Noob that needs CAM answers

Joined
Aug 29, 2004
Messages
4
Reaction score
0
Points
0
Age
39
Well,

I am new to this whole satellite thing and I am looking to get into it.

From what I understand a CAM is a device that acts like a decoder and is connected to satellite equipment via a CI (Common Interface or PCMCIA) slot. Anyways, I hear people talking about how such and such CAM with such and such firmware can open such and such channels, isn’t this illegal, decoding stations with out a smartcard? I am looking for a legal solution and I want a subscription via my smart card. Anyways, my real question is in regards to the “Matrix” series of CAMs. I am looking to decode some nagravision channels and I was wondering what the “selectable box key” is? What is it for? Anyways, I want a cam that is not illegal and reads decoding and subscription information off my smart card, not one that does it all in the cam. As there such thing as a legal CAM that doesn’t decode channels with out the appropriate smartcard and subscription?



Signed,

Slice



P.S. I am looking for a cam that will work with dish network and my Dish network smartcard in my new receiver. I am looking to just change receivers, how do I do this (take the smart card out of my old one and place it in my new)? Also note that my new receiver does not have any built in CAMs; it just has two CI slots.
 

guiri

Regular Member
Joined
Apr 5, 2004
Messages
189
Reaction score
1
Points
16
My Location
Manchester, UK
A CAM performs the job of de-encryption through something called CAS (conditional access system). CAMs like Matrix Reloaded provide a number of CAS eg. Nagravision, Seca, Conax. In addition, they also provide emulation (sometimes called EMU) of the smart card as well - this is the bit you are not interested in.

With something like an original Conax card, you can take it out of one CAM, and put it in another CAM which supports the Conax CAS, and you are away.

Nagravision is a different matter entirely though. The smart card is locked to the CAM with the boxkey (the boxkey is part of the CAM firmware and is unique to that CAM). Therefore the card will only work with that CAM.

Matrix Reloaded provides selectable box key, so it can be made to work with smart cards which are expecting a particular box key. This is ok, but you need to know the box key in the first place - and it is hidden.

If you have a legitimate dish network subscription, can you ask for a CAM and card together from the supplier - they will be locked to each other?

The other option is to extract the boxkey from your existing dish network receiver or smart card, but both these are specialist jobs. You could then put the extracted boxkey in a Matrix, as you point out.
 
Joined
Aug 29, 2004
Messages
4
Reaction score
0
Points
0
Age
39
guiri said:
A CAM performs the job of de-encryption through something called CAS (conditional access system). CAMs like Matrix Reloaded provide a number of CAS eg. Nagravision, S*ca, Conax. In addition, they also provide emulation (sometimes called EMU) of the smart card as well - this is the bit you are not interested in.

With something like an original Conax card, you can take it out of one CAM, and put it in another CAM which supports the Conax CAS, and you are away.

Nagravision is a different matter entirely though. The smart card is locked to the CAM with the boxkey (the boxkey is part of the CAM firmware and is unique to that CAM). Therefore the card will only work with that CAM.

Matrix Reloaded provides selectable box key, so it can be made to work with smart cards which are expecting a particular box key. This is ok, but you need to know the box key in the first place - and it is hidden.

If you have a legitimate dish network subscription, can you ask for a CAM and card together from the supplier - they will be locked to each other?

The other option is to extract the boxkey from your existing dish network receiver or smart card, but both these are specialist jobs. You could then put the extracted boxkey in a Matrix, as you point out.
How could I extract the boxkey? How sophisticated is the process?



Where can I get "Clean" firmware for the Matrix cams...you know firmware that requires a smartcard?



*How much would it cost to get a cam and new smartcard from a dish supplier?
 

BGonaSTICK

Retired Moderator
Joined
Dec 22, 2003
Messages
5,145
Reaction score
0
Points
36
Age
50
My Satellite Setup
Dreambox 7000, Skystar2
My Location
Brighton
guiri said:
Matrix Reloaded provides selectable box key, so it can be made to work with smart cards which are expecting a particular box key. This is ok, but you need to know the box key in the first place - and it is hidden.
Nice post, well written. Something else I learnt today :D
 

guiri

Regular Member
Joined
Apr 5, 2004
Messages
189
Reaction score
1
Points
16
My Location
Manchester, UK
slicemaster101 said:
How could I extract the boxkey? How sophisticated is the process?
Extracting the boxkey (bk) from the receiver normally involves desoldering a chip and then placing it in a suitable reader and dumping the contents - the bk is available at a certain memory location. This process very much depends on the type of receiver - you'd need to know what chip to take out and its memory map, and have the appropriate chip reader as well.
Extracting the bk from the smart card is only possible with certain revisions of cards - you hack the card with a suitable phoenix programmer using software tools available at www.zackyfiles.com for example, then dump the card. The bk is found in the dump. This process is the first step in making a MOSC (modified original smart card).
slicemaster101 said:
Where can I get "Clean" firmware for the Matrix cams...you know firmware that requires a smartcard?
Sometimes, but not always, the Matrix Reloaded comes with UCAS 3.0 firmware loaded on it. This is clean. So if you were buying one, you'd ask for that. I've neved seen it availalable for download.
slicemaster101 said:
*How much would it cost to get a cam and new smartcard from a dish supplier?
You'd have to ask them - its a legitimate question.
 
Joined
Aug 29, 2004
Messages
4
Reaction score
0
Points
0
Age
39
guiri said:
Extracting the boxkey (bk) from the receiver normally involves desoldering a chip and then placing it in a suitable reader and dumping the contents - the bk is available at a certain memory location. This process very much depends on the type of receiver - you'd need to know what chip to take out and its memory map, and have the appropriate chip reader as well.
Extracting the bk from the smart card is only possible with certain revisions of cards - you hack the card with a suitable phoenix programmer using software tools available at www.zackyfiles.com for example, then dump the card. The bk is found in the dump. This process is the first step in making a MOSC (modified original smart card).
Sometimes, but not always, the Matrix Reloaded comes with UCAS 3.0 firmware loaded on it. This is clean. So if you were buying one, you'd ask for that. I've neved seen it availalable for download.



You'd have to ask them - its a legitimate question.
How come only certain cards can be dumped?

And the UCAS 3.0 firmware you speak of, does it support nagravision with selectable box key?
 

guiri

Regular Member
Joined
Apr 5, 2004
Messages
189
Reaction score
1
Points
16
My Location
Manchester, UK
slicemaster101 said:
How come only certain cards can be dumped?
I guess it is because the designers of the cards wanted to prevent it, so they made revisions to the card software to make it more difficult. Also the hardware design of some of the smart card may have made them more vulnerable - some dumping attacks rely on glitching the smart card into a state where it can be compromised. If you are really interested in this, the subject is called MOSCing (or mosceando in spanish).
slicemaster101 said:
And the UCAS 3.0 firmware you speak of, does it support nagravision with selectable box key
I can't say for certain (my MR came with 1.070 pre-installed), but if it didn't you could always put MR1.070 on which does ;) . If you want to be totally legit then the original nagra CAM and card is the way to go (providing that you can be supplied with one).
 
Joined
Aug 29, 2004
Messages
4
Reaction score
0
Points
0
Age
39
Is there any easy way of dumping the contents of the receivers TSOP (including BOXKEY)? Or retrieving the BOXKEY from your smartcard?
 
Top