Pioneer Software For TS4 BCT-1410/1420/1430 DBR100NL2 DBR200F DBR200NL
_____________________________________________________________________________________
Version 6.32

1. Fixed Nagra update.

2. Added DiseqC 4x1 commands for - now supported and DiseqC and tone burst.
   Scaning from menu now scan only one Dish which you select.

3. Low symbol rates now 8000 maybe little lower.

4. Added letter box function for 16/9 picture.

5. NTCS support - for this mode you must set PAL in menu 8 and box switch to NTSC 
   automaticly. Menu in NTSC mode look disturbed - thay not patched yet for NTSC.
_____________________________________________________________________________________
Version 6.31

1. Fixed Viaccess update on ASTRA sattelite.

2. Fixed CABO and DIGITAL+ update. Now used new algo - all decrypted EMM saved in the
   data flash, so one EMM instruction decrypted only ones. Now, I suppose, you can 
   watch on 1330 model nagra providers with update ON, you just need to wait when all
   EMM (signatures) will be saved in DATA flash and watch then without interrupts until
   new key will arrived. DATA flash can save up to 100 signatures for each provider - 
   I hope it would be enough - if buffer overflow all starts from the beginning. 
   Signature of EMM with key saved separately, but if you delete new key from the EMU
   menu and press C button - "save" - all key signature will be reseted, and you be 
   able to ketch new keys again. This new algo needs to be tested more, so post 
   feedback on the message board.
_____________________________________________________________________________________
Version 6.30

1. Fixed Polsat 7101 update.
_____________________________________________________________________________________
Version 6.29

1. Fixed seca 82 ins to card number.
_____________________________________________________________________________________
Version 6.28

1. Fixed CABO 4901 update.
_____________________________________________________________________________________
Version 6.27

1. Fixed nagravision update for 4001 and 4801 providers. Added in secondary menu
   switch for nagravision EMM - if you have problems in the future with nagravision
   EMM you can switch it of now.
_____________________________________________________________________________________
Version 6.26 beta

1. Fixed problem with irdeto and conax radio channels.

2. Added simulator for nagra update - now update should work on 4001 4801 7001 7401 
   providers. If you have autoupdate keys for other providers then report it on the
   board http://www.host17.org/dynamit/forum/forumdisplay.php?s=&forumid=2 and we 
   insert them.
_____________________________________________________________________________________
Version 6.25 beta

1. Optimazed RSA conax/nagra algo - now it works faster.
_____________________________________________________________________________________
Version 6.24 beta

1. Fixed irdeto PROV ID update. Now not necessary to put PRov ID 
   with xx xx 00 - zeros at the end. HMK must be preXORed.
_____________________________________________________________________________________
Version 6.23 beta

1. Added seca update inside.
   - for update you must define PPUA and MK01 and maybe MK11 for some providers.

2. Added card support for all EMMs - like before all non seca EMM goes to fake seca 
   provider BEEF, but UA, PPUA, ProvID, Hex serial for other system then seca must be 
   defied only in EMU menu 9. All EMMs goes to card when on card exist fake provider 
   BEEF, even if internal EMU update was successful/unsuccessful. About seca EMM that 
   go card:
   - if you define PPUA for seca ident in menu 9 and on card you have this IDENT - you 
   instruction filtered by this PPUA to the EMU and to card also. If you have same 
   idents on the card and in menu 9 and in menu 9 for this ident PPUA<>0 - then you 
   get instructions addressed to this provider by PPUA in menu 9 only and you loose 
   instruction addressed to this provider by PPUA in the card.


3. Switch EMM to EMU - still not supported 

4. Channel list included just for example.

_____________________________________________________________________________________
Version 6.22 beta

1. All EMM goes to internal EMU. In secondary menu 7-0 you can select EMM info mode 
       NEW - show only new key in EMM info window
       ON - show all keys, even existing key in EMM info window. 
   - in menu 7-1 you can switch off EMM info window.
   - update always on and you can't switch it of by 7-0 menu "off" - this feature 
     don't work 

2. Viaccess update: 
   - for update though UA you must define valid UA and keys what provider uses (usialy 
     it is MK00 
   - for update though CGA (PPUA) you must define valid CGA (PPUA) and keys what 
     provider uses (usially it is MK01 or MK04). Cust WP by fours byte in CGA don't work
     so you will be receiving and processing all EMM for CGA (and fours in CGA don't
     matter)
   - for update though ISSUER you must define your ISSUER like normal provider. You can
     define two ISSUERS with same ident, but only first will be working.

3. Irdeto update:
   - for update trough HMK you must define HEX serial and HMK key. HMK key must be  
     preXORed and you get new PMK key.
   - for update trough PMK you must have ID prov and PK key. Last byte in ID prov must 
     be zeros XX XX 00. For same reason you receive update for all group.

4. Nagravision update:
   - keys for POLSAT (7001, 7101) and for STARDIGITAL (7401, 7501) already inside.
     You only must define in Nagra menu idents 7101 and 7501 and wait for update.
   
5. EPG Menu added. You can define for "OTHER" provider EPG (must work on conax, but 
   I can't receive this channel so I can't test it).

6. Inserted CALLBACK feature by "0" button - you can jump with it to last watched
   channel. 

_____________________________________________________________________________________
Version 6.17 beta

1. You can edit conax key in menu 9.
_____________________________________________________________________________________
Version 6.16 beta

1. Optimazed conax RSA one more time. Now it runs faster.

2. Added support for Nagra MECM only for Polsat 7001 - key already inside.
_____________________________________________________________________________________
Version 6.15 beta

1. Added conax algo inside the box (4,5 sec max on 14xx model). Key inside only for one 
   provider "1 west - THOR" and you can't change them from menu. If inside algo give 
   signature wrong then all ECM goes to card, but if you want to use some PC emulator 
   for conax and want speed up the proccess, then in menu 9 you can on/off conax inside
   EMU and all ECM goes directly to card without processing in inside EMU algo.

