Explanation of a MAP CALL

[Ladybbird]

An Easier Way To Understand A Map Call

C&P

First how digital scrambling works, quick version.
A digital picture or audio, is simply a bunch of numbers, when put together they make up the picture you watch or audio you hear.

Digital scrambling is easy you simply mix up the numbers, but to unscramble the picture you must know how it was scambled.

All sat TV providers use the same system to scramble, its called a Control Word system, easy term, they use a number like 03 c2 51 da 35 f5 ef 76 to scramble ONE channel for about 2 minutes, then they change the number, this number is called the CW (control word), they use a different number(CW) for each channel, it is just a random 8 byte number.

After they have Scrambled the video with the CW number it is unwatchable, so their subscribers can't watch it either, so they must send out the CW to all their subscribers, and THIS is where encryption and decryption comes into the system.

This is what a card or card less software is for, decrypting the CW for a specific channel, this is also why some channels will work and others won't, more on that later.

OK so the picture is Scrambled using a random number called the Control Word(CW).

Now to prevent anyone with a dish and digital receiver from watching their channels the provider must encrypt(hide) the CW using different prearranged math methods, the prearranged part is what they have loaded on their subscribers cards or receivers, they encrypt the CW using the reverse of the prearranged decryption on the cards, and this is where MAPs come into play.

A MAP is nothing more, or less, than a preset math formula.

add 03 to all numbers
sub 06 from all numbers
multiply all numbers by 04

All 3 of these are simplified math versions, each its own MAP.

So

MAP01 = add 03 to all numbers
MAP02 = sub 06 from all numbers
MAP03 = multiply all numbers by 04

Real MAPs are a little more complicated mathwise, lol.

But the process is the same, a MAP changes the CW number in a known way, known to DN.

DN tells the cards to use MAP57, then MAP03, then MAP3B in that order to decrypt the CW, if you don't know what the MAP does to the CW or you do it in the wrong order then you get the wrong CW at the end an no picture

They also throw in a key or two (auto-roll gets one of those keys) in the decryption process just to make it a little more secure.

So pretty straight forward process, nothing real complicated about it, and very secure IF your cards are secure. This is why DTV is no longer a "freeTV" option, their new cards are secure.

There is no way to get around this type of scrambling you can either get the correct CW or you can't, the problem is the CW changes every 2 min. on each channel and no two channels will have the same CW.

You aren't going to just "guess" the CW for a channel, and even using the fastest computer on the planet you couldn't beat the 2 min. cycle.

If you read something that says they can beat this type of system without inside the card info, then put your hand on your wallet and back out of the room slowly, LOL

Because each channel basically is running its own CW encryption they can run some channels on one CW encryption and other channels on another CW encryption, BEV is even using a different base system for NFL.
At any given time there are usually 2-4 different decryption paths available on a card, at this time BEV has 2-6.

In theory there could be 256 MAPs in a DN card, MAP00 to MAPFF, but probably not.

Just FYI, N1 and N2, and for that matter N3 when it comes, use the same scrambling of the digital picture, only the way the CW is Encrypted and decrypted changes, so they can run multiple types of encryption at the same time, its only a few more CW packets every few minutes there is no bandwidth issue.

Now what has happened as of late, is that (Nagra Vision) has started implementing N3 into the stream, this itself is why we have all started seeing (private keys) example: nagra 01 06 00,for DN and B*V and 09 05 00,09 06 00,an 09 07 00.

Most of the time these keys are not active, but as of late they Bev , and Charlie's are trying to see just how far they can push there own receiver's and still work, most times itself is not but for a few hours at a time. but they are still continuing to work on it, making every ones life hard, including there own customers of course.

Just remember that, unless Bev , and Charlie's does a (complete system wide) upgrade of there whole (equipment, CAD Cards and Codes) at a cost of possibly a billion US dollars, only then can it shutdown FTA, and stop any coders from writing codes for all FTA units.


Hope This Helps

[jpitt16]

First of all thank you for your post!

Below is my understanding of the code word encryption/decryption process (please correct if anything is wrong)

1. Provider Channels are scrambled with a CW
2. Provider encrypts (technically) the CW with various MAP calls which are also on subscriber's card
3. Provider encrypts the MAP encrypted CW with NAG1,2,3
2. MAP Encrypted and NAG encrypted CW is sent from Satellite to Receiver
3. Receiver /card uses NAG1,2 (not 3 quite yet ) keys to decrypt
4. Remaining MAP encrypted CW is run through the reverse of the various MAP Calls used in step 1.
5. (Twice) decrypted CW is used to descramble the channel
6. Football, Beer and Peanuts?


Also, are the MAP calls typically the first bit of the decryption data that hackers are able to obtain since they are pre-programmed onto the subscribers cards (unless NAG code is leaked quickly)?

Acid and electron microscopes… that’s what I read in another thread.

[car5469]

numbers, letters, math = picture That's so simple they should have this N3 fixed by the end of the day!