ROM 110 REVISION AC6 M.O.S.C. (Modified Original Subscriber's Card)
RSA 16 ECM (2111):
7508665801DC6815F8DF965641A8C27CAE056ED0249CF60F60 DEDD75A3A84D486E85285220F133439F038BFE54975543C8DF C4205067985E5CDAD7ABA4CF48A7
KÈY ECM Signa (2111):
7653BBDAA13D97BB32B1B05E42272060
RSA12 EMMG (2011):
41C52356C25807052B6C15FBD951E07CED5360C11A792BE076 134167AF9438410DE37E0C8F6E71CF5B7794B14F4642AB692B C3133E450BB6FB58D792898EF6EBCE7EDF407381CE8C827E65 961132F6047E9A23D0F013E5A3F2E4FE559AE524C6
IKEY AC6 EMMG (2011):
E6525030148B33BC1EA499DC979E60DA
KÈY EMMG Signa (2011):
D918B9AA5DEBC0378E9BDF6623E54AFB
KÈY DES AC6 (2011):
81BE2D2CA5BC1607
2111 00 (Kèy Idea ECM 06) xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2111 01 (Kèy Idea ECM 46) xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2111 M1 (RSA16 ECM) 7508665801DC6815F8DF965641A8C27CAE056ED0249CF60F60DEDD75A3A84D486E85285220F133439F038BFE54975543C8DFC4205067985E5CDAD7ABA4CF48A7 ;
2111 07 (Kèy ECM Signa) 7653BBDAA13D97BB32B1B05E42272060
2011 52 (RSA12 EMMG) 41C52356C25807052B6C15FBD951E07CED5360C11A792BE076134167AF9438410DE37E0C8F6E71CF5B7794B14F4642AB692BC3133E450BB6FB58D792898EF6EBCE7EDF407381CE8C827E65961132F6047E9A23D0F013E5A3F2E4FE559AE524C6
2011 02 (RAM IKEY AC6 EMMG) E6525030148B33BC1EA499DC979E60DA
2011 03 (Kèy EMMG Signa) D918B9AA5DEBC0378E9BDF6623E54AFB
2011 3D (Kèy DES AC6) 81BE2D2CA5BC1607 !!!!!!!!!!!!!!!
EMM-G KÈYS DIGI TV Encriptado:
21006DA0CA00006704652011920098FB1FDBEEE1BB3464AD0B04D0119A363BA3AAC15996BDF8D2F9718CCF16B8AC108C989EEA5FCF9B401CCCD18C0EE9B86B20735343F6A859CD3A1BB2F4C4C0E4F4188EC73B888E5DEC9E72022A884B75C8DFE4A2FD04B63268C9EBAE18C000D107027E
Analisis:
21006DA0CA0000670465: Header
2011 : Proveedor
920098 : Select Kèy: 42 18 52 10 03 18 (EMM-G) 2011 (RAM IKEY AC6)
Longitud (Len) 96 Bytes datos a desncriptar:
FB1FDBEEE1BB3464AD0B04D0119A363BA3AAC15996BDF8D2F9718CCF16B8AC108C989EEA5FCF9B401CCCD18C0EE9B86B20735343F6A859CD3A1BB2F4C4C0E4F4188EC73B888E5DEC9E72022A884B75C8DFE4A2FD04B63268C9EBAE18C000D107
02
7E :CRL
_______________________________
_______________________________
1: RSA 768 Bits (M= Datos) (N= RSA12) (E= EXP)
_______________________________
_______________________________
M = FB1FDBEEE1BB3464AD0B04D0119A363BA3AAC15996BDF8D2F9718CCF16B8AC108C989EEA5FCF9B401CCCD18C0EE9B86B20735343F6A859CD3A1BB2F4C4C0E4F4188EC73B888E5DEC9E72022A884B75C8DFE4A2FD04B63268C9EBAE18C000D107
N = 41C52356C25807052B6C15FBD951E07CED5360C11A792BE076134167AF9438410DE37E0C8F6E71CF5B7794B14F4642AB692BC3133E450BB6FB58D792898EF6EBCE7EDF407381CE8C827E65961132F6047E9A23D0F013E5A3F2E4FE559AE524C6
E = 03
M ^ E mod N = CFB99AAEB416B88C868A5987DF0C40027EEA85B47E7CAD316A4D1A64EDFE19ADEFC508768CCB949626AD7FA34B06A9C978B39C69D3A52EAE037C3EC1A8D6580036E08AC7D3A64C513DED60F1E8D1D45E77CA7BAADC462CAE5F845925BEC2711E
_______________________________
_______________________________
2:
______________________________
_______________________________
Select Kèy: 98 (10011000 binary)
1E (00011110 binary)
1E or (98 and 80) = 9E
M = CFB99AAEB416B88C868A5987DF0C40027EEA85B47E7CAD316A4D1A64EDFE19ADEFC508768CCB949626AD7FA34B06A9C978B39C69D3A52EAE037C3EC1A8D6580036E08AC7D3A64C513DED60F1E8D1D45E77CA7BAADC462CAE5F845925BEC2719E
