<?xml version="1.0"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en">
	<id>https://nurdspace.nl/api.php?action=feedcontributions&amp;feedformat=atom&amp;user=Melan</id>
	<title>NURDspace - User contributions [en]</title>
	<link rel="self" type="application/atom+xml" href="https://nurdspace.nl/api.php?action=feedcontributions&amp;feedformat=atom&amp;user=Melan"/>
	<link rel="alternate" type="text/html" href="https://nurdspace.nl/Special:Contributions/Melan"/>
	<updated>2026-04-20T02:25:13Z</updated>
	<subtitle>User contributions</subtitle>
	<generator>MediaWiki 1.39.4</generator>
	<entry>
		<id>https://nurdspace.nl/index.php?title=KlikoAI&amp;diff=15956</id>
		<title>KlikoAI</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=KlikoAI&amp;diff=15956"/>
		<updated>2026-04-16T19:47:40Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=KlikoAI&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Smart stuff&lt;br /&gt;
|Purpose=Home Automation&lt;br /&gt;
|Tool=No&lt;br /&gt;
}}&lt;br /&gt;
&lt;br /&gt;
{{Note|1=There is a better writeup of this on Melan&#039;s blog https://melanpan.nl/posts/klikoai/}}&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
KlikoAI detects whether the paper and waste containers at NURDspace are inside or outside. Previous approaches using distance sensors (often caused spam on IRC) and BLE sensors proved unreliable (they fell right off after the container got emptied), so the project switched to AI-based vision detection instead.&lt;br /&gt;
&lt;br /&gt;
KlikoAI uses &amp;lt;code&amp;gt;mistral3:14b&amp;lt;/code&amp;gt; via llama-swap with llama.cpp as the backend. Before that, moondream was used with inference running inside KlikoAI itself, but it struggled with certain container configurations. &amp;lt;code&amp;gt;mistral3:14b&amp;lt;/code&amp;gt; showed better performance on this task.&lt;br /&gt;
&lt;br /&gt;
It runs on gpu.vm.nurd.space (as a systemd service, in &amp;lt;code&amp;gt;/opt/klikoai&amp;lt;/code&amp;gt;) on an Nvidia GeForce RTX 3080. (See https://git.nurd.space/bofh/nixos/gpu)&lt;br /&gt;
&lt;br /&gt;
KlikoAI uses the Home Assistant calendar integration to detect trash pick-up days and switches to a more frequent scan schedule on those days, falling back to once every 6 hours otherwise. There is also logic to detect significant changes in frame, though this has not yet been tested.&lt;br /&gt;
&lt;br /&gt;
State is published as an MQTT sensor to Home Assistant, which allows the &amp;quot;PUT THE TRASH OUTSIDE&amp;quot; notification to be muted for both the space&#039;s Signal group and IRC channel once the correct container has been detected outside. There is also IRC integration via the &amp;lt;code&amp;gt;!klikos&amp;lt;/code&amp;gt; and &amp;lt;code&amp;gt;!klikoupdate&amp;lt;/code&amp;gt; commands (the latter triggers a manual scan).&lt;br /&gt;
&lt;br /&gt;
A couple of bright lights controlled by an ESP8266 and a MOSFET have been added to illuminate the containers, as they sit in a fairly dark spot. As a bonus, they make for a good jumpscare when people walk past the space at night. A strobe effect has also been added for partying to gabber in the kliko corner.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;gallery&amp;gt;&lt;br /&gt;
KlikoAI_klikos.jpg|Klikos in their natural habitat.&lt;br /&gt;
KlikoAI_showcasing_lights.jpg|Lights on when inference is running&lt;br /&gt;
KlikoAI_lights_controller.jpg|ESP8266 + N-channel MOSFET controlling the lights&lt;br /&gt;
KlikoAI_lights_and_camera.jpg|Camera and light mounting&lt;br /&gt;
1b925f63993602e21b367f81270d818c1c4a0860b896b46ce5be2684d0a33952.png|What the camera sees&lt;br /&gt;
&amp;lt;/gallery&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight&amp;gt;&lt;br /&gt;
&amp;lt;@Melan&amp;gt; !klikoupdate&lt;br /&gt;
&amp;lt;@nurdbot&amp;gt; [Klikos] Running kliko inference task...&lt;br /&gt;
&amp;lt;@nurdbot&amp;gt; [Klikos] Paper: Visible Waste: Visible | Last Update: 2026-04-14 19:52:04 | Avg time: 41.48 secs&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
The inference time is expected: it runs on a shared GPU machine and the model is loaded and unloaded dynamically, which is included in the total inference time.&lt;br /&gt;
&lt;br /&gt;
We use the following prompt:&lt;br /&gt;
&amp;lt;syntaxhighlight&amp;gt;&lt;br /&gt;
Look carefully at this image.&lt;br /&gt;
I can see garbage containers. Tell me which colored LIDS are visible:&lt;br /&gt;
&lt;br /&gt;
1. Is there a YELLOW or cream colored lid?&lt;br /&gt;
2. Is there a BLUE or dark blue colored lid?&lt;br /&gt;
&lt;br /&gt;
Reply ONLY with valid JSON using double quotes:&lt;br /&gt;
{&amp;quot;yellow&amp;quot;: true, &amp;quot;blue&amp;quot;: true}&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Previous Iteration ==&lt;br /&gt;
&lt;br /&gt;
The original plan was to train a YOLO model on an existing garbage container dataset. Due to the limited camera mounting options at the space, detection results were poor, which led to switching to an LLM vision model.&lt;br /&gt;
&lt;br /&gt;
=== Dataset ===&lt;br /&gt;
&lt;br /&gt;
The bins at NURDspace have a blue lid and a yellow lid on an otherwise green body. Finding training images with those specific lid colours turned out to be harder than expected.&lt;br /&gt;
&lt;br /&gt;
YOLO returns bounding boxes, so one option would have been to inspect just the top portion of the detected box and check the colour range, or determine bin position based on where it appears in frame.&lt;br /&gt;
&lt;br /&gt;
Since the default YOLO models do not support garbage bin detection, a custom model was trained on a 5090 using [https://universe.roboflow.com/finance-insitut/garbage-container-detection-sam7i this dataset from Roboflow].&lt;br /&gt;
&lt;br /&gt;
&amp;lt;gallery&amp;gt;&lt;br /&gt;
2026-01-14_17-08-31.jpg|Before training&lt;br /&gt;
2026-01-14_18-02-49.jpg|After training&lt;br /&gt;
&amp;lt;/gallery&amp;gt;&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=User:Melan&amp;diff=15955</id>
		<title>User:Melan</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=User:Melan&amp;diff=15955"/>
		<updated>2026-04-16T19:45:52Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Members&lt;br /&gt;
|picture=Melan.png&lt;br /&gt;
|Nickname=Melan&lt;br /&gt;
|Memberstatus=member&lt;br /&gt;
|URL=https://melanpan.nl&lt;br /&gt;
|Project=ESP_OPL, MPDTube, Sonic_Amplifier, Slabbar, DIY_Ambilight, Airplane_Tracking, nurdlights, Desk_lights, LaLamp, Nurd Plotter, Sony Vaio Ultraportable, DRIS_Display, HAIrk, Nurdtemps, Spacesound, NurdBot Lora Failover, DIY_DSP, Erratic, Open/closed_sign, Labelprinters, Meshcore, KlikoAI, Intellian_i4_Satellite_dish, Dontlookup, Adtec_RD-60,SkyStar 2 eXpress HD&lt;br /&gt;
|nickname=Melan&lt;br /&gt;
|email=rijst@kopen.nl&lt;br /&gt;
}}&lt;br /&gt;
Will proudly present you the latest trash straight from the local Kringloop.&lt;br /&gt;
&lt;br /&gt;
== Main interests ==&lt;br /&gt;
* Programming: Python and a bit of C++&lt;br /&gt;
* Automation&lt;br /&gt;
* Anime&lt;br /&gt;
* Making Music, playing with Synths, making hark songs and remixes&lt;br /&gt;
* Audio related stuff&lt;br /&gt;
* &#039;&#039;&#039;Leds&#039;&#039;&#039;&lt;br /&gt;
* Airplanes (ADS-B) and HAMkaas radio, radio astronomy&lt;br /&gt;
* Microcontrollers (esp8266, esp32, rp2040)&lt;br /&gt;
* Machine Learning&lt;br /&gt;
* Adding pointless and annoying things to the space&lt;br /&gt;
&lt;br /&gt;
== Part of the following commissions ==&lt;br /&gt;
* RF Commission&lt;br /&gt;
* Media Commission&lt;br /&gt;
* BOFH&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=Intellian_i4_Satellite_dish&amp;diff=15950</id>
		<title>Intellian i4 Satellite dish</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=Intellian_i4_Satellite_dish&amp;diff=15950"/>
		<updated>2026-04-16T00:08:15Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=Intellian i4 Satellite dish&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Sdr&lt;br /&gt;
|Tool=No&lt;br /&gt;
|Location=the roof&lt;br /&gt;
}}&lt;br /&gt;
= Intellian i4 Satellite Dish =&lt;br /&gt;
&lt;br /&gt;
The &#039;&#039;&#039;Intellian i4&#039;&#039;&#039; is a motorised Ku-band maritime satellite TV antenna system installed on the NURDspace roof.&lt;br /&gt;
Acquired secondhand via Marktplaats, it functions as a fully steerable ground station capable of pointing at any satellite on the geostationary arc on command.&lt;br /&gt;
&lt;br /&gt;
== Hardware ==&lt;br /&gt;
&lt;br /&gt;
=== Antenna ===&lt;br /&gt;
* &#039;&#039;&#039;Model:&#039;&#039;&#039; Intellian i4 (compact motorised VSAT-style pedestal mount)&lt;br /&gt;
* &#039;&#039;&#039;Band:&#039;&#039;&#039; Ku-band (10.7–12.75 GHz receive)&lt;br /&gt;
* &#039;&#039;&#039;LNB output (IF):&#039;&#039;&#039; 950–2150 MHz&lt;br /&gt;
* &#039;&#039;&#039;Mount:&#039;&#039;&#039; Full azimuth + elevation motorised pedestal (designed for maritime/land-mobile use)&lt;br /&gt;
&lt;br /&gt;
=== Antenna Control Unit (ACU) ===&lt;br /&gt;
* RS-232 serial interface (19200 baud, 8N1)&lt;br /&gt;
* Ethernet port (TCP/IP, &amp;lt;code&amp;gt;10.208.2.223:4002&amp;lt;/code&amp;gt;) (preferred for scripting)&lt;br /&gt;
* Official control software: &#039;&#039;&#039;Aptus&#039;&#039;&#039; (Windows-only; works via Wine)&lt;br /&gt;
&lt;br /&gt;
== Control Protocol ==&lt;br /&gt;
&lt;br /&gt;
The ACU speaks a straightforward ASCII framed protocol over serial or TCP. Commands are wrapped in curly braces with a checksum suffix.&lt;br /&gt;
&lt;br /&gt;
=== Key Commands ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Command !! Description !! Notes&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;{QP}&amp;lt;/code&amp;gt; || Query current antenna position || Returns azimuth + elevation&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;{AP az el}&amp;lt;/code&amp;gt; || Send antenna position response || az/el in ×100 format (e.g. 18000 = 180.00°)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;{GO az el}&amp;lt;/code&amp;gt; || Go to position || az/el in ×100 format&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;{SH heading type}&amp;lt;/code&amp;gt; || Set heading reference || type 7 = Ground Test&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;{GN}&amp;lt;/code&amp;gt; || Gyro/heading query || Returns heading in ×100 format&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Azimuth and elevation values are always &#039;&#039;&#039;×100 integers&#039;&#039;&#039; (e.g. 16250 = 162.50°).&lt;br /&gt;
&lt;br /&gt;
== Demonstrated Uses ==&lt;br /&gt;
&lt;br /&gt;
=== Watching Chinese Propaganda Beamed from Astra 1L ===&lt;br /&gt;
&lt;br /&gt;
One of the first use cases was watching CGTN HD via Astra 1L.&lt;br /&gt;
&lt;br /&gt;
=== Clarke Belt Sky Scan ===&lt;br /&gt;
&lt;br /&gt;
The dish has been used to produce 2D heatmap images of the geostationary arc by sweeping azimuth 140°–230° at elevation ~20–33° while logging RF signal level. Multiple satellites are clearly resolved as distinct bright blobs.&lt;br /&gt;
&lt;br /&gt;
Signal level was read from the ACU&#039;s internal AGC output (not via SDR), building up a power-vs-position map as the dish swept.&lt;br /&gt;
A future goal is to replace the ACU signal level readout with a modified satellite finder connected to an Arduino + ADC for more direct RF power measurement.&lt;br /&gt;
&lt;br /&gt;
[[File:Sky scan 20260126-013235.png|thumb|center|Clarke Belt sky scan geostationary arc, azimuth 140°–230°]]&lt;br /&gt;
&lt;br /&gt;
== Goals ==&lt;br /&gt;
&lt;br /&gt;
=== Auto-Skew ===&lt;br /&gt;
&lt;br /&gt;
It might be interesting to add auto-skew control to the LNB.&lt;br /&gt;
&lt;br /&gt;
=== dontlookup Integration ===&lt;br /&gt;
&lt;br /&gt;
The plan is to use the dish with the [[dontlookup]] project to capture and analyse satellite internet traffic.&lt;br /&gt;
&lt;br /&gt;
=== IRC Plugin ===&lt;br /&gt;
&lt;br /&gt;
It would be cool to have an IRC plugin showing the coordinates the dish is currently pointed at, and optionally signal levels.&lt;br /&gt;
&lt;br /&gt;
=== Move the dish ===&lt;br /&gt;
&amp;lt;s&amp;gt;The dish&#039;s current position on the roof might not be the optimal location, we might have to move the dish.&amp;lt;/s&amp;gt;&lt;br /&gt;
Dish has been moved and we now can get a good lock on Astra 1&lt;br /&gt;
&lt;br /&gt;
=== Pretend-to-be-a-boat ===&lt;br /&gt;
Add a MCU + RS422 to the NMEA IN on the ACU and pretend our heading is 0° so the dish can calculate the correct offsets.&lt;br /&gt;
&lt;br /&gt;
== Links ==&lt;br /&gt;
&lt;br /&gt;
* [https://intelliantech.com/en/products/marine-satellite-tv/i4 Intellian i4 product page]&lt;br /&gt;
* [https://drive.google.com/drive/folders/1JSQBLE6q4ek3xGKxx8AiK_yDOuuoIicD?usp=drive_link Aptus Software]&lt;br /&gt;
* [https://gist.github.com/Melanpan/83196f626b3851ecf726993364770c5a ACU Protocol specification]&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=Template:Note&amp;diff=15949</id>
		<title>Template:Note</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=Template:Note&amp;diff=15949"/>
		<updated>2026-04-15T14:15:13Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;div class=&amp;quot;note&amp;quot; style=&amp;quot;border-left: 4px solid #36c; padding: 0.5em 1em; background: #eaf3fb;&amp;quot;&amp;gt;&lt;br /&gt;
&#039;&#039;&#039;Note:&#039;&#039;&#039; {{{1|}}}&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;br /&gt;
&amp;lt;noinclude&amp;gt;&lt;br /&gt;
== Usage ==&lt;br /&gt;
&amp;lt;pre&amp;gt;{{Note|1=Your note text here}}&amp;lt;/pre&amp;gt;&lt;br /&gt;
Note: the &amp;lt;code&amp;gt;1=&amp;lt;/code&amp;gt; prefix is required if your text contains &amp;lt;code&amp;gt;=&amp;lt;/code&amp;gt; signs.&lt;br /&gt;
&amp;lt;/noinclude&amp;gt;&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=Template:Note&amp;diff=15948</id>
		<title>Template:Note</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=Template:Note&amp;diff=15948"/>
		<updated>2026-04-15T14:14:51Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;div class=&amp;quot;note&amp;quot; style=&amp;quot;border-left: 4px solid #36c; padding: 0.5em 1em; background: #eaf3fb;&amp;quot;&amp;gt;&lt;br /&gt;
&#039;&#039;&#039;Note:&#039;&#039;&#039; {{{1|}}}&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Use:&lt;br /&gt;
&amp;lt;code&amp;gt;&lt;br /&gt;
{{Note|1=Folkert is gek}}&lt;br /&gt;
&amp;lt;/code&amp;gt;&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=SkyStar_2_eXpress_HD&amp;diff=15947</id>
