DO NOT USE THIS SOFTWARE TO WATCH TV WITHOUT HAVING A LEGAL SUBSCRIPTION. IT IS EXPERIMENTAL FOR TESTING PURPOSES ONLY

This version of FreeCAM contains FREEORF.BIN which is patched to emulate F-Cards, which are used by ORF and in fact needed to view ORF1 and ORF2. ird105.bin is the original version of Freecam, which does not support F-Cards (No ORF).

This is still an experimental version. You now have version 0.14. It has been tested on the following:

                             ORF  PW Premiere  PW PPV  PW ATV  PW Extras  PW BD1/BD4  C+NL  Tele+/D+  Stream  Nova
Technisat Technibox CAM1     yes      yes        yes     yes     yes          yes     yes     yes      yes    yes
Kathrein UFD 510             yes      yes        no*     yes     yes          yes     no**    no**     no**   no**
Technotrend DVB-S PCI card   yes      yes        yes     yes     yes          yes     yes     yes      yes    yes
Galaxis IqS                  yes      yes        yes     yes     yes          yes     yes     yes      yes    yes

* The Kathrein UFD 510 does not tune to Cinedoms, Blue Movie is working.
** The Kathrein refuses to open non-German channels also with the original FreeCAM (like many other OpenTV receivers)

The following keys are installed (same order as on CAM for your reference).

