Finding BISS key

Dear Jimbo and Haim,
Permission to Post this. Is it appropriate or not ?


Subject: Filsat BISS Key Team
Objectives : BISS learning and Finding BISS key

First Target : ZamJari 1 BISS Key ( NSS11)

Requirements:

1. Generate a TS File Called " Zamjari_VPID_4381.ts

2. In order to create a TS file you need SKYSTAR2 TV Digital receiver.
http://www.technisat.com/img/en/produkte/extras/skystar-2-orig.jpg

3.Tune to Channel Zamjari 1 and start creating TS file , about 3-5 sec of recording time ~~3.5MB = Zamjari_VPID_4381.ts
4.Upload the TS file to any FILEsharing or FTP site.
5. Download CWFinder Software (watch out for any Virus on the file)
http://data.hu/get/2283848/CWFinder0.9.rar.html

6. This CWFinder Software can find the good key but the problem the time. If you want to find the key from 00 00 00 00 00 00 00 to FF FF FF FF FF FF . It takes 10 years, 7 Months and 2 days at one PC. If we are a team (with 250 - 300 members), team need only a week to find a biss key for any biss channel! You just need a Computer. of course the fastest processor the better.

7. PM Jimbo and Haim or me if you’re interested to join.

8. I will send via PM the Range of your assignment from this table

9. Once the member found a key , He/she will then SEND the key to Jimbo,HAIM or me, And we will send to FILSAT BISS Key Team via PM
10. Thou shall not post the KEY

My experience is only Skystar2 PID record ok. Another receiver ts record wrong.
CWFinder message will be "Error file".

Zamjari 1 Vpid:4381
Zamjari 2 VPid:4245

Congratualation for NBA searching. If we have result I will share you.
At the moment 470000000000 -4FFFFFFFFFFF, 800000000000 - 8FFFFFFFFFFF are my searching are.

If anybody wants to find Zamjari (NSS11) key and can spend few weeks to find key with CWFinder just send a p.m. message for me.
If we find key it will be not public just for searching team.


I think we have only information about opened biss channels. We know nothing about unknown keys.
We can separate Biss-1 and Biss-E modes.
Biss-1 key is clear and = CW
Biss-E key is encrypted and CW is calculated from DES algo.
Lots of Biss-1 key is very simple like 100000... or 111111... or 12345... etc.
Calculated CW from Biss-E is secret and it can be any character combination.


better now start looking for keys to channels of SuperSport 1-2-3-5-6-7 MultiChoice 68E of the BISS encoding

http://www.flysat.com/is68.php

For the simple reason that it was impossible to purchase a valid ticket or doing this package sharing


Team members don't need to use Skystar2 PCI Card. It is not necessary for searching.
One person who has SS2 card (For example me) can save one scrambled biss channel ts (transport stream) file /3 MByte is enough/.
After I can give you an url like this: http://data.hu/get/2920271/NBA42E_Vpid518.ts.html
You need to download this file sample.
Sorry it is hungarian site here is some translation:
Choose Ingyenes letöltés = Free download
after select Nem élek vele = I won't pay
after select Letöltés indítása = Start download
I hope it was useful for you.


Please find the link: http://www.multiupload.com/MSHQXBV1LT
I hope it will work.
You can download CWFinder from Fedel Castro at "be on team to find biss keys" topic.

VPid is 518 so you can type this number when you load the ts file.


I have finished 56..... No cw found.
I think we have not enough members.
Key will find within 6 months.

70% of the keys are down

Normal speed is 1Mkey (CW)/second with intel proc.
AMD is not supported so AMD speed is 5 -600 k / sec.
If you have dual core (or quad) CPU you can run CWfinder twice (same time).

My biggest computer speed is 2 x 2,7 M keys / second. But under this speed nobody can work any other applications.
My fastest computer is an Intel dual Core 6500 with 2 GB RAM, but memory is not interest from this point of view. It needs 4 - 5 days to finish from 56 to 57.

My AMD proc computer is only 1,8 GHz. It is slow to search any keys.

When CWFinder takes all of the keys program send a message: All CW Searched. CW not found.

