Hello everybody! This post describes how Common Interface (CI) works on Joker TV device. Common Interface (CI) is required for descrambling (decrypt) TV channels. Usually operators do the encryption for paid TV content (not free content), and end users have to buy Conditional Access Module (CAM) and smart cards for decryption. Smart card should be inserted into CAM, then the CAM should be inserted into a Common Interface (CI) slot on Joker TV device. Here is a photo below:

Joker TV with inserted CAM module and smart card

Note: Joker TV firmware revision 0x37 or newer and libjokertv version 1.10.2 or newer is recommended to work with Common Interface (CI).

Common Interface (CI) and CAM usage

Joker TV does the Common Interface (CI) and CAM initialization. If it is successful then a green LED near the CI should come on. Then we should use joker-tv console app for RF tuning and configuring CI and CAM. For testing purposes I will use following command:

joker-tv -d 6 -f 12303000000 -s 27500000 -y 18 -z 10750,10750,0 -p -q 31001 -c -g

This command will tune the satellite DVB-S2 transponder 12303MHz 27500H on Eutelsat 36B satellite. This transponder broadcasts encrypted content for largest Russian satellite TV operator “Tricolor TV”. I’m using Neotion DRE Pro CAM and smart card officially ordered from Tricolor TV. If everything is ok you should see decrypted content in the out.ts file. Here is the correct output for the above mentioned command:

Channel freq 12303.00 MHz, LO 10750.00 MHz, L-Band freq 1553.00 MHz 22kHz tone Off
CAM detected
CAM: Validated. Infostring:NEOTION CAM CI MANID: 0xffff DEVID:1 CONFIGBASE:0x1fe CONFIGOPTION:0xf
CAM: CAM interface initialized
CAM: EN50221 link initialized
EN50221 initialized
joker_en50221_server_worker: Server is listening on 7777
 CAM info: 
 Application type: 01
 Application manufacturer: 4a60
 Manufacturer code: 0001
 Menu string: Multi Pro CAM 
 Info string: NEOTION CAM CI
 Supported CAIDs: 
 CAID: 2710
 CAID: 7be1
 CAID: 7be0
 CAID: 4ae1
 CAID: 4ae0
 CAID: 2710
 CAID: 7be1
 CAID: 7be0
 CAID: 4ae1

joker_en50221_sync_cam: 1 program(s) will send to CAM 
CA PMT object sent into CAM for program=31001 listmgmt=3
Enable TS traffic through CAM

INFO: status=0 (LOCK) ucblocks=0, rflevel=58.975 dBm, SNR 12.200 dB, BER 1.17e-02, quality 2
USB ISOC: all/complete=7930.599262/6899.801235 transfer/sec 14.50 MBytes 57.972239 mbits/sec, 61.957807 calls/sec

As you can see, CAM is successfully configured and has started the decryption.

Man-Machine Interface (MMI)

Man-Machine Interface (MMI) is a control interface to interact with CAM. Joker-tv console app exports MMI interaction to TCP port (by default localhost:7777). You can use simple telnet console app to connect to MMI and some useful information can be obtained through it. Here is an example:

# telnet 127.0.0.1 7777
Connected to 127.0.0.1.

Main menu

Press Ok to select, or Exit to quit
 1: Information
 2: Settings

Smart card

Press Ok to select, or Exit to quit
 1: General information
 2: Providers

Subscriptions
 Provider: Tricolor TV
 Press Ok or Exit to quit
 1: - Class 000:2018/02/28-2018/04/02
 2: - Class 001:2018/02/28-2018/04/02
 3: - Class 012:2015/12/07-2015/12/13

In the above listing I have obtained the available subscriptions that are saved to my smart card. Date ranges specify the period of time that I have been allowed to see paid TV content. CAM is unable to decrypt channels after this period of time if I do not extend my subscriptions.

Analyzing interaction with CAM

Joker-tv app can dump all communications to a file with CAM. Option ‘–cam-pcap cam.pcap’ should be used for this. This file contains all traffic control to/from CAM in PCAP format. We can use the Wireshark application to analyze it. Here is screenshots of Wireshark app after opening cam.pcap:

CAM and Host interaction in Wireshark

I have marked the most important information in red. This command was sent from “Host” to “CAM” and contains command (CA PMT command ID: ok descrambling (0x01) to decrypt TV program number 0x7919. This TV program consists of one Video (TS PID 0x1201) and one Audio (TS PID 0x1202) stream. CAM starts decryption after receiving this command from the host.

Transport Stream (TS) traffic to and from CAM

Now, Joker TV should pass TS through CAM and it will transparently decrypt TS traffic and send it back to the Joker TV. Signals form and timings defined in EN50221 standard in section “A.5.5.4 Signal Description”.

Signal to and from CAM according to EN50221 standard

MCLKI signal is a clock generated by Joker TV. According to EN50221, the clock period is 111 ns which means 9 MHz. Data (TS) transmitted on MDI0-7 lines in parallel. This gives us maximum bitrate on Common Interface (CI):

9 MHz * 8 bit = 72 Mbit/sec

Return channel clock (MCLKO) is generated by the CAM module and actually can be clocked at any frequency. As stated in EN50221 – “There is no specification for delay between MCLKI and MCLKO. In the case of a module providing its own MCLKO, they may not even be the same frequency”. Joker TV Verilog implementation takes this into account and should work with any reasonable MCLKO frequencies.

All these lines are connected to a FPGA inside the Joker TV. For those who want to dig deeper into CI lines traced on Joker TV can check this post about hardware sharing.

CAM collection that I have successfully tested with Joker TV

Conclusion

Joker TV has fully supported Common Interface (CI) but is not limited to this functionality. It can be adopted to CAM’s specific set of features or even implement workarounds for known bugs. Please send me your success stories with descrambling TV channels using Joker TV and CAM. I will also maintain compatibility list of supported CAM’s.

Thank you, until next time!