alpha S2CE

[hashoom]

Hey guys,,,

do you know anything about this STB alpha S2CE ????????? or where we can get it from?

[Keepleft]

Sounds nuclear??

[hashoom]

Sounds nuclear??

well it used to be more than Nuclear before the gamma stoped!!

[hashoom]

sounds like no one knows anything about it

[MadMAN]

I've got one mate..are you talking about the one that connects to the server via ethernet cable?? if thats the one i have one but not useful anymore Im watching FTA channels on it.

Does any one have the update server for that box?

[hashoom]

yea they stoped working

[MadMAN]

hashoom, may be you can ask the same person that sold it for you, Im trying to call him but his number is switched off, can you ask yours?

[c427537]

I know this is an old Thread, may bring it back to life,
hashoom, may have bought ur Alpha s2c from the markets yesterday,
the guy wanted $50 gave him $30 no remote.I need some information for this box google had no answers, i hope some body has some clues
It has a card reader ,ethernet,com port,and all Australian Ku preloaded.
thanks

[c427537]

No ideas?Common somebody must know something , I'm not looking for a server lol,all i need is information,any firmware up dates? is it a Linux os?
i tried ftp t frizz,starting to fill like i was jabbed, payed 2 much for it lol....
cheers

[badass]

Well $30 cheep FTA sat tv if it works?
If you are asking how to get free pay tv then you'll be waiting a long time I think.

[c427537]

Badass m8 thanks for the reply.
not after FREE TV no such thing. I have been around long enough to know m8 Its was just a hobby for me ,now i have some free time i thought will do some catching up,i missed the gamma or whiety craze,but i still have 2 new ones,I have a good collection of decoders starting from the good old 5400 humax.
the reason i bought that decoder was the price and curiosity,
I had a closer look at the menu it looks like it can support many cams,it also handles different keys ir**to-B*ss,Vi**ses,etc and yes ca*d sh**E it looks like newcs not certain,,,,with out a remote control and or the knowledge to ftp its a dead end.
cheers

[weirdo]

Not familiar with the Alpha but it might have been cloned to work on the same servers for the Visionnets.
I believe there are still servers working in Europe but not here.
I think they go under the name Nannox now.

[c427537]

Not familiar with the Alpha but it might have been cloned to work on the same servers for the Visionnets.
I believe there are still servers working in Europe but not here.
I think they go under the name Nannox now.

As usual wierdo to the rescue,thanks m8 ,i got some answers from google ,now
i can waist a few hours on it.
cheers

Euro forum
"maxx1000, nannox, protec, starex sr2000,Technosat All are Same receiver, with diffrent Names or Brands, So if your searching for firmeware you need to search for one or All of These names,"

[jtc2005]

if u want a remote for it, pm me

[jaykaus]

hi guys... new to the forum. was googling the Alpha S2ce and stumbled here.
A friend of mine bought some free cable/satellite and the guy who installed it installed one of these boxes. The thing hooks up to the internet and will cut reception to channels if the internet goes down, that way they can charge my mate a subscription! Dodgy TV with recurring subscription! wow! haha

Anyways, he asked me to have a look at it and see if there is a way to have it work without the internet connection. Firstly so he doesnt have to pay the dodgy cable company and secondly because his internet keeps dropping out and therefore so does the TV.

I work with networks so I decided to do a packet capture on the device and found that on bootup 2 TCP sessions are established to fant*******.homeip.net (censored out real URL) (most probably a public dynds domain) to ports 10121 and 10120. It seems once some basic negotiation is done some sort of keepalive mechanism running every 10 secs or so keeps the TV alive.

I havent had a proper chance to look through the captures yet, I was hoping I could get more info on this box from the net first. Anyways, if anyone know anything on it or would like to discuss further please PM me. Ive uploaded the capture file to mega upload if anyone is interested in having a look. Its been filtered to the 2 TCP sessions, so no DNS lookups etc.

[jaykaus]

btw, its got an RS232 (serial) connection on the back. I plugged it up hoping it would be some sort console connection no glory there. Anyone know what its for and if it is a console connection?

