|
@@ -171,43 +171,30 @@ uint8_t *init_2b(uint32_t val, uint8_t *b) {
|
171
|
171
|
static void camd35_init_auth(char *user, char *pass) {
|
172
|
172
|
unsigned char dump[16];
|
173
|
173
|
camd35_auth = crc32(0L, MD5((unsigned char *)user, strlen(user), dump), 16);
|
174
|
|
-// fprintf(stderr, "camd35_auth = 0x%08x\n", camd35_auth);
|
175
|
174
|
|
176
|
175
|
MD5((unsigned char *)pass, strlen(pass), dump);
|
177
|
|
-// fprintf(stderr, "aes_dec_key=0x%02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x\n\n",
|
178
|
|
-// dump[0], dump[1], dump[2] , dump[3] , dump[4] , dump[5] , dump[6] , dump[7],
|
179
|
|
-// dump[8], dump[9], dump[10], dump[11], dump[12], dump[13], dump[14], dump[15]
|
180
|
|
-// );
|
|
176
|
+
|
181
|
177
|
AES_set_encrypt_key(dump, 128, &camd35_aes_encrypt_key);
|
182
|
178
|
AES_set_decrypt_key(dump, 128, &camd35_aes_decrypt_key);
|
183
|
179
|
}
|
184
|
180
|
|
185
|
181
|
static int camd35_recv(uint8_t *data, int *data_len) {
|
186
|
|
- fprintf(stderr, "%s\n", __func__);
|
187
|
182
|
int i;
|
188
|
183
|
|
189
|
184
|
uint32_t auth_token = (((data[0] << 24) | (data[1] << 16) | (data[2]<<8) | data[3]) & 0xffffffffL);
|
190
|
|
- fprintf(stderr, "recv auth : 0x%08x\n", auth_token);
|
|
185
|
+ if (auth_token != camd35_auth)
|
|
186
|
+ fprintf(stderr, "WARN: recv auth : 0x%08x != camd35_auth 0x%08x\n", auth_token, camd35_auth);
|
191
|
187
|
|
192
|
188
|
*data_len -= 4; // Remove header
|
193
|
189
|
memmove(data, data + 4, *data_len); // Remove header
|
194
|
190
|
|
195
|
|
- char *d = ts_hex_dump(data, *data_len, 16);
|
196
|
|
- fprintf(stderr, "recv Encrypted data:\n%s\n", d);
|
197
|
|
- free(d);
|
198
|
|
-
|
199
|
191
|
for (i = 0; i < *data_len; i += 16) // Decrypt payload
|
200
|
192
|
AES_decrypt(data + i, data + i, &camd35_aes_decrypt_key);
|
201
|
193
|
|
202
|
|
- char *f = ts_hex_dump(data, *data_len, 16);
|
203
|
|
- fprintf(stderr, "recv Decrypted data:\n%s\n", f);
|
204
|
|
- free(f);
|
205
|
|
-
|
206
|
194
|
return 0;
|
207
|
195
|
}
|
208
|
196
|
|
209
|
|
-static int camd35_send(uint8_t *data, uint8_t data_len) {
|
210
|
|
- fprintf(stderr, "%s\n", __func__);
|
|
197
|
+static int camd35_send(uint8_t *data, uint8_t data_len, enum e_flag tp) {
|
211
|
198
|
unsigned int i;
|
212
|
199
|
uint8_t buf[BUF_SIZE];
|
213
|
200
|
uint8_t *bdata = buf + 4;
|
|
@@ -218,23 +205,17 @@ static int camd35_send(uint8_t *data, uint8_t data_len) {
|
218
|
205
|
for (i = 0; i < data_len; i += 16) // Encrypt payload
|
219
|
206
|
AES_encrypt(data + i, bdata + i, &camd35_aes_encrypt_key);
|
220
|
207
|
|
221
|
|
- char *d = ts_hex_dump(bdata, data_len, 16);
|
222
|
|
- fprintf(stderr, "ECM SEND (encrypted):\n%s\n", d);
|
223
|
|
- free(d);
|
|
208
|
+ savefile(buf, data_len + 4, tp);
|
224
|
209
|
|
225
|
|
- savefile(buf, data_len + 4, TYPE_ECM);
|
226
|
|
-
|
227
|
|
- int dlen = data_len + 4;
|
228
|
|
- camd35_recv(buf, &dlen);
|
229
|
210
|
return 0;
|
230
|
211
|
}
|
231
|
212
|
|
232
|
213
|
|
233
|
214
|
static int camd35_send_ecm(uint16_t service_id, uint16_t ca_id, uint16_t idx, uint8_t *data, uint8_t data_len) {
|
234
|
|
- fprintf(stderr, "%s\n", __func__);
|
235
|
215
|
uint8_t buf[BUF_SIZE];
|
236
|
216
|
uint32_t provider_id = 0;
|
237
|
217
|
uint32_t crc = crc32(0L, data, data_len);
|
|
218
|
+ int to_send = boundary(4, HDR_LEN + data_len);
|
238
|
219
|
|
239
|
220
|
memset(buf, 0xff, BUF_SIZE);
|
240
|
221
|
|
|
@@ -249,20 +230,14 @@ static int camd35_send_ecm(uint16_t service_id, uint16_t ca_id, uint16_t idx, ui
|
249
|
230
|
buf[19] = 0xff;
|
250
|
231
|
memcpy(buf + HDR_LEN, data, data_len);
|
251
|
232
|
|
252
|
|
- int to_send = boundary(4, data_len + HDR_LEN);
|
253
|
|
-
|
254
|
|
- char *d = ts_hex_dump(buf, to_send, 16);
|
255
|
|
- fprintf(stderr, "ECM SEND:\n%s\n", d);
|
256
|
|
- free(d);
|
257
|
|
-
|
258
|
|
- savefile(buf, to_send, TYPE_ECM);
|
259
|
|
- return camd35_send(buf, to_send);
|
|
233
|
+ return camd35_send(buf, to_send, TYPE_ECM);
|
260
|
234
|
}
|
261
|
235
|
|
262
|
236
|
static int camd35_send_emm(uint16_t ca_id, uint8_t *data, uint8_t data_len) {
|
263
|
237
|
uint8_t buf[BUF_SIZE];
|
264
|
238
|
uint32_t prov_id = 0;
|
265
|
239
|
uint32_t crc = crc32(0L, data, data_len);
|
|
240
|
+ int to_send = boundary(4, data_len + HDR_LEN);
|
266
|
241
|
|
267
|
242
|
memset(buf, 0xff, BUF_SIZE);
|
268
|
243
|
|
|
@@ -274,14 +249,7 @@ static int camd35_send_emm(uint16_t ca_id, uint8_t *data, uint8_t data_len) {
|
274
|
249
|
init_4b(prov_id, buf + 12);
|
275
|
250
|
memcpy(buf + HDR_LEN, data, data_len);
|
276
|
251
|
|
277
|
|
- int to_send = boundary(4, data_len + HDR_LEN);
|
278
|
|
-
|
279
|
|
- char *d = ts_hex_dump(buf, to_send, 16);
|
280
|
|
- fprintf(stderr, "EMM SEND:\n%s\n", d);
|
281
|
|
- free(d);
|
282
|
|
-
|
283
|
|
- savefile(buf, to_send, TYPE_EMM);
|
284
|
|
- return camd35_send(buf, to_send);
|
|
252
|
+ return camd35_send(buf, to_send, TYPE_EMM);
|
285
|
253
|
}
|
286
|
254
|
|
287
|
255
|
#define ERR(x) do { fprintf(stderr, "%s", x); return NULL; } while (0)
|