40 40 40 40 40 40 40 40 40 Unknown <00 00 00 00 00 00 00 00 <90 00 7.15 INS54: finilises the key generation process, encrypts and sends the output >D3 54 00 00 3C <54 - Box acknowledges instruction <XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX \ <XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX - encrypted data <XX XX XX XX XX XX XX XX XX XX XX XX XX / <XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX encrypted signature <90 20 - Sw1/Sw2 7.16 INS56: send card swap data >D1 56 00 00 FF <56 <00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ..... <00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <90 00 7.17 INS58: Sends card information >D1 58 00 00 FF <58 <XX XX XX <XX XX XX XX - card serial number <XX XX XX XX XX XX XX XX XX <00 00 00 00 <XX XX XX XX XX XX <XX XX XX XX - card serial number <FF FF FF FF <XX XX XX 00 - shared address <FF FF FF 00 00 00 00 00 00 00 00 00 08 00 00 00 <XX XX XX XX XX XX XX XX XX 20 20 20 20 20 XX XX <XX XX 00 00 <90 00 7.17 INS5A: ZKT: Send either r or r*s MOD n >D1 5A 10 00 FF ;Unknwon <5A <00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .... <00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <90 00 7.18 INS72: sends some data >D1 72 00 00 08 <72 <XX XX XX 00 00 00 00 00 00 00 00 00 00 00 00 00 <00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00 <90 00 7.19 INS74: sends protocol data >D1 74 01 00 9C ;Lists all available Instructions in order from EEPROM <74 <01 9A 26 01 <D0 02 FF 02 <D0 04 FF 00 <D0 06 FF 02 <D0 08 FF 00 <D0 10 FF 02 <D0 0C 0A 01 <D0 0E FF 02 <D0 18 0C 01 <D0 1A 08 03 <D0 1C 25 03 <D0 1E 08 03 <D0 20 10 03 <D0 28 02 03 <D0 2A 91 03 <D0 2C FF 02 <D0 2E FF 00 <D0 30 08 03 <D0 32 01 01 <D0 36 FF 02 <D0 38 02 03 <D0 40 FF 00 <D0 42 FF 00 <D0 44 35 01 <D0 46 FF 00 <D0 48 04 01 <D0 4A FF 00 <D0 4C 09 01 <D0 52 04 03 <D0 54 18 03 <D0 56 35 03 <D0 58 4A 03 <D0 5A FF 02 <D0 5C 04 03 <D0 5E FF 02 <D0 72 FF 02 <D0 74 FF 02 <D0 76 FF 02 <D0 78 18 03 <90 00 ============================== >D1 74 02 00 03 <74 <XX XX XX <90 00 ============================== >D1 74 03 00 04 <74 <XX XX XX XX <90 00 ============================== >D1 74 04 00 10 <74 <XX XX 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <90 00 ============================== >D1 74 05 00 21 <74 <XX XX XX XX XX 00 00 00 00 00 00 00 00 00 00 00 <00 00 00 XX XX XX 00 00 00 00 00 00 00 XX 00 XX <XX <90 00 ============================== >D1 74 06 00 0A <74 <XX XX 00 00 00 00 00 00 00 00 <90 00 ============================== >D1 74 07 00 06 <74 <XX XX 00 00 00 00 <90 00 ============================== >D1 74 07 00 06 <74 <XX XX XX XX XX XX <90 00 ============================== >D1 74 09 00 06 <74 <XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX <XX XX 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00 00 00 00 00 00 00 00 00 00 <90 00 ============================== >D1 74 10 00 06 <74 <XX XX XX XX XX XX XX XX XX XX <90 00 7.19 INS78: sends some data (replaces former INS1C ?) >D1 78 00 00 14 <78 <FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF <FF FF FF FF <90 00 >D1 78 03 00 14 <78 <08 00 73 17 92 9F FF FF 01 08 00 73 17 92 9F FF <FF 01 8F 00 <90 00 8. The signature Scheme 9. Codes 9.1 The Fuse Byte The fuse byte is set during the intitial activation possibly with Cmd3D. Bit Purpose 0 Active 1 (unknown) 2 Not Virgin 3 Swapped 4 (unknown) 5 Married 6 (unknown) 7 (unknown) 9.2 The Rating Byte The level of parental control is selected in the services/parental control menu. This along with the rating byte sent in the ECMs can be used by the subscriber to block un-wanted programming. The Rating Byte which follows the 02 nano describes the type of programming content. 