I’ve been buying broken Macbook’s in SA when I’ve been home, for repair in China.

My latest purchase is a pre unibody Mac Book Pro that had been dropped – the top case was dented,and the screen shattered.
The LCD was fairly painless to replace – I’ve done quite a few already on various models, and I have a bazillion suppliers for raw panels.

The top case was a little more problematic – I ordered 2 consecutive replacements off of Taobao, but unfortunately the delivery company (ShenTong) destroyed both in shipping. Took about a month to sort that out and find a yet another replacement with explicit instructions please not to send via ShenTong (aka destroyer of parts).

The third case arrived in pristine condition, and I installed the keyboard from the previous case, only to find that the function keys didn’t work, and the caps lock didn’t work.

It wasn’t a hardware issue with the keyboard, as it worked fine in another laptop. I even ordered another one just to make sure.

A bit of googling revealed that the keyboard kext gets the layout from the USB hardware ID present in the top case.
As my top case didn’t quite match up hardware id wise, I was seeing that as an issue.

Fixing this is a bit tricky, but doable.

First up was to find out what the hardware id is for the USB case.
In my case this was as below (snarfed from System Information / USB)

Apple Internal Keyboard / Trackpad:

  Product ID:	0x0231
  Vendor ID:	0x05ac  (Apple Inc.)
  Version:	0,70
  Speed:	Up to 12 Mb/sec
  Manufacturer:	Apple, Inc.
  Location ID:	0x5d200000 / 3
  Current Available (mA):	500
  Current Required (mA):	40

Product ID is the useful bit – 0x0231 = 561 in decimal.
So, we need to lookup 561 in the kext (driver) for the keyboard.

In Lion / Snow Leopard, this is in the AppleUSBTopCase.kext over in System / Library / Extensions.

If you open up that kext, it has the plist for the keyboard layouts over here –

AppleUSBTopCase.kext » Contents » PlugIns » AppleUSBTCKeyEventDriver.kext » Contents » Info.plist

Open up the Info.plist, and look for the Product ID that matches your Product ID – in my case 560.

The key FnFunctionUsageMap contains the mapping for the keyboard. In my case I had to change it to this:

FnFunctionUsageMap
0x0007003a,0x00ff0005,0x0007003b,0x00ff0004,0x0007003c,0x000c00e2,0x0007003d,0x000c00ea,0x0007003e,0x000c00e9,0x0007003f,0x00070083,0x00070040,0x00ff0006,0x00070041,0x00ff0007,0x00070042,0x00ff0009,0x00070043,0x00ff0008

Each value is a pair – first the key number, then the value to set it to.
0x0007003a = F1
0x0007003b = F2
…

My above settings are for
F1 = brightness down
F2 = brightness up
F3 = mute
F4 = volume down
F5 = volume up
F6 = num lock
F7 = Expose
F8 = Keyboard Light off
F9 = Keyboard Light down
F10 = Keyboard Light Up
F11 = n/a
F12 = n/a

I got these values from here –

// usage IDs from the hid
#define FF_BRIGHTNESS_DOWN_ID_LAPTOP @”0x00ff0005″ // for laptops
#define FF_BRIGHTNESS_UP_ID_LAPTOP @”0x00ff0004″ // for laptops
#define FF_BRIGHTNESS_DOWN_ID_EXTERNAL @”0xff010021″ // for external keyboards
#define FF_BRIGHTNESS_UP_ID_EXTERNAL @”0xff010020″ // for external keyboards
#define FF_EXPOSE_ID @”0xff010010″
#define FF_DASHBOARD_ID @”0xff010002″
#define FF_ILLUMINATION_TOGGLE_ID @”0x00ff0007″
#define FF_ILLUMINATION_DOWN_ID @”0x00ff0009″
#define FF_ILLUMINATION_UP_ID @”0x00ff0008″
#define FF_VIDEO_MIRROR_ID @”0x00ff0006″
#define FF_REWIND_ID @”0x000C00B4″
#define FF_PLAYPAUSE_ID @”0x000C00CD”
#define FF_FASTFORWARD_ID @”0x000C00B3″
#define FF_MUTE_ID @”0x000C00E2″
#define FF_VOLUME_DOWN_ID @”0x000C00EA”
#define FF_VOLUME_UP_ID @”0x000C00E9″

Once I’d done that, I also needed to rebuild (or in my case build), the Kext cache so that the OS would use it on next reboot.
Heres how to do that in Lion

sudo kextcache -v 1 -a i386 -a x86_64 -m /System/Library/Caches/com.apple.kext.caches/Startup/Extensions.mkext /System/Library/Extensions

…oh, and lastly, reboot of course!

Post reboot my function keys were working normally.
The caps lock key is still non-functional, but I’m ok with that, as its means a bit more work for little effort.

I may look into setting up a special plist to override the usb_id its getting from the hardware via the method here –http://www.projectosx.com/forum/index.php?showtopic=798

..but again, time vs effort…

Still, my Macbook is working now more or less, so its good enough for me 🙂

Of course, subsequently to doing this the hard way, I found a program to do it all for me!

http://pqrs.org/macosx/keyremap4macbook/

Suggest unless you are a masochist, use that!

We use xcache as a php caching mechanism on our servers.
Its pretty painless for us for the most part.

One of our clients did complain that their app was now crapping out.

A check of the software forums for that app (ActiveCollab) showed that it was an issue with PHP5.3.2 and XCache and ActiveCollab.
So, needed to disable Xcache.

This should be relatively easy I thought, but the documentation sucks, so took a while to find out how.
Its pretty simple to do though.

Assuming you’ve allowed htaccess files in apache, you can do the below –

Add an htaccess file in the root folder of the website with the following info

php_flag xcache.cacher Off
php_flag xcache.size 0
php_flag xcache.stat Off

Thats it.