		<title>SkyStar 2 eXpress HD</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=SkyStar_2_eXpress_HD&amp;diff=15947"/>
		<updated>2026-04-15T14:13:51Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=SkyStar 2 eXpress HD&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Sdr&lt;br /&gt;
|Tool=No&lt;br /&gt;
|Location=&lt;br /&gt;
}}&lt;br /&gt;
&lt;br /&gt;
== Overview ==&lt;br /&gt;
&lt;br /&gt;
This page describes the process of getting raw DVB-S2 BBframe capture working on a &#039;&#039;&#039;TechniSat SkyStar 2 eXpress HD&#039;&#039;&#039; PCIe card under Debian trixie (kernel 6.12), as part of replicating the [https://github.com/ucsdsysnet/dontlookup dontlookup] research project.&lt;br /&gt;
&lt;br /&gt;
The dontlookup paper uses a TBS5927 USB stick with a one-line driver patch to capture raw BBframes. This write-up ports that approach to the SkyStar 2 eXpress HD, which uses a different (and more interesting) chipset.&lt;br /&gt;
=== Raspberry Pi 5 ===&lt;br /&gt;
&lt;br /&gt;
The card has been confirmed working on a &#039;&#039;&#039;Raspberry Pi 5&#039;&#039;&#039; with a [https://www.suptronics.com/Xseries/x1010.html SupTronics X1010] PCIe x4 HAT. The Pi 5 exposes a PCIe Gen 2 x1 lane which is more than sufficient for a DVB card, and crucially &#039;&#039;&#039;provides 3.3V on the slot&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
The SkyStar requires a Molex power connector in addition to PCIe slot power. The X1010 HAT has a DC12V Molex input, providing 12V directly. A small buck converter is needed to generate the 5V rail for the Molex connector on the card (3.3V comes from the PCIe slot, 12V from the HAT Molex).&lt;br /&gt;
&lt;br /&gt;
{{Note|1=The Skystar does not enumerate unless the PCIE bus is forced at gen 1 speeds with &amp;lt;code&amp;gt;dtparam=pciex1_gen=1&amp;lt;/code&amp;gt;}}&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;lspci&amp;lt;/code&amp;gt; output on Pi 5:&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
0001:00:00.0 PCI bridge: Broadcom Inc. and subsidiaries BCM2712 PCIe Bridge (rev 30)&lt;br /&gt;
0001:01:00.0 Multimedia controller: Philips Semiconductors SAA7160 (rev 03)&lt;br /&gt;
0002:00:00.0 PCI bridge: Broadcom Inc. and subsidiaries BCM2712 PCIe Bridge (rev 30)&lt;br /&gt;
0002:01:00.0 Ethernet controller: Raspberry Pi Ltd RP1 PCIe 2.0 South Bridge&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
dmesg on Pi 5 (kernel &amp;lt;code&amp;gt;6.12.62+rpt-rpi-2712&amp;lt;/code&amp;gt;):&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
[  543.603095] saa716x_core: loading out-of-tree module taints kernel.&lt;br /&gt;
[  543.603753] SAA716x Budget 0001:01:00.0: found a SkyStar 2 eXpress HD PCIe card&lt;br /&gt;
[  543.603770] SAA716x Budget 0001:01:00.0: enabling device (0000 -&amp;gt; 0002)&lt;br /&gt;
[  543.603881] SAA716x Budget 0001:01:00.0:  SAA7160 Rev 3, irq: 186 (MSI)&lt;br /&gt;
[  543.613413] SAA716x Budget 0001:01:00.0: Initializing SAA716x I2C Core 0 @ 100kHz&lt;br /&gt;
[  543.616467] SAA716x Budget 0001:01:00.0: Initializing SAA716x I2C Core 1 @ 100kHz&lt;br /&gt;
[  543.619278] dvbdev: DVB: registering new adapter (SAA716x dvb adapter)&lt;br /&gt;
[  543.773006] i2c i2c-15: Attaching STV6110x&lt;br /&gt;
[  543.830525] SAA716x Budget 0001:01:00.0: DVB: registering adapter 0 frontend 0 (STV090x Multistandard)...&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Hardware ==&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;BBframe capture has not yet been tested with an actual satellite signal. Testing pending dish access at NURDspace.&lt;br /&gt;
&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;TechniSat SkyStar 2 eXpress HD&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Component !! Details&lt;br /&gt;
|-&lt;br /&gt;
| PCIe bridge || NXP SAA7160 (rev 3)&lt;br /&gt;
|-&lt;br /&gt;
| DVB-S2 demodulator || &#039;&#039;&#039;STV0903B&#039;&#039;&#039; (STV090x family)&lt;br /&gt;
|-&lt;br /&gt;
| Tuner || &#039;&#039;&#039;STV6110A&#039;&#039;&#039;&lt;br /&gt;
|-&lt;br /&gt;
| PCI ID || Appears as &amp;lt;code&amp;gt;Philips Semiconductors SAA7160&amp;lt;/code&amp;gt; in lspci&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Why This Card ===&lt;br /&gt;
&lt;br /&gt;
The STV090x family was specifically targeted because:&lt;br /&gt;
* It has hardware-level BBframe support via the &amp;lt;code&amp;gt;FRAME_MODE_FIELD&amp;lt;/code&amp;gt; bit in &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt;&lt;br /&gt;
* The mainline kernel driver (&amp;lt;code&amp;gt;stv090x&amp;lt;/code&amp;gt;) is well maintained&lt;br /&gt;
* The chip is well documented compared to alternatives&lt;br /&gt;
&lt;br /&gt;
=== 3.3V PCIe Issue ===&lt;br /&gt;
&lt;br /&gt;
AMD Ryzen systems (and many modern motherboards) do not provide 3.3V on PCIe slots, as modern GPUs don&#039;t require it. DVB cards like the SkyStar 2 eXpress HD use 3.3V for their logic and will not enumerate (&amp;lt;code&amp;gt;lspci&amp;lt;/code&amp;gt; shows nothing) on affected systems.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Workaround:&#039;&#039;&#039; Use an Intel-based system. The card was confirmed working in an X99 board. PCIe 3.3V injector risers from AliExpress are an alternative for AMD systems.&lt;br /&gt;
&lt;br /&gt;
== Software Environment ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! !! Details&lt;br /&gt;
|-&lt;br /&gt;
| OS || Debian trixie&lt;br /&gt;
|-&lt;br /&gt;
| Kernel || &amp;lt;code&amp;gt;6.12.74+deb13+1-amd64&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Driver source || [https://github.com/s-moch/linux-saa716x s-moch/linux-saa716x] (out-of-tree saa716x driver, maintained as kernel-version-specific diffs)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Building the saa716x Driver ==&lt;br /&gt;
&lt;br /&gt;
The &amp;lt;code&amp;gt;saa716x&amp;lt;/code&amp;gt; driver is not in the mainline kernel. The s-moch repo provides diffs that patch it into the kernel source tree.&lt;br /&gt;
&lt;br /&gt;
=== Install dependencies ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sudo apt install linux-source-6.12 linux-headers-$(uname -r) \&lt;br /&gt;
    libelf-dev build-essential flex bison libssl-dev wget&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Extract kernel source and apply patch ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
mkdir ~/kernel-compile &amp;amp;&amp;amp; cd ~/kernel-compile&lt;br /&gt;
wget https://github.com/s-moch/linux-saa716x/compare/saa716x-6.12.diff&lt;br /&gt;
tar xJf /usr/src/linux-source-6.12.tar.xz&lt;br /&gt;
cd linux-source-6.12&lt;br /&gt;
cp /boot/config-$(uname -r) .config&lt;br /&gt;
cp /usr/src/linux-headers-$(uname -r)/Module.symvers .&lt;br /&gt;
patch -p1 &amp;lt; ../saa716x-6.12.diff&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Configure and build ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
make olddefconfig&lt;br /&gt;
make modules_prepare&lt;br /&gt;
make syncconfig&lt;br /&gt;
&lt;br /&gt;
# Enable saa716x in config&lt;br /&gt;
scripts/config --enable SAA716X_SUPPORT&lt;br /&gt;
scripts/config --enable DVB_SAA716X_BUDGET&lt;br /&gt;
make syncconfig&lt;br /&gt;
&lt;br /&gt;
# Build just the saa716x driver&lt;br /&gt;
make -C . M=drivers/media/pci/saa716x modules -j$(nproc)&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Install ===&lt;br /&gt;
Extra step on Raspbian&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sudo mkdir -p /lib/modules/$(uname -r)/kernel/drivers/media/pci&lt;br /&gt;
sudo mkdir -p /lib/modules/$(uname -r)/kernel/drivers/media/dvb-frontends&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_core.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_budget.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo depmod -a&lt;br /&gt;
sudo modprobe saa716x_budget&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Expected dmesg output ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;text&amp;quot;&amp;gt;&lt;br /&gt;
SAA716x Budget 0000:06:00.0: found a SkyStar 2 eXpress HD PCIe card&lt;br /&gt;
SAA716x Budget 0000:06:00.0:  SAA7160 Rev 3, irq: 55 (MSI)&lt;br /&gt;
SAA716x Budget 0000:06:00.0: Initializing SAA716x I2C Core 0 @ 100kHz&lt;br /&gt;
SAA716x Budget 0000:06:00.0: Initializing SAA716x I2C Core 1 @ 100kHz&lt;br /&gt;
dvbdev: DVB: registering new adapter (SAA716x dvb adapter)&lt;br /&gt;
i2c i2c-2: Attaching STV6110x&lt;br /&gt;
SAA716x Budget 0000:06:00.0: DVB: registering adapter 0 frontend 0 (STV090x Multistandard)...&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
DVB devices appear at &amp;lt;code&amp;gt;/dev/dvb/adapter0/{demux0,dvr0,frontend0,net0}&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
== BBframe Patches ==&lt;br /&gt;
&lt;br /&gt;
Two patches are required:&lt;br /&gt;
&lt;br /&gt;
# &#039;&#039;&#039;&amp;lt;code&amp;gt;saa716x_adap.c&amp;lt;/code&amp;gt;&#039;&#039;&#039;: swap &amp;lt;code&amp;gt;dvb_dmx_swfilter&amp;lt;/code&amp;gt; for &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw&amp;lt;/code&amp;gt; so the DMA data is passed raw to userspace instead of being parsed as 188-byte TS packets&lt;br /&gt;
# &#039;&#039;&#039;&amp;lt;code&amp;gt;stv090x.c&amp;lt;/code&amp;gt;&#039;&#039;&#039;: set &amp;lt;code&amp;gt;FRAME_MODE_FIELD=1&amp;lt;/code&amp;gt; in &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt; after lock, which tells the STV0903B to output raw BBframes instead of decoded TS&lt;br /&gt;
&lt;br /&gt;
=== Background: How dontlookup&#039;s TBS5927 patch works ===&lt;br /&gt;
&lt;br /&gt;
The original dontlookup patch for the TBS5927 is a single line added to &amp;lt;code&amp;gt;tbs5927.c&amp;lt;/code&amp;gt;:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;c&amp;quot;&amp;gt;&lt;br /&gt;
.caps = DVB_USB_ADAP_RECEIVES_RAW_PAYLOAD,&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
This flag causes the dvb-usb layer to call &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw()&amp;lt;/code&amp;gt; instead of &amp;lt;code&amp;gt;dvb_dmx_swfilter()&amp;lt;/code&amp;gt;, passing raw bytes straight through. The saa716x patch replicates this at the PCI driver level.&lt;br /&gt;
&lt;br /&gt;
=== Patch 1: saa716x_adap.c (Raw DMA passthrough) ===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;File:&#039;&#039;&#039; &amp;lt;code&amp;gt;drivers/media/pci/saa716x/saa716x_adap.c&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Change &amp;lt;code&amp;gt;dvb_dmx_swfilter&amp;lt;/code&amp;gt; to &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw&amp;lt;/code&amp;gt; in the DMA completion handler:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;diff&amp;quot;&amp;gt;&lt;br /&gt;
-               dvb_dmx_swfilter(demux, data, 348 * 188);&lt;br /&gt;
+               dvb_dmx_swfilter_raw(demux, data, 348 * 188);&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Apply with:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sed -i &#039;s/dvb_dmx_swfilter(demux, data, 348 \* 188)/dvb_dmx_swfilter_raw(demux, data, 348 * 188)/&#039; \&lt;br /&gt;
    drivers/media/pci/saa716x/saa716x_adap.c&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Note:&#039;&#039;&#039; The buffer size &amp;lt;code&amp;gt;348 * 188 = 65424&amp;lt;/code&amp;gt; bytes is the DMA buffer size and is passed as-is. &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw&amp;lt;/code&amp;gt; does not assume 188-byte alignment so this is fine.&lt;br /&gt;
&lt;br /&gt;
=== Patch 2: stv090x.c (Enable BBframe mode after lock) ===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;File:&#039;&#039;&#039; &amp;lt;code&amp;gt;drivers/media/dvb-frontends/stv090x.c&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
After the demodulator achieves DVB-S2 lock, set &amp;lt;code&amp;gt;FRAME_MODE_FIELD=1&amp;lt;/code&amp;gt; in &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt;. This tells the STV0903B to output raw BBframes rather than decoded transport stream packets.&lt;br /&gt;
&lt;br /&gt;
The relevant register is defined in &amp;lt;code&amp;gt;stv090x_reg.h&amp;lt;/code&amp;gt;:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;c&amp;quot;&amp;gt;&lt;br /&gt;
#define STV090x_OFFST_Px_FRAME_MODE_FIELD  1&lt;br /&gt;
#define STV090x_WIDTH_Px_FRAME_MODE_FIELD  1&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Insert the following block after the &amp;lt;code&amp;gt;RESET_UPKO_COUNT&amp;lt;/code&amp;gt; sequence (around line 3397), immediately before the &amp;lt;code&amp;gt;ERRCTRL1&amp;lt;/code&amp;gt; write:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;diff&amp;quot;&amp;gt;&lt;br /&gt;
+                               /* Enable BBframe mode */&lt;br /&gt;
+                               reg = STV090x_READ_DEMOD(state, PDELCTRL2);&lt;br /&gt;
+                               STV090x_SETFIELD_Px(reg, FRAME_MODE_FIELD, 1);&lt;br /&gt;
+                               if (STV090x_WRITE_DEMOD(state, PDELCTRL2, reg) &amp;lt; 0)&lt;br /&gt;
+                                       goto err;&lt;br /&gt;
                                if (STV090x_WRITE_DEMOD(state, ERRCTRL1, 0x67) &amp;lt; 0) /* PER */&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Apply with Python (handles tabs correctly):&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;python&amp;quot;&amp;gt;&lt;br /&gt;
with open(&#039;drivers/media/dvb-frontends/stv090x.c&#039;, &#039;r&#039;) as f:&lt;br /&gt;
    content = f.read()&lt;br /&gt;
&lt;br /&gt;
old = &#039;\t\t\t\tif (STV090x_WRITE_DEMOD(state, ERRCTRL1, 0x67) &amp;lt; 0) /* PER */&#039;&lt;br /&gt;
new = (&#039;\t\t\t\t/* Enable BBframe mode */\n&#039;&lt;br /&gt;
       &#039;\t\t\t\treg = STV090x_READ_DEMOD(state, PDELCTRL2);\n&#039;&lt;br /&gt;
       &#039;\t\t\t\tSTV090x_SETFIELD_Px(reg, FRAME_MODE_FIELD, 1);\n&#039;&lt;br /&gt;
       &#039;\t\t\t\tif (STV090x_WRITE_DEMOD(state, PDELCTRL2, reg) &amp;lt; 0)\n&#039;&lt;br /&gt;
       &#039;\t\t\t\t\tgoto err;\n&#039;&lt;br /&gt;
       &#039;\t\t\t\tif (STV090x_WRITE_DEMOD(state, ERRCTRL1, 0x67) &amp;lt; 0) /* PER */&#039;)&lt;br /&gt;
&lt;br /&gt;
content = content.replace(old, new, 1)&lt;br /&gt;
&lt;br /&gt;
with open(&#039;drivers/media/dvb-frontends/stv090x.c&#039;, &#039;w&#039;) as f:&lt;br /&gt;
    f.write(content)&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Building and installing the patched modules ===&lt;br /&gt;
&lt;br /&gt;
After applying both patches:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
cd ~/kernel-compile/linux-source-6.12&lt;br /&gt;
&lt;br /&gt;
