(转帖) CAS智能卡工作原理和破解关键点C源码示范

[]CASC - CardSharing - ,iptv,,dreambox,DM,CardSharing,,nfi,IMG,FW2,HD,BS,GPRS,KEY - Powered by Discuz!
#ifndef __sc_def_h__
#define __sc_def_h__
#define U8 unsigned char
#define U16unsigned short
#define U32unsigned int
#define bool unsigned char
#define Smart_Handle_t unsigned int
#define Smart_ErrorCode_tint
#define NULL ((void *)0)
#define SMC_NO_ERROR 0
#define true1
#define false 0
/*
smart cardcase!
tfsmatr:
1. 3b 6c 00 00 4e 54 xx xx xx xx xx xx 4a 03 00 00 (T0?)
2. 3b 02 02 80 (T0? !)
*/
Smart_ErrorCode_t Smart_Reset(Smart_Handle_t Handle,U8* pucAtrBuffer,
U8* pucAtrLength,U8* pucHistoryLength);//
Smart_ErrorCode_t Smart_Transfer(Smart_Handle_t Handle,U8* pucCommand,
U16 uNumberToWrite, U8* pucResponse,
U16 uNumberToRead,U16* pusNumberRead,
U8* pucPBWords);//
#endif /* __sc_def_h__ */
/******************************************************
* smsx.c
* SCA
*
*
*****************************************************/
#include <stdio.h>
#include <memory.h>
#include "smsx.h"
Smsx_Info_tsmsx;
Smsx_Info_t* pstSmsxInfo;
static Smart_ErrorCode_t smsx_transfer(
Smart_Handle_t Handle,
U8* ins,
U16 NumberToWrite,
U8* Response,
U16* Read,
U8* Status);//
bool smsx_readdata(Smart_Handle_t Handle,U8 len,U8 *outbuf);
static bool smsx_begincmd(Smart_Handle_t Handle);
static bool smsx_get_sn(Smart_Handle_t Handle);//
/************************************************************************/
/* ,
handle -- smart card

true -- false --
http://www.tvrofans.org/thread-27050-1-1.html[2012/8/5 11:39:29]
*/
/************************************************************************/
bool smsx_init(Smart_Handle_t handle)
{
pstSmsxInfo = &smsx;
memset(pstSmsxInfo,0,sizeof(Smsx_Info_t));
if(!smsx_begincmd(handle))
{
printf("smsx init : begin cmd failed !!\n");
//return false;
}
if(!smsx_get_sn(handle))
{
printf("smsx init : get sn failed !!\n");
//return false;
}
printf("SMSX Init OK !!\n");
return true;
}
/************************************************************************/
/* , Reset
Handle -- smart card

true -- false --

:
00 A4 04 00 02 A4 3F 00
90 00
00 A4 04 00 02 A4 4A 00
90 00
*/
/************************************************************************/
static bool smsx_begincmd(Smart_Handle_t Handle)
{
U8 cmd[16]={0x00,0xa4,0x04,0x00,0x02,0x3F,0x00};
U8 response[10];
U8 pbword[2]={0};
U16 cmdlen=0;
U16 replen=0;
Smart_ErrorCode_t bresult=SMC_NO_ERROR;
cmd[5] = 0x3F;
cmd[6] = 0x00;
cmdlen=cmd[4]+5;
bresult=smsx_transfer(Handle,cmd,cmdlen,response,&replen,pbword);
// if(bresult!=SMC_NO_ERROR)
// {
//return false;
// }
if((pbword[0]!=0x90)||(pbword[1]!=0x00))
{
return false;
}
cmd[5] = 0x4A;
cmd[6] = 0x00;
cmdlen=cmd[4]+5;
// {
//return false;
// }
{
return false;
}
return true;
}
/************************************************************************/
/* IDID

true -- false --
pstYxtfInfoOSD
:
00 B2 00 05 06 B2 00 01 FF 00 01 FF
61 67
00 C0 00 00 67 C0
00 00 00 xx xx xx xx yy yy yy yy yy yy yy yy 00 // xx xx xx xx () ID yy yy yy yy yy yy yy yy(
)
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 90 00 */
/************************************************************************/
bool smsx_get_sn(Smart_Handle_t Handle)
{
U8 cmd[]={0x00,0xB2,0x00,0x05,0x06,0x00,0x01,0xFF,0x00,0x01,0xFF};
U8 response[200];
U8 pbword[2]={0};
U16 cmdlen=0;
U16 replen=0;
U8 nextreadsize=0;
cmdlen = 5+cmd[4];
// {
//return false;
// }
if((pbword[0]&0xf0)!=0x60)
{
return false;
}
nextreadsize=pbword[1];
if(smsx_readdata(Handle,nextreadsize,response)!=true)
{
return false;
}
memcpy(pstSmsxInfo->uCardUA, response+7, 8);//
pstSmsxInfo->uCardNumber=(response[3]<<24)+(response[4]<<16)+(response[5]<<8)+response[6];//
!
return true;
}
/************************************************************************/
/* ECMCWECMfilter
0x80/0x81ok
Handle -- smart card buf -- ECM0x80/0x81
pucCW-- cw16
true -- ECM false --ECM

