PANSAT 9200 with XX Client

[lenonh]

I was just wondering if anyone has tried to see if it would work?

[skywalker999]

Well you need an iks bin for that but sense there is no iks bin how will it work with xx client

[lenonh]

true! Guess I didn't think

[n3fta]

You might want to read through the thread below.

http://www.satfix.net/showthread.php...-in-sw-modding

[skywalker999]

all i can say is that it's close to an iks bin but no cigar yet but if you know or know someone that knows a bit of machine coding then that thread has everything you need to finish what jvvh started me i could look all day at the disassemble of the bin with ida pro and still don't understand nothing i wish i did and today i'm not even sure that Dualtest is still working on it and damn it's frustrating to see no progress

[jvvh5897]

Well, if you are frustrated--start working on it--ask questions. The problem is not very hard, you modify the serial port output to send out the ecm packets and modify the serial port input to receive CWs and put them in the spot needed for the processor to use them. As best as I can recall, the first part was pretty much done and the second part was pretty much done. Now it may be that the N2 radio on 97 degree Ku band is hard to get so you will not have that as an aid in seeing how the very last part is done, but you do have the example info from the the thread and some RAM dumps. Most of the direct machine code stuff was done, you would just have to work in C.

[skywalker999]

Well jvvh i did asked a question on the sw modding thread and there is no reply
is it possible that the provider id is in the channel data on the ram dumps has it was the case for the Pany 2700 or 3500 if it is what should we be looking for on the ram dump and as for ram dumps of N2 radio on 97 there is at least 1 or 2 on the advance section

[jvvh5897]

Sorry did not see a post--they do get hidden with the other sub-sections. Advanced section has less traffic.

Based on the coolsat code the box gets provID as part of the network NIT scan when you find channels and I do expect that the ID is in there. When you select a ch from the list the data is copied to a specific spot in RAM so I bet you will find it there. Just look in a ch list backup that the box likely can give you and figure out how to parse the list for ch name, video and audio PIDs and see if the ID is in there.

As part of the emm and ecm handling the code does try to extract the provID from the stream as well, so it should be pulling in the CAT part of the stream and parsing that for the prov code (some prov fake the ID in the CAT though--you can see that in the coolsat code) and they can use some other parts of the stream than CAT. But I suspect that the spot we were looking at in the earlier work was an extract from the stream--this would likely be the better to use, but it is up to you--where ever you find the ID in a reliable, constant spot would likely be good enough.

[jvvh5897]

BTW the channel info is in the RAM dump posts--try search term like "TNT".

Here are some example conditional access table packets (CAT) from RAM dumps:
in gc_capture of 97 degree:
CAT shows Ca ID 1802 and EMM PID of 0xf563--09 04 18 02 F5 63
215FC0 00 00 00 00 00 00 00 00-02 B0 23 00 9E CD 00 00
215FD0 E2 30 F0 00 02 E2 30 F0-06 09 04 18 02 F5 63 03
215FE0 E2 31 F0 06 09 04 18 02-F5 63 8C 64 C7 32 00 00

later in file:
21C5E0 00 00 00 09 04 18 02 F5-63 09 04 18 02 F5 63 09
21C5F0 04 18 40 E1 39 09 04 18-16 E0 39 09 04 18 40 E1
21C600 39 09 04 18 16 E0 39 00-00 00 00 00 00 00 00 00

-------------------------------------------------------

in nbcsp159cap2 file
215FB0 00 00 00 00 00 00 00 00-00 00 00 00 02 80 51 00
215FC0 9F CD 00 00 F8 22 F0 00-DA E2 94 F0 12 0F 04 4F
215FD0 54 56 00 90 01 90 FE 04-41 50 50 00 FD 01 3F 02
215FE0 F8 22 F0 0C 09 04 18 40-E1 27 09 04 18 16 E0 27
215FF0 04 F8 23 F0 12 09 04 18-40 E1 27 09 04 18 16 E0
216000 27 0A 04 65 6E 67 00 DB-F8 27 F0 00 92 F5 8C 51
216010 00 79 EF C0 C8 BD 9E 00-E4 BC 9E 00 01 69 D3 C0
216020 44 00 58 00 68 BD 9E 00-50 00 00 00 00 00 00 00

later:
429B30 09 04 18 00 E0 20 09 04-18 01 E1 20 09 04 18 10
429B40 E1 20 09 04 18 21 E3 51-09 04 18 22 E3 52 09 04
429B50 18 16 E1 20 09 04 18 2E-E3 50 09 04 18 40 E1 20

-----------------------------------------------------------

Can you see how the later in file stuff seems to be partial copy of CAT info? I'm guessing that the code pulls in CAT packets and parses out the different CaID and associated EMM PID info for opening filters to get EMMs if in autoroll and maybe just to read off the correct CaID even if not in autoroll.

[jvvh5897]

I still think the code where the mod was made to pull in the ecm packets is the place to find the stream ID easiest--there was a test fo the ID there and so there has to be an easy way to pull out the ID for your use. The mod was to change 1810 to 1840 or 1816 as I recall.

[skywalker999]

Well first Merry Christmas to you and yours

now has for the pany 9200 not sure i should post the script here but her is a description of what the receiver his doing

This is what the receiveris doing
with every cws that it receives with xx client for windows or rq ssp, every 15 seconds the receiver randomly shows a different menu like the volume bar next the favorites menu or the sat button menu or it changes channel.

i hope this gives you an idea of what the receiver is doing and suggest changes to the script thanks

and another thing i can confirm this part that you mention a long time ago
CP / from page 12

You can see that it is looking for the CAID up around 0x78C500-78C600 and that is where the RAM dump 21C5E0 area is. I'm not sure if that area is scanned for the ID or if it is looking at one specific pair of bytes, but that is where the ID has to be. It might be copied to other locations in a better format for the debug message routine to pull it from, but that is the key area for filter building.

and that's exactly what i fund in the ram dump at that ADR 21C5E0

ADR 21C5C4 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ADR 21C5E0 = 09 04 18 40 E1 39 09 04 18 16 E0 39 09 04 18 40 E1 39 09 04 18 16 E0 39 09 04 18
ADR 21C5FC = 40 E1 39 09 04 18 16 E0 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

[jvvh5897]

Hum, I would guess that the odd menu might be the result of coming back from subroutine with different values in the registers and stack than you had when you called subroutne.

I'm not sure that the caid you see in the 21c5e0 area will always be in the order you see, it might be that the order of packet from the stream determines what it sees and puts in the list.