# Rebuild saa716x&lt;br /&gt;
make -C . M=drivers/media/pci/saa716x modules -j$(nproc)&lt;br /&gt;
&lt;br /&gt;
# Rebuild stv090x frontend&lt;br /&gt;
make -C . M=drivers/media/dvb-frontends modules -j$(nproc)&lt;br /&gt;
&lt;br /&gt;
# Install&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_core.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_budget.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo cp drivers/media/dvb-frontends/stv090x.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/dvb-frontends/&lt;br /&gt;
&lt;br /&gt;
sudo depmod -a&lt;br /&gt;
sudo modprobe -r saa716x_budget&lt;br /&gt;
sudo modprobe saa716x_budget&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Capture Procedure ==&lt;br /&gt;
&lt;br /&gt;
Once the card is connected to a dish:&lt;br /&gt;
&lt;br /&gt;
=== 1. Create a channels.conf for the target transponder ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;text&amp;quot;&amp;gt;&lt;br /&gt;
[SomeTransponder]&lt;br /&gt;
        DELIVERY_SYSTEM = DVBS2&lt;br /&gt;
        FREQUENCY = 1550000&lt;br /&gt;
        SYMBOL_RATE = 30000000&lt;br /&gt;
        POLARIZATION = HORIZONTAL&lt;br /&gt;
        MODULATION = QPSK&lt;br /&gt;
        INNER_FEC = AUTO&lt;br /&gt;
        ROLLOFF = AUTO&lt;br /&gt;
        STREAM_ID = -1&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Note:&#039;&#039;&#039; frequency is the &#039;&#039;&#039;IF frequency&#039;&#039;&#039; after LNB downconversion, not the satellite frequency. For a universal LNB (LO = 9750 MHz low band / 10600 MHz high band), subtract accordingly.&lt;br /&gt;
&lt;br /&gt;
=== 2. Capture raw BBframes ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
dvbv5-zap -a 0 -l UNIVERSAL -S 0x80000000 -o capture.ts -c channels.conf &amp;quot;SomeTransponder&amp;quot; -m&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;-S 0x80000000&amp;lt;/code&amp;gt; sets &amp;lt;code&amp;gt;DTV_STREAM_ID&amp;lt;/code&amp;gt; to request all streams in raw mode.&lt;br /&gt;
&lt;br /&gt;
=== 3. Run dontlookup ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
git clone https://github.com/ucsdsysnet/dontlookup&lt;br /&gt;
cd dontlookup&lt;br /&gt;
pip install -r requirements.txt&lt;br /&gt;
python3 dontlookup.py capture.ts -p all&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Output IP pcaps will appear in &amp;lt;code&amp;gt;output/&amp;lt;/code&amp;gt;, open with Wireshark.&lt;br /&gt;
&lt;br /&gt;
== Known Issues / TODO ==&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;Blindscan:&#039;&#039;&#039; The STV090x driver has a &amp;lt;code&amp;gt;stv090x_blind_search()&amp;lt;/code&amp;gt; function internally but it is never triggered from userspace. The DVB core rejects symbol rate = 0. A follow-up patch to enable blindscan via srate=0 is needed.&lt;br /&gt;
* &#039;&#039;&#039;BTF generation skipped:&#039;&#039;&#039; &amp;lt;code&amp;gt;vmlinux&amp;lt;/code&amp;gt; not available for BTF, modules load fine but may affect BPF tooling.&lt;br /&gt;
* &#039;&#039;&#039;BBframe capture unverified:&#039;&#039;&#039; Patches compile and load cleanly but have not yet been tested with an actual satellite signal. Testing pending dish access at NURDspace.&lt;br /&gt;
* Test to see if we can get this working on a Raspberry Pi 5&lt;br /&gt;
&lt;br /&gt;
== References ==&lt;br /&gt;
&lt;br /&gt;
* [https://github.com/ucsdsysnet/dontlookup dontlookup paper/tool]&lt;br /&gt;
* [https://github.com/s-moch/linux-saa716x s-moch/linux-saa716x]&lt;br /&gt;
* [https://github.com/xenpac/Linux-DVB-S2-SatReceiver xenpac/Linux-DVB-S2-SatReceiver]&lt;br /&gt;
* [https://github.com/newspaperman/bbframe-tools newspaperman/bbframe-tools]&lt;br /&gt;
* [https://linuxtv.org/wiki/index.php/DVBSky_T9580 LinuxTV wiki: DVBSky T9580]&lt;br /&gt;
* [https://www.linuxtv.org/wiki/index.php/Hauppauge_WinTV-HVR-5500 LinuxTV wiki: Hauppauge WinTV-HVR-5500]&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=SkyStar_2_eXpress_HD&amp;diff=15946</id>
		<title>SkyStar 2 eXpress HD</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=SkyStar_2_eXpress_HD&amp;diff=15946"/>
		<updated>2026-04-15T14:12:38Z</updated>

		<summary type="html">&lt;p&gt;Melan: /* Raspberry Pi 5 */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=SkyStar 2 eXpress HD&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Sdr&lt;br /&gt;
|Tool=No&lt;br /&gt;
|Location=&lt;br /&gt;
}}&lt;br /&gt;
&lt;br /&gt;
== Overview ==&lt;br /&gt;
&lt;br /&gt;
This page describes the process of getting raw DVB-S2 BBframe capture working on a &#039;&#039;&#039;TechniSat SkyStar 2 eXpress HD&#039;&#039;&#039; PCIe card under Debian trixie (kernel 6.12), as part of replicating the [https://github.com/ucsdsysnet/dontlookup dontlookup] research project.&lt;br /&gt;
&lt;br /&gt;
The dontlookup paper uses a TBS5927 USB stick with a one-line driver patch to capture raw BBframes. This write-up ports that approach to the SkyStar 2 eXpress HD, which uses a different (and more interesting) chipset.&lt;br /&gt;
=== Raspberry Pi 5 ===&lt;br /&gt;
&lt;br /&gt;
The card has been confirmed working on a &#039;&#039;&#039;Raspberry Pi 5&#039;&#039;&#039; with a [https://www.suptronics.com/Xseries/x1010.html SupTronics X1010] PCIe x4 HAT. The Pi 5 exposes a PCIe Gen 2 x1 lane which is more than sufficient for a DVB card, and crucially &#039;&#039;&#039;provides 3.3V on the slot&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
The SkyStar requires a Molex power connector in addition to PCIe slot power. The X1010 HAT has a DC12V Molex input, providing 12V directly. A small buck converter is needed to generate the 5V rail for the Molex connector on the card (3.3V comes from the PCIe slot, 12V from the HAT Molex).&lt;br /&gt;
&lt;br /&gt;
{{Note|The Skystar does not enumerate unless the PCIE bus is forced at gen 1 speeds with &amp;lt;code&amp;gt;dtparam=pciex1_gen=1&amp;lt;/code&amp;gt;}}&lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;lspci&amp;lt;/code&amp;gt; output on Pi 5:&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
0001:00:00.0 PCI bridge: Broadcom Inc. and subsidiaries BCM2712 PCIe Bridge (rev 30)&lt;br /&gt;
0001:01:00.0 Multimedia controller: Philips Semiconductors SAA7160 (rev 03)&lt;br /&gt;
0002:00:00.0 PCI bridge: Broadcom Inc. and subsidiaries BCM2712 PCIe Bridge (rev 30)&lt;br /&gt;
0002:01:00.0 Ethernet controller: Raspberry Pi Ltd RP1 PCIe 2.0 South Bridge&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
dmesg on Pi 5 (kernel &amp;lt;code&amp;gt;6.12.62+rpt-rpi-2712&amp;lt;/code&amp;gt;):&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
[  543.603095] saa716x_core: loading out-of-tree module taints kernel.&lt;br /&gt;
[  543.603753] SAA716x Budget 0001:01:00.0: found a SkyStar 2 eXpress HD PCIe card&lt;br /&gt;
[  543.603770] SAA716x Budget 0001:01:00.0: enabling device (0000 -&amp;gt; 0002)&lt;br /&gt;
[  543.603881] SAA716x Budget 0001:01:00.0:  SAA7160 Rev 3, irq: 186 (MSI)&lt;br /&gt;
[  543.613413] SAA716x Budget 0001:01:00.0: Initializing SAA716x I2C Core 0 @ 100kHz&lt;br /&gt;
[  543.616467] SAA716x Budget 0001:01:00.0: Initializing SAA716x I2C Core 1 @ 100kHz&lt;br /&gt;
[  543.619278] dvbdev: DVB: registering new adapter (SAA716x dvb adapter)&lt;br /&gt;
[  543.773006] i2c i2c-15: Attaching STV6110x&lt;br /&gt;
[  543.830525] SAA716x Budget 0001:01:00.0: DVB: registering adapter 0 frontend 0 (STV090x Multistandard)...&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Hardware ==&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;BBframe capture has not yet been tested with an actual satellite signal. Testing pending dish access at NURDspace.&lt;br /&gt;
&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;TechniSat SkyStar 2 eXpress HD&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Component !! Details&lt;br /&gt;
|-&lt;br /&gt;
| PCIe bridge || NXP SAA7160 (rev 3)&lt;br /&gt;
|-&lt;br /&gt;
| DVB-S2 demodulator || &#039;&#039;&#039;STV0903B&#039;&#039;&#039; (STV090x family)&lt;br /&gt;
|-&lt;br /&gt;
| Tuner || &#039;&#039;&#039;STV6110A&#039;&#039;&#039;&lt;br /&gt;
|-&lt;br /&gt;
| PCI ID || Appears as &amp;lt;code&amp;gt;Philips Semiconductors SAA7160&amp;lt;/code&amp;gt; in lspci&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Why This Card ===&lt;br /&gt;
&lt;br /&gt;
The STV090x family was specifically targeted because:&lt;br /&gt;
* It has hardware-level BBframe support via the &amp;lt;code&amp;gt;FRAME_MODE_FIELD&amp;lt;/code&amp;gt; bit in &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt;&lt;br /&gt;
* The mainline kernel driver (&amp;lt;code&amp;gt;stv090x&amp;lt;/code&amp;gt;) is well maintained&lt;br /&gt;
* The chip is well documented compared to alternatives&lt;br /&gt;
&lt;br /&gt;
=== 3.3V PCIe Issue ===&lt;br /&gt;
&lt;br /&gt;
AMD Ryzen systems (and many modern motherboards) do not provide 3.3V on PCIe slots, as modern GPUs don&#039;t require it. DVB cards like the SkyStar 2 eXpress HD use 3.3V for their logic and will not enumerate (&amp;lt;code&amp;gt;lspci&amp;lt;/code&amp;gt; shows nothing) on affected systems.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Workaround:&#039;&#039;&#039; Use an Intel-based system. The card was confirmed working in an X99 board. PCIe 3.3V injector risers from AliExpress are an alternative for AMD systems.&lt;br /&gt;
&lt;br /&gt;
== Software Environment ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! !! Details&lt;br /&gt;
|-&lt;br /&gt;
| OS || Debian trixie&lt;br /&gt;
|-&lt;br /&gt;
| Kernel || &amp;lt;code&amp;gt;6.12.74+deb13+1-amd64&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Driver source || [https://github.com/s-moch/linux-saa716x s-moch/linux-saa716x] (out-of-tree saa716x driver, maintained as kernel-version-specific diffs)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Building the saa716x Driver ==&lt;br /&gt;
&lt;br /&gt;
The &amp;lt;code&amp;gt;saa716x&amp;lt;/code&amp;gt; driver is not in the mainline kernel. The s-moch repo provides diffs that patch it into the kernel source tree.&lt;br /&gt;
&lt;br /&gt;
=== Install dependencies ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sudo apt install linux-source-6.12 linux-headers-$(uname -r) \&lt;br /&gt;
    libelf-dev build-essential flex bison libssl-dev wget&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Extract kernel source and apply patch ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
mkdir ~/kernel-compile &amp;amp;&amp;amp; cd ~/kernel-compile&lt;br /&gt;
wget https://github.com/s-moch/linux-saa716x/compare/saa716x-6.12.diff&lt;br /&gt;
tar xJf /usr/src/linux-source-6.12.tar.xz&lt;br /&gt;
cd linux-source-6.12&lt;br /&gt;
cp /boot/config-$(uname -r) .config&lt;br /&gt;
cp /usr/src/linux-headers-$(uname -r)/Module.symvers .&lt;br /&gt;
patch -p1 &amp;lt; ../saa716x-6.12.diff&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Configure and build ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
make olddefconfig&lt;br /&gt;
make modules_prepare&lt;br /&gt;
make syncconfig&lt;br /&gt;
&lt;br /&gt;
# Enable saa716x in config&lt;br /&gt;
scripts/config --enable SAA716X_SUPPORT&lt;br /&gt;
scripts/config --enable DVB_SAA716X_BUDGET&lt;br /&gt;
make syncconfig&lt;br /&gt;
&lt;br /&gt;
# Build just the saa716x driver&lt;br /&gt;
make -C . M=drivers/media/pci/saa716x modules -j$(nproc)&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Install ===&lt;br /&gt;
Extra step on Raspbian&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sudo mkdir -p /lib/modules/$(uname -r)/kernel/drivers/media/pci&lt;br /&gt;
sudo mkdir -p /lib/modules/$(uname -r)/kernel/drivers/media/dvb-frontends&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_core.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_budget.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo depmod -a&lt;br /&gt;
sudo modprobe saa716x_budget&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Expected dmesg output ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;text&amp;quot;&amp;gt;&lt;br /&gt;
SAA716x Budget 0000:06:00.0: found a SkyStar 2 eXpress HD PCIe card&lt;br /&gt;
SAA716x Budget 0000:06:00.0:  SAA7160 Rev 3, irq: 55 (MSI)&lt;br /&gt;
SAA716x Budget 0000:06:00.0: Initializing SAA716x I2C Core 0 @ 100kHz&lt;br /&gt;
SAA716x Budget 0000:06:00.0: Initializing SAA716x I2C Core 1 @ 100kHz&lt;br /&gt;
dvbdev: DVB: registering new adapter (SAA716x dvb adapter)&lt;br /&gt;
i2c i2c-2: Attaching STV6110x&lt;br /&gt;
SAA716x Budget 0000:06:00.0: DVB: registering adapter 0 frontend 0 (STV090x Multistandard)...&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
DVB devices appear at &amp;lt;code&amp;gt;/dev/dvb/adapter0/{demux0,dvr0,frontend0,net0}&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
== BBframe Patches ==&lt;br /&gt;
&lt;br /&gt;
Two patches are required:&lt;br /&gt;
&lt;br /&gt;
# &#039;&#039;&#039;&amp;lt;code&amp;gt;saa716x_adap.c&amp;lt;/code&amp;gt;&#039;&#039;&#039;: swap &amp;lt;code&amp;gt;dvb_dmx_swfilter&amp;lt;/code&amp;gt; for &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw&amp;lt;/code&amp;gt; so the DMA data is passed raw to userspace instead of being parsed as 188-byte TS packets&lt;br /&gt;
# &#039;&#039;&#039;&amp;lt;code&amp;gt;stv090x.c&amp;lt;/code&amp;gt;&#039;&#039;&#039;: set &amp;lt;code&amp;gt;FRAME_MODE_FIELD=1&amp;lt;/code&amp;gt; in &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt; after lock, which tells the STV0903B to output raw BBframes instead of decoded TS&lt;br /&gt;
&lt;br /&gt;
=== Background: How dontlookup&#039;s TBS5927 patch works ===&lt;br /&gt;
&lt;br /&gt;
The original dontlookup patch for the TBS5927 is a single line added to &amp;lt;code&amp;gt;tbs5927.c&amp;lt;/code&amp;gt;:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;c&amp;quot;&amp;gt;&lt;br /&gt;
.caps = DVB_USB_ADAP_RECEIVES_RAW_PAYLOAD,&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
This flag causes the dvb-usb layer to call &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw()&amp;lt;/code&amp;gt; instead of &amp;lt;code&amp;gt;dvb_dmx_swfilter()&amp;lt;/code&amp;gt;, passing raw bytes straight through. The saa716x patch replicates this at the PCI driver level.&lt;br /&gt;
&lt;br /&gt;
=== Patch 1: saa716x_adap.c (Raw DMA passthrough) ===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;File:&#039;&#039;&#039; &amp;lt;code&amp;gt;drivers/media/pci/saa716x/saa716x_adap.c&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Change &amp;lt;code&amp;gt;dvb_dmx_swfilter&amp;lt;/code&amp;gt; to &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw&amp;lt;/code&amp;gt; in the DMA completion handler:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;diff&amp;quot;&amp;gt;&lt;br /&gt;