We’ve been using MODx for a number of years now for site development, and one thing that repeatedly comes up in all our sites is how to add Events.

This is actually pretty easy within MODx, as you’ll see.
Ditto and CALx are two plugins that make this doable.

First up, I recommend you setup a folder for the events to be held in. I usually sit this outside of the main site tree, and set it to be not shown in the menu.

Lets call this the Events Folder.
Heres one I made earlier that has some events inside.

Lets not get ahead of ourselves though.

So, now we have a folder to place stuff into.
Next, we need some details for our events.

At a minimum, we’ll need an Event Start Date, and End Date (although to be honest, most clients don’t use that many fields).

So, lets setup 2 Template Variables called… EventStartDate, and EventEndDate.

As we’ll be using Ditto and CALx, we need to tell MODx to use UnixTime for these, so that we can sort with them later. Make a new Template Variable, set the Input Type to Date, and set the Widget to UnixTime.

See below for an example. (do the same for both Template Variables)

Don’t forget to make sure that both template variables are accessible in whatever templates you will be using.

Ok, so now we have a folder, and two template variables.
Lets make some data.

Go to the Events folder you created, right click, and Create New Resource Here.
You should see the two template variables we created listed in the page. Set them to something appropriate.

Save the page.
Create another few entries with different dates so we’ll have something to sort by.

You should now have a folder, our template variables, and some sample data.
At this point we’ll need to make a chunk so that we can display the output of running Ditto against our data.

Make a new Chunk,call it chkShowEvent, and put this inside.

Title: [+title+]
Start: [+EventStartDate:date=`%d-%b-%y %H:%M`+] 
End: [+EventEndDate:date=`%d-%b-%y %H:%M`+]

(You’ll note that we’re formatting the UnixTime based data automagically by using MODx’s built in formatting functions.)

Neat huh.

Ok, so now we have almost all our details together.
All we need now is to create some code to show off the data.

If you recall way back to the top of this page, we setup a Start Date and an End Date.
Our Start Date is called EventStartDate.

Lets make some code to show off a single event using Ditto.

[!Ditto? &startID=`4` &tpl=`chkShowEvent` &displayArchive=`0` &multiLevel=`1` &paginate=`0` &paginateAlwaysShowLinks=`0` &orderBy=`EventStartDate ASC` &extenders=`summary,dateFilter` &dateSource=`EventStartDate` &summarize=`1` &dateFormat=`%d. %b. %y` &filter=`EventStartDate,@EVAL return strtotime("now");,3`!]

Looks complicated, doesn’t it!.
Actually not that bad, what we’re doing is telling Ditto to give us one single result, ordered by date.
We then tell Ditto to filter out anything thats older than the current time/date.
This gives us one single result – our most recent upcoming event.

IMPORTANT – The StartID needs to be the same one that YOU are using. Make sure that your folder number and the Ditto call number match. My folder ID is 4, so I’m using 4. You’ll need to use whatever number shows in your MODx.

Ah, I hear you say, but how do I show more than one upcoming event?
Easy peasy. We’ll also need to add a little piece of code for the pagination underneath our Ditto call, so don’t forget to do that.

This Ditto call will show you a listing of upcoming events in date order (past events won’t be displayed)

[!Ditto? &startID=`4`&tpl=`events` &showInMenuOnly=`1` &displayArchive=`0` &multiLevel=`1` &paginate=`1` &paginateAlwaysShowLinks=`1` &orderBy=`EventStartDate ASC` &extenders=`summary,dateFilter` &dateSource=`EventStartDate` &summarize=`5` &dateFormat=`%d. %b. %y` &filter=`EventStartDate,@EVAL return strtotime("now");,3`!]

[+previous+] [+pages+] [+next+]

Again, remember to make sure that startID is the one YOU are using.

Ok, so thats pretty straightforward. Where does CALx come in?
Well, most of the time, people want a Calendar as well as an events listing.

As we’ve created the EventStartDate and EventEndDate as UnixTime, CALx doesn’t need any special help.

Here’s a sample call using the fields we’ve made

[!CALx? &getFolder=`4` &idMultiEvent=`4` &lang=`english` &useTV=`true` &dateStartTVName=`EventStartDate` &dateEndTVName=`EventEndDate` &showOtherMonth=`both` &getTypeProcess=`createCal` &popupType=`3`!]

This will show a calendar for the current month on the page its used on, and list the events for that month. Again, make sure that the folder id that YOU need is used – change getFolder=`4` to your folder ID.

Read up on CAlx, and Ditto at the MODx site for a rundown on the various parameters used.
This should give you an idea of how to setup and use them though.

Good luck.

Feel free to ask questions.

My coffee machine decided it would give up the ghost a while ago (due to lack of use I think).

I tried descaling, but that wasn’t working, and from what I could see (or hear in my case) happening looked like something simple had happened – one of the hoses had come off or wasn’t completely on, as not enough water was coming through the front, and the bottom had a small leak.

As I have successfully fixed other coffee machines in the past with similar issues, I thought I’d have a go at repairing mine.

First up was a quick google for my machine (Krups Cube XN5005) – unfortunately most of the posts were of people with similar issues, and no help.
I brought the machine to the office and took a closer look. First issue is that it uses security oval style screws on some of the parts. Thats a pain in the ass, as its hard to find the exact screwdriver.

I drove off to the local tools market and did some shopping around, but no luck, so I bought a selection of needle nosed pliers instead.
There is zero reason to use security screws unless you’re trying to piss off the consumer. If I’ve bought something I should be able to take it apart myself and repair it.

