PVR Disable Encryption C/D Serie.

[stm999999999]

OK, thanks for the explanation.

Playing the renamed file with media player has only one little inconvenience: the 16:9 picture is displayed in 4:3, so I have to choose Extras - Bildformat (sorry do not know the phrase in english firmware) modus 2 while in most other cases I need modus 1.

[Denny]

i guess it is need to foward it to samsuungs suport center , that they are not able to discover from DVB-TS stream the real picture size/format and show it on the panel correct.

Shame on you "Samsung"

[stm999999999]

Samsung build good tv hardware (IMHO) and they make a good decision to use a linux. So SamyGO can work!

But there is very much to shame about for Samsung.

media player cannot handle more than one srt-file
no uniform way of doing things: subtitle on tv, press key "SUBT". same on media player, press "tools", "subtitle in extras menu"
no way to get out directly of teletext w/o cycling through all display modes ...

[plasticassius]

I thought the policy was that disabling DRM was not allowed. But since you've changed your mind, I'll show a different way to disable DRM that I've been using. There is a flag called CpProtected in exeDSP, and if it is not set, there is no DRM. I think there must be some way to clear the flag without a patch (perhaps in the debug menu), but I've been using the following patch to exeDSP (T-VALDEUC_3005.1):

Code: Select all

  4b263c:	e5993394 	ldr	r3, [r9, #916]	; 0x394
  4b2640:	e3530000 	cmp	r3, #0
  4b2644:	058d317c 	streq	r3, [sp, #380]	; 0x17c
  4b2648:	0a000008 	beq	+28	; 4b2670 <TDBuilder::GetTDiCP(TDSourceObject_k)+0x1d5450>
  4b264c:	e59b3000 	ldr	r3, [fp]
  4b2650:	e3130008 	tst	r3, #8
  4b2654:	1a000160 	bne	+588	; 4b2bdc PRINT 'Set CpProtected flag to true for DRM'

change:

4b263c: e3a03000 mov r3, #0

I haven't figured out how to use the firmware patcher, so I patch with an injectso mod.

[Denny]

plasticassius

i will check the issue , sure... atm are other issues in work

basically, my mind is, that noone have right to do something what is not done by owner/provider!

in case of FTA channels, Samsung do not have any Legal right to scramble it with their so called DRM Engine!,
for sure, Samsung have contract with CI+ etc... there they should do it , i personly wuld nothing have against it (where CI+ is biggest bullshit ever hapend) , but as they did not follow implementation rules there is no way then to remove this issue by patching.

all in all, buyer of Samsung devices have also full right to do with their stored contents(movies/series/videos) if they are transmitted by owner/provider unscrambled, this right can Samsung not take them.

there are many other things where Samsung think that they can do , but they think wrong .

[Denny]

plasticassius

i have sems found better position,

Code: Select all

Configure::Configure(v34);  --> loads the config 
Configure::getIsDrmApply(v34); --> check flag 
etc...
flags : 

int __fastcall Configure::init(int result)
{
  *(_BYTE *)(result + 20) = 0;                           -----> IndexCallbackInfoStatus
  *(_BYTE *)(result + 12) = 1;                           -----> CanExtractThumbnail
  *(_DWORD *)(result + 8) = 5400;                    -----> MaxTimeshiftTime
  *(_BYTE *)(result + 4) = 1;                             -----> Is Drm Apply
  *(_BYTE *)(result + 5) = 0;                             -----> CanPrintDrmKey
  *(_BYTE *)(result + 13) = 0;                           -----> CanExtractFrameData
  return result;
}

just that Configure::init() is called during start of exeDSP, it should be maybee problem to find it in ram, hardcore to change it direct in exeDSP for future use when authuld stuff is removed will be more easy.

[plasticassius]

I'm sure there are better places for a patch. I didn't do extensive analysis, when I was reading through the strings 'Set CpProtected flag to true for DRM' caught my attention, so I looked there.

What bugged me most is that I have other recorders which record without DRM, so why should it be OK for one technology, but not another? The problem with the other recorders is they're complicated to use. With the TV, my 5 year old can turn on her favorite cartoon, press the record button, and save the show all by herself. I have a script move the recording to a network drive, so she has a collection of her favorites.

