SamyGO

Hi there,

has anyone tried to use the InstallCallback function to setup a transport stream callback ?
I would like to grab the data from the tuner, process it and forward it to the demuxer.
Any idea how to use the InstallCallback function (I'm using a B650 CI+ model).

Thanks,
cu Cyberdemon

I understand what you try to achieve...

But I think callbacks will not be sufficient.
E.g. when you tune to a particular channel and then kill exeDSP, you still get the video/audio output. This means TS demuxing and decoding is done in hardware. Just configuration and selection (channels, PIDs, etc.) is done through exeDSP.

You dive too deep. Take breath before...
I don't think if anyone inspect it before.

I think you guessed correct. I'm trying to simulate a cicam module
to avoid buying one (while learning something about my tv).
I do have an old digital settop box and would love to replace it,
letting the tv do all the work.
What about the samdrv.ko kernel module ?
I think I saw it creating the device /dev/sam/Ci0 (or something like that).
Would trying to implement TS-modifying code in this module be an option ?
A first step could be to implement a simple logging functionality into this
module, writing out all data traffic to and from the Ci0 device file.
I think you made a post about injecting code into samdrv.ko some time ago,
so there wouldn't be any modification to the filesystem and the risk to
play with the module should be relatively low. My main problem is that I
don't have a normal cicam available (the settop box has a built-in one).

cu
Cyberdemon

Correct me if I am wrong. With this, we can watch 2B series TV with one Card, right?
I wanted to have C series TV, but If I make it, how can I use old B series with 1 card?
Is it possible with this hack?

Hi,

hmm what do you mean in fact of the B or C Series ?!
I think it should nor make any difference if you use a B or C-Series TV with the Idea you have ... at least to software which communicates with the TV?s and handels the Card probably needs to be configured for B or C-Series. So more or less if the Basic Idea would be working ... it shouldn?t matter if it runs on a B or C-Series TV.

Regards

Since B and C series firmware is different I thought it require new binary hack for C series TV.
Idea is not mine, I just say what I understand with cicam hack. Does this hack enables that?

Hmmm I think if the functions are the same i.e. in ExeDSP (equal if firmware differs) it is not said that you need different binarys ... if the needed functions are the same you can theoretically use the same binary at both Series.
Only thing which you probably need external is a device which can read your smartcard which is connected to on TV set and handles the smartcard, the other TV just could be client to the one with the smartcard attached i.e. over LAN.

I think more interesting would be if the Samsung TV?s have descramblers at the CPU or the chip which handles the whole TS stuff ...
If yes emulating a CI Cam would not be neccessary cause a software could handle the whole smartcard stuff and write the decrypted answers of the card directly to the descrambler.

Regards

Hi,

if one could pull it off for the B series, I would also work (directly, or with very marginal modifications) on the C series
and the other way round. The descrambling of a encoded channel is done by applying the common scrambling algorithm (CSA)
on the scmrabled transport stream (commonly not the complete transport stream, but the individual elementary streams within
it are scrambled). The CSA takes a 8 byte key as input of which only 6 bytes are used (the other two are checksum bytes).
The implementation of the CSA in hardware is what you can think of as the CICAM. Because the CSA has been reverse engineered,
it can be emulated in software only. This is what we are trying to achive.
I have seen some strange functions in exeDSP along the lines of "sendKeyToCam" (the name was something like that, don't know exactly),
which may be CIPlus stuff or maybe this already is the CSA triggering function, who knows.

To tell the complete story of the decryption process:
An encrypted channel consists of different elementary stream (audio, video, teletext, ecm, ...). Typically audio and video streams
are encrypted by the CSA algorithmn and teletext usually is free to air (unencrypted). The ecm-stream carries a seed-value for the
smartcard (which gets transmitted from the tuner via the CICAM to the smartcard inserted into it), you can think of it as a question
for the card. The card calculates an answer to this question (if you it thinks you are allowed to watch it) and sends it back to the CICAM
(this are those 8 bytes).

If it becomes way to difficult to find the functions inside exeDSP we could start to adapt the already known streamrecording function
(used for the pvr) and instead of dumping it to a file, we decrypt it and have our own application display it on the screen (hook the
mediaplayer function of the TV). We could even try to adapt to this software piece by piece, until we have our own fully fletched
(opensource) TV Viewer App and get rid of exeDSP
This would be a VERY huge project... but none the less also very interesting

cu
Cyberdemon

Hi,

this surely would be a way to get the content descrambled

But the more easier way would be if TV had an internal Descrambler onboard (don?t know if it has one), but if yes this device could be used for descrambling and the softwre CSA wouldn?t be needed anso so a lot of work less.

but in fact such a function surely would be nice!

Regards