ïżRemember that watching pay-TV without paying subscription fees is illegal!
Files included here can be used only for educational purposes!
=====================================================================

15_OFM_110806_PI722a4
DTF2_OFM_061106_hdl_matrix ( HDL matrix )
----------------------

A simultaneous public release of Deemonru's PI722a4 HDL and OFM MHW layer

The change in layers MHW/HDL made Deemonru.
Big Thanx :)

Limited TPS AES key autoroll added.
Encrypted AES keyshedule is stored in data flash inside the file /TPS/TPS.
According to current time MHW extracts an actual AES key and replace the old one in emu key buffer (keys 3/13 of provi 007c00).
Keyschedule itself is not updated automatically. You have to replace it manually (via rs232 port) when a new keyset is available.
To update, use programme MediaCom or MediasatConnect:
-> MediaCom
- switch the box into "receive settings" mode (menu/8/3);
- run mediacom.exe, click the button "Settings", choose the file to download into a receiver (tps.bin);
- select a section which contains TPS folder, click OK and wait for download to complete.
-> MediasatConnect
- switch the box into "receive settings" mode (menu/8/3);
- run MediasatConnect, the tuck "Dump/Send", click "Connect"
- click the button "Open list", choose the file to download into a receiver (tps.bin);
- select a section which contains TPS folder, click "Send folders" and wait for download to complete.
That's all.

julekjulek
===================================================================

15_OFM_100606_PI721a10
----------------------

A simultaneous public release of Deemonru's PI721a10 HDL and OFM MHW layer

The updating of algorithms in the layer HDL.
Thanks for Deemonru.

New command for RS-connection added.
PC->>tuner Signature demand -> 0x55 0x30
tuner->>PC The answer -> 0x55 0x30 0x0 (or 0x1 = Signature)
I used the new command in MediasatConnect to roll AES keys.

julekjulek
===================================================================

15_OFM_170506_PI721a8
----------------------

Added:
- constant CW service.
-------
You can enter MORE than 1 "constant_CW'
Value of CW is stored by tuner and remembered
(read from if needed) in RSA_KEYS file.

MENU, 7 EMU 'RSA Keys'- the way to enter CW manually.

How to enter (as an example Softcam.key data format is used)
W AAAA:BBBBBB:CCFF:DDDD:EEEE::11223344556677881122334455667788 ; info
here:
AAAA - encryption system
BBBBBB - provider
CCFF - service_ID
DDDD - PMT_ID
EEEE - video_ECM
112233... - constant_CW

'CA System' - choose 'CONST. CW'
'ID provider' - gets '0000FF' value and is of no importance
'Index' - CC in the example is the high nibble from 'service_ID'
'Type' - FF in the example is the low nibble from 'service_ID',
'Length' - gets the '14' value
'Value' - DDDDEEEE11223344556677881122334455667788
in the given example in a row -> 'PMT_ID' + 'video_ECM' + 'constant_CW'


The meaning of buttons in MENU, 7 EMU 'RSA Keys' (for ALL systems):
'CA System' arrows left/right - encryption system choice
arrows up/down - choosing value to edit/add
OK - editing start/finish
SERV - deleting the key during edition
0-9,A-E,F(PILOT) - data, entering of values


Firmware identifies the necessity to use the constant_CW based on
service_ID and video_ECM (PMT_ID is not verified).
Frequently value of constant_CW is provided without data identifying the channel.
In this case service_ID and video_ECM may be read from the tuner's menu:
service_ID - '+, MENU, 3' position one 'SID' shows service_ID value
video_ECM - '+, MENU' position zero 'ECM PID' shows video_ECM value
(values are shown in decimal, to enter they must be converted to hex)

- 'MediasatConnect v2.5' is attached; it enables entering of 'constant_CW'
through 'EMU Keys' button pressing, and with the help of PC-RS(COM)-tuner connection
a) automatic entering of CW from SoftCam.Key file is POSSIBLE
quite enough if we'll have 'constant_CW' written in this file as follows below:
W AAAA:BBBBBB:CCFF:DDDD:EEEE::11223344556677881122334455667788 ; info
b) manual entering of 'constant_CW' is also POSSIBLE using button 'EMU Keys manually'
the way to enter data is the same as with the tuner, in MENU, 7 EMU 'RSA Keys' (see above)


julekjulek
=================================
latest translation and check:
YARO, 18.05.2006
=================================