============================
3: IDEA CBC 12 Rounds
============================
IDEACBC Kèy: E6525030148B33BC1EA499DC979E60DA (RAM IKEY AC6 EMMG)
M (ALL Blocks)=
CFB99AAEB416B88C --> block 01
868A5987DF0C4002 --> block 02
7EEA85B47E7CAD31 --> block 03
6A4D1A64EDFE19AD --> block 04
EFC508768CCB9496 --> block 05
26AD7FA34B06A9C9 --> block 06
78B39C69D3A52EAE --> block 07
037C3EC1A8D65800 --> block 08
36E08AC7D3A64C51 --> block 09
3DED60F1E8D1D45E --> block 10
77CA7BAADC462CAE --> block 11
5F845925BEC2719E --> block 12
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Block 12 : 5F845925BEC2719E
Crypter IDEACBC : E6525030148B33BC1EA499DC979E60DA
Crypted Block : 1250F821826B2F82
Crypted Block XOR Block 11 = xxxxxxxxxxxxxxxx --> New block 12
1250F821826B2F82 XOR 77CA7BAADC462CAE = 659A838B5E2D032C --> New block 12
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Block 11 : 77CA7BAADC462CAE
Crypter IDEACBC : E6525030148B33BC1EA499DC979E60DA
Crypted Block : 06BE340887C1C676
Crypted Block XOR Block 10 = xxxxxxxxxxxxxxxx --> New block 11
06BE340887C1C676 XOR 3DED60F1E8D1D45E = 3B5354F96F101228 --> New block 11
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Block 10 : 3DED60F1E8D1D45E
Crypter IDEACBC : E6525030148B33BC1EA499DC979E60DA
Crypted Block : 32D0819F4F48D2AF
Crypted Block XOR Block 9 = xxxxxxxxxxxxxxxx --> New block 10
32D0819F4F48D2AF XOR 36E08AC7D3A64C51 = 04300B589CEE9EFE --> New block 10
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Block 9 : 36E08AC7D3A64C51
Crypter IDEACBC : E6525030148B33BC1EA499DC979E60DA
Crypted Block : EDAA63C95208F9E9
Crypted Block XOR Block 8 = xxxxxxxxxxxxxxxx --> New block 9
EDAA63C95208F9E9 XOR 037C3EC1A8D65800 = EED65D08FADEA1E9 --> New block 9
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Block 8 : 037C3EC1A8D65800
Crypter IDEACBC : E6525030148B33BC1EA499DC979E60DA
Crypted Block : 3440C658956DE103
Crypted Block XOR Block 7 = xxxxxxxxxxxxxxxx --> New block 8
3440C658956DE103 XOR 78B39C69D3A52EAE = 4CF35A3146C8CFAD --> New block 8
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Block 7 : 78B39C69D3A52EAE
Crypter IDEACBC : E6525030148B33BC1EA499DC979E60DA
Crypted Block : B1A416F7E844A6C0
Crypted Block XOR Block 6 = xxxxxxxxxxxxxxxx --> New block 7
B1A416F7E844A6C0 XOR 26AD7FA34B06A9C9 = 97096954A3420F09 --> New block 7
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Block 6 : 26AD7FA34B06A9C9
Crypter IDEACBC : E6525030148B33BC1EA499DC979E60DA
Crypted Block : B6E9B8218DCA6068
Crypted Block XOR Block 5 = xxxxxxxxxxxxxxxx --> New block 6
B6E9B8218DCA6068 XOR EFC508768CCB9496 = 592CB0570101F4FE --> New block 6
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Block 5 : EFC508768CCB9496
Crypter IDEACBC : E6525030148B33BC1EA499DC979E60DA
Crypted Block : 31E361B941F7F84F
Crypted Block XOR Block 4 = xxxxxxxxxxxxxxxx --> New block 5
31E361B941F7F84F XOR 6A4D1A64EDFE19AD = 5BAE7BDDAC09E1E2 --> New block 5
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Block 4 : 6A4D1A64EDFE19AD
Crypter IDEACBC : E6525030148B33BC1EA499DC979E60DA
Crypted Block : DB72219DEF5A880C
Crypted Block XOR Block 3 = xxxxxxxxxxxxxxxx --> New block 4
DB72219DEF5A880C XOR 7EEA85B47E7CAD31 = A598A4299126253D --> New block 4
