Results 1 to 11 of 11

Thread: Austar state of play

  1. #1
    Senior Member gw1's Avatar
    Join Date
    Jan 2008
    Location
    Hobart
    Posts
    957
    Thanks
    49
    Thanked 608 Times in 213 Posts
    Rep Power
    267
    Reputation
    1901

    Default Austar state of play

    Quote Originally Posted by unsolicited PM
    I have a Dream DM500S. I have an ASSTAR SUB, is there anyway I can share this with the dream or is only possible now with FXTEL.
    Last time I looked there was no way to use Austar subscription cards (or Austar gammas for that matter) on any receiver except one of Austars. That's because Austar stuck extra encryption onto the transport stream, preventing third party embedded Irdeto and with Irdeto CAMs from being used with Gamma cards. To decrypt and recover the standard Irdeto stream Austar use an enhanced softcam embedded in their proprietary firmware, distributed over-the-air. Old timers who'd collected abandoned Austar receivers capable of running the new firmware dusted them off, married them to Gammas via a JTAG hack, and received the working firmware via satellite automatically. Limited box availability meant the hack was only an annoyance to providers rather than a threat.

    To view American pay TV here the only alternative to provider boxes at the moment is Dreambox (and similar Linux receivers) using a Foxtel subscription, a SelecTV subscription, a legit home Foxtel cardshare, or a pirate NDS cardshare. There are other attack vectors (NDS wafer, UEC clone) which I won't go into but basically for the average punter wanting to view Pay TV on his Dreambox - rather than the crappy provider box - the only options are Foxtel and SelecTV. Austar subscribers are at the moment.

    NDS sharing has demotivated attacks on Austar considerably but we may yet see an Austar-compatible Dreambox softcam reversed out of their firmware. It may not happen but if it does it will mark a fascinating new chapter in the Irdeto 2 saga.
    • Austar would counter the softcam by tweaking the transport code or algorithm and pumping out a firmware change every day or two. (It's not their preferred option because each update involves an outage and carries a risk of bricking, but needs must.)
    • If Austar attempt to automate this process (rather than bankrolling developers to create fresh tweaks intelligently like virus writers) the rolled changes will be relatively straightforward to crack. Because that's so probable the new softcam would include an update mechanism for crack delivery, independent of the legit Dream update sites. That mechanism could be client/server, P2P, push or manual.
    • Because the initial crack takes considerable effort it's likely the softcams would be syndicated to commercial distributors, some of whom would leverage existing card sharing networks, others direct selling to Gamma owners who network only for the updates.
    • With working softcams being in high demand, and with nothing to stop their redistribution, there'll always be members who are greedy or boastful enough to break trust. Consequently networks using client/server or P2P would soon end in tears with service shutdown and members left out of pocket or even prosecuted. Push and manual update mechanisms are less insecure but in most cases it's only the fairly-costed networks with mutually vested interest that persist.
    • As techniques for firmware cracking become better understood the number of independent crackers multiplies.
    • Before long the firmware is being cracked automatically by tools which of course are shared with non-technical users.
    • That's followed by a plugin that captures OTA updates and refreshes the softcam automatically.
    • Several rounds of leapfrogging follow, Austar hiring developers back in to break the crack tools and scrapers.

    It's no different to application vendors and online : to limit piracy and scraping they have two options - reduce demand by pricing affordably, or continuously invest in frequent unpredictable encryption changes.

    Because wafer based piracy isn't so traceable it's far safer for developers, which is why it gets deployed far more widely, and why wafers will always be more of a threat to providers than card sharing.

  2. The Following 21 Users Say Thank You to gw1 For This Useful Post:

    + Show/Hide list of the thanked

    aZz (12-05-09),bambbbam (12-05-09),best4less (12-05-09),bloggs (10-06-09),bobzombie (11-05-09),dibbz (03-07-09),jonc (11-05-09),macca (10-05-09),Oberg (06-06-09),OSIRUS (10-05-09),OzBlackKnight (11-05-09),peter3535 (10-06-09),poiuytrewq (12-05-09),Rocket (12-05-09),satguy (12-05-09),screwloose (11-06-09),spence (13-05-09),statesmanjeff (13-05-09),SystemRat (12-06-09),Tumatawhero (19-06-09),weirdo (10-06-09)



Look Here ->
  • #2
    Junior Member
    Join Date
    Mar 2009
    Age
    47
    Posts
    46
    Thanks
    3
    Thanked 4 Times in 4 Posts
    Rep Power
    185
    Reputation
    24

    Default

    I think gw1 knows better and have more infos ,
    from things i saw in this game in the past 10 years my idea is that: it's some kind of Mafia thing, maybe Korea or Taiwan or now even China.
    When they see enough potential in making money in Austrailia , they'll make something for watching Austar.
    I guess at this moment they are busy with HD game , and they are making enough $$$ from HD maybe that's why they doesn't care about Austar .
    In Europe and middle east providers are going to use new technology against card sharing , called "pairing" or something like that and i think it's the same protection as Austar is using at the moment.
    So when most of providers migrate their systems to this new protection , then chance of cracking it will increase.