I also managed to find the Nespresso service manual for it (Krups Cube Nespresso Service Manual – xn5005 manual). While the external design is nice, the engineering is a bit crappy. If they weren’t trying to overcomplicate the design to keep the consumer out it would be a lot simpler. Sigh.

First to come off is the front chromed plastic part. Push both sides in and pull off.

I managed to get one side off, then the other. Once you see how it clips on its fairly easy to get off.

With that off, unclip the next plastic part on the nozzle.

Next up is to remove the front faceplate.
Flip the unit upside down, then get 2 flat screwdrivers and put into both of the entry slots at the bottom. Twist slightly and it should come off. If you have trouble, do one side first, then the other. I usually get a credit card into the gap I make when I twist the screwdriver so that its easier to do.

The top should come straight off without too much hassle once you have the evil clips off at the bottom.

Next up is the back panel, with the security screws. As I couldn’t find the exact screwdriver, I bought a selection of pliers and they came out fairly easily.

In case anyone can find them, the diameter is a 4mm oval shape.

I basically sat and twisted gently to get the screws out.

You need to remove the 3 at the back, and the two front ones at the bottom (closest to the back), for a total of 5 screws.

Once those five screws are out, the back can come off. Its a bit fiddly, as it didn’t want to budge much on the water tank side, but perseverance paid off.

Once you have the back off, the machine is reasonably accessible.

In my case, I just had to reseat one of the hoses, and retest.
The manual does give further instructions on how to get more of it disassembled from there, but thats as far as I needed to go.

While I was in there I gave it a bit of a clean also.
Compared to the other machine I have (a Saeco fully automatic), this is slightly better designed, but less serviceable. It still has the issue of electrics and water routing in the same area’s, which is silly, as that could be a failure/hazard point, but its safer than some i’ve seen.

Hopefully mine will now continue to give a few more years of service!.

If you need parts for them, this site appears to have some –

http://www.buyspares.co.uk/krups/coffee-makers/xn5005-white/catalogue.pl?shop=krups&path=561166&model_ref=781507

And of course after I finish this post, I find someone else doing similar things here –
https://chrisinmtown.github.io/blog/20100627_nespresso.html

Oh well..

Good luck!

The recent accident in Wenzhou has highlighted some of the issues that are present in train systems today.

The facts –

One high-speed rail train D301 from Beijing was headed for Fuzhou, this train was followed by train D3115 from Hangzhou to Fuzhou. At 20:34 or so, the train D3115 was hit by thunder, subsequently lost power and stopped.
Train D301 did not, and crashed into train D3115.
Two cars from train D3115 as well as four cars from D301 derailed, some falling off of a bridge.

The trains are from different manufacturers –
D301 – CRH1 (Bombardier Regina, Swedish)
D3115 – CRH2 (Shinkansen E2, Japanese)

Read more »

China wanted control over the internet, and now they have it.

2 years ago, China was a spammer haven, as domain registration was cheap, and USA based spammers (which still is the source of 99% of spam) registered a gazillion odd spam domains.

The powers that be decided to change that.

They changed the law.

First it only affected new domain registrations, you needed to provide real info for those registrations. Once they had that down, then they extended that to only Chinese people or Chinese organizations could register chinese domains. Then they started enforcing ICP registration for domains – each domain in china requires an ICP licence, or it can’t be hosted. For bonus annoyance points to do a ICP registration the website must be shutdown till the licence gets issued.

Then they extended that to no ICP licence, no domain – if your domain doesn’t have an ICP licence, bam, its put in suspended state at the registrar.
Now they’re rigorously enforcing ICP registrations to the n’th degree.

They’ve been cancelling those left right and center for no real reason, forcing people to resubmit.

Currently an ICP submission requires that you have an ISP licence, as only ISP’s can submit ICP’s for their hosted domains.

Each ISP has to verify sites as follows. Have the owner or representative for the site provide fill in 3 forms, make certified copies of business licence, copy of their ID, and take a photo of them in the ISP’s office. Which is the reason why all our clients need to come to our office now for photo’s and bring documents for their registrations.

These are scanned and submitted to the local Telecom authority through the ICP backend registration system. The user is then assigned a login and password where they can check their ICP licence at the MII official website.

Its been a pain in the ass for us recently as the Telco has been arbitrarily cancelling perfectly good ICP licences without notice or reason.
The Telecom bureau for each region does publish blacklists, but guess what – the cancelled ones don’t appear the blacklist.

If you host a domain with a cancelled licence (which unless you literally check all your clients licence stuff daily, you have no way of knowing about currently), then the Telco will also do fun lets call you at 6:30 on a Friday evening, and tell you that you have 30 minutes to remove that domain, or they shut down that ip address (shutting off hundreds of clients). What fun.

Its gotten to the point that I’m seriously considering moving all my non .cn clients to a new oversea’s server because we can’t keep up with their ever changing needs.

They keep changing the rules and regulations, they don’t have a decent mechanism in place for tracking stuff, and there is no warning if they arbitrarily cancel a licence.

What its meant for us is that domain management has gotten dramatically more time intensive over the last year, as the regulations and requirements for paperwork have changed a number of times now, requiring resubmissions, constant checks, and a lot more work. We have had to hire additional staff a few times already to cater for this at various points in time too.

All this does is increase our costs substantially, and annoy clients who ask why they need to do the ICP stuff yet again when they already did it.

Thank you China. Not.

As the law has changed regarding pet dogs in Shanghai (again), here are the steps to get your dog licensed.

The new rules state that people can only own 1 pet per household from now on.
The only exception to this is where you had more pets previously licensed in your household; you can continue to renew their licenses, but not add new dogs.

Note that the instructions below are for Xu Hui District, but are similar for other districts.