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Block 3 : 7EEA85B47E7CAD31
Crypter IDEACBC : E6525030148B33BC1EA499DC979E60DA
Crypted Block : E5D0723A5CBC27D1
Crypted Block XOR Block 2 = xxxxxxxxxxxxxxxx --> New block 3
E5D0723A5CBC27D1 XOR 868A5987DF0C4002 = 635A2BBD83B067D3 --> New block 3
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Block 2 : 868A5987DF0C4002
Crypter IDEACBC..: E6525030148B33BC1EA499DC979E60DA
Crypted Block : 1D97A9F0C726485A
Crypted Block XOR Block 1 = xxxxxxxxxxxxxxxx --> New block 2
1D97A9F0C726485A XOR CFB99AAEB416B88C = D22E335E7330F0D6 --> New block 2
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Block 1 : CFB99AAEB416B88C
Crypter IDEACBC : E6525030148B33BC1EA499DC979E60DA
Crypted Block : 3DC48D64E066B8C3 --> New Block 1
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
ALL Blocks = M
3DC48D64E066B8C3 --> New Block 01
D22E335E7330F0D6 --> New Block 02
635A2BBD83B067D3 --> New Block 03
A598A4299126253D --> New Block 04
5BAE7BDDAC09E1E2 --> New Block 05
592CB0570101F4FE --> New Block 06
97096954A3420F09 --> New Block 07
4CF35A3146C8CFAD --> New Block 08
EED65D08FADEA1E9 --> New Block 09
04300B589CEE9EFE --> New Block 10
3B5354F96F101228 --> New Block 11
659A838B5E2D032C --> New Block 12
M = 3DC48D64E066B8C3D22E335E7330F0D6635A2BBD83B067D3A598A4299126253D5BAE7BDDAC09E1E2592CB0570101F4FE97096954A3420F094CF35A3146C8CFADEED65D08FADEA1E904300B589CEE9EFE3B5354F96F101228659A838B5E2D032C
_______________________________
_______________________________
4: RSA 768 Bits (M= Datos) (N= RSA12) (E= EXP)
_______________________________
_______________________________
M = 3DC48D64E066B8C3D22E335E7330F0D6635A2BBD83B067D3A598A4299126253D5BAE7BDDAC09E1E2592CB0570101F4FE97096954A3420F094CF35A3146C8CFADEED65D08FADEA1E904300B589CEE9EFE3B5354F96F101228659A838B5E2D032C
N = 41C52356C25807052B6C15FBD951E07CED5360C11A792BE076134167AF9438410DE37E0C8F6E71CF5B7794B14F4642AB692BC3133E450BB6FB58D792898EF6EBCE7EDF407381CE8C827E65961132F6047E9A23D0F013E5A3F2E4FE559AE524C6
E = 03
M ^ E mod N = 779CB669AF8BC57B201113DB00011A337789BA8A9BB60D88A4F1AA02B70DA641B7163F153A151216AE1BCD82209D1316B8DCB7DC9FB814B8D3B7D384B70D86A632CC9BDD832111420110060800106F91B55DB76F1C38F8D3E2D531002C090000
M = 779CB669AF8BC57B 201113DB00011A337789BA8A9BB60D88A4F1AA02B70DA641B7163F153A151216AE1BCD82209D1316B8DCB7DC9FB814B8D3B7D384B70D86A632CC9BDD832111420110060800106F91B55DB76F1C38F8D3E2D531002C090000
779CB669AF8BC57B --> Block 01
201113DB00011A33 --> Block 02
7789BA8A9BB60D88 --> Block 03
A4F1AA02B70DA641 --> Block 04
B7163F153A151216 --> Block 05
AE1BCD82209D1316 --> Block 06
B8DCB7DC9FB814B8 --> Block 07
D3B7D384B70D86A6 --> Block 08
32CC9BDD83211142 --> Block 09
0110060800106F91 --> Block 10
B55DB76F1C38F8D3 --> Block 11
E2D531002C090000 --> Block 12
_______________________________
_______________________________
5:
_______________________________
_______________________________
IDEACBC *** Signature: D918B9AA5DEBC0378E9BDF6623E54AFB (*** EMMG Signa)
Datos:
201113DB00011A33 --> Block 02
7789BA8A9BB60D88 --> Block 03
A4F1AA02B70DA641 --> Block 04
B7163F153A151216 --> Block 05
AE1BCD82209D1316 --> Block 06
B8DCB7DC9FB814B8 --> Block 07
D3B7D384B70D86A6 --> Block 08
32CC9BDD83211142 --> Block 09