  • #3
    Junior Member
    Join Date
    Feb 2009
    Age
    52
    Posts
    49
    Thanks
    1
    Thanked 44 Times in 11 Posts
    Rep Power
    188
    Reputation
    176

    Default

    You would be surprised how simple the extra layer of encryption is on the control words.

    A little disassembling can reveal a lot

    Code:
    000abf3d	40	sub_abf3d:	ldc	#0	 ; load constant - A = n, B=A, C=B
    000abf3e	d2		stl	#2 [arg_2]	 ; store local - workspace[n] = A, A=B, B=C
    000abf3f	72	loc_abf3f:	ldl	#2 [arg_2]	 ; load local - A = workspace[n], B=A, C=B
    000abf40	71		ldl	#1 [arg_1]	 ; load local - A = workspace[n], B=A, C=B
    000abf41	66 29 90		call	sub_ab8d4	 ; call - Call Subroutine
    000abf44	d3		stl	#3 [arg_3]	 ; store local - workspace[n] = A, A=B, B=C
    000abf45	21 2f 2f 4f		ldc	#1fff	 ; load constant - A = n, B=A, C=B
    000abf49	73		ldl	#3 [arg_3]	 ; load local - A = workspace[n], B=A, C=B
    000abf4a	86		adc	#6	 ; add constant - Add to A with carry check
    000abf4b	2c f8		ss		 ; store sixteen - *A = B
    000abf4d	22 20 20 40		ldc	#2000	 ; load constant - A = n, B=A, C=B
    000abf51	73		ldl	#3 [arg_3]	 ; load local - A = workspace[n], B=A, C=B
    000abf52	2c f8		ss		 ; store sixteen - *A = B
    000abf54	60 4f		ldc	#-1	 ; load constant - A = n, B=A, C=B
    000abf56	73		ldl	#3 [arg_3]	 ; load local - A = workspace[n], B=A, C=B
    000abf57	e2		stnl	#2	 ; store non-local - A[n] = B, A=C
    000abf58	40		ldc	#0	 ; load constant - A = n, B=A, C=B
    000abf59	73		ldl	#3 [arg_3]	 ; load local - A = workspace[n], B=A, C=B
    000abf5a	82		adc	#2	 ; add constant - Add to A with carry check
    000abf5b	2c f8		ss		 ; store sixteen - *A = B
    000abf5d	40		ldc	#0	 ; load constant - A = n, B=A, C=B
    000abf5e	73		ldl	#3 [arg_3]	 ; load local - A = workspace[n], B=A, C=B
    000abf5f	51		ldnlp	#1	 ; load non-local pointer - A = &A[n]
    000abf60	2c f8		ss		 ; store sixteen - *A = B
    000abf62	40		ldc	#0	 ; load constant - A = n, B=A, C=B
    000abf63	73		ldl	#3 [arg_3]	 ; load local - A = workspace[n], B=A, C=B
    000abf64	e3		stnl	#3	 ; store non-local - A[n] = B, A=C
    000abf65	40		ldc	#0	 ; load constant - A = n, B=A, C=B
    000abf66	73		ldl	#3 [arg_3]	 ; load local - A = workspace[n], B=A, C=B
    000abf67	e4		stnl	#4	 ; store non-local - A[n] = B, A=C
    000abf68	40		ldc	#0	 ; load constant - A = n, B=A, C=B
    000abf69	73		ldl	#3 [arg_3]	 ; load local - A = workspace[n], B=A, C=B
    000abf6a	e5		stnl	#5	 ; store non-local - A[n] = B, A=C
    000abf6b	40		ldc	#0	 ; load constant - A = n, B=A, C=B
    000abf6c	73		ldl	#3 [arg_3]	 ; load local - A = workspace[n], B=A, C=B
    000abf6d	e6		stnl	#6	 ; store non-local - A[n] = B, A=C
    000abf6e	72		ldl	#2 [arg_2]	 ; load local - A = workspace[n], B=A, C=B
    000abf6f	81		adc	#1	 ; add constant - Add to A with carry check
    000abf70	d2		stl	#2 [arg_2]	 ; store local - workspace[n] = A, A=B, B=C
    000abf71	48		ldc	#8	 ; load constant - A = n, B=A, C=B
    000abf72	72		ldl	#2 [arg_2]	 ; load local - A = workspace[n], B=A, C=B
    000abf73	f9		gt		 ; greater than - A = B > A
    000abf74	a2		cj	loc_abf77	 ; conditional jump - jump if A = 0
    000abf75	63 08		j	loc_abf3f	 ; jump - Unconditional relative jump
    000abf77	71	loc_abf77:	ldl	#1 [arg_1]	 ; load local - A = workspace[n], B=A, C=B
    000abf78	6c 98		call	sub_abeb2	 ; call - Call Subroutine
    000abf7a	40		ldc	#0	 ; load constant - A = n, B=A, C=B
    000abf7b	22 f0		ret		 ; return