000 002 162 128 158 080 217 032 078 033 [0002 A2809E50D9204E21] ;01-AUG-00 *RF
000 004 007 001 021 100 185 060 176 076 [0004 07011564B93CB04C] ;13-MAY-01 *RF
000 006 175 245 025 026 206 102 172 026 [0006 AFF5191ACE66AC1A] ;13-MAY-01 *RF
000 008 071 076 087 112 110 013 060 163 [0008 474C57706E0D3CA3] ;01-AUG-00 *RF 
000 010 171 192 065 003 177 141 015 087 [000A ABC04103B18D0F57] ;22-NOV-00 *RF
000 012 207 169 050 015 120 089 109 103 [000C CFA9320F78596D67] ;04-DEC-00 *RF
000 000 031 082 205 090 008 170 106 012 [0000 1F52CD5A08AA6A0C] ;01-JAN-00 Str**m (Service)
000 004 025 161 128 233 014 162 232 218 [0004 19A180E90EA2E8DA] ;21-MAY-01 Str**m active
000 006 125 144 245 066 169 209 254 224 [0006 7D90F542A9D1FEE0] ;21-MAY-01 Str**m next
000 000 170 061 021 073 108 212 026 007 [0000 AA3D15496CD41A07] ;01-JAN-00 N*va GR Service
000 004 025 161 128 233 014 162 232 218 [0004 19A180E90EA2E8DA] ;21-MAY-01 N*va GR recent
000 006 125 144 245 066 169 209 254 224 [0006 7D90F542A9D1FEE0] ;21-MAY-01 N*va GR next
000 002 152 009 125 122 170 023 081 158 [0002 98097D7AAA17519E] ;01-JAN-00 C Di*it*l NL
000 004 152 009 125 122 170 023 081 158 [0004 98097D7AAA17519E] ;01-JAN-00 C Di*it*l NL
000 002 123 095 012 030 238 213 040 205 [0002 7B5F0C1EEED528CD] ;01-JAN-00 M*di* Vision 0001 Dealerkey D-cards
000 002 050 089 013 224 247 197 196 202 [0002 32590DE0F7C5C4CA] ;12-MAY-01 M*di* Vision 3AA2 D-cards
000 002 167 063 054 217 174 208 135 107 [0002 A73F36D9AED0876B] ;12-MAY-01 M*di* Vision 0190 D-cards
000 002 251 098 182 106 095 214 191 222 [0002 FB62B66A5FD6BFDE] ;12-MAY-01 M*di* Vision 0190 D-0384
000 004 065 117 250 115 089 151 202 200 [0004 4175FA735997CAC8] ;12-MAY-01 M*di* Vision 000A D-cards
000 004 222 002 229 244 144 183 018 202 [0004 DE02E5F490B712CA] ;13-MAY-01 M*di* Vision 0014 D-cards
000 008 161 161 132 181 197 037 091 058 [0008 A1A184B5C5255B3A] ;13-MAY-01 M*di* Vision 00CA D-cards
000 008 067 184 085 201 013 114 030 140 [0008 43B855C90D721E8C] ;12-MAY-01 M*di* Vision 00CA D-0384 
000 010 223 106 203 069 189 067 058 102 [000A DF6ACB45BD433A66] ;01-JAN-00 M*di* Vision (not tested)
000 012 191 157 204 237 217 215 215 229 [000C BF9DCCEDD9D7D7E5] ;13-MAY-01 M*di* Vision 00D1 et al. D-cards
000 012 149 195 111 161 215 073 057 091 [000C 95C36FA1D749395B] ;12-MAY-01 M*di* Vision 00C9,00CD et al. D-0384
000 014 205 202 216 195 134 087 104 080 [000E CDCAD8C386576850] ;01-JAN-00 M*di* Vision (not tested)
000 014 047 252 196 001 098 009 255 110 [000E 2FFCC4016209FF6E] ;12-MAY-01 M*di* Vision 00D3 D-0384
016 002 089 197 220 110 239 101 095 151 [1002 59C5DC6EEF655F97] ;16-MAY-01 2710 D-cards NEXT DEALERKEY!!! 
016 002 170 109 150 228 048 043 085 141 [1002 AA6D96E4302B558D] ;16-MAY-01 2710 D-0384 cards NEXT DEALERKEY!!!
016 002 197 204 039 194 139 176 252 017 [1002 C5CC27C28BB0FC11] ;13-MAY-01 271F D-cards (cable)
016 002 240 006 019 016 147 014 136 229 [1002 F0061310930E88E5] ;13-MAY-01 271F D-0384 (cable)
016 002 020 253 035 099 164 088 080 152 [1002 14FD2363A4585098] ;01-JAN-00 *box Test
016 002 162 128 158 080 217 032 078 033 [1002 A2809E50D9204E21] ;01-JAN-00 PW Superpaket F-cards
016 002 022 155 110 215 240 184 188 094 [1002 169B6ED7F0B8BC5E] ;13-MAY-01 PW F*mily World 7D00 C-cards
016 002 222 104 137 149 078 004 120 173 [1002 DE6889954E0478AD] ;13-MAY-01 PW F*mily World 7D00 F-0384