-               dvb_dmx_swfilter(demux, data, 348 * 188);&lt;br /&gt;
+               dvb_dmx_swfilter_raw(demux, data, 348 * 188);&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Apply with:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sed -i &#039;s/dvb_dmx_swfilter(demux, data, 348 \* 188)/dvb_dmx_swfilter_raw(demux, data, 348 * 188)/&#039; \&lt;br /&gt;
    drivers/media/pci/saa716x/saa716x_adap.c&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Note:&#039;&#039;&#039; The buffer size &amp;lt;code&amp;gt;348 * 188 = 65424&amp;lt;/code&amp;gt; bytes is the DMA buffer size and is passed as-is. &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw&amp;lt;/code&amp;gt; does not assume 188-byte alignment so this is fine.&lt;br /&gt;
&lt;br /&gt;
=== Patch 2: stv090x.c (Enable BBframe mode after lock) ===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;File:&#039;&#039;&#039; &amp;lt;code&amp;gt;drivers/media/dvb-frontends/stv090x.c&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
After the demodulator achieves DVB-S2 lock, set &amp;lt;code&amp;gt;FRAME_MODE_FIELD=1&amp;lt;/code&amp;gt; in &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt;. This tells the STV0903B to output raw BBframes rather than decoded transport stream packets.&lt;br /&gt;
&lt;br /&gt;
The relevant register is defined in &amp;lt;code&amp;gt;stv090x_reg.h&amp;lt;/code&amp;gt;:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;c&amp;quot;&amp;gt;&lt;br /&gt;
#define STV090x_OFFST_Px_FRAME_MODE_FIELD  1&lt;br /&gt;
#define STV090x_WIDTH_Px_FRAME_MODE_FIELD  1&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Insert the following block after the &amp;lt;code&amp;gt;RESET_UPKO_COUNT&amp;lt;/code&amp;gt; sequence (around line 3397), immediately before the &amp;lt;code&amp;gt;ERRCTRL1&amp;lt;/code&amp;gt; write:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;diff&amp;quot;&amp;gt;&lt;br /&gt;
+                               /* Enable BBframe mode */&lt;br /&gt;
+                               reg = STV090x_READ_DEMOD(state, PDELCTRL2);&lt;br /&gt;
+                               STV090x_SETFIELD_Px(reg, FRAME_MODE_FIELD, 1);&lt;br /&gt;
+                               if (STV090x_WRITE_DEMOD(state, PDELCTRL2, reg) &amp;lt; 0)&lt;br /&gt;
+                                       goto err;&lt;br /&gt;
                                if (STV090x_WRITE_DEMOD(state, ERRCTRL1, 0x67) &amp;lt; 0) /* PER */&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Apply with Python (handles tabs correctly):&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;python&amp;quot;&amp;gt;&lt;br /&gt;
with open(&#039;drivers/media/dvb-frontends/stv090x.c&#039;, &#039;r&#039;) as f:&lt;br /&gt;
    content = f.read()&lt;br /&gt;
&lt;br /&gt;
old = &#039;\t\t\t\tif (STV090x_WRITE_DEMOD(state, ERRCTRL1, 0x67) &amp;lt; 0) /* PER */&#039;&lt;br /&gt;
new = (&#039;\t\t\t\t/* Enable BBframe mode */\n&#039;&lt;br /&gt;
       &#039;\t\t\t\treg = STV090x_READ_DEMOD(state, PDELCTRL2);\n&#039;&lt;br /&gt;
       &#039;\t\t\t\tSTV090x_SETFIELD_Px(reg, FRAME_MODE_FIELD, 1);\n&#039;&lt;br /&gt;
       &#039;\t\t\t\tif (STV090x_WRITE_DEMOD(state, PDELCTRL2, reg) &amp;lt; 0)\n&#039;&lt;br /&gt;
       &#039;\t\t\t\t\tgoto err;\n&#039;&lt;br /&gt;
       &#039;\t\t\t\tif (STV090x_WRITE_DEMOD(state, ERRCTRL1, 0x67) &amp;lt; 0) /* PER */&#039;)&lt;br /&gt;
&lt;br /&gt;
content = content.replace(old, new, 1)&lt;br /&gt;
&lt;br /&gt;
with open(&#039;drivers/media/dvb-frontends/stv090x.c&#039;, &#039;w&#039;) as f:&lt;br /&gt;
    f.write(content)&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Building and installing the patched modules ===&lt;br /&gt;
&lt;br /&gt;
After applying both patches:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
cd ~/kernel-compile/linux-source-6.12&lt;br /&gt;
&lt;br /&gt;
# Rebuild saa716x&lt;br /&gt;
make -C . M=drivers/media/pci/saa716x modules -j$(nproc)&lt;br /&gt;
&lt;br /&gt;
# Rebuild stv090x frontend&lt;br /&gt;
make -C . M=drivers/media/dvb-frontends modules -j$(nproc)&lt;br /&gt;
&lt;br /&gt;
# Install&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_core.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_budget.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo cp drivers/media/dvb-frontends/stv090x.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/dvb-frontends/&lt;br /&gt;
&lt;br /&gt;
sudo depmod -a&lt;br /&gt;
sudo modprobe -r saa716x_budget&lt;br /&gt;
sudo modprobe saa716x_budget&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Capture Procedure ==&lt;br /&gt;
&lt;br /&gt;
Once the card is connected to a dish:&lt;br /&gt;
&lt;br /&gt;
=== 1. Create a channels.conf for the target transponder ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;text&amp;quot;&amp;gt;&lt;br /&gt;
[SomeTransponder]&lt;br /&gt;
        DELIVERY_SYSTEM = DVBS2&lt;br /&gt;
        FREQUENCY = 1550000&lt;br /&gt;
        SYMBOL_RATE = 30000000&lt;br /&gt;
        POLARIZATION = HORIZONTAL&lt;br /&gt;
        MODULATION = QPSK&lt;br /&gt;
        INNER_FEC = AUTO&lt;br /&gt;
        ROLLOFF = AUTO&lt;br /&gt;
        STREAM_ID = -1&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Note:&#039;&#039;&#039; frequency is the &#039;&#039;&#039;IF frequency&#039;&#039;&#039; after LNB downconversion, not the satellite frequency. For a universal LNB (LO = 9750 MHz low band / 10600 MHz high band), subtract accordingly.&lt;br /&gt;
&lt;br /&gt;
=== 2. Capture raw BBframes ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
dvbv5-zap -a 0 -l UNIVERSAL -S 0x80000000 -o capture.ts -c channels.conf &amp;quot;SomeTransponder&amp;quot; -m&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;-S 0x80000000&amp;lt;/code&amp;gt; sets &amp;lt;code&amp;gt;DTV_STREAM_ID&amp;lt;/code&amp;gt; to request all streams in raw mode.&lt;br /&gt;
&lt;br /&gt;
=== 3. Run dontlookup ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
git clone https://github.com/ucsdsysnet/dontlookup&lt;br /&gt;
cd dontlookup&lt;br /&gt;
pip install -r requirements.txt&lt;br /&gt;
python3 dontlookup.py capture.ts -p all&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Output IP pcaps will appear in &amp;lt;code&amp;gt;output/&amp;lt;/code&amp;gt;, open with Wireshark.&lt;br /&gt;
&lt;br /&gt;
== Known Issues / TODO ==&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;Blindscan:&#039;&#039;&#039; The STV090x driver has a &amp;lt;code&amp;gt;stv090x_blind_search()&amp;lt;/code&amp;gt; function internally but it is never triggered from userspace. The DVB core rejects symbol rate = 0. A follow-up patch to enable blindscan via srate=0 is needed.&lt;br /&gt;
* &#039;&#039;&#039;BTF generation skipped:&#039;&#039;&#039; &amp;lt;code&amp;gt;vmlinux&amp;lt;/code&amp;gt; not available for BTF, modules load fine but may affect BPF tooling.&lt;br /&gt;
* &#039;&#039;&#039;BBframe capture unverified:&#039;&#039;&#039; Patches compile and load cleanly but have not yet been tested with an actual satellite signal. Testing pending dish access at NURDspace.&lt;br /&gt;
* Test to see if we can get this working on a Raspberry Pi 5&lt;br /&gt;
&lt;br /&gt;
== References ==&lt;br /&gt;
&lt;br /&gt;
* [https://github.com/ucsdsysnet/dontlookup dontlookup paper/tool]&lt;br /&gt;
* [https://github.com/s-moch/linux-saa716x s-moch/linux-saa716x]&lt;br /&gt;
* [https://github.com/xenpac/Linux-DVB-S2-SatReceiver xenpac/Linux-DVB-S2-SatReceiver]&lt;br /&gt;
* [https://github.com/newspaperman/bbframe-tools newspaperman/bbframe-tools]&lt;br /&gt;
* [https://linuxtv.org/wiki/index.php/DVBSky_T9580 LinuxTV wiki: DVBSky T9580]&lt;br /&gt;
* [https://www.linuxtv.org/wiki/index.php/Hauppauge_WinTV-HVR-5500 LinuxTV wiki: Hauppauge WinTV-HVR-5500]&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=Template:Note&amp;diff=15945</id>
		<title>Template:Note</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=Template:Note&amp;diff=15945"/>
		<updated>2026-04-15T14:11:34Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;div class=&amp;quot;note&amp;quot; style=&amp;quot;border-left: 4px solid #36c; padding: 0.5em 1em; background: #eaf3fb;&amp;quot;&amp;gt;&lt;br /&gt;
&#039;&#039;&#039;Note:&#039;&#039;&#039; {{{1|}}}&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=Template:Note&amp;diff=15944</id>
		<title>Template:Note</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=Template:Note&amp;diff=15944"/>
		<updated>2026-04-15T14:07:44Z</updated>

		<summary type="html">&lt;p&gt;Melan: Created page with &amp;quot;&amp;lt;div class=&amp;quot;note&amp;quot; style=&amp;quot;border-left: 4px solid #36c; padding: 0.5em 1em; background: #eaf3fb;&amp;quot;&amp;gt; &amp;#039;&amp;#039;&amp;#039;Note:&amp;#039;&amp;#039;&amp;#039; {{{1}}} &amp;lt;/div&amp;gt;&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;div class=&amp;quot;note&amp;quot; style=&amp;quot;border-left: 4px solid #36c; padding: 0.5em 1em; background: #eaf3fb;&amp;quot;&amp;gt;&lt;br /&gt;
&#039;&#039;&#039;Note:&#039;&#039;&#039; {{{1}}}&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=SkyStar_2_eXpress_HD&amp;diff=15941</id>
		<title>SkyStar 2 eXpress HD</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=SkyStar_2_eXpress_HD&amp;diff=15941"/>
		<updated>2026-04-14T19:14:49Z</updated>

		<summary type="html">&lt;p&gt;Melan: /* 2. Capture raw BBframes */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=SkyStar 2 eXpress HD&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Sdr&lt;br /&gt;
|Tool=No&lt;br /&gt;
|Location=&lt;br /&gt;
}}&lt;br /&gt;
&lt;br /&gt;
== Overview ==&lt;br /&gt;
&lt;br /&gt;
This page describes the process of getting raw DVB-S2 BBframe capture working on a &#039;&#039;&#039;TechniSat SkyStar 2 eXpress HD&#039;&#039;&#039; PCIe card under Debian trixie (kernel 6.12), as part of replicating the [https://github.com/ucsdsysnet/dontlookup dontlookup] research project.&lt;br /&gt;
&lt;br /&gt;
The dontlookup paper uses a TBS5927 USB stick with a one-line driver patch to capture raw BBframes. This write-up ports that approach to the SkyStar 2 eXpress HD, which uses a different (and more interesting) chipset.&lt;br /&gt;
=== Raspberry Pi 5 ===&lt;br /&gt;
&lt;br /&gt;
The card has been confirmed working on a &#039;&#039;&#039;Raspberry Pi 5&#039;&#039;&#039; with a [https://www.suptronics.com/Xseries/x1010.html SupTronics X1010] PCIe x4 HAT. The Pi 5 exposes a PCIe Gen 2 x1 lane which is more than sufficient for a DVB card, and crucially &#039;&#039;&#039;provides 3.3V on the slot&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
The SkyStar requires a Molex power connector in addition to PCIe slot power. The X1010 HAT has a DC12V Molex input, providing 12V directly. A small buck converter is needed to generate the 5V rail for the Molex connector on the card (3.3V comes from the PCIe slot, 12V from the HAT Molex).&lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;lspci&amp;lt;/code&amp;gt; output on Pi 5:&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
0001:00:00.0 PCI bridge: Broadcom Inc. and subsidiaries BCM2712 PCIe Bridge (rev 30)&lt;br /&gt;
0001:01:00.0 Multimedia controller: Philips Semiconductors SAA7160 (rev 03)&lt;br /&gt;
0002:00:00.0 PCI bridge: Broadcom Inc. and subsidiaries BCM2712 PCIe Bridge (rev 30)&lt;br /&gt;
0002:01:00.0 Ethernet controller: Raspberry Pi Ltd RP1 PCIe 2.0 South Bridge&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
dmesg on Pi 5 (kernel &amp;lt;code&amp;gt;6.12.62+rpt-rpi-2712&amp;lt;/code&amp;gt;):&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
[  543.603095] saa716x_core: loading out-of-tree module taints kernel.&lt;br /&gt;
[  543.603753] SAA716x Budget 0001:01:00.0: found a SkyStar 2 eXpress HD PCIe card&lt;br /&gt;
[  543.603770] SAA716x Budget 0001:01:00.0: enabling device (0000 -&amp;gt; 0002)&lt;br /&gt;
[  543.603881] SAA716x Budget 0001:01:00.0:  SAA7160 Rev 3, irq: 186 (MSI)&lt;br /&gt;
[  543.613413] SAA716x Budget 0001:01:00.0: Initializing SAA716x I2C Core 0 @ 100kHz&lt;br /&gt;
[  543.616467] SAA716x Budget 0001:01:00.0: Initializing SAA716x I2C Core 1 @ 100kHz&lt;br /&gt;
[  543.619278] dvbdev: DVB: registering new adapter (SAA716x dvb adapter)&lt;br /&gt;
[  543.773006] i2c i2c-15: Attaching STV6110x&lt;br /&gt;
[  543.830525] SAA716x Budget 0001:01:00.0: DVB: registering adapter 0 frontend 0 (STV090x Multistandard)...&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Hardware ==&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;BBframe capture has not yet been tested with an actual satellite signal. Testing pending dish access at NURDspace.&lt;br /&gt;
&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;TechniSat SkyStar 2 eXpress HD&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Component !! Details&lt;br /&gt;
|-&lt;br /&gt;
| PCIe bridge || NXP SAA7160 (rev 3)&lt;br /&gt;
|-&lt;br /&gt;
| DVB-S2 demodulator || &#039;&#039;&#039;STV0903B&#039;&#039;&#039; (STV090x family)&lt;br /&gt;
|-&lt;br /&gt;
| Tuner || &#039;&#039;&#039;STV6110A&#039;&#039;&#039;&lt;br /&gt;
|-&lt;br /&gt;
| PCI ID || Appears as &amp;lt;code&amp;gt;Philips Semiconductors SAA7160&amp;lt;/code&amp;gt; in lspci&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Why This Card ===&lt;br /&gt;
&lt;br /&gt;
The STV090x family was specifically targeted because:&lt;br /&gt;
* It has hardware-level BBframe support via the &amp;lt;code&amp;gt;FRAME_MODE_FIELD&amp;lt;/code&amp;gt; bit in &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt;&lt;br /&gt;
* The mainline kernel driver (&amp;lt;code&amp;gt;stv090x&amp;lt;/code&amp;gt;) is well maintained&lt;br /&gt;
* The chip is well documented compared to alternatives&lt;br /&gt;
&lt;br /&gt;
=== 3.3V PCIe Issue ===&lt;br /&gt;
&lt;br /&gt;
AMD Ryzen systems (and many modern motherboards) do not provide 3.3V on PCIe slots, as modern GPUs don&#039;t require it. DVB cards like the SkyStar 2 eXpress HD use 3.3V for their logic and will not enumerate (&amp;lt;code&amp;gt;lspci&amp;lt;/code&amp;gt; shows nothing) on affected systems.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Workaround:&#039;&#039;&#039; Use an Intel-based system. The card was confirmed working in an X99 board. PCIe 3.3V injector risers from AliExpress are an alternative for AMD systems.&lt;br /&gt;