0110060800106F91 --> Block 10
B55DB76F1C38F8D3 --> Block 11
E2D531002C090000 --> Block 12
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Block 2 : 201113DB00011A33
Crypter IDEACBC : D918B9AA5DEBC0378E9BDF6623E54AFB
Crypted Block : AD8C458C4872AA6A
Block 2 XOR Crypted Block = xxxxxxxxxxxxxxxx --> Second octet new *** IDEACBC
201113DB00011A33 XOR AD8C458C4872AA6A = 8D9D56574873B059 --> Second octet new *** IDEACBC
New *** IDEACBC : 8E9BDF6623E54AFB8D9D56574873B059
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Block 3 : 7789BA8A9BB60D88
Crypter IDEACBC : 8E9BDF6623E54AFB8D9D56574873B059
Crypted Block : 6A3785369FFB379F
Block 3 XOR Crypted Block = xxxxxxxxxxxxxxxx --> Second octet new *** IDEACBC
7789BA8A9BB60D88 XOR 6A3785369FFB379F = 1DBE3FBC044D3A17 --> Second octet new *** IDEACBC
New *** IDEACBC : 8D9D56574873B0591DBE3FBC044D3A17
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Block 4 : A4F1AA02B70DA641
Crypter IDEACBC : 8D9D56574873B0591DBE3FBC044D3A17
Crypted Block : 0CAD3EA95FC00678
Block 4 XOR Crypted Block = xxxxxxxxxxxxxxxx --> Second octet new *** IDEACBC
A4F1AA02B70DA641 XOR 0CAD3EA95FC00678 = A85C94ABE8CDA039 --> Second octet new *** IDEACBC
New *** IDEACBC: 1DBE3FBC044D3A17A85C94ABE8CDA039
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Block 5 : B7163F153A151216
Crypter IDEACBC : 1DBE3FBC044D3A17A85C94ABE8CDA039
Crypted Block : 0CAF3890DF8FB953
Block 5 XOR Crypted Block = xxxxxxxxxxxxxxxx --> Second octet new *** IDEACBC
B7163F153A151216 XOR 0CAF3890DF8FB953 = BBB90785E59AAB45 --> Second octet new *** IDEACBC
New *** IDEACBC: A85C94ABE8CDA039BBB90785E59AAB45
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Block 6 : AE1BCD82209D1316
Crypter IDEACBC : A85C94ABE8CDA039BBB90785E59AAB45
Crypted Block : EB21A8D6110797EF
Block 6 XOR Crypted Block = xxxxxxxxxxxxxxxx --> Second octet new *** IDEACBC
AE1BCD82209D1316 XOR EB21A8D6110797EF = 453A6554319A84F9 --> Second octet new *** IDEACBC
New *** IDEACBC: BBB90785E59AAB45453A6554319A84F9
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Block 7 : B8DCB7DC9FB814B8
Crypter IDEACBC : BBB90785E59AAB45453A6554319A84F9
Crypted Block : FF36EB6B81164192
Block 7 XOR Crypted Block = xxxxxxxxxxxxxxxx --> Second octet new *** IDEACBC
B8DCB7DC9FB814B8 XOR FF36EB6B81164192 = 47EA5CB71EAE552A --> Second octet new *** IDEACBC
New *** IDEACBC: 453A6554319A84F947EA5CB71EAE552A
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Block 8 : D3B7D384B70D86A6
Crypter IDEACBC : 453A6554319A84F947EA5CB71EAE552A
Crypted Block : F0DB4B01BD03AF54
Block 8 XOR Crypted Block = xxxxxxxxxxxxxxxx --> Second octet new *** IDEACBC
D3B7D384B70D86A6 XOR F0DB4B01BD03AF54 = 236C98850A0E29F2
New *** IDEACBC: 47EA5CB71EAE552A236C98850A0E29F2
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Block 9 : 32CC9BDD83211142
Crypter IDEACBC : 47EA5CB71EAE552A236C98850A0E29F2
Crypted Block : A0C4EFE9169006E8
Block 9 XOR Crypted Block = xxxxxxxxxxxxxxxx --> Second octet new *** IDEACBC
32CC9BDD83211142 XOR A0C4EFE9169006E8 = 9208743495B117AA --> Second octet new *** IDEACBC
New *** IDEACBC: 236C98850A0E29F29208743495B117AA
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Block 10 : 0110060800106F91
Crypter IDEACBC : 236C98850A0E29F29208743495B117AA