  • The Following 3 Users Say Thank You to fasulye For This Useful Post:

    AceR (10-06-09),OzBlackKnight (12-06-09),weirdo (10-06-09)

  • #4
    Senior Member
    weirdo's Avatar
    Join Date
    Jan 2008
    Posts
    5,458
    Thanks
    4,638
    Thanked 3,135 Times in 1,633 Posts
    Rep Power
    0
    Reputation
    29602

    Default

    Quote Originally Posted by fasulye View Post
    You would be surprised how simple the extra layer of encryption is on the control words.

    A little disassembling can reveal a lot

    Code:
    000abf3d	40	sub_abf3d:	ldc	#0	 ; load constant - A = n, B=A, C=B
    000abf3e	d2		stl	#2 [arg_2]	 ; store local - workspace[n] = A, A=B, B=C
    000abf3f	72	loc_abf3f:	ldl	#2 [arg_2]	 ; load local - A = workspace[n], B=A, C=B
    000abf40	71		ldl	#1 [arg_1]	 ; load local - A = workspace[n], B=A, C=B
    000abf41	66 29 90		call	sub_ab8d4	 ; call - Call Subroutine
    000abf44	d3		stl	#3 [arg_3]	 ; store local - workspace[n] = A, A=B, B=C
    000abf45	21 2f 2f 4f		ldc	#1fff	 ; load constant - A = n, B=A, C=B
    000abf49	73		ldl	#3 [arg_3]	 ; load local - A = workspace[n], B=A, C=B
    000abf4a	86		adc	#6	 ; add constant - Add to A with carry check
    000abf4b	2c f8		ss		 ; store sixteen - *A = B
    000abf4d	22 20 20 40		ldc	#2000	 ; load constant - A = n, B=A, C=B
    000abf51	73		ldl	#3 [arg_3]	 ; load local - A = workspace[n], B=A, C=B
    000abf52	2c f8		ss		 ; store sixteen - *A = B
    000abf54	60 4f		ldc	#-1	 ; load constant - A = n, B=A, C=B
    000abf56	73		ldl	#3 [arg_3]	 ; load local - A = workspace[n], B=A, C=B
    000abf57	e2		stnl	#2	 ; store non-local - A[n] = B, A=C
    000abf58	40		ldc	#0	 ; load constant - A = n, B=A, C=B
    000abf59	73		ldl	#3 [arg_3]	 ; load local - A = workspace[n], B=A, C=B
    000abf5a	82		adc	#2	 ; add constant - Add to A with carry check
    000abf5b	2c f8		ss		 ; store sixteen - *A = B
    000abf5d	40		ldc	#0	 ; load constant - A = n, B=A, C=B
    000abf5e	73		ldl	#3 [arg_3]	 ; load local - A = workspace[n], B=A, C=B
    000abf5f	51		ldnlp	#1	 ; load non-local pointer - A = &A[n]
    000abf60	2c f8		ss		 ; store sixteen - *A = B
    000abf62	40		ldc	#0	 ; load constant - A = n, B=A, C=B
    000abf63	73		ldl	#3 [arg_3]	 ; load local - A = workspace[n], B=A, C=B
    000abf64	e3		stnl	#3	 ; store non-local - A[n] = B, A=C
    000abf65	40		ldc	#0	 ; load constant - A = n, B=A, C=B
    000abf66	73		ldl	#3 [arg_3]	 ; load local - A = workspace[n], B=A, C=B
    000abf67	e4		stnl	#4	 ; store non-local - A[n] = B, A=C
    000abf68	40		ldc	#0	 ; load constant - A = n, B=A, C=B
    000abf69	73		ldl	#3 [arg_3]	 ; load local - A = workspace[n], B=A, C=B
    000abf6a	e5		stnl	#5	 ; store non-local - A[n] = B, A=C
    000abf6b	40		ldc	#0	 ; load constant - A = n, B=A, C=B
    000abf6c	73		ldl	#3 [arg_3]	 ; load local - A = workspace[n], B=A, C=B
    000abf6d	e6		stnl	#6	 ; store non-local - A[n] = B, A=C
    000abf6e	72		ldl	#2 [arg_2]	 ; load local - A = workspace[n], B=A, C=B
    000abf6f	81		adc	#1	 ; add constant - Add to A with carry check
    000abf70	d2		stl	#2 [arg_2]	 ; store local - workspace[n] = A, A=B, B=C
    000abf71	48		ldc	#8	 ; load constant - A = n, B=A, C=B
    000abf72	72		ldl	#2 [arg_2]	 ; load local - A = workspace[n], B=A, C=B
    000abf73	f9		gt		 ; greater than - A = B > A
    000abf74	a2		cj	loc_abf77	 ; conditional jump - jump if A = 0
    000abf75	63 08		j	loc_abf3f	 ; jump - Unconditional relative jump
    000abf77	71	loc_abf77:	ldl	#1 [arg_1]	 ; load local - A = workspace[n], B=A, C=B
    000abf78	6c 98		call	sub_abeb2	 ; call - Call Subroutine
    000abf7a	40		ldc	#0	 ; load constant - A = n, B=A, C=B
    000abf7b	22 f0		ret		 ; return
    Yep fasulye, it jumped straight out at me lol