016 002 150 100 166 016 229 131 120 110 [1002 9664A610E583786E] ;13-MAY-01 PW F*mily World 7D00 C-0384-cards
016 002 002 246 184 049 100 004 064 089 [1002 02F6B83164044059] ;01-JAN-00 PW F*mily World 7D08
016 002 156 130 171 000 250 108 022 180 [1002 9C82AB00FA6C16B4] ;13-MAY-01 PW M*vie World 7D01
016 002 178 120 223 226 116 178 206 135 [1002 B278DFE274B2CE87] ;13-MAY-01 PW M*vie World 7D01 C-0384 cards
016 002 034 245 214 068 142 232 070 148 [1002 22F5D6448EE84694] ;01-JAN-00 PW M*vie World 7D09
016 002 046 024 060 197 222 088 103 003 [1002 2E183CC5DE586703] ;12-MAY-01 2719 D-cards
016 002 109 186 108 052 238 191 020 120 [1002 6DBA6C34EEBF1478] ;13-MAY-01 2719 D-0384 cards
016 004 159 157 088 113 100 033 250 068 [1004 9F9D58716421FA44] ;13-MAY-01 PW M*vie World + F*mily World 7D02
016 004 144 086 075 193 193 119 099 110 [1004 90564BC1C177636E] ;13-MAY-01 PW M*vie World + Sp*rts World 7D03
016 004 123 050 066 191 118 042 228 074 [1004 7B3242BF762AE44A] ;13-MAY-01 7D03 PW M*vieWorld,Sp*rtWorld C-0384 cards
016 004 233 078 054 024 107 151 044 026 [1004 E94E36186B972C1A] ;12-MAY-01 7D02 PW M*vieWorld,F*milyWorld C-0384 cards
016 004 187 173 180 121 055 243 116 122 [1004 BBADB47937F3747A] ;12-MAY-01 271A D-cards
016 004 034 067 117 162 207 051 023 221 [1004 224375A2CF3317DD] ;13-MAY-01 271A D-0384 cards
016 004 191 144 022 183 145 091 168 027 [1004 BF9016B7915BA81B] ;12-MAY-01 2720 D-cards
016 004 002 210 141 156 244 155 004 124 [1004 02D28D9CF49B047C] ;13-MAY-01 2720 D-0384 cards
016 004 041 221 231 130 241 153 238 075 [1004 29DDE782F199EE4B] ;13-MAY-01 BD3/B*taB*/BD2
016 004 072 219 166 112 105 206 199 047 [1004 48DBA67069CEC72F] ;12-MAY-01 2710 Dealerkey D-cards (cable)
016 004 069 223 040 156 037 107 087 188 [1004 45DF289C256B57BC] ;13-MAY-01 2710 Dealerkey D-0384 cards (cable)
016 006 177 112 162 203 127 027 008 079 [1006 B170A2CB7F1B084F] ;13-MAY-01 ATV+Superpaket+Extras 4E2A C-cards
016 006 100 084 202 217 085 129 063 102 [1006 6454CAD955813F66] ;13-MAY-01 ATV+Superpaket+Extras 4E2A C-0384
016 006 248 111 110 015 192 158 080 188 [1006 F86F6E0FC09E50BC] ;13-MAY-01 ATV+Superpaket+Extras 4E2A F-cards
016 006 254 081 143 103 192 142 090 172 [1006 FE518F67C08E5AAC] ;12-MAY-01 2729 D-cards
016 006 096 119 135 180 112 200 019 127 [1006 607787B470C8137F] ;13-MAY-01 2729 D-0384 cards
016 006 232 197 127 253 152 080 036 173 [1006 E8C57FFD985024AD] ;01-JAN-00 Pr*m*r* analog
016 008 121 209 096 104 054 150 079 238 [1008 79D1606836964FEE] ;13-MAY-01 PW Superpaket 4E2C
016 008 192 158 220 221 054 040 082 242 [1008 C09EDCDD362852F2] ;13-MAY-01 PW Superpaket 4E2C F-cards
016 008 017 124 038 091 123 218 087 236 [1008 117C265B7BDA57EC] ;13-MAY-01 4E2C PW Super Paket C-0384 cards
016 008 204 117 249 250 042 215 212 098 [1008 CC75F9FA2AD7D462] ;12-MAY-01 272B Sportsworld cable D-cards
016 008 027 099 088 082 013 219 252 245 [1008 1B6358520DDBFCF5] ;13-MAY-01 272b Sportsworld D-0384 cards
016 008 122 019 086 139 191 237 122 218 [1008 7A13568BBFED7ADA] ;12-MAY-01 2732 D-cards
016 008 080 227 006 064 223 000 245 110 [1008 50E30640DF00F56E] ;13-MAY-01 2732 D-0384 cards
016 008 246 037 206 161 034 005 138 209 [1008 F625CEA122058AD1] ;13-MAY-01 2733 D-cards
016 008 177 024 253 074 117 172 173 022 [1008 B118FD4A75ACAD16] ;13-MAY-01 2733 D-0384 cards