&lt;br /&gt;
== Software Environment ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! !! Details&lt;br /&gt;
|-&lt;br /&gt;
| OS || Debian trixie&lt;br /&gt;
|-&lt;br /&gt;
| Kernel || &amp;lt;code&amp;gt;6.12.74+deb13+1-amd64&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Driver source || [https://github.com/s-moch/linux-saa716x s-moch/linux-saa716x] (out-of-tree saa716x driver, maintained as kernel-version-specific diffs)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Building the saa716x Driver ==&lt;br /&gt;
&lt;br /&gt;
The &amp;lt;code&amp;gt;saa716x&amp;lt;/code&amp;gt; driver is not in the mainline kernel. The s-moch repo provides diffs that patch it into the kernel source tree.&lt;br /&gt;
&lt;br /&gt;
=== Install dependencies ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sudo apt install linux-source-6.12 linux-headers-$(uname -r) \&lt;br /&gt;
    libelf-dev build-essential flex bison libssl-dev wget&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Extract kernel source and apply patch ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
mkdir ~/kernel-compile &amp;amp;&amp;amp; cd ~/kernel-compile&lt;br /&gt;
wget https://github.com/s-moch/linux-saa716x/compare/saa716x-6.12.diff&lt;br /&gt;
tar xJf /usr/src/linux-source-6.12.tar.xz&lt;br /&gt;
cd linux-source-6.12&lt;br /&gt;
cp /boot/config-$(uname -r) .config&lt;br /&gt;
cp /usr/src/linux-headers-$(uname -r)/Module.symvers .&lt;br /&gt;
patch -p1 &amp;lt; ../saa716x-6.12.diff&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Configure and build ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
make olddefconfig&lt;br /&gt;
make modules_prepare&lt;br /&gt;
make syncconfig&lt;br /&gt;
&lt;br /&gt;
# Enable saa716x in config&lt;br /&gt;
scripts/config --enable SAA716X_SUPPORT&lt;br /&gt;
scripts/config --enable DVB_SAA716X_BUDGET&lt;br /&gt;
make syncconfig&lt;br /&gt;
&lt;br /&gt;
# Build just the saa716x driver&lt;br /&gt;
make -C . M=drivers/media/pci/saa716x modules -j$(nproc)&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Install ===&lt;br /&gt;
Extra step on Raspbian&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sudo mkdir -p /lib/modules/$(uname -r)/kernel/drivers/media/pci&lt;br /&gt;
sudo mkdir -p /lib/modules/$(uname -r)/kernel/drivers/media/dvb-frontends&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_core.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_budget.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo depmod -a&lt;br /&gt;
sudo modprobe saa716x_budget&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Expected dmesg output ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;text&amp;quot;&amp;gt;&lt;br /&gt;
SAA716x Budget 0000:06:00.0: found a SkyStar 2 eXpress HD PCIe card&lt;br /&gt;
SAA716x Budget 0000:06:00.0:  SAA7160 Rev 3, irq: 55 (MSI)&lt;br /&gt;
SAA716x Budget 0000:06:00.0: Initializing SAA716x I2C Core 0 @ 100kHz&lt;br /&gt;
SAA716x Budget 0000:06:00.0: Initializing SAA716x I2C Core 1 @ 100kHz&lt;br /&gt;
dvbdev: DVB: registering new adapter (SAA716x dvb adapter)&lt;br /&gt;
i2c i2c-2: Attaching STV6110x&lt;br /&gt;
SAA716x Budget 0000:06:00.0: DVB: registering adapter 0 frontend 0 (STV090x Multistandard)...&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
DVB devices appear at &amp;lt;code&amp;gt;/dev/dvb/adapter0/{demux0,dvr0,frontend0,net0}&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
== BBframe Patches ==&lt;br /&gt;
&lt;br /&gt;
Two patches are required:&lt;br /&gt;
&lt;br /&gt;
# &#039;&#039;&#039;&amp;lt;code&amp;gt;saa716x_adap.c&amp;lt;/code&amp;gt;&#039;&#039;&#039;: swap &amp;lt;code&amp;gt;dvb_dmx_swfilter&amp;lt;/code&amp;gt; for &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw&amp;lt;/code&amp;gt; so the DMA data is passed raw to userspace instead of being parsed as 188-byte TS packets&lt;br /&gt;
# &#039;&#039;&#039;&amp;lt;code&amp;gt;stv090x.c&amp;lt;/code&amp;gt;&#039;&#039;&#039;: set &amp;lt;code&amp;gt;FRAME_MODE_FIELD=1&amp;lt;/code&amp;gt; in &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt; after lock, which tells the STV0903B to output raw BBframes instead of decoded TS&lt;br /&gt;
&lt;br /&gt;
=== Background: How dontlookup&#039;s TBS5927 patch works ===&lt;br /&gt;
&lt;br /&gt;
The original dontlookup patch for the TBS5927 is a single line added to &amp;lt;code&amp;gt;tbs5927.c&amp;lt;/code&amp;gt;:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;c&amp;quot;&amp;gt;&lt;br /&gt;
.caps = DVB_USB_ADAP_RECEIVES_RAW_PAYLOAD,&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
This flag causes the dvb-usb layer to call &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw()&amp;lt;/code&amp;gt; instead of &amp;lt;code&amp;gt;dvb_dmx_swfilter()&amp;lt;/code&amp;gt;, passing raw bytes straight through. The saa716x patch replicates this at the PCI driver level.&lt;br /&gt;
&lt;br /&gt;
=== Patch 1: saa716x_adap.c (Raw DMA passthrough) ===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;File:&#039;&#039;&#039; &amp;lt;code&amp;gt;drivers/media/pci/saa716x/saa716x_adap.c&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Change &amp;lt;code&amp;gt;dvb_dmx_swfilter&amp;lt;/code&amp;gt; to &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw&amp;lt;/code&amp;gt; in the DMA completion handler:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;diff&amp;quot;&amp;gt;&lt;br /&gt;
-               dvb_dmx_swfilter(demux, data, 348 * 188);&lt;br /&gt;
+               dvb_dmx_swfilter_raw(demux, data, 348 * 188);&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Apply with:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sed -i &#039;s/dvb_dmx_swfilter(demux, data, 348 \* 188)/dvb_dmx_swfilter_raw(demux, data, 348 * 188)/&#039; \&lt;br /&gt;
    drivers/media/pci/saa716x/saa716x_adap.c&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Note:&#039;&#039;&#039; The buffer size &amp;lt;code&amp;gt;348 * 188 = 65424&amp;lt;/code&amp;gt; bytes is the DMA buffer size and is passed as-is. &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw&amp;lt;/code&amp;gt; does not assume 188-byte alignment so this is fine.&lt;br /&gt;
&lt;br /&gt;
=== Patch 2: stv090x.c (Enable BBframe mode after lock) ===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;File:&#039;&#039;&#039; &amp;lt;code&amp;gt;drivers/media/dvb-frontends/stv090x.c&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
After the demodulator achieves DVB-S2 lock, set &amp;lt;code&amp;gt;FRAME_MODE_FIELD=1&amp;lt;/code&amp;gt; in &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt;. This tells the STV0903B to output raw BBframes rather than decoded transport stream packets.&lt;br /&gt;
&lt;br /&gt;
The relevant register is defined in &amp;lt;code&amp;gt;stv090x_reg.h&amp;lt;/code&amp;gt;:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;c&amp;quot;&amp;gt;&lt;br /&gt;
#define STV090x_OFFST_Px_FRAME_MODE_FIELD  1&lt;br /&gt;
#define STV090x_WIDTH_Px_FRAME_MODE_FIELD  1&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Insert the following block after the &amp;lt;code&amp;gt;RESET_UPKO_COUNT&amp;lt;/code&amp;gt; sequence (around line 3397), immediately before the &amp;lt;code&amp;gt;ERRCTRL1&amp;lt;/code&amp;gt; write:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;diff&amp;quot;&amp;gt;&lt;br /&gt;
+                               /* Enable BBframe mode */&lt;br /&gt;
+                               reg = STV090x_READ_DEMOD(state, PDELCTRL2);&lt;br /&gt;
+                               STV090x_SETFIELD_Px(reg, FRAME_MODE_FIELD, 1);&lt;br /&gt;
+                               if (STV090x_WRITE_DEMOD(state, PDELCTRL2, reg) &amp;lt; 0)&lt;br /&gt;
+                                       goto err;&lt;br /&gt;
                                if (STV090x_WRITE_DEMOD(state, ERRCTRL1, 0x67) &amp;lt; 0) /* PER */&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Apply with Python (handles tabs correctly):&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;python&amp;quot;&amp;gt;&lt;br /&gt;
with open(&#039;drivers/media/dvb-frontends/stv090x.c&#039;, &#039;r&#039;) as f:&lt;br /&gt;
    content = f.read()&lt;br /&gt;
&lt;br /&gt;
old = &#039;\t\t\t\tif (STV090x_WRITE_DEMOD(state, ERRCTRL1, 0x67) &amp;lt; 0) /* PER */&#039;&lt;br /&gt;
new = (&#039;\t\t\t\t/* Enable BBframe mode */\n&#039;&lt;br /&gt;
       &#039;\t\t\t\treg = STV090x_READ_DEMOD(state, PDELCTRL2);\n&#039;&lt;br /&gt;
       &#039;\t\t\t\tSTV090x_SETFIELD_Px(reg, FRAME_MODE_FIELD, 1);\n&#039;&lt;br /&gt;
       &#039;\t\t\t\tif (STV090x_WRITE_DEMOD(state, PDELCTRL2, reg) &amp;lt; 0)\n&#039;&lt;br /&gt;
       &#039;\t\t\t\t\tgoto err;\n&#039;&lt;br /&gt;
       &#039;\t\t\t\tif (STV090x_WRITE_DEMOD(state, ERRCTRL1, 0x67) &amp;lt; 0) /* PER */&#039;)&lt;br /&gt;
&lt;br /&gt;
content = content.replace(old, new, 1)&lt;br /&gt;
&lt;br /&gt;
with open(&#039;drivers/media/dvb-frontends/stv090x.c&#039;, &#039;w&#039;) as f:&lt;br /&gt;
    f.write(content)&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Building and installing the patched modules ===&lt;br /&gt;
&lt;br /&gt;
After applying both patches:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
cd ~/kernel-compile/linux-source-6.12&lt;br /&gt;
&lt;br /&gt;
# Rebuild saa716x&lt;br /&gt;
make -C . M=drivers/media/pci/saa716x modules -j$(nproc)&lt;br /&gt;
&lt;br /&gt;
# Rebuild stv090x frontend&lt;br /&gt;
make -C . M=drivers/media/dvb-frontends modules -j$(nproc)&lt;br /&gt;
&lt;br /&gt;
# Install&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_core.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_budget.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo cp drivers/media/dvb-frontends/stv090x.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/dvb-frontends/&lt;br /&gt;
&lt;br /&gt;
sudo depmod -a&lt;br /&gt;
sudo modprobe -r saa716x_budget&lt;br /&gt;
sudo modprobe saa716x_budget&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Capture Procedure ==&lt;br /&gt;
&lt;br /&gt;
Once the card is connected to a dish:&lt;br /&gt;
&lt;br /&gt;
=== 1. Create a channels.conf for the target transponder ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;text&amp;quot;&amp;gt;&lt;br /&gt;
[SomeTransponder]&lt;br /&gt;
        DELIVERY_SYSTEM = DVBS2&lt;br /&gt;
        FREQUENCY = 1550000&lt;br /&gt;
        SYMBOL_RATE = 30000000&lt;br /&gt;
        POLARIZATION = HORIZONTAL&lt;br /&gt;
        MODULATION = QPSK&lt;br /&gt;
        INNER_FEC = AUTO&lt;br /&gt;
        ROLLOFF = AUTO&lt;br /&gt;
        STREAM_ID = -1&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Note:&#039;&#039;&#039; frequency is the &#039;&#039;&#039;IF frequency&#039;&#039;&#039; after LNB downconversion, not the satellite frequency. For a universal LNB (LO = 9750 MHz low band / 10600 MHz high band), subtract accordingly.&lt;br /&gt;
&lt;br /&gt;
=== 2. Capture raw BBframes ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
dvbv5-zap -a 0 -l UNIVERSAL -S 0x80000000 -o capture.ts -c channels.conf &amp;quot;SomeTransponder&amp;quot; -m&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;-S 0x80000000&amp;lt;/code&amp;gt; sets &amp;lt;code&amp;gt;DTV_STREAM_ID&amp;lt;/code&amp;gt; to request all streams in raw mode.&lt;br /&gt;
&lt;br /&gt;
=== 3. Run dontlookup ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
git clone https://github.com/ucsdsysnet/dontlookup&lt;br /&gt;
cd dontlookup&lt;br /&gt;
pip install -r requirements.txt&lt;br /&gt;
python3 dontlookup.py capture.ts -p all&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Output IP pcaps will appear in &amp;lt;code&amp;gt;output/&amp;lt;/code&amp;gt;, open with Wireshark.&lt;br /&gt;
&lt;br /&gt;
== Known Issues / TODO ==&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;Blindscan:&#039;&#039;&#039; The STV090x driver has a &amp;lt;code&amp;gt;stv090x_blind_search()&amp;lt;/code&amp;gt; function internally but it is never triggered from userspace. The DVB core rejects symbol rate = 0. A follow-up patch to enable blindscan via srate=0 is needed.&lt;br /&gt;
* &#039;&#039;&#039;BTF generation skipped:&#039;&#039;&#039; &amp;lt;code&amp;gt;vmlinux&amp;lt;/code&amp;gt; not available for BTF, modules load fine but may affect BPF tooling.&lt;br /&gt;
* &#039;&#039;&#039;BBframe capture unverified:&#039;&#039;&#039; Patches compile and load cleanly but have not yet been tested with an actual satellite signal. Testing pending dish access at NURDspace.&lt;br /&gt;
* Test to see if we can get this working on a Raspberry Pi 5&lt;br /&gt;
&lt;br /&gt;
== References ==&lt;br /&gt;
&lt;br /&gt;
* [https://github.com/ucsdsysnet/dontlookup dontlookup paper/tool]&lt;br /&gt;
* [https://github.com/s-moch/linux-saa716x s-moch/linux-saa716x]&lt;br /&gt;
* [https://github.com/xenpac/Linux-DVB-S2-SatReceiver xenpac/Linux-DVB-S2-SatReceiver]&lt;br /&gt;
* [https://github.com/newspaperman/bbframe-tools newspaperman/bbframe-tools]&lt;br /&gt;
* [https://linuxtv.org/wiki/index.php/DVBSky_T9580 LinuxTV wiki: DVBSky T9580]&lt;br /&gt;
* [https://www.linuxtv.org/wiki/index.php/Hauppauge_WinTV-HVR-5500 LinuxTV wiki: Hauppauge WinTV-HVR-5500]&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=KlikoAI&amp;diff=15940</id>
		<title>KlikoAI</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=KlikoAI&amp;diff=15940"/>
		<updated>2026-04-14T18:08:48Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=KlikoAI&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Smart stuff&lt;br /&gt;
|Purpose=Home Automation&lt;br /&gt;
|Tool=No&lt;br /&gt;
}}&lt;br /&gt;
&lt;br /&gt;
KlikoAI detects whether the paper and waste containers at NURDspace are inside or outside. Previous approaches using distance sensors (often caused spam on IRC) and BLE sensors proved unreliable (they fell right off after the container got emptied), so the project switched to AI-based vision detection instead.&lt;br /&gt;
&lt;br /&gt;
KlikoAI uses &amp;lt;code&amp;gt;mistral3:14b&amp;lt;/code&amp;gt; via llama-swap with llama.cpp as the backend. Before that, moondream was used with inference running inside KlikoAI itself, but it struggled with certain container configurations. &amp;lt;code&amp;gt;mistral3:14b&amp;lt;/code&amp;gt; showed better performance on this task.&lt;br /&gt;
&lt;br /&gt;
It runs on gpu.vm.nurd.space (as a systemd service, in &amp;lt;code&amp;gt;/opt/klikoai&amp;lt;/code&amp;gt;) on an Nvidia GeForce RTX 3080. (See https://git.nurd.space/bofh/nixos/gpu)&lt;br /&gt;
&lt;br /&gt;
