tsdecrypt reads and decrypts CSA encrypted incoming mpeg transport stream over UDP/RTP using code words obtained from OSCAM or similar CAM server. tsdecrypt communicates with CAM server using cs378x (camd35 over tcp) protocol or newcamd protocol. https://georgi.unixsol.org/programs/tsdecrypt/
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

camd-cs378x.c 5.4KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183
  1. /*
  2. * cs378x protocol
  3. * Copyright (C) 2011 Unix Solutions Ltd.
  4. *
  5. * This program is free software; you can redistribute it and/or modify
  6. * it under the terms of the GNU General Public License version 2
  7. * as published by the Free Software Foundation.
  8. *
  9. * This program is distributed in the hope that it will be useful,
  10. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  12. * GNU General Public License for more details.
  13. *
  14. * You should have received a copy of the GNU General Public License
  15. * along with this program; if not, write to the Free Software
  16. * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA 02110-1301, USA.
  17. */
  18. #include <stdlib.h>
  19. #include <unistd.h>
  20. #include <string.h>
  21. #include <openssl/aes.h>
  22. #include <openssl/md5.h>
  23. #include "libfuncs/libfuncs.h"
  24. #include "data.h"
  25. #include "util.h"
  26. #include "camd.h"
  27. static int cs378x_connect(struct camd *c) {
  28. if (c->server_fd < 0)
  29. c->server_fd = camd_tcp_connect(c->server_addr, c->server_port);
  30. return c->server_fd;
  31. }
  32. static void cs378x_disconnect(struct camd *c) {
  33. shutdown_fd(&c->server_fd);
  34. }
  35. static int cs378x_reconnect(struct camd *c) {
  36. cs378x_disconnect(c);
  37. return cs378x_connect(c);
  38. }
  39. static int cs378x_recv(struct camd *c, uint8_t *data, int *data_len) {
  40. int i;
  41. // Read AUTH token
  42. ssize_t r = fdread(c->server_fd, (char *)data, 4);
  43. if (r < 4)
  44. return -1;
  45. uint32_t auth_token = (((data[0] << 24) | (data[1] << 16) | (data[2]<<8) | data[3]) & 0xffffffffL);
  46. if (auth_token != c->cs378x.auth_token) {
  47. ts_LOGf("ERR | [%s] recv auth 0x%08x != camd_auth 0x%08x\n",
  48. c->ops.ident, auth_token, c->cs378x.auth_token);
  49. }
  50. *data_len = 256;
  51. for (i = 0; i < *data_len; i += 16) { // Read and decrypt payload
  52. fdread(c->server_fd, (char *)data + i, 16);
  53. AES_decrypt(data + i, data + i, &c->cs378x.aes_decrypt_key);
  54. if (i == 0)
  55. *data_len = boundary(4, data[1] + 20); // Initialize real data length
  56. }
  57. return *data_len;
  58. }
  59. static int cs378x_send_buf(struct camd *c, int data_len) {
  60. int i;
  61. unsigned char dump[16];
  62. if (cs378x_connect(c) < 0)
  63. return -1;
  64. // Prepare auth token (only once)
  65. if (!c->cs378x.auth_token) {
  66. c->cs378x.auth_token = crc32(0L, MD5((unsigned char *)c->user, strlen(c->user), dump), 16);
  67. MD5((unsigned char *)c->pass, strlen(c->pass), dump);
  68. AES_set_encrypt_key(dump, 128, &c->cs378x.aes_encrypt_key);
  69. AES_set_decrypt_key(dump, 128, &c->cs378x.aes_decrypt_key);
  70. }
  71. uint8_t *bdata = c->cs378x.buf + 4; // Leave space for auth token
  72. memmove(bdata, c->cs378x.buf, data_len); // Move data