=== Information for developers ===
All 'constant_CW' keys are stored inside the RSA_KEYS MHW file.
Therefore, 'constant_CW' keys are stored as follows:
00 - CA ID (0xFF)
01 - higher byte 'service_ID'
02 - lower byte 'service_ID'
03 - key length (0x14)
04...key[3] - key value->'PMT_ID'(2 byte) + 'video_ECM'(2 byte) + 'constant_CW'(0x10 byte).


=========================================================================
14_OFM_040506_PI721a8
----------------------
the test with the use HDL 1430_MX_Generator_EU_07052006.rcu

=========================================================================
15_OFM_040506_PI721a8
----------------------

A simultaneous public release of Deemonru's PI721a8 HDL and OFM MHW layer

HDL PI721a8 includes now Cryptoworks decryption algo
(see detailed information in readme_hdl.txt)

Added in layer MHW :
- MENU 'RSA Keys' - manual addition and edition of
Cryptoworks keys (n2 already added), as well as Seca and Viaccess keys.

Manual addition/edition of Crypto keys from STB menu level

if in SoftCam.Key file We have
0D03C0 00 9EEA1.... <- (here 0x10 in hex shows the key length)
so having the key as shown in menu 'RSA Keys' we enter these parametres :
CA System - here choose CRYPTO
ID provider - whatever value here is OK
Index - write down 00, index is placed before the key
Type - write down C0, last two chars from 0D03C0
Length - write down in hex 10, the key length
Value - write down the key value, confirming 'OK'

added - information about system Crypto in menu '+',
as well as the use of 2x'E' - enables/disables CAM
information while switching channels

added - programs MediaCom v2.5 and MediasatConnect v 2.3
they make possible the automatic downloading of internet keys
and sending them to tuner using the RS-connection previously established.
The details of how to use these programs can be found in readme and
readme_hdl.txt respectively.

On behalf of all participating in the OpenFirmwareMulti
firmware creation and improvement,-

julekjulek
=============
latest check by YARO
09.05.2006 - 15.15
=====================================================================
XX_OFM_270406_1620_YYYY

Released for 1430, 1530 and DTF2 models.

It's possible to glue MHW and fonts to another software
without making any modifications in it; there's no need
for a special preparation.
MHW is now self-configurable, tested on these models:
DTF-1
DTF-2
BCT 1330
BCT 1430
BCT 1530
BCT 1630
BCT 1730
Pace 7
Pace13 (CP3000P)
ANOTHER - a message that you will see in case of
trying to glue MHW to any different tuner model.

ATTENTION!!! For 1430 and other models where HDL does not serve
RSA_KEYS file and n2-keys in it:
You can send n2-keys downloaded from Internet automaticly
with MediasatConnect v2.2 marking 'Not RSA_KEYS' in 'EMU Keys'
section.

ADDED:

- correction of 2x_MENU function through front tuner panel
switching RS-communication ON/OFF
(RS-communication is a MUST to enable for sending out keys to firmware)

- corrections and language changes made in MHW
Checking out and correction of all ENGLISH texts in OFM.
Preparing of the Russian OFM version with Windows-1251 text encoding.
Size and position change of panel elements, suitable for changed texts length.

Here is a precise quantity of changes as compared to OFM_010406_0420 version:

PL version
----
panels - 231 change
data - 15 changes
scripts - 15 changes
---
total = 261

RUS version
---
panels - 663 changes
data - 103 changes
skrypty - 15 changes
---
total = 781

Grand total of all changes in both versions - 1042 changes
(Russian fonts included).

THANX fly out to Yaro - for his active translations of language texts
in MHW OFM and in MediasatConnect v2.2 as well.

