UPC Direct Nano 80 60 used in Cryptoworks Encryption System to encrypt and protect ECM
==============================================
UPC Direct Thor @ 0.8° West UPC EMU SSSP
14/09/2013
If we have this ECM and we want to decrypt the ECM that encrypted by Nano 80 60
ECM:
81708181FF00007C8060EEBBA7BC0863D1F956B92CA914C78D0FD5A58C2E A01CCAE79FAEA18CDA38904151E3DA7F207C66D951E8B03AC7C7C25A16F8 7A1A30A566C7C33EEE1AABE989D240450479BE85832B3FA5C0FC346B5287 7E8D2D9F8093D28051E8731D924627E88301A08402A0018C032000508E02 2EF1DF08E77CAD47933D4BD1
81708181FF00007C8060
EEBBA7BC0863D1F9 Block 1
56B92CA914C78D0F Block 1
D5A58C2EA01CCAE7 Block 2
9FAEA18CDA389041 Block 3
51E3DA7F207C66D9 Block 4
51E8B03AC7C7C25A Block 5
16F87A1A30A566C7 Block 6
C33EEE1AABE989D2 Block 7
40450479BE85832B Block 8
3FA5C0FC346B5287 Block 9
7E8D2D9F8093D280 Block 10
51E8731D924627E8 Block 11
[8301A08402A0018C032000508E022EF1DF08E77CAD47933D4BD1] Not needed
Encrypted Blocks
EEBBA7BC0863D1F9 Block 1
56B92CA914C78D0F Block 1
D5A58C2EA01CCAE7 Block 2
9FAEA18CDA389041 Block 3
51E3DA7F207C66D9 Block 4
51E8B03AC7C7C25A Block 5
16F87A1A30A566C7 Block 6
C33EEE1AABE989D2 Block 7
40450479BE85832B Block 8
3FA5C0FC346B5287 Block 9
7E8D2D9F8093D280 Block 10
51E8731D924627E8 Block 11
1- We will decrypt encrypted blocks using OP key
OP KEY(3DES)= 307249C2E6CA1BFC698C79B4C64E810C
EEBBA7BC0863D1F9
3DES
307249C2E6CA1BFC698C79B4C64E810C
=
6406013DB5E89994 Block 1
56B92CA914C78D0F
3DES
307249C2E6CA1BFC698C79B4C64E810C
=
A59D72930D5D45FB Block 2
D5A58C2EA01CCAE7
3DES
307249C2E6CA1BFC698C79B4C64E810C
=
F9CD6582CB308E39 Block 3
9FAEA18CDA389041
3DES
307249C2E6CA1BFC698C79B4C64E810C
=
FCDE2A8ED6BBB775 Block 4
51E3DA7F207C66D9
3DES
307249C2E6CA1BFC698C79B4C64E810C
=
39F15D47FC550968 Block 5
51E8B03AC7C7C25A
3DES
307249C2E6CA1BFC698C79B4C64E810C
=
F9F7A541CD4EEF76 Block 6
16F87A1A30A566C7
3DES
307249C2E6CA1BFC698C79B4C64E810C
=
2DD7B8396AFACAA6 Block 7
C33EEE1AABE989D2
3DES
307249C2E6CA1BFC698C79B4C64E810C
=
A0D1680FE2C05508 Block 8
40450479BE85832B
3DES
307249C2E6CA1BFC698C79B4C64E810C
=
ABF6936DD77DC1C4 Block 9
3FA5C0FC346B5287
3DES
307249C2E6CA1BFC698C79B4C64E810C
=
C7BFD3B4637D8B41 Block 10
7E8D2D9F8093D280
3DES
307249C2E6CA1BFC698C79B4C64E810C
=
A9F8FA297ACB38AA Block 11
51E8731D924627E8
3DES
307249C2E6CA1BFC698C79B4C64E810C
=
94149CDBC8F24A8C Block 12
2- No we swap the OP KEY(3DES) 1st 8 Byte with 2nd 8Byte as follow:
698C79B4C64E810C307249C2E6CA1BFC
EEBBA7BC0863D1F9
3DES
698C79B4C64E810C307249C2E6CA1BFC
=
B839C4CDEDD5BAC9 Block 1
56B92CA914C78D0F
3DES
698C79B4C64E810C307249C2E6CA1BFC
=
D66C4CFC71CA7CC3 Block 2
D5A58C2EA01CCAE7
3DES
698C79B4C64E810C307249C2E6CA1BFC
=
5CD0E639F56642A8 Block 3
9FAEA18CDA389041
3DES
698C79B4C64E810C307249C2E6CA1BFC
=
FA68CFA16CD43AA0 Block 4
51E3DA7F207C66D9
3DES
698C79B4C64E810C307249C2E6CA1BFC
=
9A95C4FFC2B1D718 Block 5
51E8B03AC7C7C25A
3DES
698C79B4C64E810C307249C2E6CA1BFC
=
B7FAB9FC29254374 Block 6
16F87A1A30A566C7
3DES
698C79B4C64E810C307249C2E6CA1BFC