I suggest buy a plastic file, and keep all related paperwork together.
To succeed in this mission, you’ll need patience, some cash, and some kind of canine.

Ouch that hurt! aka vaccinations

Bring
Dog
Money (few hundred rmb).

In Xu Hui district (also would be ok for other districts), this is the large pet hospital at 2451 Xie Tu Lu
带狗去斜土路2451号打疫苗

You’ll need to ask for a “gou yi miao ban zheng” 办理狗证续证

The dog will get a vaccination shot, price for this varies depending on which vet you visit, but should be less than 100rmb.
You’ll also get a piece of paper. This is called a da zhen ping zheng. This is important, don’t lose it!

If your dog has never been licenced before, you will also need to get an id implanted too.
This is a small rfid tag that gets injected somewhere around the neck area.

This will also cost somewhere in the less than 100rmb range.
You’ll also get a piece of paper for that, again, don’t lose it.

If you don’t have the magic piece of paper, have the vet make another one for you. China runs on small bits of paper that are easily lost, so make sure that you have anything you possibly may need in a folder.

Lastly, don’t forget to get an official fapiao for the above, and keep that together with everything else.

The Joy of Paperwork! (at your local neighborhood police station)

Bring
The rental contract for where you live (or a property ownership book if you own your apartment).
Your Passport (with your work permit / residence permit inside).
The 2 or 3 papers from the vet that you got in step 1.
Your dog.
More money (500rmb)

In Chinese that looks like this – 带上狗证，房产证，护照去徐汇区湖南派出所登记
Take all of the above to your local police station.
(Not all do licenses, but they’ll be able to point you to which one in your district is responsible for doing dog licenses)

In Xu Hui district this is on Xiang Yang Lu, near Fuxing road (opposite the fake electronics mall)

    电话：23037446
    办公时间：8：30am－5：00pm
    地址：襄阳南路203号靠近复兴中路( Xiangyang Nanlu 203#(Near fuxingzhonglu)

Give them all the paperwork you have so far, and 500RMB.
They should give you another slip of paper with a receipt, and a date to come back.
OR they’ll do it all there and then.
This depends on your districts setup.

Success!

Whichever of the above, at some point you’ll collect a pack of goodies!

This will include a dated sticker (this should be stuck on your door)
A Dog licence photo id card (this should be carried whenever you walk your dog).
A dog tag (which you should put on your dogs collar).
Plus some other assorted bits and pieces depending on which dog food company is sponsoring the gifts (last year was a bowl and some dog food).

I usually make copies of everything, and put into that file I told you to make in step one, and throw it into a safe place.

Currently you don’t need to bring photo’s, but from the 15th of June 2011, you’ll need to bring photos.
One side view, and one front view of your dog, in passport photo sized (1×3″) shots.
This was immense fun last time I tried to do this, as my dog doesn’t want to sit still for photo’s, and it took a while to get that done.

At time of writing this is all currently correct, but rules change (eg the we’re not sure about the photo’s thing yet), so have a chinese person call, and confirm first. Make sure that they ask for a clear answer that you understand, as its not unknown for people in China to forget to tell you about some essential item you need to bring, so ask clearly for what exactly is needed, and have them repeat it out to you.

Good luck!

Despite my pendance for semi obscure cultural references (its most of the title from a decent Peter Sellers satire), I do often find useful things that people can use.

One of the things that is annoying about Windows especially is its resolute failure to find drivers when you run the “search the internet” option in XP, Vista^Hno such OS, and Win7

Example of this below:

At first we’re hopeful – maybe the gods will deign to assist us in our hour of need.

…but then reality comes crashing down, and we realise that we have to do the wild goosechase of running around trying to find drivers.

Wouldn’t it be nice if Microsoft actually got their act together, and put drivers online like they probably intended to?

Well, our prayers have been answered, but in typical Microsoft fashion, we still need to jump through multiple hoops to do so.

So… lets say we have some hardware in our computer that has the mystery yellow ? icon of unhappyness in Device Manager.

What to do?

First off, lets go visit Microsofts rather good, but also rather unpublicized site here:

http://catalog.update.microsoft.com

Install the cab file and sign away your life, rights and grandmother, as per standard clauses.

Bookmark this page, as its going to become very useful.

Done?

Ok, good.  Now lets return to device manager.

As I’m writing this from a Win7 box, I’ll pick something that doesn’t appear to have Windows 7 drivers post install.

SIS900 Ethernet.

If you visit the SIS website, they don’t have drivers for Windows 7.

Not all is lost though.

Lets search that site we just bookmarked

Yes!

Windows 7 drivers for the SIS900.  I’ll talk about the rather convoluted way we have to use these in a second.

For now, lets go with another example.

Lets say we have an unknown device in Device Manager in Windows, and we don’t really know what it is. 

All devices have something called a hardware ID.  This is what identifies the hardware so Windows can lookup what driver is appropriate.

I’ll pick another driver from this desktop I’m busy installing drivers for at the moment.

As you can see, we can see a list of hardware ID’s in the details tab of the property window for that device (Open up device manager, right click the ?’d device, and click properties to bring this window up)

 In Windows 7 we can finally copy the text, yay!, in older Windows OS’s we need to write down those numbers.

Lets swing back to the Microsoft site, and search for that Device_ID&Ven_ID

PCI\VEN_1039&DEV_7012&SUBSYS_0C4C105B

Woohoo!  Nice and easy – right?

Um no, remember, this is Microsoft, no Apple, so ts a little bit more complicated to use them.

Click on the driver thats appropriate for the OS in use, add to basket, then download.  You may need to try a couple of different versions if the first one you try doesn’t solve the driver issue, so pick two or three different ones.

I suggest save to the desktop.