KlikoAI uses the Home Assistant calendar integration to detect trash pick-up days and switches to a more frequent scan schedule on those days, falling back to once every 6 hours otherwise. There is also logic to detect significant changes in frame, though this has not yet been tested.&lt;br /&gt;
&lt;br /&gt;
State is published as an MQTT sensor to Home Assistant, which allows the &amp;quot;PUT THE TRASH OUTSIDE&amp;quot; notification to be muted for both the space&#039;s Signal group and IRC channel once the correct container has been detected outside. There is also IRC integration via the &amp;lt;code&amp;gt;!klikos&amp;lt;/code&amp;gt; and &amp;lt;code&amp;gt;!klikoupdate&amp;lt;/code&amp;gt; commands (the latter triggers a manual scan).&lt;br /&gt;
&lt;br /&gt;
A couple of bright lights controlled by an ESP8266 and a MOSFET have been added to illuminate the containers, as they sit in a fairly dark spot. As a bonus, they make for a good jumpscare when people walk past the space at night. A strobe effect has also been added for partying to gabber in the kliko corner.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;gallery&amp;gt;&lt;br /&gt;
KlikoAI_klikos.jpg|Klikos in their natural habitat.&lt;br /&gt;
KlikoAI_showcasing_lights.jpg|Lights on when inference is running&lt;br /&gt;
KlikoAI_lights_controller.jpg|ESP8266 + N-channel MOSFET controlling the lights&lt;br /&gt;
KlikoAI_lights_and_camera.jpg|Camera and light mounting&lt;br /&gt;
1b925f63993602e21b367f81270d818c1c4a0860b896b46ce5be2684d0a33952.png|What the camera sees&lt;br /&gt;
&amp;lt;/gallery&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight&amp;gt;&lt;br /&gt;
&amp;lt;@Melan&amp;gt; !klikoupdate&lt;br /&gt;
&amp;lt;@nurdbot&amp;gt; [Klikos] Running kliko inference task...&lt;br /&gt;
&amp;lt;@nurdbot&amp;gt; [Klikos] Paper: Visible Waste: Visible | Last Update: 2026-04-14 19:52:04 | Avg time: 41.48 secs&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
The inference time is expected: it runs on a shared GPU machine and the model is loaded and unloaded dynamically, which is included in the total inference time.&lt;br /&gt;
&lt;br /&gt;
We use the following prompt:&lt;br /&gt;
&amp;lt;syntaxhighlight&amp;gt;&lt;br /&gt;
Look carefully at this image.&lt;br /&gt;
I can see garbage containers. Tell me which colored LIDS are visible:&lt;br /&gt;
&lt;br /&gt;
1. Is there a YELLOW or cream colored lid?&lt;br /&gt;
2. Is there a BLUE or dark blue colored lid?&lt;br /&gt;
&lt;br /&gt;
Reply ONLY with valid JSON using double quotes:&lt;br /&gt;
{&amp;quot;yellow&amp;quot;: true, &amp;quot;blue&amp;quot;: true}&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Previous Iteration ==&lt;br /&gt;
&lt;br /&gt;
The original plan was to train a YOLO model on an existing garbage container dataset. Due to the limited camera mounting options at the space, detection results were poor, which led to switching to an LLM vision model.&lt;br /&gt;
&lt;br /&gt;
=== Dataset ===&lt;br /&gt;
&lt;br /&gt;
The bins at NURDspace have a blue lid and a yellow lid on an otherwise green body. Finding training images with those specific lid colours turned out to be harder than expected.&lt;br /&gt;
&lt;br /&gt;
YOLO returns bounding boxes, so one option would have been to inspect just the top portion of the detected box and check the colour range, or determine bin position based on where it appears in frame.&lt;br /&gt;
&lt;br /&gt;
Since the default YOLO models do not support garbage bin detection, a custom model was trained on a 5090 using [https://universe.roboflow.com/finance-insitut/garbage-container-detection-sam7i this dataset from Roboflow].&lt;br /&gt;
&lt;br /&gt;
&amp;lt;gallery&amp;gt;&lt;br /&gt;
2026-01-14_17-08-31.jpg|Before training&lt;br /&gt;
2026-01-14_18-02-49.jpg|After training&lt;br /&gt;
&amp;lt;/gallery&amp;gt;&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=KlikoAI&amp;diff=15939</id>
		<title>KlikoAI</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=KlikoAI&amp;diff=15939"/>
		<updated>2026-04-14T17:53:12Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=KlikoAI&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Smart stuff&lt;br /&gt;
|Purpose=Home Automation&lt;br /&gt;
|Tool=No&lt;br /&gt;
}}&lt;br /&gt;
&lt;br /&gt;
KlikoAI detects whether the paper and waste containers at NURDspace are inside or outside. Previous approaches using distance sensors and BLE sensors proved unreliable, so the project switched to AI-based vision detection instead.&lt;br /&gt;
&lt;br /&gt;
KlikoAI uses mistral3:14b via Ollama as the backend. Before that, moondream was used with inference running inside KlikoAI itself, but it struggled with certain container configurations. mistral3:14b showed better performance on this task.&lt;br /&gt;
&lt;br /&gt;
It runs on gpu.vm.nurd.space (via Docker, in ~/klikoai) on an Nvidia GeForce RTX 3080.&lt;br /&gt;
&lt;br /&gt;
KlikoAI uses the Home Assistant calendar integration to detect trash pick-up days and switches to a more frequent scan schedule on those days, falling back to once every 6 hours otherwise. There is also logic to detect significant changes in frame, though this has not yet been tested.&lt;br /&gt;
&lt;br /&gt;
State is published as an MQTT sensor to Home Assistant, which allows the &amp;quot;PUT THE TRASH OUTSIDE&amp;quot; notification to be muted once the correct container has been detected outside. There is also IRC integration via the !klikos and !klikoupdate commands (the latter triggers a manual scan).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;gallery&amp;gt;&lt;br /&gt;
KlikoAI_klikos.jpg|Klikos in their natural habitat. &lt;br /&gt;
KlikoAI_showcasing_lights.jpg|Lights on when interference is running&lt;br /&gt;
KlikoAI_lights_controller.jpg|ESP8226 + N channel mosfet controlling the lights&lt;br /&gt;
KlikoAI_lights_and_camera.jpg|Camera and Light mounting&lt;br /&gt;
1b925f63993602e21b367f81270d818c1c4a0860b896b46ce5be2684d0a33952.png|What the camera sees&lt;br /&gt;
&amp;lt;/gallery&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight&amp;gt;&lt;br /&gt;
&amp;lt;@Melan&amp;gt; !klikoupdate&lt;br /&gt;
&amp;lt;@nurdbot&amp;gt; [Klikos] Running kliko inference task...&lt;br /&gt;
&amp;lt;@nurdbot&amp;gt; [Klikos] Paper: Visible Waste: Visible | Last Update: 2026-04-14 19:52:04 | Avg time: 41.48 secs&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
== Previous Iteration ==&lt;br /&gt;
&lt;br /&gt;
The original plan was to train a YOLO model on an existing garbage container dataset. Due to the limited camera mounting options at the space, detection results were poor, which led to switching to an LLM vision model.&lt;br /&gt;
&lt;br /&gt;
=== Dataset ===&lt;br /&gt;
&lt;br /&gt;
The bins at NURDspace have a blue lid and a yellow lid on an otherwise green body. Finding training images with those specific lid colours turned out to be harder than expected.&lt;br /&gt;
&lt;br /&gt;
YOLO returns bounding boxes, so one option would have been to inspect just the top portion of the detected box and check the colour range, or determine bin position based on where it appears in frame.&lt;br /&gt;
&lt;br /&gt;
Since the default YOLO models do not support garbage bin detection, a custom model was trained on a 5090 using [https://universe.roboflow.com/finance-insitut/garbage-container-detection-sam7i this dataset from Roboflow].&lt;br /&gt;
&lt;br /&gt;
&amp;lt;gallery&amp;gt;&lt;br /&gt;
2026-01-14_17-08-31.jpg|Before training&lt;br /&gt;
2026-01-14_18-02-49.jpg|After training&lt;br /&gt;
&amp;lt;/gallery&amp;gt;&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=KlikoAI&amp;diff=15938</id>
		<title>KlikoAI</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=KlikoAI&amp;diff=15938"/>
		<updated>2026-04-14T17:51:40Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=KlikoAI&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Smart stuff&lt;br /&gt;
|Purpose=Home Automation&lt;br /&gt;
|Tool=No&lt;br /&gt;
}}&lt;br /&gt;
&lt;br /&gt;
KlikoAI detects whether the paper and waste containers at NURDspace are inside or outside. Previous approaches using distance sensors and BLE sensors proved unreliable, so the project switched to AI-based vision detection instead.&lt;br /&gt;
&lt;br /&gt;
KlikoAI uses mistral3:14b via Ollama as the backend. Before that, moondream was used with inference running inside KlikoAI itself, but it struggled with certain container configurations. mistral3:14b showed better performance on this task.&lt;br /&gt;
&lt;br /&gt;
It runs on gpu.vm.nurd.space (via Docker, in ~/klikoai) on an Nvidia GeForce RTX 3080.&lt;br /&gt;
&lt;br /&gt;
KlikoAI uses the Home Assistant calendar integration to detect trash pick-up days and switches to a more frequent scan schedule on those days, falling back to once every 6 hours otherwise. There is also logic to detect significant changes in frame, though this has not yet been tested.&lt;br /&gt;
&lt;br /&gt;
State is published as an MQTT sensor to Home Assistant, which allows the &amp;quot;PUT THE TRASH OUTSIDE&amp;quot; notification to be muted once the correct container has been detected outside. There is also IRC integration via the !klikos and !klikoupdate commands (the latter triggers a manual scan).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;gallery&amp;gt;&lt;br /&gt;
KlikoAI_klikos.jpg|Klikos in their natural habitat. &lt;br /&gt;
KlikoAI_showcasing_lights.jpg|Lights on when interference is running&lt;br /&gt;
KlikoAI_lights_controller.jpg|ESP8226 + N channel mosfet controlling the lights&lt;br /&gt;
KlikoAI_lights_and_camera.jpg|Camera and Light mounting&lt;br /&gt;
1b925f63993602e21b367f81270d818c1c4a0860b896b46ce5be2684d0a33952.png|What the camera sees&lt;br /&gt;
&amp;lt;/gallery&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Previous Iteration ==&lt;br /&gt;
&lt;br /&gt;
The original plan was to train a YOLO model on an existing garbage container dataset. Due to the limited camera mounting options at the space, detection results were poor, which led to switching to an LLM vision model.&lt;br /&gt;
&lt;br /&gt;
=== Dataset ===&lt;br /&gt;
&lt;br /&gt;
The bins at NURDspace have a blue lid and a yellow lid on an otherwise green body. Finding training images with those specific lid colours turned out to be harder than expected.&lt;br /&gt;
&lt;br /&gt;
YOLO returns bounding boxes, so one option would have been to inspect just the top portion of the detected box and check the colour range, or determine bin position based on where it appears in frame.&lt;br /&gt;
&lt;br /&gt;
Since the default YOLO models do not support garbage bin detection, a custom model was trained on a 5090 using [https://universe.roboflow.com/finance-insitut/garbage-container-detection-sam7i this dataset from Roboflow].&lt;br /&gt;
&lt;br /&gt;
&amp;lt;gallery&amp;gt;&lt;br /&gt;
2026-01-14_17-08-31.jpg|Before training&lt;br /&gt;
2026-01-14_18-02-49.jpg|After training&lt;br /&gt;
&amp;lt;/gallery&amp;gt;&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=File:KlikoAI_lights_and_camera.jpg&amp;diff=15937</id>
		<title>File:KlikoAI lights and camera.jpg</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=File:KlikoAI_lights_and_camera.jpg&amp;diff=15937"/>
		<updated>2026-04-14T17:50:33Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=File:KlikoAI_lights_controller.jpg&amp;diff=15935</id>
		<title>File:KlikoAI lights controller.jpg</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=File:KlikoAI_lights_controller.jpg&amp;diff=15935"/>
		<updated>2026-04-14T17:50:11Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=File:KlikoAI_showcasing_lights.jpg&amp;diff=15934</id>
		<title>File:KlikoAI showcasing lights.jpg</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=File:KlikoAI_showcasing_lights.jpg&amp;diff=15934"/>
		<updated>2026-04-14T17:49:46Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=File:KlikoAI_klikos.jpg&amp;diff=15933</id>
		<title>File:KlikoAI klikos.jpg</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=File:KlikoAI_klikos.jpg&amp;diff=15933"/>
		<updated>2026-04-14T17:49:26Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=KlikoAI&amp;diff=15931</id>
		<title>KlikoAI</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=KlikoAI&amp;diff=15931"/>
		<updated>2026-04-14T17:49:02Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=KlikoAI&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Smart stuff&lt;br /&gt;
|Purpose=Home Automation&lt;br /&gt;
|Tool=No&lt;br /&gt;
}}&lt;br /&gt;
&lt;br /&gt;
KlikoAI detects whether the paper and waste containers at NURDspace are inside or outside. Previous approaches using distance sensors and BLE sensors proved unreliable, so the project switched to AI-based vision detection instead.&lt;br /&gt;
&lt;br /&gt;
KlikoAI uses mistral3:14b via Ollama as the backend. Before that, moondream was used with inference running inside KlikoAI itself, but it struggled with certain container configurations. mistral3:14b showed better performance on this task.&lt;br /&gt;
&lt;br /&gt;
It runs on gpu.vm.nurd.space (via Docker, in ~/klikoai) on an Nvidia GeForce RTX 3080.&lt;br /&gt;
&lt;br /&gt;
KlikoAI uses the Home Assistant calendar integration to detect trash pick-up days and switches to a more frequent scan schedule on those days, falling back to once every 6 hours otherwise. There is also logic to detect significant changes in frame, though this has not yet been tested.&lt;br /&gt;
&lt;br /&gt;
State is published as an MQTT sensor to Home Assistant, which allows the &amp;quot;PUT THE TRASH OUTSIDE&amp;quot; notification to be muted once the correct container has been detected outside. There is also IRC integration via the !klikos and !klikoupdate commands (the latter triggers a manual scan).&lt;br /&gt;
&lt;br /&gt;
&amp;lt;gallery&amp;gt;&lt;br /&gt;
KlikoAI_klikos.jpg|Klikos in their natural habitat. &lt;br /&gt;
KlikoAI_showcasing_lights.jpg|Lights on when interference is running&lt;br /&gt;
KlikoAI_lights_controller.jpg|ESP8226 + N channel mosfet controlling the lights&lt;br /&gt;
KlikoAI_lights_and_camera.jpg|Camera and Light mounting&lt;br /&gt;
&amp;lt;/gallery&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Previous Iteration ==&lt;br /&gt;
&lt;br /&gt;
The original plan was to train a YOLO model on an existing garbage container dataset. Due to the limited camera mounting options at the space, detection results were poor, which led to switching to an LLM vision model.&lt;br /&gt;
&lt;br /&gt;