On behalf of all participating in the OpenFirmwareMulti
creation and improvement,-

julekjulek
=========================================
OFM_010406_0420 for 1530 and DTF2 added:

- 2x_MENU on front panel of STB
switch on/switch off RS-connection
signalled on LED-display of STB:
-switched ON - CoM1
-switched OFF - CoM0
It's now possible to manage STB through RS-connection
with the help of simulation software
working instead of remote-control
to enter please press '+, MENU, 6, 4'
(primarily meant for STB with a damaged remote-control)
- memorization of all settings
when tuner is connected or disconnected from mains.

The following features added in here:
- Mediacom 2.4 makes it now possible to automaticly
connect to internet, to find all necessary keys
and to send them out to STB;
- MediasatConnect which is a remote-control substituting
program to manage STBs instead of broken/damaged
remote control unit through RS-port.

On behalf of all participating in the OpenFirmwareMulti
firmware creation and improvement,-

julekjulek
=====================================================================
DTF2_OFM_260306_2300_matrix

All keys are now in the same format as in p1530.
Idea key length is 0x10, not 0x18. You don't need to fill
idea key with '0' anymore;)

=====================================================================
15_OFM_250306_2300_PI721a7 added:
----------------------------------

A simultaneous public release of Deemonru's PI721a7 HDL and OFM MHW layer

1. Nagra2 limited emm-processing added. You need to load rsa and idea
emm keys to have key autoroll.
2. MHW menu for rsa keys added.

Go to install menu/7 (emu keys), press "->" or "<-" buttons to open "RSA Keys" page.
enter 6 ident characters (e.g. 007101), desirable key index and type.
If the key already exists then you will see it in the bottom field,
- press OK to edit or remove the key,
-- press OK when finished to save new key value
-- or SERV to delete it.

Hint:
AU for N2 will work when you add proper data with Mediacom
or through menu/7/"rsa keys"

e.g. for provider 7101 add data with these parameters:
RSA_EMM - 'key index'-12, 'key type'-10, 'key len'-60
IDEA_EMM - 'key index'-02, 'key type'-18, 'key len'-10
AU will update new IDEA keys for you

to get the picture you will need also to insert:

RSA - 'key index'-16, 'key type'-00, 'key length'-40

Changes in HDL and main changes in MHW layer done by Deemonru

On behalf of all participating in the OpenFirmwareMulti
creation and improvement,-

julekjulek

=====================================================
DTF2_OFM_230306_0000_matrix:
----------------------------

Added - the automatic service of nagra2 keys
Improved - initiating of EMU-buffer
Improved - information layout about keys
Press +,MENU and 2x_E to initiate this function.

Some data that one should enter into
MediaBox using Mediacom from Deemonru:
RSA_EMM and IDEA_EMM need to be inserted
to achieve AU

{ in some files available on uploads
RSA_EMM may be named as MOD, IDEA_EMM as KEY)
------
Parameters for 7001:
'Ident' -7001
RSA_EMM- 'key index'-11, 'key type'-10, 'key len'-60
IDEA_EMM- 'key index'-01, 'key type'-18, 'key len'-18
RSA_EMM- 'key index'-12, 'key type'-10, 'key len'-60
IDEA_EMM- 'key index'-02, 'key type'-18, 'key len'-18

Parameters for 7101:
'Ident' -7101
RSA_EMM- 'key index'-11, 'key type'-10, 'key len'-60
IDEA_EMM- 'key index'-01, 'key type'-18, 'key len'-18
RSA_EMM- 'key index'-12, 'key type'-10, 'key len'-60
IDEA_EMM- 'key index'-02, 'key type'-18, 'key len'-18
==========
Parameters for 4001:
'Ident' -4001
RSA_EMM- 'key index'-11, 'key type'-10, 'key len'-60
IDEA_EMM- 'key index'-01, 'key type'-18, 'key len'-18
RSA_EMM- 'key index'-12, 'key type'-10, 'key len'-60
IDEA_EMM- 'key index'-02, 'key type'-18, 'key len'-18

Parameters for 4101:
'Ident' -4101
RSA_EMM- 'key index'-11, 'key type'-10, 'key len'-60
IDEA_EMM- 'key index'-01, 'key type'-18, 'key len'-18
RSA_EMM- 'key index'-12, 'key type'-10, 'key len'-60
IDEA_EMM- 'key index'-02, 'key type'-18, 'key len'-18
-------
On behalf of all participating in the OpenFirmwareMulti
creation and improvement,-

julekjulek
=======================================================================

DTF2_OFM_180306_0000 Fixed:
---------------------------
Fixed bugs in HDL, now it's possible to add IDEA keys for Nagra2
with Mediacom from Deemonru or in Box EMU-section.
- insert keys into EMU, activate them and cancel
the keys key stored previously in RSA_KEYS.