Crypted Block : 2785A6BF3B9038D2
Block 10 XOR Crypted Block = xxxxxxxxxxxxxxxx --> Second octet new *** IDEACBC
0110060800106F91 XOR 2785A6BF3B9038D2 = 2695A0B73B805743 --> Second octet new *** IDEACBC
New *** IDEACBC: 9208743495B117AA2695A0B73B805743
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Block 11 : B55DB76F1C38F8D3
Crypter IDEACBC : 9208743495B117AA2695A0B73B805743
Crypted Block : 92B5B341FD78ADC6
Block 11 XOR Crypted Block = xxxxxxxxxxxxxxxx --> Second octet new *** IDEACBC
B55DB76F1C38F8D3 XOR 92B5B341FD78ADC6 = 27E8042EE1405515 --> Second octet new *** IDEACBC
New *** IDEACBC: 2695A0B73B80574327E8042EE1405515
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Block 12 : E2D531002C090000
Crypter IDEACBC : 2695A0B73B80574327E8042EE1405515
Crypted Block : 154987698382C57B
Block 12 XOR Crypted Block = xxxxxxxxxxxxxxxx
E2D531002C090000 XOR 154987698382C57B = F79CB669AF8BC57B '"F7"'
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
_______________________________
_______________________________
6:
_______________________________
_______________________________
F7 (11110111 binary)
F7 AND 7F = 77
Firma (Signature) ok!!!!!!: (77)9CB669AF8BC57B
=========================================================================
EMMG Desencrypt
779CB669AF8BC57B 2011 13DB0001 1A337789 [BA] 8A9BB60D88A4F1AA02B70DA641B7163F153A151216AE1BCD82209D1316B8DCB7DC9FB814B8D3B7D384B70D86A632CC9BDD832111420110060800106F91B55DB76F1C38F8D3E2D531002C090000
779CB669AF8BC57B Signature
2011 Provider ((Digi TV (Rumania))
13DB0001 Creacion (Creation) (01/12/2005 00:00:02)
1A337789 Expiracion (Expiry) (13/05/2010 17:00:02)
Cmd BA (Execute ST Code)
Code 8A9BB60D88A4F1AA02B70DA641B7163F153A151216AE1BCD82209D1316B8DCB7DC9FB814B8D3B7D384B70D86A632CC9BDD [83] 2111 [42] 011006080010 6F91B55DB76F1C38F8D3E2D531002C09 0000
Cmd 83 Cambia (change) Provider --> 2111
Cmd 42 Update ***
Data 0110'06'080010 (06= Index 00)
*** Encrypt 6F91B55DB76F1C38F8D3E2D531002C09
0000
Code disassembly:
8A9BB60D88A4F1AA02B70DA641B7163F153A151216AE1BCD82209D1316B8DCB7DC9FB814B8D3B7D384B70D86A632CC9BDD
RAM 00:0093: 8A push cc ; Stack <- CC
RAM 00:0094: 9B sim ; I <-- 1
RAM 00:0095: B60D ld a, $0D ; Load in A
RAM 00:0097: 88 push a ; Stack <- A
RAM 00:0098: A4F1 and a, #$F1 ; A= A and ...
RAM 00:009A: AA02 or a, #$02 ; A= A or ...
RAM 00:009C: B70D ld $0D, a ; Store A in...
RAM 00:009E: A641 ld a, #$41 ; Load in A
RAM 00:00A0: B716 ld $16, a ; Store A in...
RAM 00:00A2: 3F15 clr $15 ; <-- 0
RAM 00:00A4: 3A15 dec $15 ; -=1
RAM 00:00A6: 1216 bset $16, #1 ; Bit 1 <-- 1
RAM 00:00A8: AE1B ld x, #$1B ; Load in X
RAM 00:00AA: CD8220 call $8220 ; Go to subroutine
Edit rom110 by kasita botonnou (add code:AB515FAEA081)
ROM 00:8220: AB51 add a, #$51 ; A=A + ...
ROM 00:8222: 5F clr x ; x <-- 0
ROM 00:8223: AEA0 ld x, #$A0 ; Load in X
ROM 00:8225: 81 ret ; Return from subroutine
RAM 00:00AD: 9D nop ; No operation
RAM 00:00AE: 1316 bclr $16, #1 ; Bit 1 <-- 0
RAM 00:00B0: B8DC xor a, $DC ; A= A xor ...
RAM 00:00B2: B7DC ld $DC, a ; Store A in...
RAM 00:00B4: 9F ld a, x ; X --> A
RAM 00:00B5: B814 xor a, $14 ; A= A xor ...
RAM 00:00B7: B8D3 xor a, $D3 ; A= A xor ...
RAM 00:00B9: B7D3 ld $D3, a ; Store A in...
