Saturday, 11 August 2012

Extracting CA EMM/ECM sections with TS File Demux

In this post I will demonstrate how to use TS File Demux section  filter feature to extraxt CA entitlement management message (EMM) / entitlement control message (ECM) sections. I will use a local DVB-T MUX 770 MHz from GO as example.
Screenshot below show the MUX in DVBStreamExplorer with Boomerang TV service expanded.

Boomerang TV service expanded in DVBStreamExplorer TS Mon

I have outlined CA EMM and ECM streams which are those of interest for this post. It can be seen that CA provider is Norwegian Telekom (CA_ID 0x0b00) which would imply that the CA system is Conax. The EMM PID is carried on PID 0x0063 (99) and the ECM PID for Boomerang TV service is carried on PID 0x01f6 (502).
I used DVBStreamExplorer to capture a Transport Stream file that I will use as input in TS File Demux. But you can use any software capable of capturing Transport Stream file.

After launching TS File Demux the first thing to do is to open the Transport Stream file saved in previous step. TS File Demux will scan the file for program and PID information and you will end up with something similar to screenshot below.

TS File Demux after selecting TS file

You can now locate the PID streams of interest and add filters. You can can double-click on an entry containing a PID value in programs tree to populate filter controls. The application will try to find the most appropriate filter type from the context. You can change parameters before adding the filter by applying 'Add' button.
Below is screenshot after adding 0x0063 (EMM) and 0x01f6 (EMM) section filters.

TS File Demux after adding filters

Now apply 'Start' button and the selected streams will be saved to the folder specified. Two files were generated, sec_0x0063.bin and sec_0x01f6.bin. Their file names were generated from the filter type (section ) and from the PID values saved.
Below is screenshot of sec_0x01f6.bin shown in a hex editor (PSPad).

ECM section in hex highlighted in hex editor

One ECM section is highlighted. It can be seen that table_id field is 0x80 and section_length field is 0x44 (68) bytes.
It is beyond the scope of this post trying to interpret the content of ECM section. I will leave this as an exercise for the reader.
Happy CA exploring!