016 010 149 181 091 093 004 255 243 248 [100A 95B55B5D04FFF3F8] ;01-JAN-00 PW S*perp*k*t 7D12
016 010 158 172 174 248 238 038 157 063 [100A 9EACAEF8EE269D3F] ;12-MAY-01 2711 D-cards
016 010 008 088 011 226 147 229 244 242 [100A 08580BE293E5F4F2] ;13-MAY-01 2711 D-0384 cards
016 010 076 040 122 089 182 179 153 186 [100A 4C287A59B6B399BA] ;13-MAY-01 2713 D-cards
016 010 143 195 194 059 130 156 109 060 [100A 8FC3C23B829C6D3C] ;13-MAY-00 2713 D-0384 cards
016 010 079 181 009 099 069 214 199 141 [100A 4FB5096345D6C78D] ;13-MAY-01 PW T*sts*bscr*pt**n M*vie+F*mily+Sp*rts 61B3
016 010 232 080 125 224 038 206 113 104 [100A E8507DE026CE7168] ;13-MAY-01 61B3 PW Test Abo C-0384 cards
016 010 042 122 232 190 231 036 095 185 [100A 2A7AE8BEE7245FB9] ;12-MAY-01 61B3 PW Test Abo F-0384 cards
016 012 161 167 131 240 221 172 092 042 [100C A1A783F0DDAC5C2A] ;12-MAY-01 PPV D-cards (<384)
016 012 012 160 212 165 064 011 152 004 [100C 0CA0D4A5400B9804] ;13-MAY-01 PPV D-0384 cards (cable)
016 012 191 110 203 028 140 099 009 244 [100C BF6ECB1C8C6309F4] ;12-MAY-01 PW BD1/BD4
016 012 052 174 226 070 223 047 241 153 [100C 34AEE246DF2FF199] ;13-MAY-01 PW Gala World 4E2B
016 012 211 153 093 220 186 111 193 107 [100C D3995DDCBA6FC16B] ;13-MAY-01 2730 D-cards
016 012 145 182 158 019 171 246 135 248 [100C 91B69E13ABF687F8] ;13-MAY-01 2730 D-0384 cards
016 012 197 170 111 169 116 209 202 083 [100C C5AA6FA974D1CA53] ;01-JAN-00 PW Gala World 7D11
016 012 004 235 236 127 188 077 219 100 [100C 04EBEC7FBC4DDB64] ;13-MAY-01 272E D-0384 cards
016 012 238 033 252 111 169 113 122 158 [100C EE21FC6FA9717A9E] ;12-MAY-01 272E D-cards (<384)
016 012 201 235 148 096 227 112 147 113 [100C C9EB9460E3709371] ;13-MAY-01 4E2B PW GalaWorld C-0384 cards
016 014 102 034 169 228 088 114 048 132 [100E 6622A9E458723084] ;13-MAY-01 PW Dealerkey F-cards
016 014 108 243 073 180 092 145 064 186 [100E 6CF349B45C9140BA] ;16-MAY-01 PW NEXT(!) Dealerkey C-cards
016 014 255 128 144 081 069 019 036 098 [100E FF80905145132462] ;16-MAY-01 PW NEXT(!) Dealerkey C-0384 cards
016 014 022 161 238 248 245 160 198 061 [100E 16A1EEF8F5A0C63D] ;13-MAY-01 2736 D-???? cards
016 014 069 207 021 181 196 132 059 241 [100E 45CF15B5C4843BF1] ;13-MAY-01 2736 D-???? cards
016 014 118 088 120 170 109 125 106 076 [100E 765878AA6D7D6A4C] ;13-MAY-01 2713/2F00 PPV(Cinedom) C-cards (SAT)
016 014 220 006 244 120 070 059 128 053 [100E DC06F478463B8035] ;12-MAY-01 2713/2F00 PPV(Cinedom) C-0384 (SAT)
016 016 125 179 040 080 169 229 230 216 [1010 7DB32850A9E5E6D8] ;13-MAY-01 7D04-7D07, 7D0C-7D0F Extras S**sons, Cl*ssic*, H*im*tk*n*l/F*lmp*l*st
016 016 193 102 145 085 014 139 027 204 [1010 C16691550E8B1BCC] ;13-MAY-01 7D04-7D07, 7D0C-7D0F C-0384 cards
016 016 150 208 141 188 104 161 155 092 [1010 96D08DBC68A19B5C] ;13-MAY-01 271B-271E D-0384 cards
016 016 140 004 056 014 147 085 151 163 [1010 8C04380E935597A3] ;12-MAY-01 271B-271E D cards (<0384)
016 016 048 036 144 226 211 100 225 103 [1010 302490E2D364E167] ;01-JAN-00 2724 D-0384 cards
016 016 149 114 002 038 227 090 048 122 [1010 95720226E35A307A] ;12-MAY-01 7530 PW Dealerkey C-cards (<0384)
016 016 110 170 155 098 155 095 095 097 [1010 6EAA9B629B5F5F61] ;13-MAY-01 7530 PW Dealerkey C-0384 cards
016 017 076 172 013 127 116 089 073 037 [1011 4CAC0D7F74594925] ;01-JAN-00 PW BD3 (sometimes)