RAM 00:00BB: 84 pop a ; Stack -> A
RAM 00:00BC: B70D ld $0D, a ; Store A in...
RAM 00:00BE: 86 pop cc ; Stack -> CC
RAM 00:00BF: A632 ld a, #$32 ; Load in A
RAM 00:00C1: CC9BDD jp $9BDD NextEMMCMD ; Jump
cr:-pc- aa xx yy dr -sp- VHINZC -mem@pc- -mem@sp- -cycles-
RAM 00:0093 00 00 00 00 0fff V..... 8a9bb60d 00000000 00000000 PUSHC
RAM 00:0094 00 00 00 00 0ffe V..... 9bb60d88 e0000000 00000003 SEI
RAM 00:0095 00 00 00 00 0ffe V.I... b60d88a4 e0000000 00000005 LDA 0d {00}
RAM 00:0097 00 00 00 00 0ffe V.I.Z. 88a4f1aa e0000000 00000008 PUSHA
RAM 00:0098 00 00 00 00 0ffd V.I.Z. a4f1aa02 00e00000 0000000b AND #f1
RAM 00:009a 00 00 00 00 0ffd V.I.Z. aa02b70d 00e00000 0000000d ORA #02
RAM 00:009c 02 00 00 00 0ffd V.I... b70da641 00e00000 0000000f STA 0d
RAM 00:009e 02 00 00 00 0ffd V.I... a641b716 00e00000 00000013 LDA #41
RAM 00:00a0 41 00 00 00 0ffd V.I... b7163f15 00e00000 00000015 STA 16
RAM 00:00a2 41 00 00 00 0ffd V.I... 3f153a15 00e00000 00000019 CLR 15
RAM 00:00a4 41 00 00 00 0ffd V.I.Z. 3a151216 00e00000 0000001e DEC 15 {00}
RAM 00:00a6 41 00 00 00 0ffd ..IN.. 1216ae1b 00e00000 00000023 BSET 16 {41} ,#1
RAM 00:00a8 41 00 00 00 0ffd ..IN.. ae1bcd82 00e00000 00000028 LDX #1b
RAM 00:00aa 41 1b 00 00 0ffd ..I... cd82209d 00e00000 0000002a JSR 8220
Edit rom110 (add code:AB51 5F AEA0 81)
ROM 00:8220 41 1b 00 00 0ffb ..I... ab515fae 00ad00e0 00000030 ADD #51
ROM 00:8222 92 1b 00 00 0ffb ..I... 5faea081 00ad00e0 00000033 CLR X
ROM 00:8223 92 00 00 00 0ffb ..I... aea081a3 00ad00e0 00000036 LDX #A0
ROM 00:8225 92 a0 00 00 0ffb ..I... 81a30127 00ad00e0 0000003a RTS
!!!! A=92 X=A0 Y=00 !!!!
RAM 00:00ad 92 a0 00 00 0ffd ..IN.. 9d1316b8 00e00000 00001ae7 NOP
RAM 00:00ae 92 a0 00 00 0ffd ..IN.. 1316b8dc 00e00000 00001ae9 BCLR 16 {43} ,#1
***=6F91B55DB76F1C38 F8D3E2D531002C09
RAM 00:00b0 92 a0 00 00 0ffd ..IN.. b8dcb7dc 00e00000 00001aee EOR dc {2c}
RAM 00:00b2 be a0 00 00 0ffd ..IN.. b7dc9fb8 00e00000 00001af1 STA dc
____ 2C ($00DC) XOR 92 (A) = BE ($00DC) ____
***=6F91B55DB76F1C38 F8D3E2D53100(BE)09
RAM 00:00b4 be a0 00 00 0ffd ..IN.. 9fb814b8 00e00000 00001af5 TXA
RAM 00:00b5 a0 a0 00 00 0ffd ..IN.. b814b8d3 00e00000 00001af7 EOR 14 {f9}
RAM 00:00b7 59 a0 00 00 0ffd ..IN.. b8d3b7d3 00e00000 00001afa EOR d3 {6f}
RAM 00:00b9 36 a0 00 00 0ffd ..IN.. b7d384b7 00e00000 00001afd STA d3
____ A0 (A) XOR F9 ($0014) = 59 (A) XOR 6F ($00D3) = 36 ($00D3) ____
***=6F91B55DB7(36)1C38 F8D3E2D53100(BE)09
RAM 00:00bb 36 a0 00 00 0ffd ..IN.. 84b70d86 00e00000 00001b01 POPA
RAM 00:00bc 00 a0 00 00 0ffe ..IN.. b70d86a6 e0000000 00001b05 STA 0d
RAM 00:00be 00 a0 00 00 0ffe ..I.Z. 86a632cc e0000000 00001b09 POPC
RAM 00:00bf 00 a0 00 00 0fff V..... a632cc9b 00000000 00001b0d LDA #32
RAM 00:00c1 32 a0 00 00 0fff V..... cc9bdd83 00000000 00001b0f JMP 9bdd Next_EMMCMD
((((((((((((((((((((((((( XOR: 1-0=1; 0-1=1; 1-1=0; 0-0=0 )))))))))))))))))))))))))))))
*** EMMG: 6F91B55DB7 '6F' 1C38F8D3E2D53100 '2C' 09
____ 2C XOR 92 = BE $00DC ____
____ A0 XOR F9 = 59 XOR 6F = 36 $00D3 ____
*** (Desencrypt 2 bytes): 6F91B55DB7 '36' 1C38F8D3E2D53100 'BE' 09
6F91B55DB7361C38 = 8 Bytes Desencrypt