In a few minutes you’ll find that you have a folder on the desktop with the driver in a cab file.

A cab file?  Hmm, thats not very useful, right?

Exactly…

So, we need to unpack that cab (cabinet file), and take out the juicy driver goodness so we can finally get our hardware working.

My favourite tool for this would be Winrar, so download WinRar, and install (http://www.rarlabs.com).

Installed?

Good, now right click on the cab file, and choose extract files…

Next, choose an appropriate folder name, as the defaults are too long, and winrar can’t extract the files.

In this case, as its an Audio driver, I used the cunning name of “Audio” for the folder.

Lets have a look at the folder, and see if it has an installer (usually something along the lines of Install.exe or Setup.exe.  In this case it doesn’t, so off we go back to control panel, device manager.

 We’ll try install using the driver we just downloaded.

Right click on the device, click Properties, Update Driver (usually something similar in most Windows OS’s)

Tell windows we have our own driver, and point it at the folder we just extracted.

If you are lucky you should see something like this:

Woohoo, win!

Whats strange is that Microsoft seemingly goes out of their way to make this more complicated than it really should be.

They’ve  had a driver update from the internet option in Windows since XP days.  They have this nice site with all the drivers.  They make it rather convoluted to use though. 

Wouldn’t it be nice if they put it all together and automated it?

Oh well, until we reach that perfect world, the instructions above should help you with any driver issues for Windows.

No more downloading from dodgy driver support sites, or trawling the internet for providers driver files.  Get them from Microsoft instead!

Kudelski N3 bits and pieces, plus thoughts on key / rsa extraction from flash.
N3 Notes mostly from forum posts by TheCoder

These are notes for future reference more than anything else, so please no excited emails about how its wrong, or right, or can I hack your box.

—
There are three different pairing methods used N3 boxes presently. These are DT06, DT08 and Secondary key.

The DT06 method transfers a compressed form of an rsa pq keyset from which the CAM public/private rsa keyset and its associated modulus can be derived.

The DT08 method transfers the cam modulus along with the IRD number of the married box. The public rsa key is not transferred but it is implied that the box already knows this value.

The Secondary key method does not involve a transfer. It imples that the box already knows the cards matching CAM modulus and rsa public key value.

Various boxes, depending on make/model, may use any of the above pre-pair key transfer methods but it could be useful to know which box uses which method.

http://www.digital-kaos.co.uk/forums/f10/people-n3-cards-82421/

Instructions:
1 Stick your N2/N3 card in your card reader
2 Run NagraEdit – DO NOT ATTEMPT TO READ YOUR CARD !!!
3 Select the Comm Tab. This should give you an upper and lower text pane
4 Cut/Paste the scriptt below into the top pane
5 Press the “Send D2C” button/icon
6 Results should appear in bottom pane
7 Interpret your results based on info below.
Script – Read DT06/DT08
Code:

rs
tx 21 C1 01 FE 1F
rx
tx 21 00 08 A0 CA 00 00 02 12 00 06 55
dl 02 00
rx
dl 02 00
tx 21 00 09 A0 CA 00 00 03 22 01 00 1C 7E
dl 02 00
rx
dl 02 00
mg *
mg *** DT06 info ***
tx 21 00 09 A0 CA 00 00 03 22 01 06 13 **
dl 02 00
rx
mg DT06 response1
dl 02 00
tx 21 40 09 A0 CA 00 00 03 22 01 86 13 **
dl 02 00
rx
dl 02 00
mg DT06 response2
mg *** End DT06 info ***
mg *
mg *** DT08 info ***
tx 21 40 09 A0 CA 00 00 03 22 01 08 13 **
dl 02 00
rx
mg DT08 response1
dl 02 00
tx 21 00 09 A0 CA 00 00 03 22 01 C8 55 **
dl 02 00
rx
dl 02 00
mg DT08 response2
tx 21 40 09 A0 CA 00 00 03 22 01 88 55 **
dl 02 00
rx
mg DT08 response3
dl 02 00
mg *** End DT08 info ***
*******
Just to clarify :
The important bits your looking at are the DT06/DT08 responses (the bits that start with Rx: )
ie RX: 12 00 15 A2 11 08 E0 00 00 00 5E 01 20 00 00 00
00 00 00 00 00 00 90 00 B3
RX: 12 40 15 A2 11 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 90 00 64
RX: 12 00 15 A2 11 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 90 00 24
and
RX: 12 40 57 A2 53 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 90 00 64

If the responses vary significantly from the above, with the 00’s replaced with some varying data, then its likely your card had the specified tier and is probably using the corresponding pairing method.

If the DT06 response contains lots of 00’s then its NOT DT06 pairing
If the DT08 response contains lots of 00’s then its NOT DT08 pairing
If its not DT06 or DT08 then its probably secondary key.

For non DT08 cards (mostly the newer boxes) each box has a unique cam_n already built into its firmware – this can only be extracted from the actual box itself.

About the Algorithm,

N2 encrytion was based on the following algorithm ->
decrypted message = ( (IDEA( ( (EncryptedMsg ^ 3)Mod N1) ,IdeaKey) ) ^3) Mod N1
Thats 2 distinct algorithms. An RSA algorithm (performed twice) and an IDEA algorithm.
The key for the RSA algorithm is something like –
RSA EMM-G=15A811B2065DF39CD48C9C958E7B406345295B09D0E9A18A 9B92C5FD7761CAAFAB830880F1F06B4E4477F157EA10D0AFC3 FDDB1ED2E7E83E89F03FF81237047DB76F79D6A2CFD75A7255 D72E52E7F47B96C2DFBDEBFC80CE927F6AD351FDF0BF8DA13F F62295BFBAF29035A230136D0B4AA99D38DD8B0465F2C709FC 8818173C
Which, as you can see, is a 128 byte (1024 bit) number. This is the main encryption key for EMM decryption.
The IDEA algorithm, which acts as an inner layer to the RSA has a standard 16 byte (128 bit) IDEA key.
There is no algorithm in N2 (or N3) that only uses an 8 byte (64 bit) key although some providers have opted to use 3DES rather than IDEA as an inner layer. This uses three separate 8 bye (64 bit – only 56 bits used) keys to form an amalgam 168 bit DES algorithm.