I have to stop the CWfinder lots of times due to PC needs to run other softs.
I use LastCW.log files what is saved all the time when I stop the soft.
CWFinder saves last CW data in every 10 minutes into LastCW.log file. You can restart your search after minimum CW losses.

This is just a decision question.
Problem is we have not 200 members only 5 -10. It means we need to find the keys 7 - 8 months !
My personal opinion is: If we have no enough people in the team our chance is almost zero.

hi guys this is good by not right way , because how we know that on the time that you are searching on , the provider will change the key an cat/mouse game...so i suggest first to understand the frequency of changing keys (how time between every swich....) after that u can devide the work ...but it will take a lottt of time!
regards


yeah that is true and Law if anybody wants the key help for find the key.
yeah if we dont search for the key we will never find the key :)
I think it is true one point of view.
Lot's of people just want a key without any plus work.
But the World is not perfect...


Next area can be E3 (E300000000 - E3FFFFFFFFFF).

If Zamjari is DVB-S and QPSK this card is OK.
If Zamjari is DVB-S2 8PSK you need to buy Skysatr 2 DVB-S2 card (price is twice more than DVB-S card).




F SID VPID KEY - all of them are in hex format.

SID = 4 characters
VPID = 4 characters


if you use CCCam, just put this line into var/keys/constant.cw file.

2600:000000:0002:0066:1fff::12 34 56 9C 78 9A BC CE 12 34 56 9C 78 9A BC CE # RTM 2
or you can put this line in softcam.key
F 00021FFF 00 1234569C789ABCCE ; RTM2

but make sure there are no line start the same as F 00021FFF .. ........
if there is, delete or put " ; "

If we found the key ? How we can put this in our receiver Dm500s ?

is the Format Correct ?

Zamjari F 00021FFF 01 55 21 0c 72 7d d5 30 72;
Zamjari F 00031FFF 00 55 21 0c 72 7d d5 30 72;
---End Quote---

As I know Zamjari 1 SID = 4,
Zamjari 2 SID=3 so key format i:

Zamjari 1 F 00041FFF 00 xxxxxxxxxxxxxxx;
F 00041FFF 01 xxxxxxxxxxxxxxx;

Zamjari 2 F 00031FFF 00 yyyyyyyyyyyyyyyy;
F 00031FFF 01 yyyyyyyyyyyyyyyy;

Or (if it is below not good)

Zamjari 1 F 0004111D 00 xxxxxxxxxxxxxxxx;
F 0004111D 01 xxxxxxxxxxxxxxxx;

Zamjari 2 F 00031095 00 yyyyyyyyyyyyyyyy;
F 00031095 01 yyyyyyyyyyyyyyyy;

One Zamjari channel needs two key (00, 01). Of course keys are same.

Sorry for the not quick answer but at the moment I am on abroad in a 4 days training.
My internet acces is very limited.

You need to open the contents of the DCC and then enter the folder var / keys
Then put the new key in updated file of Softcam.key
Then do the MGcamd Emulator Reset
1. biss keys: NASN/ESPN Classic, Rossiya 1 (Vesti), TV7 Bulgaria.
Here is the CWFinder: http://data.hu/get/2283848/CWFinder0.9.rar.html
Here is an ts file (TV7 Bulgaria): http://data.hu/get/2835236/TV7_VPID_301.ts.html
If you have experience how it works use this software please: try from 2C 31 50 00 00 00 up to 2C 31 50 FF FF FF.
You will get the key (CW) within few second.
This SW can find the good key but the problem the time. If you want to find the key from 00 00 00 00 00 00 00 to FF FF FF FF FF FF need more than 1 year at one PC. If we are a team (with 250 - 300 members), team need only a week to find a biss key for any biss channel !
Yes u r right ellenerv,
CW found:
2C 31 50 [AD] 00 9D D2 [6F]
takes less than a minute.


