Algorithm Nagraravison 3 (FAKE)

[aristides]

Algorithm Nagraravison 3 tested 100%

[stoner2399]

This just seems to be a bunch of N2 stuff from north america

[magictails]

hi

it's a good FAQ for read the base of nagravison 1 & 2

tested Ok 05.02.2001
----------------------------------


Contents:

0: Openers
0.1: Introduction/About me
0.2: Where to find this FAQ
0.3: Contributors
0.4: Detractors
1: The T=1 protocol
1.1: NagraVision2 ATR
1.2: NagraVision's packet structure I: The ISO-specified portion
1.2.1: Chained messages
1.3: NagraVision's packet structure II: The IRD-to-CAM information field
1.4: NagraVision's packet structure III: The CAM-to-IRD information field
1.5: The status word

2: Commands
2.1: Command list
2.2: Command lengths, expected replies, and reply lengths
2.3: Command breakdown
2.4: Basic command sequences
2.4.1: Finding out if the card is busy or has new information
2.4.2: Finding out what data types in the card's database have changed
2.4.3: Retrieving a specific data item from the card
2.4.4: Getting the data required to decrypt the video stream

3: EMM commands
3.1: EMM command list
3.2: EMM command breakdown

4: 21-xx data types
4.1: Data type list
4.2: Data type breakdown

5: The backdoors
5.1: The backdoor passwords
5.2: The backdoor commands

6: Inside NagraVision cards
6.1: The MCU core
6.2: AA-06 vs AA-07

7: Glossary
7.1: Glossary
8: Encryption

8.1: ECM encryption
8.1.1: The encryption algorithm
8.2: EMM encryption
8.3: The valid hash
9: Hacks

10: Firmware versions of the various E* cards
10.102: ROM152 firmware versions

11: Writing code for NagraVision cards
11.3: ROM152 cards
11.3.1: Bug-catcher modules
11.3.2: Hooking in a bug-catcher
11.3.3: Useful routines and memory locations
11.3.3.1: Utility routines
11.3.3.2: Database routines
11.3.3.3: Low-level routines
11.3.3.4: Encryption/decryption routines
11.3.4: Memory usage
11.3.4.1: ZP RAM
11.3.4.2: Other RAM
11.3.4.3: Tables in ROM and EEPROM
11.3.5: MAPROM
13: Stream
13.1: Bootup sequence 0101
13.2: Bootup sequence 0101 cut
13.3: Bootup sequence 0801
13.4: Bootup sequence 0801 cut
13.8: Nagra_3_config1.1.cfg for T-Rex Nagra-Tool
13.9: DASM ROM152_ND13_A0FF-INTERCEPT-autoVCC_20.XVB
Blockerv7 Backdoor dasm
Blockerv7 emmhandler dasm
22sk dasm