If Using DT08 (0a) on the card :
The Dt08 (0a datatype on card) is created by the provider and sent to the card at sub time.
The dt08 contains the Cam N public rsa key along with ird/boxkey.
The dt08 is IDEA encrypted with the Idea Key made from ird/boxkey/inverted ird.
The dt08 is RSA encrypted using Ird N (public rsa key) and Ird D (private key and uknown by anyone but provider).
Ird N = N1 xored N2
Ird N1= A4E9B585932F90282FD70C908176E8605E6B2CE629335A0FC1 5B31DAB0BFC6FEEB88CFC69649994CD3FE039C9965C620C4D5 828E9153998EE4AE0E8C25644DF3 xor
Ird N1= 237280AAB36BE4B21FC71FBF08218E532A545E744D7B007FF8 69BA426831C4AC653F3825ADE9358FCD1F0239EC447CBC2765 CC0AEBE437AF2270FC461C2FA042
Ird N = 879B352F2044749A3010132F89576633743F729264485A7039 328B98D88E02528EB7F7E33BA0ACC31EE101A57521BA9CE3B0 4E847AB7AE21C6DEF2CA394BEDB1
The Ird N1,N2,Ideakey exist in the tsop.
Ird E = 3
Ird D = UKNOWN, this is the reason you can’t create your own dt08 without changing the N1/N2 on the tsop, you must know Ird D.

DT08 (0A) = IdeaEncrypt(CamN/Ird#/Boxkey/Idea Signature,Ird_Ideakey) ^ D mod Ird N.

Ird requests DT08.
Card sends back the dt08 (0a)
Ird decrypts the dt08.
Decrypted dt08 = IdeaDecrypt(DT08,Ird_IdeaKey) ^ 3 mod Ird N.
It checks the ird # and boxkeys in the Decrypted 08 if they match what is on ird,
it stores the Cam N in the decrypted 08 in ird memmory.

If Using Secondary Key (SK) on the Ird.
Ird checks for SK exists on the ird, if it does, the dt08 will never be requested/ignored from the card.
Ird validates the SK with idea signature in the SK (using IIIIIIII01924314051647990A9C4E1 where I = irdnumber).
Ird takes the Cam N in the SK and puts it in ird memmory
Note : Cam N is not even encrypted in the sk, very weak method compared to dt08.

Later, establish session key (0C datatype on the card):
Ird requests 2a data from card.
Random 2a is sent from card to ird.
Ird performs some Idea signing (leave it to you to look up 2a/2b routines)
Ird comes up with session key from the 2a message sent from Cam.
Ird encrypts the session key with rsa.
Encrypted 2B = (2B data with 16 byte session idea key) ^ 3 mod Cam N.
Sends encrypted data back to card in 2b message.
Cam decrypts 2B with Cam N, Cam D. Decrypted 2B = (Encrypted 2B) ^ Cam D mod Cam N.
If valid, store session key in ram and on card for later use.

This all happens as ird boots.
When you select a channel.
Ird sends Cmd 07 ECM message with control words encrypted.
Cam decrypts the control words rencrypts them with Idea encryption using the session key established above.
The ird then requests the control words.
The Cam sends them back in the 1C response.
The ird decrypts the control words with with Idea encryption using the session key established above.
Sends the control words to the mpeg decoder.
8 seconds of video.
Repeat 07/1C process over and over.

——–

and pay special attention on CMD$2A ??

it should reply the CAMID serial number + 64 bytes random key generated and then shortly after encrypted with the CAM(AKA Conditional Access Module or SmartCard) RSA primary 96 bytes from the card… the so famous RSA modulus keys 96bytes at eeprom $8xxx on the ROM110 days.. From the card (this cmd is also the first step of the SessionKey negotiation)

shortly after the receiver receives this card reply.. and will decrypt it using the Secondary Key which is also 96bytes, this key is build up by using the following information stored in the receivers flash..

IR IR IR IR ZZ ZZ ZZ ZZ ZZ ZZ ZZ ZZ 00 03 F1 F1
F1 F1 F1 F1 F1 F1 SK SK SK SK SK SK SK SK SK SK
SK SK SK SK SK SK SK SK SK SK SK SK SK SK SK SK
SK SK SK SK SK SK SK SK SK SK SK SK SK SK SK SK
SK SK SK SK SK SK SK SK SK SK SK SK SK SK SK SK
SK SK SK SK SK SK F2 F2 F2 F2 F2 F2 F2 F2 CR CR

total 96 bytes..

IR = Receiver serial number
XX = Unimportant
EE = RSA public exponent for STB
F1 = SK signature 1 used to calculate the box key
F2 = SK signature 2 used to calculate the box key
SK = RSA public modulus N
CR = CRC Checksum
BB = BoxKey result from xoring F1 with F2 keys stored in the flash firmware from the receiver

once we decrypt the cmd2A we extract from inside the original 64byte random key generated in the card, then we will apply the IDEA encryption algo on the first 32bytes from the 64 byte random key to hash out the session key.