[Denny]

@plasticassius

i checked to modify it on fly in ram (initialised values), no success, when i dl_load function and modify returned structure, start of PVR crash the TV,
when i change direct in ram somwhere the value is checked and new array is created new, i will tomorow check to patch exeDSP in ram.

[plasticassius]

Denny, I don't completely follow you, but I take it you're trying to modify the structure that

Code: Select all

4b263c: e5993394 ldr r3, [r9, #916]   ; 0x394

refers to. That seems like a good idea so more power to you. I don't really have the tools or expertise to examine the code in as much detail as I'd like to. I just know that this one instruction change does the trick:

Code: Select all

4b263c: e3a03000 mov r3, #0

[Denny]

yes, i change preseted value after they are initialised by starting of exeDSP, this i have today success tested on my D8000 TV,
tv create all files like drm is enabled just the recorded .srf file is not scrambled.
must check is it posible on same way to do on C serie.

this way is just posible by injectso or loading a game from SmartHub/Internet@TV where Injectso i did not use.

also , i have also alredy patched samdrv.ko , so the tool posted on 1st posting will be soon replaced by new one.

Code: Select all

void DRM_Disable(void) {

	void *dl_handle;
	void* tmpfunc;
	funcexe tmp;
	char *error;
	unsigned char *rc;
	
	dl_handle = dlopen( NULL, RTLD_NOW | RTLD_GLOBAL );
	if (!dl_handle) {
		fprintf(log_fp,"[CIP_SAMYGO] Open exeDSP self %s\n", dlerror() );
		return;
	}
	tmpfunc = (void*)  dlsym( dl_handle, "_ZN9SingletonI9ConfigureE11getInstanceEv" );
	error = dlerror();
	if (error != NULL) {
		fprintf(log_fp,"[CIP_SAMYGO] Singleton::Configure::getInstanc func load error -> %s\n", error );
		return;
	}
	fprintf(log_fp,"[CIP_SAMYGO] Singleton::Configure::getInstanc func loaded\n" );
	assert(sizeof(funcexe) == sizeof(tmpfunc));
	memcpy(&tmp, &tmpfunc, sizeof(tmpfunc));
	fprintf(log_fp,"[CIP_SAMYGO] Singleton::Configure::getInstanc func loaded @ %x\n" , tmp ); 
	rc = tmp( );
	
	if (rc) {
		fprintf(log_fp, "[CIP_SAMYGO]DRM Config before : %x %x \n", tmp, rc ); 
		fprintf(log_fp,"[CIP_SAMYGO] %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x \n", rc[0],rc[1],rc[2],rc[3],rc[4],rc[5],rc[6],rc[7],rc[8],rc[9],rc[10],rc[11],rc[12],rc[13],rc[14] );
		rc[4] = 0; // -----> Is Drm Apply  0 or 1
//		rc[5] = 1; // -----> CanPrintDrmKey 0 or 1
// 	rc[13]= 1; // -----> CanExtractFrameData 0 or 1
		fprintf(log_fp, "[CIP_SAMYGO] DRM Config after : %x %x \n", tmp, rc ); 
		fprintf(log_fp,"[CIP_SAMYGO] %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x \n", rc[0],rc[1],rc[2],rc[3],rc[4],rc[5],rc[6],rc[7],rc[8],rc[9],rc[10],rc[11],rc[12],rc[13],rc[14] );
	} else {
		fprintf(log_fp, "Singleton::Configure::getInstanc func error caling\n" ); 
	}
	dlclose( dl_handle );
}

cat /proc/kmsg give :

Code: Select all

<4>[CIP_SAMYGO] Singleton::Configure::getInstanc func loaded @ 11eccd0
<4>[CIP_SAMYGO] DRM Config before : 11eccd0 73aef60 
<4>[CIP_SAMYGO] 00 78 3e 03 01 00 00 00 18 15 00 00 01 00 00 
<4>[CIP_SAMYGO] DRM Config after : 11eccd0 73aef60 
<4>[CIP_SAMYGO] 00 78 3e 03 00 00 00 00 18 15 00 00 01 00 00

// EDIT ON
just checked T-VALDEUC ,

thre are no config setup like on D serie , basicly this can be also done by modify exeDSP but is it relay need to spend time if it can be done in samdrv.ko ?

// EDIT OFF