TV CABO &DIGITAL+ hacked!

[Turku]

TVCabo Nagra 3 cards hacked. Confirmed.
Maybe not a full hack but can confirm Cabo nagra 3 (Rom142) moscs cards exit and I confirm that. OK.

New mosc cards may not have a guarantee that they will work for more than 60 days due to a change in the way cabo now updates it's package. In fact there is no guarantee how long they will last as they have not completed the change over and there could be a revision update around the Conner for the new cards or some secret function that has not been activated yet. So not a full hack. Just a hack that at the moment gives you access to all cabo channels including Video on Demand.

Rumour has it and its 99% sure. Well 99% sure not 100% that new EMU with AU for nagra 3 on cabo. But don’t get your hopes to high as this maybe just for the current receivers that work with cabo cards.

FACTS:
Non official receivers that so far work with nagravision 3 original or mosc cards with new firmware.

Mirage models: sft-2000, sci-5110 and 8000 (Complex method but works).
AZbox models: S710 - GA, S710 - GB, ST710 - GA and ST710 - GB.
Mvision 9085 net and USB models. (Bought one over the weekend)
ASTA ESTE NOTITIA DESPTRE HACK N3 DE PE UN SITE SPANIOL

[eugennico]

Pasi mari spre N3 , a aparut saptamana aceasta primul card N3 ,se numeste CENTAURUS si e conceput de ANNACONDA Team care se pare ca rupe tot in noul sistem si se spune ca ar "papă si ceva NDS"..........Pret 69,95 EUR http://ali.to/show.php?main_kat=4&kategorie=12&nr=

http://img396.imageshack.us/img396/8115/centaj2.jpg




Hier die vom Ana...
ISO 7816 Smart****
Flash: 72 kB
Eeprom: 72 kByte
Crypto: Yes (RSA)
Protokoll: T0, T1, TE
Language: ASM, (C)
Programmable @ 3.57 MHZ
Programmierbar zb mit Smartmouse und ProgBee
Auslieferungszustand: leer mit OS
ORIGINAL ANACONDA ****
und hier die vom Centaurus,
ISO 7816 Smart****
Flash: 72 kB
Eeprom: 72 kByte
Crypto: Yes (RSA)
Protokoll: T0, T1, TE
Language: ASM, ©
Programmable @ 3.57 MHZ
Programmierbar mit Smartmouse,
ProgBee und anderen Programmern
ORIGINAL Centaurus OS

http://centaurus.to/

[Bengosu]

mai asteptati un pic, nu are rost sa aruncati cu banii degaba

[zmeura]

..........Pret 69,95 EUR

http://centaurus.to/

E chiar mai ieftin decat predecesoarele lui.Va merge o jumatate de an si va ramane fara suport.Povestea se repeta.

[comerciantul]

E chiar mai ieftin decat predecesoarele lui.Va merge o jumatate de an si va ramane fara suport.Povestea se repeta.

70 euro???
mai bine iei rec cu linux...clona sau neclona, pentru inca 30-40 euro

[eugennico]

ROM142

http://img241.imageshack.us/my.php?i...2227605qx7.jpg

http://img356.imageshack.us/my.php?i...2227661cf5.jpg

http://img356.imageshack.us/my.php?i...2227752fo3.jpg


' Rom 142 GlitchTest
'
' Only Educational Purposes !!!!
' Enjoy !!!
'
' By Zeoroone && Mitega
'*************************************************

Option Explicit

Dim StartDate
Dim FileName
Dim OutFile
Dim StrCmd1
Dim StrCmd2
Dim MsgPrompt
Dim MenuChoice
Dim Bytes
Dim Bytes2
Dim ByteOut
Dim InitDelay
Dim EndDelay
Dim InitVcc
Dim LowVcc
Dim GlitchType
Dim Count
Dim i
Dim Dump
dim Comando12
dim boot1
dim countx
dim mixDelay
dim mixVcc
dim inVcc
dim inDelay

InitDelay = &H100
EndDelay = &H400
GlitchType = &H7
InitVcc = &H40
LowVcc = &H1
mixVCC=1
mixDelay=5
inVCC = InitVcc
inDelay = InitDelay


Call SetupLoader()

Sub Main()