F8D3E2D53100BE09 = 8 Bytes Encrypt
*** = 6F91B55DB7361C38 F8D3E2D53100BE09
)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
Offs: 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
--------------------------------------------------------
00B0: A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7
00C0: A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7
00D0: A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 6F 91 B5 5D B7 36
00E0: 1C 38 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7
00F0: A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7
6F91B55DB7361C38A7A7A7A7 A7A7A7A7A7A7A7 A7A7A7A7A7A7A7A7A7A7A7A7 A7A7A7A7A7A7A7
Offs: 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
--------------------------------------------------------
00B0: A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7
00C0: A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7
00D0: A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 6F 91 B5 1B 67 B4
00E0: 07 83 2D 17 E3 5D E7 E3 6D F7 C3 1D 47 C3 AD D7
00F0: 23 5D 27 23 ED B7 03 1D 87 03 2D 97 63 5D 67 63
6F91B51B67B407832D17E35D E7E36DF7C31D47 C3ADD7235D2723EDB7031D87 032D97635D6763
P= 032D97635D6763
Q= E7E36DF7C31D47
P XOR Q = A
032D97635D6763 'XOR' E7E36DF7C31D47 = E4CEFA949E7A24
A = E4CEFA949E7A24
A = 11100100110011101111101010010100100111100111101000100100
1110 0100 = E4
1100 1110 = CE
1111 1010 = FA
1001 0100 = 94
1001 1110 = 9E
0111 1010 = 7A
0010 0100 = 24
Tabla 1
35(1)-34(1)-33(1)-32(0) 55(0)-20(1)-21(0)-22(0)--- 1110 0100 = E4
43(1)-42(1)-41(0)-40(0) 39(1)-04(1)-05(1)-06(0)--- 1100 1110 = CE
51(1)-50(1)-49(1)-48(1) 47(1)-12(0)-13(1)-14(0)--- 1111 1010 = FA
31(1)-27(0)-60(0)-61(1) 62(0)-26(1)-25(0)-24(0)--- 1001 0100 = 94
23(1)-19(0)-52(0)-53(1) 54(1)-18(1)-17(1)-16(0)--- 1001 1110 = 9E
15(0)-11(1)-44(1)-45(1) 46(1)-10(0)-09(1)-08(0)--- 0111 1010 = 7A
07(0)-03(0)-36(1)-37(0) 38(0)-02(1)-01(0)-00(0)--- 0010 0100 = 24
Tabla 2
00(0)-08(0)-16(0)-24(0) 32(0)-40(0)-48(1)-56(0)--- 0000 0010 = 02
01(0)-09(1)-17(1)-25(0) 33(1)-41(0)-49(1)-57(0)--- 0110 1010 = 6A
02(1)-10(0)-18(1)-26(1) 34(1)-42(1)-50(1)-58(0)--- 1011 1110 = BE
38(0)-46(1)-54(1)-62(0) 35(1)-43(1)-51(1)-59(0)--- 0110 1110 = 6E
37(0)-45(1)-53(1)-61(1) 06(0)-14(0)-22(0)-30(0)--- 0111 0000 = 70
36(1)-44(1)-52(0)-60(0) 05(1)-13(1)-21(0)-29(0)--- 1100 1100 = CC
03(0)-11(1)-19(0)-27(0) 04(1)-12(0)-20(1)-28(0)--- 0100 1010 = 4A
07(0)-15(0)-23(1)-31(1) 39(1)-47(1)-55(0)-63(0)--- 0011 1100 = 3C
B= 026ABE6E70CC4A3C
------------------------------------------------
B 'xor' *** DES AC6 = *** DES Permuted
026ABE6E70CC4A3C 'xor' 81BE2D2CA5BC1607 = 83D49342D5705C3B
*** DES Permuted= 83D49342D5705C3B
-------------------------------------------------
***= (('6F91B55DB7361C38')) F8D3E2D53100BE09
*** DES Permuted "DES (Encrypt)" Primer octeto *** = xxxxxxxxxxxxxxxx
83D49342D5705C3B "DES (Encrypt)" 6F91B55DB7361C38 = xxxxxxxxxxxxxxxx
Primer octeto *** :
6F91B55DB7361C38
*** DES Permuted:
83D49342D5705C3B
SUBCLAVES (BINARIO)
SUBCLAVE 1
101101100101001010111000000100000110101101010001
SUBCLAVE 2