yeh...the CW FINDER needs only CONTROL WORDS not a BISS KEYS..if the correct 12 digit CONTROL WORDS is contain in ur CW LIST TEXT FILES then the CW FINDER 'll found correct 16 digit BISS KEYS!
for example.....if the keys r following....
12 34 56 78 90 AB CD EF ...the CONTROL WORD should be as follows...12 34 56 90 AB CD!
so if the 12 34 56 90 AB CD (CONTROL WORDS) is contained in ur text files then ur CW FINDER 'll found as 12 34 56 78 90 AB CD EF-this is correct BISS keys!


you need a super computer like cray or
1. IBM's BlueGene/L - 360 teraflops
2. IBM's BGW - 115 teraflops
3. IBM's ASC Purple - 93 teraflops that you can find in any good university.
http://www.top500.org/

this computers are 10000000 more faster than a new quade intel cpu
so you have to go there and ask them to run a search
sometimes they dont use them you can find it in less than 2 days
I agree. But one doubt. If it is 10000000 times faster than a Quad Core Intel CPU then why it will still take 2 days?

Ordinary 3ghz single core Intel Pentium 4 cpu will take 10 years if the key is at FF. So 3650 days/1000computers = 3.65 days.

Quad core is faster than this Single core CPU. So Intel Quad core might take around 7 years(not sure as I haven't checked). That equals to 2555 days.

You say that super computer is faster by 10000000 times. Then it should be 2555/10000000=0.0002555 days! Not 2 days



http://www.youtube.com/watch?v=oadsy1sFGb8




SAMPLE on DM500s

ARY HBO 3864 H 19850 DCW PANAMSAT 68°E

For Diablo Cams :
0604:000000:00:8C:0008:[ 8AFB8A0F4191CEA03B0ACA0F51984F38 ];HBO Pakistan (68.5°E)

For T-Rex & Dragon Cams :
2600:0008:0A29:8AFB8A0F4191CEA03B0ACA0F51984F38 ;HBO Pakistan (68.5°E)
For GigaTwinCam (softcam.kèy)
X 2600:0008:8AFB8A0F4191CEA03B0ACA0F51984F38 ;HBO Pakistan (68.5°E)

HBO PAKISTAN (68.5°E)
CAID 0x604, SID 0x008, VPID 0xA29, PMT 0x107, PROVIDER 0x00000
CW0: 8A FB 8A 0F 41 91 CE A0
CW1: 3B 0A CA 0F 51 98 4F 38

For Mgcamd (softcam.kèy) :
F 0008ECM? 8AFB8A0F4191CEA0 ;HBO Pakistan (68.5°E)
F 0008ECM? 3B0ACA0F51984F38;HBO Pakistan (68.5°E)

For Evocamd (keylist.txt) :
B 0604 00 8AFB8A0F4191CEA03B0ACA0F51984F38 ;HBO Pakistan (68.5°E)

For Camd3 Version :
0604:000008:0000000000:07:8AFB8A0F4191CEA03B0ACA0F 51984F38 ;HBO Pakistan (68.5°E)

For SS2 :
HBO Pakistan=8AFB8A0F4191CEA03B0ACA0F51984F38

Gbox Softcam Biss Cfg :
#0: { 06 04 00 08 {8A FB 8A 0F 41 91 CE A0 3B 0A CA 0F 51 98 4F 38 }} #HBO Pakistan (68.5°E)

For SCam Constant DW (CVS):
C: { Satellite Infos 0001 0001 0008 0A29 { 8AFB8A0F4191CEA03B0ACA0F51984F38 }} #HBO Pakistan (68.5°E)



Biss: they always use only numbers in couple bits 1-2-3 and 5-6-7 and 4th and 8th are mathematic sum of decimal bits but not used in encryption. This is only because they send bytes and equipments read bytes and one byte is composed by 8 bits, 2 bytes are 16 bits
You can check by yourself before post:

eg a fake key format:

12 A3 4D 45 F2 20 0C 23

proved to be fake by simple calculation:

12 A3 4D 45 calculate these in DEC .... 18+ 163+ 77 is not equal to 69 (69 being Decimal of 45 HEX)

and...
F2 20 0C 23 ...DEC 242+ 32+ 12 is not equal to 35 (35 being Decimal of 23 HEX)

Try same test with a key previously used by Rai Italia Afrika: 59 61 37 F1 11 53 84 E8:

59 61 37 F1 are in DEC 89 + 97 + 55 = 241 and F1= 241 bingo!
11 53 84 E8 are in DEC 17 + 83 + 132 = 232 and E8= 232 bingo!