00 = not-encrypted ? 40 = encrypted (Universal) 41 = encrypted/ppv (Universal) 42 = encrypted/ppv (PG) 43 = encrypted/ppv (12) 44 = encrypted/ppv (15) 45 = encrypted/ppv (1 51 = ppv (12) 52 = ppv (15) 53 = ppv (1 80 = Information/announcement channels 9.3 The Parental Control Byte (PCB) The category of blocked programming is determined bitwise. Six bits are used. If a bit is set that category is available, if it is not set then that category is blocked. 00 = blocks all channels. PCB; "11 1111" LSB || ||||- unclassified || |||-- universal || ||--- PG || |---- 12 ||------ 15 |------- 18 PCB:- 1F = 18 programming is blocked, 2F = 15 programming is blocked 37 = 12 programming is blocked, 3B = PG programming is blocked 3D = universal programming is blocked, 3F = unrestricted - no programming is blocked. Other sample combinations of blocked channels:- 39 = U+PG 0F = 15+18 07 = 12+15+18 03 = PG+12+15+18 01 = U+PG+12+15+18 The level of parental control is selected in the services/parental control menu. This along with the rating byte sent in the ECMs can be used by the subscriber to block un-wanted programming. The PCB is set using the 48 2E 40 00 09 command. See later in the INS3E section 9.4 The Country Code. Values seen 01, 02, 08, 10 and 1b. This byte is a specific country code related to the Postal Code. 01 is for all English postcodes. 02 is for Scottish postcodes AB, DD, DG, EH, FK, G, HS, IV, KY, KA, KW, ML, PA, PH, TD, ZE. 08 is for Welsh postcodes CF, CH, DY, HR, LL, LD, NP, SA, SY, WR. 10 is for Northern Ireland postcode - BT. 1b is associated with "Postal Code" "UKxx". Is this another region or class of card? 9.5 The Regional code 03 RC is the Local Regional code. This is used for local BBC and ITV regional programming. It is written with 75 0f nano on initial activation. 03 01 is London 03 02 is Anglia 03 08 is Yorkshire 03 09 is Meridian, 03 0D is Tyne-Tees, 03 14 is Carlton Central etc. Some postcodes that lie in marginal areas between terrestrial transmitters may get two or more local regional services. Please supply your regional bytes and local ITV channel(s) received so we can make a complete list. 9.6 The Bitmap algorithm The Bitmap consits of 20 digits. Each digit consists of 8 bits. You will see that there are 256 Bits (FFh) in this Bitmap. Each bit represents a number to be present (1) or not present (0). If bit number 4 (04h) is set to 1 then 04h is present. If bit number 45 (2Dh) is set to 0 then 2Dh is not present. (Start counting from the left!) 9.7 The keys key 10 is the primary public key key 11 is the seconday public key key 12 is the primary group key key 13 is the secondary group key key 14 is the primary private key key 15 is the secondary private key key 16 is the cardswap receive key key 17 is the cardswap send key public key: same on every card, so signature is valid for every card group key: same on a group of 256 cards, signature is valid for any card in this group private key: unique to every card, signature is valid for ony one card, this is mainly used for activation Note that these are not the only keys used. The internal hash circuit has an extra keyset as well as initialisation data. 9.8 Structure of Date and Time The date and time is sent to the card with the EMM 48 42 00 00 16, about every 16 seconds. nano 01 36 15 91 1D = 2001.07.21 time not noted nano 01 38 1D BF 7A = 2001.09.29 time 23:59 GMT