011101001101100111000011111001000000100011000101
SUBCLAVE 3
001100111110100101010011100000101000001011011111
SUBCLAVE 4
001011010110010110010111000101111001011110000001
SUBCLAVE 5
011101110000010110011101000110100000010101100001
SUBCLAVE 6
010111111000000010110001010010101110100100000100
SUBCLAVE 7
100111111000100010111110011000000110010110011000
SUBCLAVE 8
101111100010001010001110111010010001000000001011
SUBCLAVE 9
011100010011111110000111001010111000011101110000
SUBCLAVE 10
011100011011110011000001000110011100110100000010
SUBCLAVE 11
010100011110010011110110010011000100010000010100
SUBCLAVE 12
111101001100010110010110110010010110000011001100
SUBCLAVE 13
011101101000001100100111101000001101001010001001
SUBCLAVE 14
101010111001000000110111100100100001011000100111
SUBCLAVE 15
101011010000001011111110100111100000101110100000
SUBCLAVE 16
011000011101011111011010000001010110000010100110
CIFRANDO (BINARIO)
RONDA 1
R0:
11100011100110100100110100101000
L0:
00010110101101011100100100110001
RONDA 2
R0:
11110111110010101010010011111000
L0:
11100011100110100100110100101000
RONDA 3
R0:
01100000010101000100111100110101
L0:
11110111110010101010010011111000
RONDA 4
R0:
11001110100000001111011000100100
L0:
01100000010101000100111100110101
RONDA 5
R0:
01001001111000011101001000101010
L0:
11001110100000001111011000100100
RONDA 6
R0:
00000011101110110011000010110010
L0:
01001001111000011101001000101010
RONDA 7
R0:
01011100111111001001100010000010
L0:
00000011101110110011000010110010
RONDA 8
R0:
10110101011100101101011011010010
L0:
01011100111111001001100010000010
RONDA 9
R0:
01001011001011100010111010101000
L0:
10110101011100101101011011010010
RONDA 10
R0:
10001000100010110100101000010110
L0:
01001011001011100010111010101000
RONDA 11
R0:
00101011011101001010010001111011
L0:
10001000100010110100101000010110
RONDA 12
R0:
10111101111010001111001011010101
L0:
00101011011101001010010001111011
RONDA 13
R0:
00000001000100110011101000111011
L0:
10111101111010001111001011010101
RONDA 14
R0:
10000100011110010000010001101011
L0:
00000001000100110011101000111011
RONDA 15
R0:
10000110001111111011111101101000
L0:
10000100011110010000010001101011
RONDA 16
R0:
10100010010001010000001101111111
L0:
10000110001111111011111101101000
Resulte: 3DEDB92B296B13C8
*** DES Permuted "DES (Encrypt)" Primer octeto *** = xxxxxxxxxxxxxxxx
83D49342D5705C3B "DES (Encrypt)" 6F91B55DB7361C38 = 3DEDB92B296B13C8 --> Resulte!!!!!!!!!!!!!!
***= 6F91B55DB7361C38 (('F8D3E2D53100BE09'))
Resulte "xor" Segund octeto *** encrypt = xxxxxxxxxxxxxxxx --> Second octet *** Desencrypt
3DEDB92B296B13C8 "xor" F8D3E2D53100BE09 = C53E5BFE186BADC1 --> Second octet *** Desencrypt
***= 6F91B55DB7361C38 (('C53E5BFE186BADC1'))
2111 00 6F91B55DB7361C38 C53E5BFE186BADC1
2111 00 (*** Idea ECM 06) 6F91B55DB7361C38C53E5BFE186BADC1
2111 01 (*** Idea ECM 46 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2111 M1 (RSA16 ECM) 7508665801DC6815F8DF965641A8C27CAE056ED0249CF60F60DEDD75A3A84D486E85285220F133439F038BFE54975543C8DFC4205067985E5CDAD7ABA4CF48A7 ;
2111 07 (*** ECM Signa) 7653BBDAA13D97BB32B1B05E42272060