=
BBE6BD4158D1CF8E Block 7
C33EEE1AABE989D2
3DES
698C79B4C64E810C307249C2E6CA1BFC
=
76F13BE2FBA1C7DF Block 8
40450479BE85832B
3DES
698C79B4C64E810C307249C2E6CA1BFC
=
6616592A7D70946A Block 9
3FA5C0FC346B5287
3DES
698C79B4C64E810C307249C2E6CA1BFC
=
3D9D5BFA7F784A43 Block 10
7E8D2D9F8093D280
3DES
698C79B4C64E810C307249C2E6CA1BFC
=
5F0BE70EEDF7C3FA Block 11
51E8731D924627E8
3DES
698C79B4C64E810C307249C2E6CA1BFC
=
DCBB9FABCD41B94F Block 12
3-Now the new OP KEY(3DES) is first block from 1st decryption and 1st block from 2nd decryption as follow:
6406013DB5E89994 B839C4CDEDD5BAC9
56B92CA914C78D0F
3DES
6406013DB5E89994B839C4CDEDD5BAC9
=
0600558301A08C03
XOR
0000000000000000
=
0600558301A08C03 1 clear block
D5A58C2EA01CCAE7
3DES
6406013DB5E89994B839C4CDEDD5BAC9
=
76B97C2716E97CCA
XOR
56B92CA914C78D0F
=
2000508E022EF1C5 2 clear block
FAEA18CDA389041
3DES
6406013DB5E89994B839C4CDEDD5BAC9
=
D425573E3D92EAB8
XOR
D5A58C2EA01CCAE7
=
0180DB109D8E205F 3 clear block
51E3DA7F207C66D9
3DES
6406013DB5E89994B839C4CDEDD5BAC9
=
A95151A3CC5272B7
XOR
9FAEA18CDA389041
=
36FFF02F166AE2F6 4 clear block
51E8B03AC7C7C25A
3DES
6406013DB5E89994B839C4CDEDD5BAC9
=
43833E2FFE544EF1
XOR
51E3DA7F207C66D9
=
1260E450DE282828 5 clear block
16F87A1A30A566C7
3DES
6406013DB5E89994B839C4CDEDD5BAC9
=
79C09812EFEFEA72
XOR
51E8B03AC7C7C25A
=
2828282828282828 6 clear block
C33EEE1AABE989D2
3DES
6406013DB5E89994B839C4CDEDD5BAC9
=
3ED05232188D4EEF
XOR
16F87A1A30A566C7
=
2828282828282828 7 clear block
40450479BE85832B
3DES
6406013DB5E89994B839C4CDEDD5BAC9
=
EB16C63283C1A1FA
XOR
C33EEE1AABE989D2
=
2828282828282828 8 clear block
3FA5C0FC346B5287
3DES
6406013DB5E89994B839C4CDEDD5BAC9
=
686D2C5196ADAB03
XOR
40450479BE85832B
=
2828282828282828 9 clear block
7E8D2D9F8093D280
3DES
6406013DB5E89994B839C4CDEDD5BAC9
=
178DE8D41C438D8F
XOR
3FA5C0FC346B5287
=
282828282828DF08 10 clear block
51E8731D924627E8
3DES
6406013DB5E89994B839C4CDEDD5BAC9
=
B3B12FD730431A3D
XOR
7E8D2D9F8093D280
=
CD3C0248B0D0C8BD 11 clear block
No we decrypted all 11 blocks
0600558301A08C03
2000508E022EF1C5
0180DB109D8E205F
36FFF02F166AE2F6
1260E450DE282828
2828282828282828
2828282828282828
2828282828282828
2828282828282828
282828282828DF08
CD3C0248B0D0C8BD
3- We must re-correct the ECM that we decrypted it
we will add 5 bytes to the beginning of ECM
8170XX 81FF; xx we get it from 3rd byte from first clear block and add it with number 5 in hexadecimal as follow:
0600 (55) 8301A08C03
3rd byte between parentheses + number 5
55(hex) + 5(Hex) = 5A(Hex)
Then we wil add 81705A81FF to the beginning of decrypted ECM:
ECM:
81705A81FF0600558301A08C032000508E022EF1C50180DB109D8E205F36 FFF02F166AE2F61260E450DE282828282828282828282828282828282828 2828282828282828282828282828282828282828282828DF08CD3C0248B0 D0C8BD
UPC Direct Thor @ 0.8° West UPC EMU SSSP
29/08/2013
==============================================
01/08/2013
W 0D02A0 00
307249C2E6CA1BFC698C79B4C64E810C
OP key
W 0D02A0 06 C4FFB330795B
CardSystem Key