*/
/************************************************************************/
bool smsx_parse_ecm(Smart_Handle_t Handle,U8* buf,U8* pucCW)
{
U8cmd1[200]={0x80,0x32,0x00,0x00,0x3C};
U8cmd2[10]={0x00,0xc0,0x00,0x00};
U8 reponse[100];
U16 writelen = 0;
U16 replen=0;
U8status[2];
U8* pbuf = buf;
int i = 0;
writelen = pbuf[2]+3+5;
// printf("ecm write len = %d\n", writelen);
cmd1[4] = pbuf[2]+3;
memcpy(cmd1+5,pbuf,writelen-5);//ECM
smsx_transfer(Handle,cmd1,writelen,reponse,&replen,status);
if (replen >= 2)
{
cmd2[4] = reponse[1];
}
else
{
if((status[0]&0xf0)==0x60)
{
cmd2[4] = status[1];
}
else
{
return false;
}
}
smsx_transfer(Handle,cmd2,5,reponse,&replen,status);
// printf("rsp len = %d\n", replen);
if (replen > 32)//
{
if(buf[0]==0x80)
{
memcpy(pucCW, reponse+18,4);
memcpy(pucCW+4, reponse+18+4+1,4);
memcpy(pucCW+8, reponse+18+8+1,4);
memcpy(pucCW+12, reponse+18+8+1+4+1,4);
}
else
{
memcpy(pucCW, reponse+18+8+1,4);
memcpy(pucCW+4, reponse+18+8+1+4+1,4);
memcpy(pucCW+8,reponse+18,4);
memcpy(pucCW+12,reponse+18+4+1,4);
}
}
else
{
return false;
}
return true;
}
/************************************************************************/
/* EMMEMMfilter0x82
5678,IDEMM
Handle -- smart card data -- EMMlen --

true -- EMM false --EMM
*/
/************************************************************************/
bool smsx_parse_emm(Smart_Handle_t Handle,U8* buf,U16 len)
{
U8cmd1[100]={0x80,0x30,0x00,0x00,0x4C};
U8cmd2[10]={0x00,0xc0,0x00,0x00};
U8 reponse[100];
U16 writelen = 0;
U16 replen=0;
U8status[2];
writelen = buf[2]+3+5;
cmd1[4] = buf[2]+3;
memcpy(cmd1+5,buf,writelen-5);//EMM
smsx_transfer(Handle,cmd1,writelen,reponse,&replen,status);
if (replen > 2)
{
return true;
}else
{
return false;
}
return true;
}
/************************************************************************/
/*
Handle -- smart card ins -- NumberToWrite -
Response -- Read -- Status --
SMC_NO_ERROR

*/
/************************************************************************/
static Smart_ErrorCode_t smsx_transfer(Smart_Handle_t Handle,
U8* ins,
U16 NumberToWrite,
U8* Response,
U16* Read,
U8* Status)
{
Smart_ErrorCode_t error = SMC_NO_ERROR;
error = Smart_Transfer(Handle,ins,NumberToWrite,Response,0,Read,Status);
// printf("Status[0]=0x%02xStatus[1]=0x%02x error = %d\n",Status[0],Status[1],error);
return error;
}
/************************************************************************/
/*
Handle -- smart card len --
outbuf --
true -- false --
*/
/************************************************************************/
bool smsx_readdata(Smart_Handle_t Handle,U8 len,U8 *outbuf)
{
U8cmd[]={0x00,0xc0,0x00,0x00,0xff};
U8reponse[255];
U16cmdlen=5;
U16replen=0;
U8pbword[2]={0};
memset(reponse,0,255);
cmd[4] = len;
bresult=smsx_transfer(Handle,cmd,cmdlen,reponse,&replen,pbword);
// {
//return false;
// }
if((pbword[0]==0x90)&&(pbword[1]==0x00)&&(replen==len))
{
memcpy(outbuf,reponse,replen);
return true;
}
else
{
return false;
}
}///////////---The end--------******************************************************
* yxtf.c
* TCA
*
*
*****************************************************/
#include <stdio.h>
#include "memory.h"
#include "yxtf.h"
Yxtf_Info_tyxtf;
Yxtf_Info_t* pstYxtfInfo = NULL;
static Smart_ErrorCode_t yxtf_transfer(Smart_Handle_t Handle,
U8* ins,
U16 NumberToWrite,
U8* Response,
U16* Read,
U8* Status);//
static bool yxtf_readdata(Smart_Handle_t Handle,U8 len,U8 *outbuf);
static bool yxtf_begincmd(Smart_Handle_t Handle);
static bool yxtf_get_sn(Smart_Handle_t Handle);//
static bool yxtf_get_prov(Smart_Handle_t Handle);//
static bool yxtf_check_pairing(Smart_Handle_t Handle);//
/************************************************************************/
/* ,
handle -- smart card