2. Added info menu 6 in secondary menu - you can see now PMT table, last ECM and state 
   of last decrypted ECM in inside EMU.
______________________________________________________________________________________
Version 6.12 beta

1. Added irdto/betacrypt algo inside the box, no update at this moment, 
   but if key is not valid (old key - decrypt fail),then ECM go to the card. 
   You must define in menu 9 keys,
   All keys written in DATA flash (lenght=0x1000) in EMU folder in this format:
   address: 0x0210  -  key in this format
                       40 01 00 11 22 33 44 55 66 77 88
                       1 byte (30) - ident irdeto
                       1 byte (01) - provider number
                       1 byte (00) - No. keys
                       8 bytes - key
   address: 0x0FFE  -  address of the last key in the list of keys (end of keys)

_____________________________________________________________________________________
Version 6.11 beta

1. Fixed NagraVision ViaDigital inside the box.
_____________________________________________________________________________________
Version 6.10 beta

1. Added nagravision algo inside the box. MECM not supported, no update at this moment, 
   but if key is not valid (old key - decrypt fail),then ECM go to the card. 
   You must define in menu 9 Ident and keys, Verify key is not important.
   All keys written in DATA flash (lenght=0x1000) in EMU folder in this format:
   First goes blocks with ID for 5 providers nagravision:
   address: 0x0120  -  4101 4901 7501 ......
   address: 0x0210  -  key in this format
                       30 01 00 11 22 33 44 55 66 77 88
                       1 byte (30) - ident nagravision
                       1 byte (01) - provider number
                       1 byte (00) - No. keys
                       8 bytes - key
   address: 0x0FFE  -  address of the last key in the list of keys (end of keys)

2. Fixed minor bugs in viaccess algo.
____________________________________________________________________________________
Version 6.09 beta

1. Fixed delete key feature in menu 9. Thanks to Piotr one more time for that.
_____________________________________________________________________________________
Version 6.08 beta

1. Added Viaccess menu, format of the keys the same, but now it is in Data flash with
   seca key in EMU section.

2. You can load keys by PC with LPT+COM together with channel list. In this archive you
   find example of that list. If you use eeprom439.txt then active blocks in DATA flash 
   are 
   0x00000
   0x10000
   0x30000
   0x40000
   You should put in this blocks TSC TPT EMU TSR sections. 

3. To edit key from menu you should enter key in hex values, so use buttons 
   0...9,a,b,c,d,e and left button on the top of the remote - "PILOT" for 0xF value.
_____________________________________________________________________________________

Version 6.07 beta

1. Fixed viaccess EMM one more time, but still have small bugs....For now tested on
   Viasat, SVT europe, SRG swiss, Slo TV and work OK.

2. Added EMU menu for editing seca key to work with seca inside algo. Seca algo is 
   very lame (don't check signature, don't support superencryption), if you have any 
   problems with seca algo just delete seca provider or key and ECM then go to card.
   All keys written in DATA flash (lenght=0x1000) in EMU folder in this format:
   First goes blocks with ID and PPUA for 8 providers SECA:
   address: 0x0000  -  0019 0012 0025 ......
   address: 0x0010  -  PPUA1 PPUA2 PPUA3 PPUA4 PPUA5 PPUA6 PPUA7 PPUA8
   address: 0x0210  -  key in this format
                       10 01 0C 11 22 33 44 55 66 77 88
                       1 byte (10) - ident seca
                       1 byte (01) - provider number
                       1 byte (0C) - No. keys
                       8 bytes - key
   address: 0x0FFE  -  address of the last key in the list of keys (end of keys)

3. Added viaccess algo inside the box. Viaccess algo writen very good - check Hash 
   (signature) - no update at this moment, but if key is not valid (old key - 
   bad signature),then ECM go to the card. About TPS - this version support TPS, 
   but if key is not valid (bad signature), then to card goes clean ECM (without 
   TPS proccessing).
   All keys written in firware flash (lenght=0x1000) at 0x7FF60000 in this format:
   First goes blocks with ID for 32 providers Viaccess:
   address: 0x0030  -  007800 008000 008C00 ......
   address: 0x0210  -  key in this format
                       20 01 08 11 22 33 44 55 66 77 88
                       1 byte (20) - ident Viaccess
                       1 byte (01) - provider number
                       1 byte (08) - No. keys
                       8 bytes - key
   address: 0x0FFE  -  address of the last key in the list of keys (end of keys)

Credits: Piotr - for the Seca menu (MHW part)
____________________________________________________________________________________
Version 6.01 test

1. Suported 16 seca providers inside. If box can't find seca provider, than ECM goes 
to card as usial.

2. Key in firmware at offset address 0x15FFE0 (0x7FF5FFE0). Providers 0019 0025 and 0012
already inside. 

3. EMM at the moment go only to card.
_____________________________________________________________________________________
Version 6.00 test - only for testing - not very practical

1. Seca work inside the box ("softcam" or "virtual card"). You can define one seca
provider. Key 00 - 0F on address 7FF7FA00 - (key for 00 19 Canal+ Digitaal already 
inserted for december-january). You must define Primary and Secondary key, if provider
don't use Secondary key insert Primary instead. Key loaded with firmware and you can't
change them from menu and autoupdate is not working too, at the moment, I hope soon it
will be. 

2. You steel need card for ini and startup staff of the box, but seca work inside free 
from hanginup and much faster than on card. 

Test report welcome. I really want to know if it is good idea to put "card soft" inside
the box.

http://pub129.ezboard.com/bpioneerreverceengineering