IDEA 86 (16 bytes) should be inserted in menu as 0 i 1 (8+8 byte's)
IDEA 96 (16 bytes) - as 2 i 3 opk (8+8 byte's)

REMEMBER ! If you want to activate an IDEA key in RSA_KEYS,
you must first delete its equivalent in EMU.

Thanks to HDL author.
julekjulek

=====================================================================
OFM_160306_2200 added:
-----------------------
- for models DTF2 and 1530 with hdl PI721a6
added support of RSA nad IDEA keys update for nagra2
with RS connection using Mediacom by Deemonru
- for other models there's no support of RSA/IDEA keys insertion
via RS or update of keys.

--- some hints for adding RSA/IDEA keys in case of e.q. 7101 ---
- Start Mediacom, the box should be connected to PC with RS cable
- open RS connection in box 'Service menu' -> 6| CAM&COM -> 4| RS232 marked
- press 'Open' - Mediacom will connect to the box
- press button "Emu Keys"
- in 'CA Systems' field mark 'Nagra'

Update of RSA key:
- 'Ident'-007101, 'key index'-16, 'key type'-00, 'key length'-40
- in edit box please insert 64 bytes of RSA-key
- press button '>>'

Update of IDEA key:
>for idea 86<
'Ident'-007101, 'key index'-06, 'key type'-0D, 'key length'-10
- in edit box insert 16 bytes of IDEA
- press button '>>'

>for idea 96<
'Ident'-007101, 'key index'-46, 'key type'-0D, 'key length'-10
- in edit box insert 16 bytes of IDEA
- press button '>>'

After each pressing '>>' button you prepare a certain instruction
in the right panel ready to be sent to the box.

When all keys are prepared, press 'Send keys', data will be transmitted
from PC to the box.

If all is OK, you should have log as follows:
3 new keys received
Key #6 for provi 7101 inserted.
Key #46 for provi 7101 inserted.
Key #16 for provi 7101 inserted.
entree dans init_proctab
sortie de init_proctab
Key #aa for provi 0 updated.

MHW added/changed:
--------------------
- fixed RSA_KEYS buffer and file creation
(now a problem like 'No room for new keys!'
should no longer exist)

- MENU, 8, 6 - cleaning RSA buffer
(BE CAREFUL! - it erases all RSA and IDEA keys
without any confirmations)

This option is useful in case of a 100% filled buffer
or wrong initialization by previous version of a firmware.

- TURN ON/OFF background for the clock/date
on screen with 'SERV' when clock is active
Setting is not saved after the box is switched off
from mains. A transparent background is set as a default.

- Fixed block of a service menu and info bar when the clock is active

- 2x_PILOT - forced changing epg standard MHW<->DVB on current channel

In the name of all working on OpenFirmware
julekjulek

===============================================================================
15_OFM_120306_1500_PI721a6

Added:
-----------------------
- Update to Deemonru's HDL PI721a6, please refer to readme_HDL

-- Wider description of keys additional functions --
Start "Mediacom", press "Open" and program should connect to STB.
Press "EMU Keys", then in "CA Systems" field select "Nagra"

Example of adding keys basing on POLSAT.

We'll need "IDEA/3DES" and "RSA mod" keys.
Writing RSA key:
Fill in the following fields: Ident-7101, key index-16, key type-00, key length-40
Paste RSA key into the window below, and press ">>".
In the window next to it You should be able to see
"3F 007101 16 00 40 xxxx", where xxxx... is our RSA key.