true -- false --
*/
/************************************************************************/
bool yxtf_init(Smart_Handle_t handle)
{
pstYxtfInfo = &yxtf;
memset(pstYxtfInfo,0,sizeof(Yxtf_Info_t));
if(!yxtf_begincmd(handle))
{
//return false;
}
#if 0
if(!yxtf_get_prov(handle))
{
printf("yxtf init : get prog info failed !!\n");
return false;
}
#endif
if(!yxtf_get_sn(handle))
{
printf("yxtf init : get sn failed !!\n");
//return false;
}
if(!yxtf_check_pairing(handle))
{
printf("yxtf init : get sn failed !!\n");
//return false;
}
printf("yxtf Init OK !!\n");
return true;
}
/************************************************************************/
/* , Reset

true -- false --

:
00 A4 04 00 05 A4 F9 5A 54 00 06
90 00
*/
/************************************************************************/
static bool yxtf_begincmd(Smart_Handle_t Handle)
{
U8 cmd[]={0x00,0xa4,0x04,0x00,0x05,0xf9,0x5a,0x54,0x00,0x06};
U8 response[10];
U8 pbword[2]={0};
U16 cmdlen=0;
U16 replen=0;
cmdlen=10;
bresult=yxtf_transfer(Handle,cmd,cmdlen,response,&replen,pbword);
// {
//return false;
// }
{
return false;
}
return true;
}
/************************************************************************/
/* ID

true -- false --
pstYxtfInfoOSD
:
80 44 00 00 08 44
xx xx 00 00 xx xx 00 00 90 00 //ID */
/************************************************************************/
static bool yxtf_get_prov(Smart_Handle_t Handle)
{
U8 cmd[5]={0x80,0x44,0x00,0x00,0x08};
U8 response[10];
U8 pbword[2]={0};
int cmdlen=0;
U16 replen=0;
int provcount=0;
int i;
cmdlen = 5+cmd[4];
bresult = yxtf_transfer(Handle,cmd,cmdlen,response,&replen,pbword);
// {
//return false;
// }
/**/
{
return false;
}
for(i=0;i<MAX_PROV_COUNT;i++)//4
{
if((response[i*2]!=0)||(response[i*2+1]!=0))
{
provcount++;
pstYxtfInfo->provID=(response[i*2]<<8)|response[i*2+1];
printf("the provid[%d] =0x%04x\n",i,pstYxtfInfo->provID);
}
}
}
/************************************************************************/
/* tftf

true -- false --
pstYxtfInfoOSD
:
80 46 00 00 04 46 01 00 00 04
61 04
00 C0 00 00 04 C0
xx xx xx xx 90 00 // xx xx xx xx () */
/************************************************************************/
bool yxtf_get_sn(Smart_Handle_t Handle)
{
U8 cmd[]={0x80,0x46,0x00,0x00,0x04,0x01,0x00,0x00,0x04};
U8 response[100];
U8 pbword[2]={0};
U16 cmdlen=0;
U16 replen=0;
U8 nextreadsize=0;
cmdlen = 5+cmd[4];
bresult=yxtf_transfer(Handle,cmd,cmdlen,response,&replen,pbword);
// {
//return false;
// }
if((pbword[0]&0xf0)!=0x60)
{
return false;
}
nextreadsize=pbword[1];
if(yxtf_readdata(Handle,nextreadsize,response)!=true)
{
return false;
}
pstYxtfInfo->uCardNumber=(response[0]<<24)+(response[1]<<16)\
+(response[2]<<8)+response[3];//,,
return true;
}
/************************************************************************/
/*