  73. init_4b(c->cs378x.auth_token, c->cs378x.buf); // Put authentication token
  74. for (i = 0; i < data_len; i += 16) // Encrypt payload
  75. AES_encrypt(bdata + i, bdata + i, &c->cs378x.aes_encrypt_key);
  76. return fdwrite(c->server_fd, (char *)c->cs378x.buf, data_len + 4);
  77. }
  78. static void cs378x_buf_init(struct camd *c, uint8_t *data, int data_len) {
  79. memset(c->cs378x.buf, 0, CAMD35_HDR_LEN); // Reset header
  80. memset(c->cs378x.buf + CAMD35_HDR_LEN, 0xff, CAMD35_BUF_LEN - CAMD35_HDR_LEN); // Reset data
  81. c->cs378x.buf[1] = data_len; // Data length
  82. init_4b(crc32(0L, data, data_len), c->cs378x.buf + 4); // Data CRC is at buf[4]
  83. memcpy(c->cs378x.buf + CAMD35_HDR_LEN, data, data_len); // Copy data to buf
  84. }
  85. static int cs378x_do_ecm(struct camd *c, struct camd_msg *msg) {
  86. int to_send = boundary(4, CAMD35_HDR_LEN + msg->data_len);
  87. cs378x_buf_init(c, msg->data, (int)msg->data_len);
  88. c->cs378x.msg_id++;
  89. c->cs378x.buf[0] = 0x00; // CMD ECM request
  90. init_2b(msg->service_id , c->cs378x.buf + 8);
  91. init_2b(msg->ca_id , c->cs378x.buf + 10);
  92. init_4b(0 , c->cs378x.buf + 12); // Provider ID
  93. init_2b(c->cs378x.msg_id, c->cs378x.buf + 16);
  94. c->cs378x.buf[18] = 0xff;
  95. c->cs378x.buf[19] = 0xff;
  96. return cs378x_send_buf(c, to_send);
  97. }
  98. static int cs378x_do_emm(struct camd *c, struct camd_msg *msg) {
  99. int to_send = boundary(4, CAMD35_HDR_LEN + msg->data_len);
  100. cs378x_buf_init(c, msg->data, (int)msg->data_len);
  101. c->cs378x.buf[0] = 0x06; // CMD incomming EMM
  102. init_2b(msg->ca_id , c->cs378x.buf + 10);
  103. init_4b(0 , c->cs378x.buf + 12); // Provider ID
  104. return cs378x_send_buf(c, to_send);
  105. }
  106. static int cs378x_get_cw(struct camd *c, uint16_t *ca_id, uint16_t *idx, uint8_t *cw) {
  107. uint8_t *data = c->cs378x.buf;
  108. int data_len = 0;
  109. int ret = 0;
  110. READ:
  111. ret = cs378x_recv(c, data, &data_len);
  112. if (ret < 0) // Fatal error
  113. return -1;
  114. // EMM request, ignore it. Sometimes OSCAM sends two EMM requests after CW
  115. if (data[0] == 0x05)
  116. goto READ;
  117. if (data[0] != 0x01) {
  118. ts_LOGf("ERR | [%s] Unexpected server response on code word request (ret data[0] == 0x%02x /%s/)\n",
  119. c->ops.ident,
  120. data[0],
  121. data[0] == 0x08 ? "No card" :
  122. data[0] == 0x44 ? "No code word found" : "Unknown err");
  123. return 0;
  124. }
  125. if (data_len < 48) {
  126. ts_LOGf("ERR | [%s] Code word packet len != 48 (%d)\n", c->ops.ident, data_len);
  127. return 0;
  128. }
  129. if (data[1] < 0x10) {
  130. ts_LOGf("ERR | [%s] Code word len != 16 (%d)\n", c->ops.ident, data[1]);
  131. return 0;
  132. }
  133. *ca_id = (data[10] << 8) | data[11];
  134. *idx = (data[16] << 8) | data[17];
  135. memcpy(cw, data + 20, 16);
  136. return 1;
  137. }
  138. void camd_proto_cs378x(struct camd_ops *ops) {
  139. ops->ident = "cs378x";
  140. ops->proto = CAMD_CS378X;
  141. ops->connect = cs378x_connect;
  142. ops->disconnect = cs378x_disconnect;
  143. ops->reconnect = cs378x_reconnect;
  144. ops->do_emm = cs378x_do_emm;
  145. ops->do_ecm = cs378x_do_ecm;
  146. ops->get_cw = cs378x_get_cw;
  147. }