To install:

1) Unzip all files the a directory of you choice (e.g. C:\FREECAM)
2) If you run Win95 (non OSR2), delete Irdeto98.inf
3) If you run Win98 or Win95 OSR2, delete Irdeto95.inf
4) If you run NT or Win2000, it won't work. Didn't get it to run on Windows ME either
5) Insert CI in PCMCIA slot of your laptop. When it asks you for a driver directory point to C:\FREECAM
6) Copy ird106.ini to your Windows directory (e.g. C:\WINDOWS)
7) Edit ird106.ini (the one in your Windows directory) and change the binary= entry
   to the file you want to install (FREEORF.BIN).
8) Click on ird106.exe in C:\FREECAM. Press the start button. When the display turns green, you're all set.
9) Unlike other readmes it is not neccessary to copy the CIPHYSICAL.DLL anywhere.

If you use FREEORF.BIN you will notice in your CAM menu, that it identifies itself as "Irdeto Free 0CDF". In the menu it says "Irdeto FreeCAM 2" instead of "Irdeto - Freecam". This is for you to see, which version of FreeCAM is installed.

History:

FreeCAM2 - 010: Initial public release
FreeCAM2 - 011: Fixed a bug in the $0328D6 routine, which also existed in FreeCAM1. Channel switching is now faster.
FreeCAM2 - 012: Fixed a bug, that caused some receivers not to support D-Cards (e.g. Mediavision)
FreeCAM2 - 013: Returned to original routine at $030064
FreeCAM2 - 014: Fixed a bug, that could destroy EEPROM contents, when turning emulator off and switch between Mode GER and INT. Added support for GER,INT,XNT,TEL and AUTO Modes. In Version 014 only use AUTO (all other modes do not work). There is a another bug (left from FreeCAM1), which can eventually destroy a smart card EEPROM contents, when the EMU is on (sends 01 FF nanos, don't know why). So do not insert a card, that supports EEPROM writing, when the EMU is on. I will work on a fix in 015.
FreeCAM2 - 015: FreeCAM in emulator mode no longer destroys smartcard. You can now switch the emulator on without the need to go to a 0602 channel before. Enhanced support for Non-Irdeto/Betacrypt ECMs.
FreeCAM2 - 016: Fixed a bug, which caused CA_ID 1722 not to work (Mediavision Bouquet affected)

How to use the goodies:
ALL-ECM (on or off): Off (default) means. Only Irdeto and Betacrypt ECMs are sent to the card, additionally to the CA_System_Id specified by the card. On means, any ECM will be sent to the card. This only works with Viaccess.
ECM: EXPERT-SETTING ONLY!!!!! Non-Experts leave this to Irdeto even, if they watch Seca or Viaccess programmes using HBEMU or similar tools. This setting is only in effect on receivers who prefilter the CA_PMT (Technisat, Humax). On receivers, who give the complete PMT to the CI (Nokia, Galaxis, Hauppauge/Technotrend DVBs) this setting has no effect. It defines the CA_System_Ids who will be tried additionally to the one specified by the card. Irdeto (default) means 0602, 0604, 0606, 1702, 1722 and 1762. Seca means 0100, 0602, 0604, 1702, 1722 and 1762. Viaccess means 0500, 0602, 0604, 1702, 1722 and 1762. Seca/Via means 0100, 0500, 0602, 1702, 1722 and 1762. Via/Seca means 0500, 0100, 0602, 1702, 1722 and 1762. Custom 1,2,3 can be patched by the user as needed at address $037FD0 (Custom1), $037FE0 (Custom2) and $037FF0 (Custom3). If you set ALL-ECM to off, the ECM should be Irdeto. Only, if you specifiy ALL-ECM: On, the others make sense. However, since SECA does not work anyway, only Viacess makes real sense besides Irdeto. WARNING! This setting does not turn your CAM into a SECA or Viaccess CI-Modul. Only specially designed Cards or Emulators (like HBEMU) can be used to watch SECA and Viaccess Programmes.
EMU: On or off. Off means, you need a card. On means you use the keys in FreeCAM2 to decode Irdeto/Betacrypt Channels.
 

Technical Information:

I'm not the author of the original FreeCAM. I don't know, who has written this, but it is likely, that it has been written by people from the original Irdeto-CI development team or from the ALLCAM SE 4.x Team, because source code was definitely available.

I only patched the FreeCAM code (now known as FreeCAM 1) to support F-cards (used  by ORF ans also PW). F-Cards use crypto PID 1762, which had to be added to the FreeCAM code.

So I did the following:

Patched a routine running from $00E05A to $00E091 to support 6 crypto-PIDs instead of only 3. This was done by changing two instructions both from "cmp.w [r7+A0h],#04h" to "cmp.w [r7+A0h],#07h" in that routine.

Patched a routine running from $0280EA to $0281CA to support 6 crypto-PIDs instead of only 3. This was done by changing the "movs.b r01,#3" to "movs.b r01,#6" at $028124.

Rewritten a Routine originally running from $030098 to $0300D5: Relocated the routine to $032800 and therefor patched the fjmp instruction at $00E07E. The routine now reads 6 CA_System_IDs from $037F80.

Rewritten a routine originally running from $0300D6 to $030125: Relocated the routine to $0328D6 and therefor patched the fjmp instruction at $00EEF8. The routine now supports PID 1762. This routine is called by receivers who do store a PMC-PID for each program.

Rewritten a routine at $030064 so that is only can return 0602, 1702, 1722 or 1762. Relocated the routine to $0327C0. There is no special reason not to use the routine at $030064 anymore, but SE 4.7 also changed this, so did I. The routines at $032800 and $0328D6 now call $0327C0 instead of $030064. However the original routine is still intact and can be used, if problems occur. Beginning with version 013 the original routine at $030064 is called again.