=== Dataset ===&lt;br /&gt;
&lt;br /&gt;
The bins at NURDspace have a blue lid and a yellow lid on an otherwise green body. Finding training images with those specific lid colours turned out to be harder than expected.&lt;br /&gt;
&lt;br /&gt;
YOLO returns bounding boxes, so one option would have been to inspect just the top portion of the detected box and check the colour range, or determine bin position based on where it appears in frame.&lt;br /&gt;
&lt;br /&gt;
Since the default YOLO models do not support garbage bin detection, a custom model was trained on a 5090 using [https://universe.roboflow.com/finance-insitut/garbage-container-detection-sam7i this dataset from Roboflow].&lt;br /&gt;
&lt;br /&gt;
&amp;lt;gallery&amp;gt;&lt;br /&gt;
2026-01-14_17-08-31.jpg|Before training&lt;br /&gt;
2026-01-14_18-02-49.jpg|After training&lt;br /&gt;
&amp;lt;/gallery&amp;gt;&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=Dontlookup&amp;diff=15930</id>
		<title>Dontlookup</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=Dontlookup&amp;diff=15930"/>
		<updated>2026-04-14T17:37:11Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=dontlookup&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Sdr&lt;br /&gt;
|Tool=No&lt;br /&gt;
|Location=&lt;br /&gt;
}}&lt;br /&gt;
= dontlookup =&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;dontlookup&#039;&#039;&#039; is an open-source tool by researchers at UC San Diego for parsing IP traffic encapsulated in raw DVB-S2(X) satellite captures. It was presented at CCS 2025.&lt;br /&gt;
&lt;br /&gt;
The name is a reference to the fact that satellite internet providers apparently did not expect anyone to be passively listening.&lt;br /&gt;
&lt;br /&gt;
NURDspace uses it (or plans to) in combination with the [[Intellian_i4_Satellite_dish]] and a DVB-S2 receiver to capture and inspect unencrypted satellite internet traffic off the air.&lt;br /&gt;
&lt;br /&gt;
== What It Does ==&lt;br /&gt;
&lt;br /&gt;
Many satellite internet providers beam IP traffic down to large coverage areas using DVB-S2 or DVB-S2X. A significant portion of this traffic is unencrypted. By capturing the raw transport stream with a DVB-S2 receiver and running it through dontlookup, you can extract actual IP packets and open them in Wireshark.&lt;br /&gt;
&lt;br /&gt;
== Capturing ==&lt;br /&gt;
&lt;br /&gt;
=== Background: BBframes ===&lt;br /&gt;
&lt;br /&gt;
DVB-S2 transmits data in &#039;&#039;&#039;Baseband Frames (BBframes)&#039;&#039;&#039; (the lowest-level data unit after forward error correction). IP traffic is encapsulated inside these frames, either directly or via GSE or MPEG-TS wrappers. dontlookup operates on raw BBframe payloads.&lt;br /&gt;
&lt;br /&gt;
The problem is that virtually every DVB-S2 receiver card exposes only a processed &#039;&#039;&#039;MPEG-TS&#039;&#039;&#039; stream to userspace. The DVB API in Linux was designed for TV reception, so the driver demodulates the signal and hands you PIDs (the raw BBframe layer is discarded). If the satellite provider uses MPEG-TS encapsulation you get lucky and this works fine. If they use direct IP or GSE encapsulation, which does not map to MPEG-TS PIDs, you get nothing.&lt;br /&gt;
&lt;br /&gt;
=== Background: Blind Scan ===&lt;br /&gt;
&lt;br /&gt;
When tuning a satellite receiver normally, you already know what you are looking for: frequency,&lt;br /&gt;
symbol rate, polarisation, and FEC parameters. These are typically sourced from a database like&lt;br /&gt;
[[https://www.lyngsat.com/ LyngSat]] or a channel list. Blind scan is the alternative: the&lt;br /&gt;
receiver sweeps the entire band and attempts to lock onto any signal it finds, determining the&lt;br /&gt;
parameters itself.&lt;br /&gt;
&lt;br /&gt;
This matters for dontlookup because the most interesting transponders, those carrying&lt;br /&gt;
unencrypted IP backhaul, are generally not listed in any public database. They are not&lt;br /&gt;
broadcast television services; they are private data links that nobody was expected to be&lt;br /&gt;
looking at. A receiver limited to known transponders will never find them.&lt;br /&gt;
&lt;br /&gt;
Blind scan is more computationally intensive than directed tuning and takes longer to complete&lt;br /&gt;
a full sweep, but it is the only reliable method to discover unknown transponders.&lt;br /&gt;
Not all DVB-S2 receiver hardware exposes blind scan capability to the Linux DVB API, even if&lt;br /&gt;
the underlying demodulator chipset supports it which is one of the reasons the [[#TBS Driver Patch|TBS5927]]&lt;br /&gt;
became the reference hardware for this project.&lt;br /&gt;
&lt;br /&gt;
=== TBS Driver Patch ===&lt;br /&gt;
&lt;br /&gt;
The dontlookup repo ships a kernel patch (&amp;lt;code&amp;gt;tbsdriver.patch&amp;lt;/code&amp;gt;) for TBS DVB-S2 receiver cards that exposes the raw BBframe stream to userspace, bypassing the normal DVB API. This is required to capture proprietary or non-MPEG-TS encapsulations.&lt;br /&gt;
&lt;br /&gt;
However, the researchers used a &#039;&#039;&#039;TBS5927&#039;&#039;&#039; which has become unobtainium.&lt;br /&gt;
&lt;br /&gt;
A &#039;&#039;&#039;TBS5925&#039;&#039;&#039; may work and is on its way to NURDspace for testing. [[User:20h]] also generously acquired a &#039;&#039;&#039;TBS-5580&#039;&#039;&#039;. Neither has been confirmed working yet.&lt;br /&gt;
&lt;br /&gt;
The TBS5925 is documented to work with EUMETCast: [https://www-cdn.eumetsat.int/files/2020-07/TBS%205925%20DVB-S2%20Receiver%20EUMETCast%20Windows%20Setup%20Guide.pdf TBS5925 EUMETCast setup guide].&lt;br /&gt;
&lt;br /&gt;
=== SAT&amp;gt;IP Devices ===&lt;br /&gt;
&lt;br /&gt;
The &#039;&#039;&#039;Digibit R1&#039;&#039;&#039; SAT&amp;gt;IP tuner used at NURDspace presents itself as a network-attached DVB-S2 tuner. It handles LNB power, DiSEqC, and tuning over the network, but only streams MPEG-TS over SAT&amp;gt;IP. There is no way to get raw BBframes out of it without hardware modifications.&lt;br /&gt;
&lt;br /&gt;
Further investigation revealed it runs STMicro&#039;s proprietary &#039;&#039;&#039;STAPI&#039;&#039;&#039; stack internally: &amp;lt;code&amp;gt;stpti5_core&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;stfdma_core&amp;lt;/code&amp;gt; etc with no &amp;lt;code&amp;gt;/dev/dvb/&amp;lt;/code&amp;gt; device exposed. minisatip talks directly to STAPI, bypassing the Linux DVB API entirely. Intercepting data at the STAPI layer to get raw BBframes would require significant reverse engineering effort.&lt;br /&gt;
&lt;br /&gt;
=== STV090x Based Chipsets ===&lt;br /&gt;
&lt;br /&gt;
The STV090x demodulator (used in many DVB-S2 cards) is capable of outputting raw BBframes at the hardware level, but the Linux driver simply never implements it. Investigation of &amp;lt;code&amp;gt;stv090x.c&amp;lt;/code&amp;gt; showed it writes an output configuration register at init:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
{ STV090x_OUTCFG, 0x00 },  /* serial TS output, hardware default */&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
The crucial register is &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt; with &amp;lt;code&amp;gt;FRAME_MODE_FIELD&amp;lt;/code&amp;gt; set to 1 - discovered via a [https://www.spinics.net/lists/linux-media/msg45597.html 2012 linux-media mailing list post] documenting exactly this on a TBS6925. One register bit is all it takes.&lt;br /&gt;
&lt;br /&gt;
It might be possible to use a [[SkyStar 2 eXpress HD]] (SAA716x + STV090x) an attempt to patch the drives has been made, but has yet to be tested. &lt;br /&gt;
&lt;br /&gt;
=== MiniTiouner / Longmynd ===&lt;br /&gt;
&lt;br /&gt;
The &#039;&#039;&#039;MiniTiouner&#039;&#039;&#039; is a USB DVB-S2 receiver designed by the British Amateur Television Club (BATC) for amateur TV reception, primarily targeting the QO-100 geostationary amateur transponder. Unlike the TBS cards, it uses the &#039;&#039;&#039;STV0910&#039;&#039;&#039; demodulator which outputs raw BBframes natively - no kernel patching required.&lt;br /&gt;
&lt;br /&gt;
The &#039;&#039;&#039;Longmynd&#039;&#039;&#039; software (also by BATC) drives the MiniTiouner and outputs BBframes directly over UDP, making it straightforwardly compatible with dontlookup.&lt;br /&gt;
&lt;br /&gt;
The catch is availability: purchasing the kit requires a BATC membership, and the hardware is not sold elsewhere.&lt;br /&gt;
&lt;br /&gt;
=== Professional IRD: Adtec RD-60 ===&lt;br /&gt;
&lt;br /&gt;
An [[ Adtec RD-60 ]] professional broadcast IRD is also available. This is the kind of kit used by actual broadcasters to receive satellite feeds.&lt;br /&gt;
&lt;br /&gt;
=== GNU Radio / gr-dvbs2rx ===&lt;br /&gt;
&lt;br /&gt;
An SDR-based approach using [https://github.com/igorauad/gr-dvbs2rx gr-dvbs2rx] (a GNU Radio out-of-tree module for DVB-S2 demodulation) was also explored. This would allow a HackRF or similar SDR to demodulate DVB-S2 and potentially extract BBframes entirely in software, without any dedicated DVB receiver hardware.&lt;br /&gt;
&lt;br /&gt;
The main constraint is bandwidth. Typical Ku-band transponders run at 27–45 Msym/s, requiring roughly that much RF bandwidth - well beyond the HackRF&#039;s 20 MHz maximum. However, some data-only transponders run significantly narrower symbol rates and could fit within an SDR&#039;s bandwidth.&lt;br /&gt;
&lt;br /&gt;
Combining two HackRFs in a phase-coherent configuration (the HackRF has explicit support for clock synchronisation between units) could double the available bandwidth and is cheaper than a LimeSDR.&lt;br /&gt;
&lt;br /&gt;
== Links ==&lt;br /&gt;
&lt;br /&gt;
* [https://github.com/ucsdsysnet/dontlookup GitHub - ucsdsysnet/dontlookup]&lt;br /&gt;
* [https://satcom.sysnet.ucsd.edu/docs/dontlookup_ccs25_fullpaper.pdf CCS 2025 paper (PDF)]&lt;br /&gt;
* [https://forums.radioreference.com/threads/dont-look-up-research-paper-on-satcom-interception.493532/]&lt;br /&gt;
* [https://youtu.be/VE7S1nk4F04 saveitforparts - Intercepting Sensitive Satellite Data Is (Scarily) Easier Than I Thought!]&lt;br /&gt;
* [https://www.spinics.net/lists/linux-media/msg45597.html linux-media 2012: STV090x BBframe patch]&lt;br /&gt;
* [https://www-cdn.eumetsat.int/files/2020-07/TBS%205925%20DVB-S2%20Receiver%20EUMETCast%20Windows%20Setup%20Guide.pdf TBS5925 EUMETCast setup guide]&lt;br /&gt;
* [https://www.satsignal.eu/wxsat/atovs/index.html SatSignal - EUMETCast receiver hardware notes]&lt;br /&gt;
* [[Intellian_i4_Satellite_dish]]&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=KlikoAI&amp;diff=15929</id>
		<title>KlikoAI</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=KlikoAI&amp;diff=15929"/>
		<updated>2026-04-14T17:35:20Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=KlikoAI&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Smart stuff&lt;br /&gt;
|Purpose=Home Automation&lt;br /&gt;
|Tool=No&lt;br /&gt;
}}&lt;br /&gt;
&lt;br /&gt;
KlikoAI detects whether the paper and waste containers at NURDspace are inside or outside. Previous approaches using distance sensors and BLE sensors proved unreliable, so the project switched to AI-based vision detection instead.&lt;br /&gt;
&lt;br /&gt;
KlikoAI uses mistral3:14b via Ollama as the backend. Before that, moondream was used with inference running inside KlikoAI itself, but it struggled with certain container configurations. mistral3:14b showed better performance on this task.&lt;br /&gt;
&lt;br /&gt;
It runs on gpu.vm.nurd.space (via Docker, in ~/klikoai) on an Nvidia GeForce RTX 3080.&lt;br /&gt;
&lt;br /&gt;
KlikoAI uses the Home Assistant calendar integration to detect trash pick-up days and switches to a more frequent scan schedule on those days, falling back to once every 6 hours otherwise. There is also logic to detect significant changes in frame, though this has not yet been tested.&lt;br /&gt;
&lt;br /&gt;
State is published as an MQTT sensor to Home Assistant, which allows the &amp;quot;PUT THE TRASH OUTSIDE&amp;quot; notification to be muted once the correct container has been detected outside. There is also IRC integration via the !klikos and !klikoupdate commands (the latter triggers a manual scan).&lt;br /&gt;
&lt;br /&gt;
== Previous Iteration ==&lt;br /&gt;
&lt;br /&gt;
The original plan was to train a YOLO model on an existing garbage container dataset. Due to the limited camera mounting options at the space, detection results were poor, which led to switching to an LLM vision model.&lt;br /&gt;
&lt;br /&gt;
=== Dataset ===&lt;br /&gt;
&lt;br /&gt;
The bins at NURDspace have a blue lid and a yellow lid on an otherwise green body. Finding training images with those specific lid colours turned out to be harder than expected.&lt;br /&gt;
&lt;br /&gt;
YOLO returns bounding boxes, so one option would have been to inspect just the top portion of the detected box and check the colour range, or determine bin position based on where it appears in frame.&lt;br /&gt;
&lt;br /&gt;
Since the default YOLO models do not support garbage bin detection, a custom model was trained on a 5090 using [https://universe.roboflow.com/finance-insitut/garbage-container-detection-sam7i this dataset from Roboflow].&lt;br /&gt;
&lt;br /&gt;
&amp;lt;gallery&amp;gt;&lt;br /&gt;
2026-01-14_17-08-31.jpg|Before training&lt;br /&gt;
2026-01-14_18-02-49.jpg|After training&lt;br /&gt;
&amp;lt;/gallery&amp;gt;&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=Adtec_RD-60&amp;diff=15928</id>
		<title>Adtec RD-60</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=Adtec_RD-60&amp;diff=15928"/>
		<updated>2026-04-14T17:33:45Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=Adtec RD-60&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Sdr&lt;br /&gt;
|Tool=No&lt;br /&gt;
|Location=the roof&lt;br /&gt;
}}&lt;br /&gt;
== Adtec RD-60 IRD ==&lt;br /&gt;
The &#039;&#039;&#039;Adtec RD-60&#039;&#039;&#039; is a 1RU integrated receiver/decoder (IRD).&lt;br /&gt;
&lt;br /&gt;
It seems the Adtec RD-60 might expose &#039;&#039;&#039;DVB-S2 baseband frames (BBFrames)&#039;&#039;&#039; below the TS layer, this might be very useful as part of the &#039;&#039;&#039;dontlookup&#039;&#039;&#039; satellite interception paper replication project. See [[dontlookup]]&lt;br /&gt;
&lt;br /&gt;
= Reverse Engineering Notes =&lt;br /&gt;
&lt;br /&gt;
== Hardware ==&lt;br /&gt;
[[File:Adtec_rd60_internals_overview.jpg|thumb|center]]&lt;br /&gt;
=== Main Unit ===&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;Model:&#039;&#039;&#039; Adtec RD-60 MultiCODEC Receiver/Decoder (IRD)&lt;br /&gt;