Now let's add IDEA/3DES key:
Once again: Ident-7101, key index-06, key type-0D, key length-10
Paste IDEA/3DES key into the window below, and press ">>" button once again.
Instruction for adding this type of key should be generated.
"Send keys" button will send those instructions to our STB.
-----------

MHW
- time, date and channel number was moved into the left bottom corner
- added possibility to get last subtitles and language setting remembered
for each channel separately under '+' menu
What STB will have to remeber we can set in:
MENU, 4, 1, 4, 'REMEMBER LAST':
a) NO
b) LANGUAGE
c) SUBTITLES
d) BOTH

MHW is prepared for usage in other STB models
(only sharing speedup won't work coz it's HDL specific function)

MHW Changes done by: Deemonru and Maybe.

On behalf of all participating in the OpenFirmwareMulti...
julekjulek

======================================================================
OFM_201105_0132_PI721a3 Added:
-----------------------
+, MENU, 5, arrow up/down, 2 'SATELLITE NAME'
edition of satellite names related to DiSEqC
+, MENU, 5, arrow up/down, 3 'MY COLOURS ...'
full edition of RGB elements and transparency
for user individual color palette
(you can draw FW in any colors)
+, MENU, 5, 7 'AUTO LOCAL TIME'
setting through which any country time shift
and daylight time savings
may be synchronized automatically
PL, GB, IT, FR, NL, ES or '*'
(When setting it to '*' only time is synchronized,
while the time shift is not).
+, MENU, 6, arrow up/down, 0 'RS232 speed'
changes baudrate speed for RS232
2x 'C' (on 'clear' screen)
a search for wanted channel by its first letters
will be launched
(capital/small letters are just the same)

Other properties:
-----------------
- MHW auto configuration for different STB models
(one firmware (MHW layer) for all STB models)
- SETTINGS file format checking at booting sequence.
FW will write default SETTINGS file if something went wrong,
so you don't have to clear flash before writing OFM.
- possibility of channel scan from SAT without card in slot
- 'SERVICE MODE K2002' (MENU, 4, 4) is moved to
MENU 8 - 'SERVICE OPTIONS' (MENU, 8, 5)
(seems like a more suitable place)
- more thorough 'cleanup' in install section
- fixed major bug related to channels deleting
it was breaking channels on the transponder
or channel being deleted

On behalf of all participating in the OpenFirmwareMulti...
julekjulek

======================================================================

OpenFirmwareMulti... (OFM)
--------------------------
This software is a successor of some time ago released
OpenFirmware.

Main new features:

-optimalization in favor of size, speed and stability
-support of 5 languages
(despite of supporting those 5 languages and keeping
basic features of the ancestor, MHW layer is around 16% smaller)
-MHW and DVB pilot services merged in one
-possibility of moving the position of main and service menu on the screen

Main contributors working on this FW version were:
- julekjulek - MHW layer changes
- eran - fonts and graphics changes

Cooperation:
------------
- optimalization of section 'basic' was done basing on MHW for DFT1 made by Yawn
- BlackSide, changes in subtitles service
- BlackSide, -=Mario=- - sharing source code used in MediasatConnect

Versions:
---------
OFM is published as open software. Everyone with enough knowledge
can make modifications and publish new version.

There are ONLY two conditions:

1. Introduced modifications should concern important changes
in functionality (not cosmetic ones)
2. releases should contain original readme file with additions
according to new functionality

An example of how to name:

model_OFM_date_time_HDLver
i.e. 15_OFM_161005_0300_PI721a1.bin

=========
IMPORTANT
=========
First firmware upload into STB
------------------------------
Because of important changes in SETTING file (settings of STB)
and information about 4 satellites in eeprom you have to:
-clear channel list flash
-upload OFM FW
-upload included eeprom
-power on STB and program some channels from satellite
After this step you can write your own channel list through RS.
----
Information "JC 2" which may appear on LED display
after switching STB off by remote means that you have
used the wrong eeprom
Lack of visible MENU after powering on STB
means that old SETTINGS file remained in channel list flash.
==========================================================================

ACKNOWLEDGEMENTS :)

Thanks to everyone who contributed into software development
not only for STB but also programs like "Defiant", "Pionero",
"uComp", "Mediasat Editor Studio", "Downloader" etc.

Thanks fly to:
PJotr, BlackSide, Deemonru, Dynamit, sa1vador, pio, PJotr, STUDI, Johann,
Jazio, Mat, Sebastian Bogacki, JM, Maybe, Generator, Yawn, Lupin III,
kOt, -=Mario=-, Bezerker, Spirit, psycho-troop ...