If CheckChipVer <> 1 then
Sc.MsgBox("Flash your Loader with NewD13.hex")
Exit Sub
End if

sc.verbose = 1
Sc.Write("A0")
Clearoutputwindow
StartDate = Now()
Do

MsgPrompt="Rom142 Rev G01 GlitchTest"
MenuChoice=Sc.ButtonBox(MsgPrompt,vbDefaultButton1+vbQuestion," ROM142 Rev G0
1 GlitchTest" & " Versi.n : 1.0" & " - Men. : ","GO","Exit")

Select Case MenuChoice
Case 1: go()

End Select
Loop Until MenuChoice=2

Exit Sub

End Sub

Sub go()
Call Glitch
End Sub



Comando12="214008A0CA00000212000615"



Sub Glitch ()
SC.write("73 0A 70 214097A0CA000091048F49012410F600000000000000000000000000000000
000000009D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9
D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9BA699AD0CB752A6F04A26FDB652819D
00")
Sc.Read(2)
Sc.Write("F0")
Sc.Read(1)
Bytes = Sc.Getbyte(0)
Sc.Read(Bytes)
Print"Initial Parameters = Delay:" & HexString(InitDelay, 4) & " VCC:" & HexStri
ng(InitVcc, 2) & " Glitch Type:" & HexString(GlitchType, 2) & vbCr & vbCr


Do
Sc.Write("B0" & HexString(InitVcc, 2))
Do

Sc.Write("06 10 01 03 50 1A 00")
Sc.Read(2)
Bytes = Sc.Getbyte(1)
If Bytes > 25 then
Sc.Read(Bytes)
countx=0
Exit Do
Else
Count = Count + 1
End If


If Count > 100 Then
ok = MsgBox("Card Maybe Looped - NO ATR - ", vbOKOnly, "Rom 142 ")
Exit Sub
End If

Loop
Sc.verbose = 0



Sc.write("2F 15 0B 60 28 9DB7524FADF3AE0A431100ADE820001000ADE298250411002
00410002000ADD5485A26F01000810272 50 07 00")
Sc.Read(2)
Bytes = Sc.Getbyte(1)
Sc.Read(Bytes)


'CMD15
Sc.write("16 1F 60 0B" + Comando15 + "20 "& hexstring(InitDelay,4) & hexst
ring(GlitchType,2) & "50 00 00")
sc.read(2)
Bytes = Sc.Getbyte(1)
Sc.Read(Bytes)


byteout=&h00
if bytes > 0 then
byteout=Sc.getbyte(0)
sc.print HexString(byteout,2)
If byteout = &h99 then
bytes2 = byteout
End if
End if

If Bytes2 = &H99 Then
Sc.Write ("A1")
Print " : ACK Received ....." & vbcr
Print "***************************************" & vbcr
Print " " & HexString(Bytes2, 2) & " Was Glitch at: Delay:" & HexSt
ring(InitDelay, 4) & " VCC:" & HexString(InitVcc, 2) & " GlitchType:" & HexString
(GlitchType, 2) & vbcr
Print " Delay Range: " & HexString(InitDelay, 4) & " to " & HexStrin
g(EndDelay, 4) & vbcr
Print " Elapsed: " & TimeDiff(StartDate, Now()) & vbcr
Print "********************************" & vbcr
Print "* Rom_142 , Glitch Succes !! *" & vbcr
Print "* *" & vbcr
Print "* 142 Glitch Test *" & vbcr
Print "********************************" & vbcr

Exit Sub
End If

If ByteOut <> &H99 Then
Print "."
InitVcc = InitVcc - mixVcc
If InitVcc < LowVcc Then
InitVcc = inVcc
InitDelay = InitDelay + mixDelay

Print "vbcr & Delay:" & HexString(InitDelay, 4) & " VCCStart:" & HexStri
ng(InitVcc, 2) & " Glitch Type:" & HexString(GlitchType, 2)
Print "Elapsed = " & TimeDiff(StartDate, Now()) & vbcr
End If
End If
If InitDelay > EndDelay Then
InitDelay = inDelay
GlitchType = GlitchType + 1
If GlitchType > &H9 Then
GlitchType = &H7

