DirecTV D2 card

[LeeGibling]

A new DirecTV card called D2, P6 or "rethink tv" by convenience, made it's
first appearance sometime in Sept. 2005, but very little is yet public about it's
technical data. Here a few card responses:

The ATR of the D2 (0017 ...) is like that of a P4 or a D1

---------------------
Trying to reset card...
Reset Successful

ATR: 3F 78 13 25 03 40 B0 20 FF FF 4A 50 00

Convention: INVERSE
Protocol: T=0
TA1 = 13
TB1 = 25
TC1 = 03

Historical Bytes: 40 B0 20 FF FF 4A 50 00
@ ° ÿ ÿ J P

Programming Voltage = 5.0 volts
Programming Current = 50ma
Maximum Clock Frequency = 5.0MHz

Assuming a 3.5790MHz clock:
Work ETU = 0.0000259849 seconds
Guard Time = 0.0003897737 seconds
Baud Rate After Reset = 38484
---------------------

The INS 02, which gets us the ID and the ROM version

---------------------
48 02 00 00 08
R01
R08
R02
---------------------

returns the following:

---------------------
Trying to reset card...
Reset Successful

RX ATR : 3F 78 13 25 03 40 B0 20 FF FF 4A 50 00
TX Data : 48 02 00 00 08
RX Data : 02
RX Data : 48 55 58 56 - 04 00 44 31
H U X V - . . D 1
RX Data : 90 00
---------------------

An attempt to read 8 bytes from the beginning of the EEPROM
---------------------
48 12 00 00 08
R01
R08
R02
---------------------

has this result:
---------------------
RX ATR : 3F 78 13 25 03 40 B0 20 FF FF 4A 50 00
TX Data : 48 12 00 00 08
RX Data : 12
RX Data : 78 FF 25 17 EF 19 05 15
RX Data : 90 00
---------------------

As it still has the "Before Returning from ATR Hole", we can get the ATR_DM:
---------------------
33 99 FF BF E1 00 5B 17 08 67 5F 57 71 CF
---------------------

inverted, according to ISO-7816, it looks like this:

---------------------
33 66 00 02 78 FF 25 17 EF 19 05 15 71 0C
---------------------

Bottom Line:

Except for the result of INS 02, it looks pretty much like a D1, whose return value is
---------------------
44 31 44 56 - 30 31 30 37
D 1 D V - 0 1 0 7
---------------------