true -- false --
pstYxtfInfoOSD
:
80 4C 00 00 04 4C FF FF FF FF
94 B1 --

94 B2 -- () */
/************************************************************************/
static bool yxtf_check_pairing(Smart_Handle_t Handle)
{
U8 cmd1[200]= {0x80,0x4c,0x00,0x00,0x04,0xFF,0xFF,0xFF,0xFF};
U8reponse[100];
U16writelen = 0;
U16replen=0;
U8 status[2];
inti = 0;
writelen = cmd1[4]+5;
yxtf_transfer(Handle,cmd1,writelen,reponse,&replen,status);
if ((status[0] == 0x94)&&(status[1] == 0xB1) )
{
printf("!\n");
pstYxtfInfo->paringflag = 0;
return true;
}
else if ((status[0] == 0x94)&&(status[1] == 0xB2) )
{
printf("!\n");
return true;
}
else
{
return false;
}
}
/************************************************************************/
/* tfECM
cw,
tf
Handle -- smart card pairingcode -- 4

,flash

true -- false --

80 4C 00 00 04 4C xx xx xx xx
90 00 //

94 B2(?) // */
/************************************************************************/
bool yxtf_pairing(Smart_Handle_t Handle, U8* pairingcode)// pairingcode 4,
{
U8cmd1[200]= {0x80,0x4c,0x00,0x00,0x04,0xFF,0xFF,0xFF,0xFF};
U8 reponse[100];
U16 writelen = 0;
U16 replen=0;
U8status[2];
int i = 0;
memcpy(cmd1+5, pairingcode, 4);
writelen = cmd1[4]+5;
if((status[0]==0x90)||(status[1]==0x00))
{
printf("!\n");
}
else
{
// printf("************Status[0]=%02x Status[1]=%02x*********\n",status[0],status[1]);
printf("!\n");
return false;
}
return true;
}
/************************************************************************/
/* ECMCWECMfilter
0x80/0x81ok
Handle -- smart card buf -- ECM0x80/0x81
pucCW-- cw16
true -- ECM false --ECM

*/
/************************************************************************/
bool yxtf_parse_ecm(Smart_Handle_t Handle,U8* buf,U8* pucCW)
{
U8cmd1[200]={0x80,0x3a,0x00,0x01,0x53};
U8cmd2[10]={0x00,0xc0,0x00,0x00};
U8 reponse[100];
U16 writelen = 0;
U16 replen=0;
U8status[2];
U8* pbuf = buf;
int i = 0;
for (i=0; i<(buf[2]+3); i++)//
{
if ((pbuf[0]==0x80)&&(pbuf[1]==0x3a))
{
break;
}
else
{
pbuf = buf+i+1;
}
}
writelen = pbuf[4]+5;
// printf("ecm write len = %d\n", writelen);
memcpy(cmd1,pbuf,writelen);
if (replen >= 2)
{
cmd2[4] = reponse[1];
}
else
{
if((status[0]&0xf0)==0x60)
{
cmd2[4] = status[1];
}
else
{
return false;
}
}
yxtf_transfer(Handle,cmd2,5,reponse,&replen,status);
//printf("rsp len = %d\n", replen);
if (replen > 23)
{//tfhoho~ ~
if(buf[0]==0x80)
else
{
memcpy(pucCW+8,reponse+8,8);
}
}
else
{
return false;
}
return true;
}
/************************************************************************/
/* EMMEMMfilter0x82
5678EMM
Handle -- smart card data -- EMMlen --

true -- EMM false --EMM
*/
/************************************************************************/
bool yxtf_parse_emm(Smart_Handle_t Handle,U8* data,U16 len)
{
U8cmd1[100]={0};
U8cmd2[10]={0x00,0xc0,0x00,0x00};
U8 reponse[100];
U16 writelen = 0;
U16 replen=0;
U8status[2];
writelen = data[15]+5;
memcpy(cmd1,data+11,writelen);//
if (replen > 2)
{
return true;
}else
{
return false;
}
return true;
}
/************************************************************************/
/*
Handle -- smart card ins -- NumberToWrite -
Response -- Read -- Status --
SMC_NO_ERROR

