[woodcreeker]

First, how digital scrambling works, quick version.

A digital picture or audio, is simply a bunch of numbers, when put together they make up the picture you watch or audio you hear.

Digital scrambling is easy, you simply mix up the numbers, but to unscramble the picture you must know how it was scrambled.

All satellite TV providers use the same system to scramble, its called a Control Word system, easy term, they use a hexidecimal number like 03 c2 51 da 35 f5 ef 76 to scramble ONE channel for about 2 minutes, then they change the number, this number is called the CW (control word), they use a different number (CW) for each channel, it is just a random 8 byte number.

After they have Scrambled the video with the CW number it is unwatchable, so their subscribers can't watch it either, so they must send out the CW to all their subscribers, and THIS is where encryption and decryption comes into the system.

This is what a card or cardless software is for, decrypting the CW for a specific channel, this is also why some channels will work and others won't, more on that later.

Ok so the picture is Scrambled using a random number called the Control Word (CW).

Now to prevent anyone with a d*sh and digital receiver from watching their channels the provider must encrypt (hide) the CW using different prearranged math methods, the prearranged part is what they have loaded on their subscribers cards or receivers, they encrypt the CW using the reverse of the prearranged decryption on the cards, and this is where MAPs come into play.

A MAP is nothing more, or less, than a preset math formula.
add 03 to all numbers
sub 06 from all numbers
multiply all numbers by 04

All 3 of these are simplified math versions, each its own MAP.

So
MAP01 = add 03 to all numbers
MAP02 = sub 06 from all numbers
MAP03 = multiply all numbers by 04

Real MAPs are a little more complicated mathwise, LOL

But the process is the same, a MAP changes the CW number in a known way, only known to DN.

DN tells the cards to use MAP57, then MAP03, then MAP3B in that order to decrypt the CW, if you don't know what the MAP does to the CW or you do it in the wrong order then you get the wrong CW at the end and no picture. They also throw in a key or two (auto-roll gets one of those keys) in the decryption process just to make it a little more secure.

So pretty straight forward process, nothing real complicated about it, and very secure IF your cards are secure. This is why DTV is no longer a "freeTV" option, their new cards are secure.

There is no way to get around this type of scrambling you can either get the correct CW or you can't, the problem is the CW changes every 2 min. on each channel and no two channels will have the same CW. You aren't going to just "guess" the CW for a channel, and even using the fastest computer on the planet you couldn't beat the 2 min. cycle.

If you read something that says they can beat this type of system without inside the card info, then put your hand on your wallet and back out of the room slowly, LOL.

Because each channel basicly is running its own CW encryption they can run some channels on one CW encryption and other channels on another CW encyption, B*V is even using a different base system for NFL. At any given time there are usually 2-4 different decryption paths available on a card, at this time B*V has 2-6.

In theory there could be 256 MAPs in a DN card, MAP00 to MAPFF, but probably not.

Just FYI, N1 and N2, and for that matter N3 when it comes, use the same scrambling of the digital picture, only the way the CW is Encrypted and decrypted changes, so they can run multiple types of encryption at the same time, its only a few more CW packets every few minutes so there are no bandwidth issues.

Now what has happened as of late, is that (Nagra Vision) has started impelmenting N3 into the stream, this itself is why we have all started seeing (private keys) example: nagra 01 06 00,for DN and B*V and 09 05 00,09 06 00,an 09 07 00.

Most of the time these keys are not active, but as of late both DAVE and Charlie are trying to see just how far they can push there own receivers and still work, most times it is not but for a few hours at a time. But they are still continuing to work on it, making everyones life hard, including there own customers, of course.

Just remember that, unless DAVE, and Charlie does a complete system wide upgrade of their whole equipment, (CAD Cards and Codes) at a cost of possibly a billion US dollars, only then can they shutdown FTA completely, and stop any coders from writing codes for all FTA units.

Now, what is this new mapcall 39 ?

That's a good question, without a doubt it is the worst mapcode ever devolved for everyone coding for FTA.

The simple answer is this, there are 64 known mapcalls that a provider can use, until this mapcall only [1] could be introduced into the stream at anyone time, via computer DOS programming.

Now mapcall$39 has incorporated into it, all 64 of these mapcalls. Meaning they can with a single finger, click a key, [F4] and change the mapcall every 15 minutes at will, also by changing the private keys with one finger every [5] minutes too.

Here's a little bit of info I wrote earlier today, I hope this helps explains things better.

The real severity of the problem:

Map$39 fix relies on finding some bytes on some registers in the card. Same as Map3B. The only reason Map3B was figured out is because ST Micro guys were selling the info to Viewsat. As far as I know there are no HW emu fixes for Map$39 at this time and it will probably take 1-2 weeks before someone figures it out, assuming they get lucky or ST sells this one too. Once the fix is posted, they move to Map$3A. Same thing. Down again. Solve the puzzle.

They have 64 map calls they can trigger with a single byte in CMD07. Also, allegedly every plastic card that has picture has its bug table (not EEPROM) altered. The consensus is Charles can loop them at will at any time. The question is how effectively will SI employ this latest tool. Judging from their past performance they will use it to the maximum ineffectiveness after the initial confusion.

Meaning: DN can drop anything on you at will it wants now at anytime, day or night, this is a really bad problem for alot of FTA units, that will not be able to handle this type of mapcode. So, a fix is at least weeks away for some boxes, all but Viewsat which has the full emulation, and the full mapcodes now.

So look for a lot of downtime, until coders reverse engineer this code from Viewsat bin files that were already released and now down again.

So we all will wait again and till the next time.

All this information comes courtesy of a fellow Moderator, CMFINC

[bigd]

hey thanks man some good info i now understand better and wont bitch so much when my fta goes down