End If
End If

Loop
End Sub

Function HexString(Number,Length)
Dim RetVal
Dim CurLen
RetVal=Hex(Number)
CurLen=Len(RetVal)
If CurLen RetVal=String(Length-CurLen,"0") & RetVal
End If
HexString=RetVal
End Function

Function CheckChipVer()
CheckChipVer = 1
sc.write("90")
delay(80)
If sc.read(4) <> 4 then
CheckChipVer = 0
Exit Function
End if
If getbyte(0) <> &H4E then CheckChipVer = 0
If getbyte(1) <> &H44 then CheckChipVer = 0
If getbyte(2) <> &H31 then CheckChipVer = 0
If getbyte(3) <> &H33 then CheckChipVer = 0

End Function

Function TimeDiff (StartTime, EndTime)
Dim Hours, Minutes, Seconds
Seconds = DateDiff("s", StartTime, EndTime)
If Seconds > 90000 Then Seconds = 90000
If Seconds < 0 Then Seconds = 0
Minutes = Seconds / 60
Minutes = Fix(Minutes)
Seconds = Seconds - (Minutes * 60)
Hours = Minutes / 60
Hours = Fix(Hours)
Minutes = Minutes - (Hours * 60)
Seconds = CStr(Seconds)
Minutes = CStr(Minutes)
Hours = CStr(Hours)
If Len(Seconds) = 1 Then Seconds = "0" + Seconds
If Len(Minutes) = 1 Then Minutes = "0" + Minutes
If Len(Hours) = 1 Then Hours = "0" + Hours
TimeDiff = Hours & ":" & Minutes & ":" & Seconds
End Function






Function SetupLoader()
sc.print "****************** Setting up WinExplorer ************************" & V
bCr
Wx.BaudRate = 115200
Wx.ResetBaudRate = 115200
Wx.Parity = 0
Wx.StopBits = 0
Wx.DTRControl = 0
Wx.RTSControl = 1
Wx.ResetDelay = 0
Wx.ByteDelay = 0
Wx.RxByteTimeout = 2500
Wx.ResetMode = 2
Wx.ResetLine = 1
Wx.ByteConvention = 1
Wx.FlushEchoByte = 0
Wx.FlushBeforeWrite = 1
Wx.IgnoreTimeouts = 1
Wx.ResetAfterTimeout = 0
Wx.LogTransactions = 0
Wx.DisplayUSW = 0
Wx.DisplayFuse = 0
End function

[Bengosu]

12octombrie 2007?

[eugennico]

Rumours about hack NDS and Nagravision 3

Since yesterday monitors our editors increasingly rumours about the possible hack of the NDS Videoguard and Kudelski Nagravision 3 coderingsystemen. In practice this could mean that the package of Sky Italia (Videoguard), the Spanish D (Nagravision3) and the German Premiere (Nagravision3) without paying any adjustments can be made visible.

The potential of the hack Nagravision3 system will be a major blow to the ailing Swiss coderingsspecialist Kudelski. This past week, made known a substantial loss in the first part of 2008 ago. This was mainly suffered by the costs that the company had to make codes cracked by television weather to recover. Even the loss of customers by the long-term free channels has to look at the losses to Kudelski. In the Netherlands using the digital television CanalDigitaal (Mediaguard) and UPC (Nagravision2) the encryption of Kudelski well as other products and services of the Swiss company.

The possible Nagravision3 hack is of a commercial nature. There will soon be a "smart card ijskrabber" on the market which brought more than 120 euros will cost. The force and any lasting effect of this smart card is totally uncertain, hence the pet name "ijskrabber."

Today come from Italy also becoming increasingly stubborn rumors that have never publicly hacked Videoguard encoding of the English NDS prey would have been cases of hackers. It talks about using an old Nokia Dbox receiver via a particular file should be modified. This is the zenderpakket of the Italian branch of the worldwide Sky television. The international satellietforum Satscreen has been through an email to its members asked to holders of Dbox recipients to enter into the file on force to be tested.

Satellite Magazine would unnecessarily indicate that use of modified smartcards and / or satellite receivers are free to be able to watch television which must be paid in the Netherlands through the Penal Code prohibited. Reason to strongly warn visitors of possible ways to look for free use.