irdeto emk breakdown

[rhinosaurusrex]

hi all

could someone perhaps explain the emk string of ir2?

like a breadown??

regards

rr

[crypto7]

Without an example infront of me...
The packet will be broken into.

0101xxxxxx EMM header
len byte
Address Mode C3/CB
3 byte HSN
a sub length (of the encrypted packet) from memory
then an encrypted packet.
a check sum byte.

the encrypted packet will be decrypted on the card with a key on the Card.

[z80]

Without an example infront of me...
The packet will be broken into.

0101xxxxxx EMM header
len byte
Address Mode C3/CB
3 byte HSN
a sub length (of the encrypted packet) from memory
then an encrypted packet.
a check sum byte.

the encrypted packet will be decrypted on the card with a key on the Card.

From memory???...

I want some of what you're smokin'....

[agarol]

I also remember that there seem to be different flavours of ird2, different from what was quoted above.
For example, the select stream seems to not use C3/CB and the HSN at all: it seems to use C0/C8/D8 rather than C3/CB, and the field noted above to contain the HSN is simply 00 00 00. This means that the cam passes a whole lot of crap to the card - packets that are not meant for that card - and the card responds with wrong sig message. However, eventually a correct sig is received and the packet is accepted.
I haven't determined how it all works, but assume that different versions of ird cams pass different descriptors - eg the humax seems to pass only the packets containing the C8 descriptor, and rejects the other ones - maybe somebody else can comment on this.
ag