nano 01 38 1E 00 02 = 2001.09.30 time 00:00 GMT nano 01 38 1E 60 46 = 2001.09.30 time 12:04 GMT nano 01 39 01 00 05 = 2001.10.01 time 00:00:08 GMT The following lines are an example algorithm. Set for example the Date: Date[4]={0x38,0x1D,0xBF,0x7A}; // example from above void RevDateCalc() { year=(Date[0]/12)+1997; mon=(Date[0]%12)+1; day=Date[1]; hh=Date[2]/8; mm=(0x100*(Date[2]-hh*+Date[3])/32; ss=(Date[3]-mm*32)*2; } You will get 29.09.2001 23:59:52. Well, now you can try that the opposit direction. Use the algorithm below and you will get "38 1D BF 7A" which is exactly the value we started from. void Datecalc() { Date[0]=((year-1997)*12 + (mon-1)); Date[1]=day; Date[2]=hh*8+mm/8; Date[3]=ss/2+mm*32; } 9.9 The Status Words At the end of every instruction the card generates two bytes known as the status words sw1/sw2. These indicate whether or not the instruction has been accepted or not and other things about the card's status. The first byte is either 90h or 91h - depending if a certain flag byte is non-zero. The second byte can have the following values:- 00h, 01h, 20h, 21h, 80h, 81h, A0h or A1h again, depending upon whether certain flag bits are set or not. If the "filters open flag" is set at the end of the instruction, then we get 8xh or Axh, otherwise it will be 0xh or 2xh. If the "IRD match flag" is set (correct card in IRD) then we will get either 2xh or Axh, otherwise 0xh or 8xh. x is either 1 or 0 depending upon whether another flag bit is set or not. 9.10 The Channel Entitlements Sky World Movies Sky Movies Premier 1 30E2 B74D Sky Movies Premier 2 30E2 B74E Sky Movies Premier 3 30E2 B74F Sky Movies Premier 4 30E2 B750 Sky Movies Premier Wide 30E2 B754 Sky Movies Max 1 30E1 B749 Sky Movies Max 2 30E1 B74A Sky Movies Max 3 30E1 B74B Sky Movies Max 4 30E1 B74C Sky Movies Max 5 30E1 B78A Sky Movies Cinema 1 B732 B747 Sky Movies Cinema 2 B732 B748 Sports Sky Sports 1 30E3 Sky Sports 2 30E4 Sky Sports 3 30E5 Sky Sports Extra 30E3 30E4 Family Pack Sports Sky Sports News 0010 B752 British Eurosport 0010 B776 attheraces 0010 1531 Entertainment Sky One 0010 B758 B759 B75A B75B B757 B723 Sky One Mix 0010 B889 UK Gold 0010 B758 B743 UK Gold +1 0010 B87B UK Gold 2 0010 B745 Living TV 0010 B758 B73C Living TV +1 0010 B87F Granada Plus 0010 B75B B727 Challenge? 0010 B75B B73D Bravo 0010 B75B B73F Bravo +1 0010 B890 Paramount 0010 B758 B762 Sci-Fi 0010 B75B B729 Discovery Home & Leisure 0010 B757 B758 B759 B75A B75B B753 Discovery Home & Leisure + 1 0010 B84F Men and Motors 0010 B75B B761 UK Style 0010 B75B B740 UK Style+1 0010 B869 UK Food 0010 B85C UK Drama 0010 B75B B742 Discovery Health 0010 B833 E4 0010 B847 CNX 0010 B884 E! 0010 5B6B UK Bright Ideas 0010 3C4D Ftn 0010 33C0 Sky Travel Shop 0010 B738 News and Documentaries Bloomberg 0010 B757 B758 B759 B75A B75B B725 CNBC 0010 B759 B735 Fox News 0010 B867 Discovery Channel 0010 B758 B759 B733 Discovery Channel + 1hr 0010 B758 B759 B763 Discovery Travel and Adventure 0010 B75D Discovery Civilisation 0010 B75E Discovery Sci-Trek 0010 B75F Discovery Wings 0010 B831 National Geographic 0010 B758 B759 B728 National Geographic Channel + 1 0010 B758 B759 B7C9 Adventure One 0010 B7CB The History Channel 0010 B759 30DD History + 1 hr 0010 B759 B839 Biography 0010 B759 B83A UK Horizons 0010 B759 B741 UK Horizons + 1 0010 B759 B84D Discovery Animal Planet 0010 B759 B734 Discovery Animal Planet + 1 0010 B84E UK History 0010 B880 Music and Radio MTV 0010 B75A B72E MTV Hits 0010 B77B VH1 0010 B75A B72F VH1 Classic 0010 B77D MTV 2 0010 B75A B760 MTV Base 0010 B77C MTV Dance 0010 B84B TMF 0010 223A The Box 0010 B75A B730 KISS 0010 B82B Smash Hits 0010 B84C Magic 0010 B853 Q 0010 B82C Kerrang! 