[weirdo]

hi guys... new to the forum. was googling the Alpha S2ce and stumbled here.
A friend of mine bought some free cable/satellite and the guy who installed it installed one of these boxes. The thing hooks up to the internet and will cut reception to channels if the internet goes down, that way they can charge my mate a subscription! Dodgy TV with recurring subscription! wow! haha

Anyways, he asked me to have a look at it and see if there is a way to have it work without the internet connection. Firstly so he doesnt have to pay the dodgy cable company and secondly because his internet keeps dropping out and therefore so does the TV.

I work with networks so I decided to do a packet capture on the device and found that on bootup 2 TCP sessions are established to fantasy2000.homeip.net 9most probably a public dynds domain) to ports 10121 and 10120. It seems once some basic negotiation is done some sort of keepalive mechanism running every 10 secs or so keeps the TV alive.

I havent had a proper chance to look through the captures yet, I was hoping I could get more info on this box from the net first. Anyways, if anyone know anything on it or would like to discuss further please PM me. Ive uploaded the capture file to mega upload if anyone is interested in having a look. Its been filtered to the 2 TCP sessions, so no DNS lookups etc.

Hi jaykaus, welcome to the forum mate.
Your mate will need to keep this system 'alive' to be able to watch tv.
His box will have a username and password programmed in that will be checked when he logs in. Without this connection he won't get the necessary keys to decrypt the picture. The only other way he could try is to get either a legitimate card for that subscription or a 'hacked' card. But you didn't mention what service he's watching.
The RS232 port on the back of the box is most liklely just for firmware upgrades to the box.
Hope this helps.

[jaykaus]

Thanks for the reply mate.

Without this connection he won't get the necessary keys to decrypt the picture.

Dam! I was hoping to set up his local PC as a mock 'server' and simply feed the cable box the TCP stream with seq/ack's to match. I wasnt sure how exactly, but im sure that once the cable box establishes the TCP session I could have some sort of daemon running to keep the TCP connection alive. Ofcourse, this all depends on the data inside the TCP stream being just a reptitive pattern saying "keep the TV alive" then 10 seconds later "keep the TV alive" etc... if its in actual fact some sort of key to decrypt the picture, my idea is out of the window!

Interesting thing is that the username/password on the cable box is viewable and so the hashed encryption key. I only had a passing glance at the contents of the menu but im pretty sure all I saw was an encryption mechanism (DES I think) and no authentication mechanism. So perhaps there may be a way to masquerade as the 'server' and brute force the encryption (so long as it remains static). Ofcourse, that still doesnt solve the problem of the clear text (which is the key to decrypt the picture).

I need to learn more about this... I hope you fellas can help me out. This has turned into more of a challenge than something to get for free.

Also, im not too sure what cable my mate is getting. Ill ask him and post it here.

Btw, I did a scan on the URL the box talks to. Looks like the user is based here in Australia, im gonna do a further check to see if I can find out where abouts in Aus, but that info it probably not really necessary.
The box is running Windows XP (!!!) and has RDP enabled on 3 ports, only 1 of which is connectable by me (other 2 are filtered). It is also running POP3 which I tried to brute force but it has a lockout feature on it which will slow things down.

[jaykaus]

Ok, I had a look in the menu settings and its got under the server info section
server mode: newcamd
DESkey: <key>
server: <URL>
port: 10120 (and 10121)
user: <Username>
password: <password>

All info is in plain text and I can see it. I didnt put it in this post for obvious reasons.

One other thing that is REALLY weird is that looking through the packet traces (posted earlier via megaupload) you can see the cable box (192.168.1.11) connecting to the server on port 10121 using source port 1024. The TCP session is established and all is going well (by the way, seq/ack's start at 1! nice and easy!) but then by packet 15 we see another SYN sent out to the server dst :10120 with src port 1024 again!!! So essentially the cable box just killed the TCP connection and we can see the next few packets after that the connection is RST (packet 20) along with the new connection too (packet 17).
#18 - Tries to connect to server from post 1025 to port 10120, to no avail
#31,32+33 - Finally, a connection is made and this connection carries on for a while. The cable box would have to re-xmit every one of its packets (server would reply to ever 2nd packet).

This communication is so shaky, im surprised its running!!! After a reboot of the router we can then see on a proper, error free, connection (filter on: tcp.stream eq 3).

One thing that is constant here is that random seq/ack's are not used. They always start from 1. Now all I need to know is what data its sending! anyone know what protocol it runs on? or anything else?