So this first 32 bytes are extracted from the 64byte random key and will be encryted using the IDEA SIGNATURE key… this key will be generated by the following information

IdeaKey generation
BB BB BB BB BB BB BB BB + CC CC CC CC + CA MI DC AM

BBBBBBBBBBBBBBBB = Boxkey result from F1 xor F2
CCCCCCCC = IRD number from receiver stored in Flash firmware
CA MI DC AM = CAM ID or Smart Card serial number converted in HEX, which can also be extracted by simply sending INS CMD$12 to the card..

so the IDEA signature key for encrypting the first 32bytes extracted from the 64 random seek key is

BBBBBBBBBBBBBBBBCCCCCAMIDCAM

once applied the IDEA encryption we will have the result 16 byte sessionkey.. which will be stored in the receiver flash for a few hours… to be more precise around 5 hours..

Now going back to the calculation done before, the receiver decrypted the cmd$2Aencrypted by the card with the RSA primary 96 stored in the card.
once decrypted it simply just extracted the first 32bytes of the 64 byte seed key generated by the card. this 32 bytes were used for calculation of the 16byte sessionkey..

but, before the 32byte keys was taken for the idea signature encryption.. the receiver.. re-encrypted the 64byte random key using the SECONDARY KEY RSA 96 stored in the receiver flash, which i just stated above how to get this key…
and will send it back to the card on cmd$2B

the card will receive the cmd$2b and will decrypt it using the PRIMARY RSA modulus key 96.
and will extract just the first 32bytes.. and by using the BOXKEY+IRD+CAMID stored in the card, the card will also calculate the same 16 byte session key.

in orde to make the card pairing , u need to know the RSA_N+BOXKEY+IRD NUMBER+CARD SERIAL number or CAMID…

then with them all together we can start comunication between the card.. and on the CMD$2A and $2B we will have the SessionKey negotiation which i just explained previously.

if for example on one side or the other we have different BKand RSA… we will a session key failure.. and without this Sessionkey we will not be able to decrypt the CM$1C or $9C related stuff

this means that if negotiation of session key succeds, then the receiver will send the ECM$07 to the card, which will then be decrypted by simply just using the ECM RSA modulus key and the ECM IdeaKey to decrypt the Control Words / CWs.

once they are decrypted the card will send them to the RECEIVER.. this is normally done via CMD$1C obviously this CMD is encrypted with the Sessionkey 16 BYTES described above.. once it arrives at the Receiver end, you will use the same Sessionkey 16byte to decrypt that CMD$1C and extract the REAL DCWs Decrypted Control Words to open up the Video and Audio stream related for that XX amount of seconds…

Now this Session key is refreshed every 5 hours.. this means that every 5 hours a new session key is produced.. so every 5 hours the card generates another 64byte random seed key using other RSA algo inside the card.., and will then send this 64 byte seed key to the receiver again.

Shortly followed by all the procedure described above to extract the new session key again.

—————-

Given that ==================================================
SK 96 BYTES
==================================================
11111111<----------------------------FIRST 4 BYTES---- IRD XXXXXXXXXXXXXXXXXXXX<--NEXT 10 BYTES---- unknown 1111111111111111<--------8 BYTES---- Y1---WRITE DOWN ================================================== 11111111111111111111111111111111-_ 11111111111111111111111111111111-_-_"N" 64 Bytes 11111111111111111111111111111111-_- 11111111111111111111111111111111- ================================================== 1111111111111111<-------8 BYTES--- Y2-----WRITE DOWN XXXX<-------------------2 BYTES--- CHECKSUM ================================================== Y2 Xor Y1 = BOXKEY ================================================== 006e convert from hex gives you 110 bytes block cipher ird 4 bytes bk 8 bytes sk 96 bytes leaving us with 02bytes used to encrypt, decrypt above. eg: 00 00 00 6e 34 0d 20 1c 03 03 70 80 5a 8e dd 24 ac cc a4 a6 e2 da 86 91 29 18 0b a6 23 6d fa c4 05 7f 1b 20 97 eb 0c 19 b3 39 2f 1e cb 9b 67 4d ed 10 f5 65 ec 0d c7 35 ac f0 b8 89 b0 51 59 22 69 85 d5 f1 93 48 7a 84 6e 1f b4 24 83 79 db 02 4d b0 9c 5e 8b df 89 57 9c 5a 7f 9a cc 87 51 3b 15 6b 15 cc c4 2f 66 e7 e6 75 4f 24 f2 07 85 0d db b0 3d e2 64 dd e9 54 ad 77 60 e7 8f a6 cd a6 46 c3 b8 fa e4 e7 51 2d 6a 2f 95 68 56 b5 78 34 17 6b b8 48 38 87 c4 95 e5 b0 41 2c 95 e1 24 aa 4b 2a 6f 8c 90 53 29 a9 6b 3d 0a b5 92 1c 95 ec 72 b9 54 a9 99 f5 f3 dd f4 0f 60 c3 25 5b 5b 81 22 e8 79 c5 be 8f 3c 89 2b 8a ad ba 27 b0 c2 f7 b1 4f 08 d5 37 2a 97 c5 f0 07 9d 99 be c7 8a a9 cf 5a c5 45 ce 1e 25 43 81 95 7a 22 33 ed 93 74 Gives: 00 00 00 63 (length) 0d 20 1c 03 03 70 80 5a 8e dd (unknown) 24 ac cc a4 a6 e2 da 86 (y1) 91 29 18 0b a6 23 6d fa c4 05 7f 1b 20 97 eb 0c 19 b3 39 2f 1e cb 9b 67 4d ed 10 f5 65 ec 0d c7 35 ac f0 b8 89 b0 51 59 22 69 85 d5 f1 93 48 7a 84 6e 1f b4 24 83 79 db 02 4d b0 9c 5e 8b df 89 (64 bytes) 57 9c 5a 7f 9a cc 87 51 (y2) Y2 XOR Y1 = 0x579c5a7f9acc8751 xor 0x24accca4a6e2da86 = 42 12 8C F2 39 39 55 FA So, a flash dump would be helpful.. Possible Scenario's - BGA, TSOP, TLGA etc.. desoldering for Flash. Put in a socket. eg from http://shop37051047.taobao.com/ or http://shop34694309.taobao.com/?search=y

Pop flash back onto something else, read, dump. eg
http://item.taobao.com/item.htm?id=7422440993

Get box key, rsa key (if req. based on a check of DT type from the actual subbed card)
Pop flash back in socket.