0010 B849 The Hits 0010 255F Music Choice (10 channels) 0010 B757 B758 B759 B75A B75B B764 Big Blue 0010 B858 B85A B85B B859 The Saint 0010 B858 B85A B85B B859 The Villan 0010 B858 B85A B85B B859 Kids Cartoon Network 0010 B758 B75A B774 Cartoon Network + 1 0010 B758 B75A B774 Boomerang 0010 B88F Nickelodeon 0010 B758 B75A B72C Nick Replay 0010 B758 B75A B72C Nick Toons TV 0010 B87D Trouble 0010 B75A B75B B73E Fox Kids 0010 B758 B75A B72A Fox Kids + 1 0010 B758 B75A B72A Nick Jr. 0010 B7CA Non-subscription channels Channel 4 B766 five B765 BBC ONE 001D BBC TWO 001D BBC THREE 001D BBC FOUR 001D S4C ~ Digitol B777 Various channels Music Choice Extra B721 Bangla TV B878 Premiership Plus 0010 B757 B758 B759 B75A B75B B739 Chelsea TV 0010 B757 B758 B759 B75A B75B B739 LBC B85F ART Europe B85F ART Movies B85F ART Music B85F Al Jazeera B85F FilmFour Night: B770 only/Day: B770 0010 B757 B758 B759 B75A B75B FilmFour +1 Night: B770 only/Day: B770 0010 B757 B758 B759 B75A B75B Film4 Weekly Night: B770 only/Day: B770 0010 B757 B758 B759 B75A B75B SouthForYou B879 NASN 2590 Ekushey TV B865 PTV Prime B837 STREAM-0 0010 001D B7C8 STREAM-1 0010 001D B7C8 STREAM-2 0010 001D B7C8 STREAM-3 0010 001D B7C8 STREAM-4 0010 001D B7C8 STREAM-5 0010 001D B7C8 STREAM-6 0010 001D B7C8 Pub Channel B78B B78C B78D B78E B78F B790 B791 B792 B793 B794 ISM Test1 v5 B778 ISM Sports 1 v6 B778 ISM Sky One v6 B778 ISM Sky News v6 B778 STT B778 101-5 B778 Snr B7D9 Tantalise TV B874 STAR Plus B838 STAR News B838 Talk Sport 0010 B757 B758 B759 B75A B75B B7D3 Zee TV / Zee Music B79A Zee Cinema B7CC Sony TV Asia B7CC Alpha EtcPun B7D5 ARY Digital B7D2 B4U Movies B799 TV5 0010 B86D Artsworld B82F MUTV B73B Link naar reactie Delen op andere sites Meer opties om te delen...
demesmaeker Geplaatst: 1 mei 2004 Delen Geplaatst: 1 mei 2004 Ik heb er persoonlijk weinig aan, maar elk nieuws op NDS gebied vind ik welkom, dus bedankt! Ik hoop dat er iemand wat aan heeft en er iets op voort kan borduren. Met vriendelijke groet, Demesmaeker Dreambox 7000 , T90, diseqc 8x1, 80Gb/5.400 Maxtor 4R080J0 HDD Link naar reactie Delen op andere sites Meer opties om te delen...
zuidveen Geplaatst: 2 mei 2004 Delen Geplaatst: 2 mei 2004 Dit is wel een hele simpele voorstelling van zaken ! <img src="/ubbthreads/images/graemlins/loldev.gif" alt="" /> Link naar reactie Delen op andere sites Meer opties om te delen...
Gast Geplaatst: 2 mei 2004 Delen Geplaatst: 2 mei 2004 En dat is dus meteen maar jou 1é mening hier op "Sat4all" ?? Maak er iets van, zou ik zeggen. Dirk <img src="/ubbthreads/images/graemlins/loldev.gif" alt="" /> Link naar reactie Delen op andere sites Meer opties om te delen...
Iberico Geplaatst: 3 mei 2004 Delen Geplaatst: 3 mei 2004 Al ruim 1 jaar lid met een bericht, ¿¿¿??? Als ik je iets vraag moet ik zeker 1 jaar op me antwoord w8ten <img src="/ubbthreads/images/graemlins/loldev.gif" alt="" /> Welkom <img src="/ubbthreads/images/graemlins/biggthumpup.gif" alt="" /> Recuerdos Dreambox 800 HD en 800SE Multytenne twin Link naar reactie Delen op andere sites Meer opties om te delen...
Aanbevolen berichten
Maak een account aan of log in om te reageren
Je moet een lid zijn om een reactie te kunnen achterlaten
Account aanmaken
Registreer voor een nieuwe account in onze community. Het is erg gemakkelijk!
Registreer een nieuwe accountInloggen
Heb je reeds een account? Log hier in.
Nu inloggen