Sorry and thanks to everyone who helped in any way in developing
of OpenFirmware but wasn't mentioned.

(this software, like any other one, does not lack faults)

On behalf of all participating in the OpenFirmwareMulti
creation and improvement,-

julekjulek
=========================================================================

Shortened keys description:
===============================
Keys working while screen is â€Å›clean’
--------------------------------------------------------------
'A' - quick execution of 'CAsystem ECMPID ProviderID' screen
2x'A' - quick execution of RS configuration screen
'B' - Radio
2x'B' - then 'arrow up'/'arrow down' - automatic crawling through channel list
(activity of this function will be indicated on LED,
press any key to interrupt)
'C' - execution of subtitles management
'D' - pause
'E' - Zaplist/EPG (depends on settings in service manu)
2x'E' - enables/disables CAM information while switching channels

POWER - STB enable/disable
2x'POWER' - STB disable with its following restart
'SERW' - Interactivity (depends on used HDL),
'PILOT' - MHW/DVB pilot
'PROG' - Zaplist/EPG (depends on settings in service menu)
'OK' - switching between last two channels watched
'+' shows basic information about parameters of current channel
'+', 'MENU' - service menu
'0' - shows/hides information about time (clock)
2x'0' - permanent clock display
3x'0' - changing position of clock:
LED, TV, LED&TV, TV&DATA, LED&TV&DATA
-----------------------------------------------------------------------
Zaplist or pilot is active:
------------------
a - All
b - List 1
c - List 2
d - List 3
-----------------------------------------------------------------------
Subtitle:
------------------
Additional keys to manage the subtitles:
A – back 5 text
B - back 1 text
D - forward 1 text
E - forward 5 text
------------------------------------------------------------------------
Description of some menu positions:
-----------------
'+', 'PILOT' - motor, precise movement to the left
'+', 'PROG' - motor, precise movement to the right
'+', 'A' - settings of shutdown timer
----------------
'+', 'MENU', '3', '5' (status), arrow up/down (status 2), '0' - channel, mark for sharing
( not (*) - channel managed by EMU or SC, yes (V) - channel managed by sharing)
'+', 'MENU', '6', '7' (DW HOST) - enables sharing through RS
(setting is saved while powering the STB off/on with a remote controller,
which automatically enables RS and sharing for selected channels)
'+', 'MENU', '7', '8' (motor) - approvement for motor control
'+', 'MENU', '4', '7' (motor) - edition of motor position in channel list
'+', 'MENU', '5', '0' - menu transparency
'+', 'MENU', '5', '1' ( <-, ->) - changing colors of firmware
'+', 'MENU', '5', '2' - clock settings
(LED, TV, LED&TV, TV&DATA, LED&TV&DATA)
'+', 'MENU', '5', '3' - E = Zaplist/EPG
'+', 'MENU', '5', '4' - channel info / CAM info
'+', 'MENU', '5', '5' - mini pilot while changing channels
'+', 'MENU', '5', '6' - provider info while changing channels
'+', 'MENU', '5', arrow down/up, 0, arrows - changing menu position
'+', 'MENU', '5', arrow down/up, 1, enable/disable channel lock
'+', 'MENU', '7', '0' - AUTO PID for SECA, enable/disable
'+', 'MENU', '7', '1' - approvement for MHW from sattelite (interactivity)
'+', 'MENU', '7', '3' - EMM EMU = no (*) , yes (V), new (+)
'+', 'MENU', '7', '4' - EMM INFO = no (*) , yes (V), information about new key from EMU
'+', 'MENU', '7', '5' - EMM SECA 2, EMM passing = no (*), UA/SA, SA
(for 1530 and Deemonru HDL - blocker is in charge,
for other models no (*) = MHW blocker enabled,
after uploading new firmware or eeprom into STB you have to set this option again)
'MENU', '4', '4' - start of dL1o service mode for 1530 with Deemonru HDL
(for other models this functionality depends on used HDL)
'MENU', 'D' - language change
=============================
latest correction by YARO
03.05.2006
=============================