  • The Following User Says Thank You to weirdo For This Useful Post:

    best4less (11-06-09)

  • #5
    Member AceR's Avatar
    Join Date
    Jan 2008
    Posts
    268
    Thanks
    4
    Thanked 49 Times in 26 Posts
    Rep Power
    211
    Reputation
    271

    Default

    heheheh....
    Member since March 2002 and still in the Blue

  • #6
    Senior Member Kavakid's Avatar
    Join Date
    Jan 2008
    Posts
    655
    Thanks
    102
    Thanked 105 Times in 73 Posts
    Rep Power
    231
    Reputation
    602

    Default

    squeak squeak squeak

  • #7
    Senior Member sublib25's Avatar
    Join Date
    Jan 2008
    Location
    My House
    Posts
    633
    Thanks
    149
    Thanked 73 Times in 53 Posts
    Rep Power
    232
    Reputation
    660

    Default

    Quote Originally Posted by Kavakid View Post
    squeak squeak squeak
    Any "good oil" to share??

  • #8
    Junior Member Rocket's Avatar
    Join Date
    Jan 2008
    Location
    NSW
    Posts
    225
    Thanks
    112
    Thanked 25 Times in 18 Posts
    Rep Power
    212
    Reputation
    379

    Default

    Can anyone do an english translation for a code dummy like me.
    Don't worry, it only seems kinky the first time.

  • #9
    Senior Member
    bambbbam's Avatar
    Join Date
    Sep 2008
    Location
    Republic of Westralia
    Posts
    1,973
    Thanks
    369
    Thanked 715 Times in 340 Posts
    Rep Power
    319
    Reputation
    3222

    Default

    I think the 'mouse' has just given the 'cat' the slip
    * Bill Paxton is the only actor to be killed by Alien, a Terminator, and the Predator.

  • #10
    Senior Member Kavakid's Avatar
    Join Date
    Jan 2008
    Posts
    655
    Thanks
    102
    Thanked 105 Times in 73 Posts
    Rep Power
    231
    Reputation
    602

    Default

    I'm referring to Acer's tight arse.....

    Just a pun, no offense Acer mate.

  • #11
    Member davo's Avatar
    Join Date
    Jan 2008
    Location
    In A House
    Age
    55
    Posts
    464
    Thanks
    32
    Thanked 202 Times in 103 Posts
    Rep Power
    231
    Reputation
    921

    Default

    The Old
    "Add to A with carry check"

    HEHE

  • Bookmarks

    Posting Permissions

    • You may not post new threads
    • You may not post replies
    • You may not post attachments
    • You may not edit your posts
    •