Been there, done that for data recovery on faulty flash drives, plus most of the places I know down at QJlu have SMD / BGA desoldering capability or better.

Bunnies blog is fairly good at explaining the basics (albeit for xbox) – http://www.xenatera.com/bunnie/proj/anatak/xboxmod.html

Most boxes use ARM based SoC’s for things. Also possible to just throw up a dev board, and interface to that.

Although most boxes also have some form of OS running, so just as feasible to dump flash that way also assuming serial or jtag access and a bootloader is available.

Amusing that people like http://www.flashbackdata.com/blog/?p=195 claim this is hard – there are plenty of tools for this already out there eg softcenter, pc3000, plus all the local chinese stuff. Semi ok forum here talking about flash recovery, although not as technical as I’d like.

http://forum.hddguru.com/hard-disk-drives-english-forum-f12.html

Once key(s) are had, then I can use my own decoder rather than the crappy one the broadcaster uses.

Yay.

Had a client come into the office today with a locked iPhone.

Normally this isn’t really a big deal (assuming that there is a hack for it), but in this case, it was a little more complex, as he didn’t have working wifi.

PwnageTool has a great feature where you can add Cydia Packages to a custom firmware, so that you can prepackage the firmware already to go.

So, I opened up PwnageTool, added the http://repo666.ultrasn0w.com/ site to the Cydia sources section in advanced, and tried to load in Ultrasn0w.

Life isn’t easy, and it didn’t work.

But why didn’t it work?

I took a look at a working site, and checked out the differences between their package section and Ultrasn0w’s.

Ultrasn0w is hosted on repo666.ultrasn0w.com
While their website doesn’t really tell you much useful information, a bit of googling lead to some info.

The .deb file (debian package file) on their site is at http://repo666.ultrasn0w.com/ultrasn0w.deb

Cydia usually needs stuff in a particular format, so I next checked out how one makes a repository.
This is documented at Saurik’s site here – http://www.saurik.com/id/7

Basically, you throw files into a folder and make a Packages file.

The example given on Saurik’s site is this:

/web/apt/xmpl]# dpkg-scanpackages -m . /dev/null >Packages
** Packages in archive but missing from override file: **
com.saurik.myprogram

Wrote 1 entries to output Packages file.
[root@desktop:/web/apt/xmpl]# bzip2 Packages
[root@desktop:/web/apt/xmpl]# ls -la *
-rw-r--r-- 1 root root 906 2008-07-01 07:48 MyProgram.deb
-rw-r--r-- 1 root root 380 2008-07-01 08:00 Packages.bz2
[root@desktop:/web/apt/xmpl]#

So, it appears we need a Packages.bz2 file.

Being adventurous, I decided to setup my own repo, and stuck the .deb file for Ultrasn0w in there.
Followed the instructions and created the Packages.bz2 file.

Tried again in PwnageTool, and… No go.

Hmm.

Does http://repo666.ultrasn0w.com have a Packages.bz2 file?
Why yes it does.

Take another look at the working one – ahah says my brain.

They point the folder to the _uncompressed_ Packages file.
I guess PwnageTool doesn’t support compressed Package list files.

So, I try that out using an uncompressed file.
Created the Packages file with

dpkg-scanpackages -m . /dev/null >Packages

and try again.

Better – I’m getting a result now with my repo when I click refresh.
However, I can’t seem to be able to download any files…

So, lets take a look at whats happening in my apache logs.


58.37.213.199 - - [07/Mar/2011:20:50:52 +0800] "GET /dists/Packages HTTP/1.1" 200 1643 "-" "PwnageTool/4.2 CFNetwork/454.11.5 Darwin/10.6.0 (i386) (iMac9%2C1)"
58.37.213.199 - - [07/Mar/2011:20:51:06 +0800] "GET /./mobilesubstrate_0.9.3228-1_iphoneos-arm.deb HTTP/1.1" 404 1184 "-" "PwnageTool/4.2 CFNetwork/454.11.5 Darwin/10.6.0 (i386) (iMac9%2C1)"
58.37.213.199 - - [07/Mar/2011:20:51:42 +0800] "GET /./ultrasn0w.deb HTTP/1.1" 404 1164 "-" "PwnageTool/4.2 CFNetwork/454.11.5 Darwin/10.6.0 (i386) (iMac9%2C1)"


Aha! While its successfully found the repo now, its looking for the files in the wrong folder – my repo is in /dists, and its looking in the root folder.

Seems the Saurik instructions are a bit mangled, or the Package generator is a bit silly.
Quick look at the helpfile shows it needs the folder via -m

So I went up a level, and regenerated my file.


cd ..
dpkg-scanpackages -m dists > dists/Packages


Yes, it works!

Now PwnageTool can download my file finally. Yay!

I just need to select it in PwnageTool / Packages as below, and build my ipsw to test.

Now I can finally make my own Ultrasn0w firmware woohoo!
Not as hard as it seems, but not as easy either!

I’ll leave my UltraSn0w repo at http://www.sheed.com/dists/ for now, but will probably move it elsewhere at some point, and update this post. So, if you need it, get it while you can.

Lawrence.