NAG 3 Status??

[DDusa]

Just asked a yank in #satworld on EFnet, he said

dave is direct tv
charlie is dish
beverly is bell

Correct ,The First 2 are name after the CEO of the sat Co. and B3v is the Canadian provider .

[Takeshi]

Hmm, hmm... I don't think N3 is gonna be hacked anytime soon, considering that N2 is not fully hacked either. My cable provider has started its digital service less than a year ago and they chose N2. But it's ROM110 for which there are no h4x.

Just my €0.02

[.: JaCkPoT :.]

Lol, all this nag3 chat and now we have a nag2 prob..
Its hacked enough..

[red devil]

Hmm, hmm... I don't think N3 is gonna be hacked anytime soon, considering that N2 is not fully hacked either. My cable provider has started its digital service less than a year ago and they chose N2. But it's ROM110 for which there are no h4x.

Just my ?0.02

here is my 2c apparently N2 on cable is hacked, a m8 was visiting relatives over the weekend near dublin and rang me on saturday to say that the white upc N2 cards were being done in dublin for about ?200 anyone out there know for sure ???

[alunfennell]

Red Devil,
I know UPC Smartcard ROM110 is open , the card is paired with the box, you will need to enter details from an original receiver and card thats probable why the cost of getting a clone card is expencive, if your looking to try and open this yourself, the only option is to get your m8s card enter it into a card programmer and download the card details of it & then try loading it onto a blank compatable smartcard, all you will then need to find and enter the box & card key onto your receiver, I believe scrypts for this are hard to come by for doing this from scratch and you will need something like a blue nexus unlooper, the easy way is to clone the clone card.

Regards:
Alun

[2tone]

are they using rom 110 in the south never new they were at that rev yet have an couple of old d+ rom 110 scripts and dumps also were they not at one point able to change a rom 10 to 110 on some of the old sat n2 cards remember some thing like that being done

[krazylegz]

i agree with alun, if ever nagra 3 is hacked it'll be in CAM form, there'll be too much money to make from it so i'd say a emu will be a big NO, well for a fair few years anyway

[.: JaCkPoT :.]

And then they will bring out new cams every 6months and discontinue the old ones ..big money in it for the hackers...

[krazylegz]

And then they will bring out new cams every 6months and discontinue the old ones ..big money in it for the hackers...

yip thats about the size of it

[andymc1s]

This might be of interest.

Originally Posted by w00t
Here is a copy & paste I found on another site...

Let's hope it is true....

So, here it is

C & P

Hello hack satellite pirates.

You will find this an interesting read.

Credit goes to Packin18 & Edmonton Guy for original concepts and n3 roms and eeproms
dumps from dish and bell providers currently making way around irc and private
underground forums around the net. Thank Packin18 for your N3 fix and no other.

A virgin non sub card was inserted into a modified blue T911 mod loader with 4053 muxs.
The virgin non sub card was reset and the atr was sent as usual.
A packet containing nops with a bclr instruction at the end was sent to the n3 cam.
When the last bit of the checksum was sent to the cam 16 additional clocks followed.
The cam was soft reset by sending the RST cam pin low from high.
As the cam rst pin swung low a bunch of glitching followed.
This glitching carried on until the RST cam pin came high again.
This glitching carried on for the first clock.
200+ additional clocks were sent to the card.
The cam i/o line was monitored for a full cycle low i/o pin result of the bclr instruction.
The cam was quickly reset, glitched, & clocked a few hundred times again. repeatidly.
When the full cycle low i/o pin signal was seen N3 cams were hacked.
The bclr instructions were removed and replaced with more bsets and bclr instructions
that ROR'd rom and eeprom a bit at a time out of the cam i/o pin without need for the
rom routines that usually handle I/O output.

What Happened?

The packet was stored in the I/O buffer and the card reset before packet processing.
The reset caused the program counter and the stack pointer to reset but not ram values.
The packet full of nops that pulled the i/o line low stayed resident in ram on soft reset.
The card was reset and the addressbus latching of the reset vector was glitched until
the new reset vector became the i/o buffer where NOPS and BCLR code opened N3.

N3 roms/eeproms (142/206/240) for all providers has successfully been dumped.
(interestingly enough this attack works on all N1/N2 cams/icams as well)
(i dont have any dave cams do you?)

if this is true we should be up and running on n3 in the short term here lets keep our finger crossed here guys

[alunfennell]

especially if a company like Duolabs put up the money to buy the data from different providers, remember each provider will be running different roms from each other, so its up to the provider how or if they intend on selling there data.

There a up side to this Nagravision could in theory sue a provider for breach of contract should a provider be seen to be open on a device such as Duolabs, (If its a public hack no one is responsable) but if on a Duolabs product both the provider and Duolabs are responsable & ultimately could be sued.

Like I have sugested a cam is the more likely option a providers will have to get and manufacture a independent cam that is in no way connected with them or even Duolabs, if this is the case we could end up with a lot of cams, one for each provider & like what Sadiq999uk mentioned the life expedancy of 6-12 months to bring in revenue for the said provider.

Nagravision are not going to tolerate providers selling on there data to third party companys to make money on the back of there encryption, Nagravision have been losing vast sums of money for well over a year & a half, if nagra3 ends up the same as Nagra2 they will go bankrupt, Providers and hackers will have to use a different path to get cams to the general public.

Regards:
Alun

[alunfennell]

Hi andymc1s,
Tell me how is this detailed post your after posting been received by your fourm members on the fourm that you got the information, what I am realy asking is to the validity of the details given by the source ?

It is a interesting read obviously this method is using plastic (smartcard) which in Europe will not go down well as the life expedancy of such methods can be pulled and end up costing as much as a original subscription from a provider.

How is this information been received on your side ?

Regards:
Alun

[andymc1s]

Hi Alun I came across this post whilst trying to learn something on Nag 3, The members of the forum the post was copied from seem to think its a step in the right direction .
B.T.W. I am in Dublin

[andymc1s]

Check out
h**p://freesatfix.com

[alunfennell]

andymc1s I thought you were from across the pond ! I have come across that site as well a while back not bad,(Interesting read) I too like to see what the American friends are up to, but I have noticed that from reading there fourms that they think we in Europe have opened Nagra 3 and that it will open up like Aladins Cave for them when needed across north America.

Hopefully we will get a clearer picture where we stand in the next few months, what we will need to buy or maybe something else will come along.

Fingers crossed.

Regards:
Alun