Calculation is also easy in hex format:

(CW1 + CW2 + CW3) AND FF = CW4
(CW5 + CW6 + CW7) AND FF = CW8
where CWi = 1 ... 8 byte of the key (CW)


In this mode there will be a CA_descriptor in the PMT, present at programme level, but no ECM stream. A single
unique CA_System_ID is assigned to identify BISS.
The Transport_Scrambling_Control bits of the Transport Packets shall be set to “10”.

NBA key Update (CW Not found)
3A, 3C, 3E, 3F
43, 45, 4A, 4D, 4E, 4F
50, 51, 52, 53, 54, 55, 56, 5A, 5B (on going)
64, 66, 67, 6A, 6B, 6D, 6E, 6F
73, 7A, 7B, 7E
80, 81, 82, 83, 84, 86, 8A, 8B, 8C, 8D, 8E, 8F
93, 9D, 9E (on going)
A9, AA
B3
C0, C1, C2, C3, C4, C5, C6, C7, C8, C9, CA, CB, CC, CD, CE, CF
E0, E2, E3, E4
At the moment I have no idea where we find key.
Any Idea from you ?

1. To do this you must prepare the data files or download them from our site ready
2. To edit the key you will need to file constant.cw (list of static keys for encrypted channels). To edit you must use an editor (for example, WordPAD, UltraEdit), which understands the line ending characters and carriage returns used in the Linux files. Constant.cw file should look like this:

CAID Provid SID PMTPID ECMPID EVENCw ODDCW http://www.blogger.com/img/blank.gif


2600:000000:0001:0000:1 FFF:: AC F2 12 34 43 21 CA 2E AC 12 34 43 21 F2 CA 2E
2600:000000:0009:0000 : 1FFF:: 12 34 00 AC 12 34 AC 00 12 34 00 AC 12 34 AC 00
2600:000000:0004:0000:1 FFF:: 10 72 20 A2 15 05 07 21 10 72 20 A2 May 15 July 21
3. All keys must be entered consistent with this format, with spaces and colons. Each line contains specific information about the key, which you will need to fill in:
"CAID" - 2600 (encoding BISS)
"Provid" - 000000 (not filled)
"SID" - ID provider channel (To find this value to
enable this channel and press the button three times INFO. The bottom line is specified
SID channel - see the picture below. However, it will be listed in the decimal system
of calculation and must be converted to hexadecimal,
for example using the scientific calculator WINDOWS OC)
"PMT PID" - 0000 (not applicable)
"ECM PID" - 1FFF
"EVEN CW" - directly the key BISS
"ODD CW" - directly to the key itself BISS
#########################################

Liverpool FC TV
Apstar-2R@76.5E
3840 H 27500 3 / 4
SID: 0001
BISS KEY: 12 34 56 9C 12 34 56 9C Italy Service 11919V S / R 27500 FEC 3 / 4 HD 9E, (Eurobird 9A) SID: 0003 VPID : 2003 (Dec) APID: 3003 (Dec) BISS KEY: 46 87 25 [F2] 68 88 48 [38

Biss key for PTV PAKSAT 38 Deg East

LINK:

http://najmsat.com/

http://satmaj.blogspot.com/2011/10/biss-channels-from-1660-east-to-555.html


#####################################################

Hi, Boyet
Good Morning,Have a nice day
I have only thaicom5 and some NSS6 (from my friend).
I always update Key.You can download Here Constant.cw, Softcam.key, Irdeto.key

yes, I have seen that site.I'm not member that site.

Thanks

Nui

https://dl.dropbox.com/u/94817442/constant.cw
https://dl.dropbox.com/u/94817442/SoftCam.Key
https://dl.dropbox.com/u/94817442/irdeto.key