*/
/************************************************************************/
static Smart_ErrorCode_t yxtf_transfer(Smart_Handle_t Handle,
U8* ins,
U16 NumberToWrite,
U8* Response,
U16* Read,
U8* Status)
{
Smart_ErrorCode_t error = SMC_NO_ERROR;
error = Smart_Transfer(Handle,ins,NumberToWrite,Response,0,Read,Status);
// printf("Status[0]=0x%02xStatus[1]=0x%02x error = %d\n",Status[0],Status[1],error);
return error;
}
/************************************************************************/
/*
Handle -- smart card len --
outbuf --
true -- false --
*/
/************************************************************************/
static bool yxtf_readdata(Smart_Handle_t Handle,U8 len,U8 *outbuf)
{
U8cmd[]={0x00,0xc0,0x00,0x00,0xff};
U8reponse[255];
U16cmdlen=5;
U16replen=0;
U8pbword[2]={0};
memset(reponse,0,255);
cmd[4] = len;
bresult=yxtf_transfer(Handle,cmd,cmdlen,reponse,&replen,pbword);
// {
//return false;
// }
if((pbword[0]==0x90)&&(pbword[1]==0x00)&&(replen==len))
{
memcpy(outbuf,reponse,replen);
return true;
}
else
{
return false;
}
}
///////////---The end---------
/*
,24,
*/
/******************************************************
* smsx.h
* SCA
*
*
*****************************************************/
#ifndef _smsx_h_
#define _smsx_h_
#include "sc_def.h"
typedef struct
{
U32 uCardNumber;//
U8 uCardUA[9];//ID
U8 iAgeGrade; //
}Smsx_Info_t;
bool smsx_init(Smart_Handle_t handle); //

bool smsx_parse_ecm(Smart_Handle_t Handle,U8* pbuf,U8* pucCW);//ECMCW
bool smsx_parse_emm(Smart_Handle_t Handle,U8* pbuf,U16 len);//EMM
#endif /* _smsx_h_ */

(转帖) CAS智能卡工作原理和破解关键点C源码示范

Uploaded by

Copyright:

Available Formats

You might also like

(转帖) CAS智能卡工作原理和破解关键点C源码示范

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

(转帖) CAS智能卡工作原理和破解关键点C源码示范

Uploaded by

Copyright:

Available Formats

[]CASC - CardSharing - ,iptv,,dreambox,DM,CardSharing,,nfi,IMG,FW2,HD,BS,GPRS,KEY - Powered by Discuz!

handle -- smart card

[]CASC - CardSharing - ,iptv,,dreambox,DM,CardSharing,,nfi,IMG,FW2,HD,BS,GPRS,KEY - Powered by Discuz!

[]CASC - CardSharing - ,iptv,,dreambox,DM,CardSharing,,nfi,IMG,FW2,HD,BS,GPRS,KEY - Powered by Discuz!

[]CASC - CardSharing - ,iptv,,dreambox,DM,CardSharing,,nfi,IMG,FW2,HD,BS,GPRS,KEY - Powered by Discuz!

[]CASC - CardSharing - ,iptv,,dreambox,DM,CardSharing,,nfi,IMG,FW2,HD,BS,GPRS,KEY - Powered by Discuz!

Handle -- smart card data -- EMMlen --

[]CASC - CardSharing - ,iptv,,dreambox,DM,CardSharing,,nfi,IMG,FW2,HD,BS,GPRS,KEY - Powered by Discuz!

[]CASC - CardSharing - ,iptv,,dreambox,DM,CardSharing,,nfi,IMG,FW2,HD,BS,GPRS,KEY - Powered by Discuz!

handle -- smart card

[]CASC - CardSharing - ,iptv,,dreambox,DM,CardSharing,,nfi,IMG,FW2,HD,BS,GPRS,KEY - Powered by Discuz!

[]CASC - CardSharing - ,iptv,,dreambox,DM,CardSharing,,nfi,IMG,FW2,HD,BS,GPRS,KEY - Powered by Discuz!

[]CASC - CardSharing - ,iptv,,dreambox,DM,CardSharing,,nfi,IMG,FW2,HD,BS,GPRS,KEY - Powered by Discuz!

[]CASC - CardSharing - ,iptv,,dreambox,DM,CardSharing,,nfi,IMG,FW2,HD,BS,GPRS,KEY - Powered by Discuz!

Handle -- smart card

Handle -- smart card pairingcode -- 4

[]CASC - CardSharing - ,iptv,,dreambox,DM,CardSharing,,nfi,IMG,FW2,HD,BS,GPRS,KEY - Powered by Discuz!

[]CASC - CardSharing - ,iptv,,dreambox,DM,CardSharing,,nfi,IMG,FW2,HD,BS,GPRS,KEY - Powered by Discuz!

[]CASC - CardSharing - ,iptv,,dreambox,DM,CardSharing,,nfi,IMG,FW2,HD,BS,GPRS,KEY - Powered by Discuz!

[]CASC - CardSharing - ,iptv,,dreambox,DM,CardSharing,,nfi,IMG,FW2,HD,BS,GPRS,KEY - Powered by Discuz!

[]CASC - CardSharing - ,iptv,,dreambox,DM,CardSharing,,nfi,IMG,FW2,HD,BS,GPRS,KEY - Powered by Discuz!

bool smsx_init(Smart_Handle_t handle); //

You might also like