* &#039;&#039;&#039;Hostname:&#039;&#039;&#039; &amp;lt;code&amp;gt;GOFFERT&amp;lt;/code&amp;gt;&lt;br /&gt;
* &#039;&#039;&#039;IP:&#039;&#039;&#039; 10.1.2.172 (DHCP)&lt;br /&gt;
* &#039;&#039;&#039;CPU:&#039;&#039;&#039; IBM PowerPC PPC405GPr @ 399 MHz (GemPPC Iolite platform)&lt;br /&gt;
* &#039;&#039;&#039;PLB bus:&#039;&#039;&#039; 133 MHz | &#039;&#039;&#039;PCI bus:&#039;&#039;&#039; 33 MHz&lt;br /&gt;
* &#039;&#039;&#039;Kernel:&#039;&#039;&#039; Linux 2.6.14-gemppc-iolite&lt;br /&gt;
* &#039;&#039;&#039;Front panel:&#039;&#039;&#039; Character LCD/VFD, text only, ~40 chars wide.&lt;br /&gt;
* &#039;&#039;&#039;Storage:&#039;&#039;&#039; CompactFlash card (8 partitions, 4 used)&lt;br /&gt;
&lt;br /&gt;
It seems that the hardware doesn&#039;t do blind scan, but scripted sequential tuning might be a workaround?&lt;br /&gt;
&lt;br /&gt;
=== Demodulator Board ===&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;Slot 2:&#039;&#039;&#039; &amp;lt;code&amp;gt;BA14&amp;lt;/code&amp;gt; - PC87 ver 1.4 (main decoder board)&lt;br /&gt;
* &#039;&#039;&#039;Slot 99:&#039;&#039;&#039; &amp;lt;code&amp;gt;7044BB&amp;lt;/code&amp;gt; - &#039;&#039;&#039;Newtec NTC/7044/BB DVB Demodulator&#039;&#039;&#039;&lt;br /&gt;
** PRM firmware: &#039;&#039;&#039;v2.34&#039;&#039;&#039; (20/03/13)&lt;br /&gt;
** FPGA bitfile: v1.01 (09/01/12)&lt;br /&gt;
** Hardware: v3.0&lt;br /&gt;
** Serial: &#039;&#039;&#039;30091216&#039;&#039;&#039;&lt;br /&gt;
** Software ID: NTC/6381 DVB Demodulator&lt;br /&gt;
** Product ID: NTC/7044/BB.BCDCBCAA.x.B&lt;br /&gt;
** License: &#039;&#039;&#039;165&#039;&#039;&#039; (includes Baseband Frames, see below)&lt;br /&gt;
** Communicates via I2C (&amp;lt;code&amp;gt;rmcp_i2c&amp;lt;/code&amp;gt; kernel module)&lt;br /&gt;
** &amp;lt;code&amp;gt;BB&amp;lt;/code&amp;gt; suffix = BaseBand licensed and capable&lt;br /&gt;
&lt;br /&gt;
According to the official Newtec datasheet, the NTC/7044/BB supports explicit &#039;&#039;&#039;output mode switching&#039;&#039;&#039; between:&lt;br /&gt;
* Single transport stream&lt;br /&gt;
* Generic stream  &lt;br /&gt;
* &#039;&#039;&#039;Base Band Frames&#039;&#039;&#039; (BBFrames)&lt;br /&gt;
&lt;br /&gt;
The control interface is &#039;&#039;&#039;RMCPv2 protocol&#039;&#039;&#039; over async serial TTL or I2C implemented by the &amp;lt;code&amp;gt;rmcp_i2c&amp;lt;/code&amp;gt; kernel module. &lt;br /&gt;
This is the mechanism to switch output to BBFrame mode.&lt;br /&gt;
&lt;br /&gt;
See also this PDF: https://www.melcom.co.uk/uploads/newdvbdemodntc7044_01.pdf&lt;br /&gt;
&lt;br /&gt;
RMCP protocol docs: https://newerasystems.net/wp-content/uploads/2017/02/RMCP-Manual-1_8.pdf&lt;br /&gt;
&lt;br /&gt;
[[File:20250429 153804.jpg|thumb|center]]&lt;br /&gt;
&lt;br /&gt;
=== Inputs/Outputs ===&lt;br /&gt;
&lt;br /&gt;
* 2x RF/satellite inputs (RF1, RF2) - 950–2150 MHz, 256 kSym/s – 45 MSym/s&lt;br /&gt;
* DVB-ASI input/output (currently set to RECEIVE mode)&lt;br /&gt;
* 2x SDI outputs (SD scaling)&lt;br /&gt;
* CVBS output&lt;br /&gt;
* 3x Ethernet (eth0, eth1, eth2)&lt;br /&gt;
* Serial: ttyS0 @ 115200, ttyBA&lt;br /&gt;
* L-Band Modulator option slot - &#039;&#039;&#039;not populated&#039;&#039;&#039; (&amp;lt;code&amp;gt;/dev/ntmod&amp;lt;/code&amp;gt; = &amp;quot;No such device&amp;quot;)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Firmware / Software ==&lt;br /&gt;
&lt;br /&gt;
=== CF Card Partition Layout ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Partition !! Size !! Contents&lt;br /&gt;
|-&lt;br /&gt;
| p5 || 137M || GNU sysroot - gcc-3.4.4 / glibc-2.3.5, PPC cross toolchain&lt;br /&gt;
|-&lt;br /&gt;
| p6 || 1.1M || &#039;&#039;&#039;Firmware&#039;&#039;&#039; - adtec/RD-60/1.12.08 and 1.12.12&lt;br /&gt;
|-&lt;br /&gt;
| p7 || 3.4M || Minimal initrd (busybox, bash, minimal libs)&lt;br /&gt;
|-&lt;br /&gt;
| p8 || 24M || Runtime/data (logs, DVC profiles, media)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
* Current firmware: &#039;&#039;&#039;1.12.12&#039;&#039;&#039; (symlinked at &amp;lt;code&amp;gt;/opt/pkg/oem&amp;lt;/code&amp;gt;)&lt;br /&gt;
* Previous firmware: &#039;&#039;&#039;1.12.08&#039;&#039;&#039; (symlinked at &amp;lt;code&amp;gt;/opt/pkg/oem_prev&amp;lt;/code&amp;gt;)&lt;br /&gt;
&lt;br /&gt;
=== p8 Runtime Directories ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Dir !! Purpose&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;dvc/&amp;lt;/code&amp;gt; || Tuner device profile files (.DVC)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;keys/&amp;lt;/code&amp;gt; || Empty - key material generated at runtime&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;log/&amp;lt;/code&amp;gt; || Rotated system logs&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;media/&amp;lt;/code&amp;gt; || Media files&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;.meta/&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;freg.db&amp;lt;/code&amp;gt; - feature registry SQLite DB&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;mvl/&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;osd/&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;rdy/&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;schmi/&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;shd/&amp;lt;/code&amp;gt; || Runtime state dirs (mostly empty)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Key Binaries (&amp;lt;code&amp;gt;/usr/local/sbin/&amp;lt;/code&amp;gt;) ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Binary !! Purpose&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;sysd&amp;lt;/code&amp;gt; || Main system daemon - tuner/demodulator config via XML&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;cmdld&amp;lt;/code&amp;gt; || Telnet API daemon (3 processes)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;menud&amp;lt;/code&amp;gt; || Front panel menu daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;fregd&amp;lt;/code&amp;gt; || Feature/license registry daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;dtrans&amp;lt;/code&amp;gt; || TS transport handler (&amp;lt;code&amp;gt;--slot=2 --id=BA14&amp;lt;/code&amp;gt;)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;dcmd&amp;lt;/code&amp;gt; || Device command interface for BA14&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;myles&amp;lt;/code&amp;gt; || Web API backend (SQLite)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;requestHandler&amp;lt;/code&amp;gt; || Apache CGI/FastCGI handler&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;snmpd&amp;lt;/code&amp;gt; || SNMP daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;snmpl&amp;lt;/code&amp;gt; || Internal SNMP poller - continuously queries Newtec MIB&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;vtosfifo&amp;lt;/code&amp;gt; || TS-to-FIFO bridge to &amp;lt;code&amp;gt;/dev/vtosfifo4&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;xcpServerd&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;xcpClientd&amp;lt;/code&amp;gt; || XCP protocol daemons (3 each)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;pard&amp;lt;/code&amp;gt; || Parallel interface daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;pnpd&amp;lt;/code&amp;gt; || PnP device daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;mirror&amp;lt;/code&amp;gt; || Mirror/redundancy daemon (runs as adtec)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Kernel Modules ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Module !! Purpose&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;newtec&amp;lt;/code&amp;gt; || Newtec 7044 demodulator driver - core BBFrame driver&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;newtec_dummy&amp;lt;/code&amp;gt; || Stub for absent optional demodulator hardware&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;dvblite&amp;lt;/code&amp;gt; || DVB lite core (depends on newtec) - exposes &amp;lt;code&amp;gt;dvblite_ioctl&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;rmcp_i2c&amp;lt;/code&amp;gt; || I2C transport for Newtec RMCP protocol&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;vtosfifo&amp;lt;/code&amp;gt; || TS FIFO device driver&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;rddma_ip&amp;lt;/code&amp;gt; || &#039;&#039;&#039;IP-over-satellite receive DMA engine (FPGA-backed)&#039;&#039;&#039;&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;ip_ingress_main&amp;lt;/code&amp;gt; || IP ingress pipeline (GSE/MPE over satellite)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;frpanel&amp;lt;/code&amp;gt; || Front panel driver&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;fanctrl&amp;lt;/code&amp;gt; / &amp;lt;code&amp;gt;pc96&amp;lt;/code&amp;gt; || Fan controller&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;proxyimg&amp;lt;/code&amp;gt; || Image proxy&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;epb&amp;lt;/code&amp;gt; || EPB bus driver&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;pnp&amp;lt;/code&amp;gt; || PnP device manager&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;fec&amp;lt;/code&amp;gt; / &amp;lt;code&amp;gt;ethfrm&amp;lt;/code&amp;gt; || Ethernet/FEC&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;pc73a&amp;lt;/code&amp;gt; / &amp;lt;code&amp;gt;pc93&amp;lt;/code&amp;gt; || Front panel dependencies&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Failed to load (hardware absent): &amp;lt;code&amp;gt;teamcast&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;nim&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;lnb_pwr&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;pc72&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Device Nodes ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Device !! Purpose&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/dvblite0-2&amp;lt;/code&amp;gt; || DVB lite interfaces&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/vtosfifo0-5&amp;lt;/code&amp;gt; || TS FIFO char devices (major 240)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/tuner0-3&amp;lt;/code&amp;gt; || Tuner interfaces (major 123)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/tuner_ledgr0-3&amp;lt;/code&amp;gt; || Tuner lock (green) LEDs&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/tuner_ledrd0-3&amp;lt;/code&amp;gt; || Tuner read LEDs&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/tuner_rst0-3&amp;lt;/code&amp;gt; || Tuner resets&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/ntmod&amp;lt;/code&amp;gt; || Newtec modulator - &#039;&#039;&#039;not populated&#039;&#039;&#039;&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== /proc Driver Interfaces ==&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;/proc/driver/dvblite/fe0/info&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
NAME=NTC/7044/BB DVB Demodulator&lt;br /&gt;
FREQ_MIN=950000 / FREQ_MAX=2150000&lt;br /&gt;
SYMRATE_MIN=256000 / SYMRATE_MAX=45000000&lt;br /&gt;
S_QPSK=1/2, 2/3, 3/4, 5/6, 6/7, 7/8, AUTO&lt;br /&gt;
S_8PSK=2/3, 5/6, 8/9, AUTO&lt;br /&gt;
S2_QPSK=1/4, 1/3, 1/2, 2/5, 2/3, 3/5, 3/4, 4/5, 5/6, 8/9, 9/10&lt;br /&gt;
S2_8PSK=2/3, 3/5, 3/4, 5/6, 8/9, 9/10&lt;br /&gt;
S2_16QAM=3/4, 7/8, AUTO&lt;br /&gt;
S2_16APSK=2/3, 3/4, 4/5, 5/6, 8/9, 9/10&lt;br /&gt;
S2_32APSK=3/4, 4/5, 5/6, 8/9, 9/10&lt;br /&gt;
SOFTWARE_LICENSE=165&lt;br /&gt;
SOFTWARE_VERSION=v2.34   20/03/13&lt;br /&gt;
FPGA_BITFILE_VERSION=v1.01 09/01/12&lt;br /&gt;
HARDWARE_VERSION=v3.0&lt;br /&gt;
SERIAL_NUM=30091216&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;/proc/driver/dvblite/fe0/stats&amp;lt;/code&amp;gt; (no signal) ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
LOCK=UNLOCKED&lt;br /&gt;
RECV_LEVEL=-70.00&lt;br /&gt;
INTRATE=41470588&lt;br /&gt;
MOD_FEC=QPSK_3/4&lt;br /&gt;
BB_CRC_ERRORS=N/A        &amp;lt;- populates with live signal&lt;br /&gt;
DUMMY_PL_RATIO=N/A       &amp;lt;- populates with live signal&lt;br /&gt;
ISI_FILTER_BYTE=N/A      &amp;lt;- populates with live signal&lt;br /&gt;
BASEBAND_LEN=N/A         &amp;lt;- populates with live signal&lt;br /&gt;
FRAMES_SEC=N/A           &amp;lt;- populates with live signal&lt;br /&gt;
ALARMS=0000110001011000&lt;br /&gt;
STATE=READY&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
fe1 has same structure but &amp;lt;code&amp;gt;NAME=NTC7044&amp;lt;/code&amp;gt; (no BB suffix, no license).&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;/proc/driver/vtosfifo/chn&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
Channel 0 processed 16620 TS frames during session. Channel 4 processed 1619.&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;/proc/driver/rddma/&amp;lt;/code&amp;gt; - FPGA DMA engine ===&lt;br /&gt;
&lt;br /&gt;
* Channel 3 active: Control=&amp;lt;code&amp;gt;49C003C0&amp;lt;/code&amp;gt;, Src=&amp;lt;code&amp;gt;03F01C00&amp;lt;/code&amp;gt; (FPGA mapped)&lt;br /&gt;
* 3.98M timer IRQs, 3.98M &amp;quot;No Data&amp;quot; - idle, no satellite IP stream&lt;br /&gt;
* PID &amp;lt;code&amp;gt;0x01E1&amp;lt;/code&amp;gt; (481) being tracked&lt;br /&gt;
&lt;br /&gt;
== Kernel Module Internals (&amp;lt;code&amp;gt;strings&amp;lt;/code&amp;gt; analysis) ==&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;newtec.ko&amp;lt;/code&amp;gt; - BBFrame symbols ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
BB_CRC_ERRORS / BB_CRC_ERRORS_CURRENT / BB_CRC_ERRORS_NEXT&lt;br /&gt;
BB_DATA_FIELD_LEN / BB_DATA_FIELD_LEN_CURRENT / BB_DATA_FIELD_LEN_NEXT&lt;br /&gt;
BB_FRAMES&lt;br /&gt;
BB_GAIN / BB_GAIN_CURRENT / BB_GAIN_NEXT&lt;br /&gt;
BASEBAND_LEN&lt;br /&gt;
ISI / ISI_CTRL / ISI_CTRL_STRUCT / ISI_CTRL_STRUCT_FIELDS&lt;br /&gt;
ISI_FILTER_BYTE / ISI_MASK&lt;br /&gt;
SAT_BB_GAIN&lt;br /&gt;
ntc_debug  (module param, uint)&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;BB_DATA_FIELD_LEN&amp;lt;/code&amp;gt; and &amp;lt;code&amp;gt;BB_FRAMES&amp;lt;/code&amp;gt; suggest the driver tracks individual baseband frames, not just statistics. Very promising for BBFrame capture.&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;dvblite.ko&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
Contains &amp;lt;code&amp;gt;dvblite_ioctl&amp;lt;/code&amp;gt; - a kernel ioctl interface on &amp;lt;code&amp;gt;/dev/dvblite0&amp;lt;/code&amp;gt;. Commands unknown to be investigated with a live signal.&lt;br /&gt;
&lt;br /&gt;
== Network Services ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Service !! Port !! Notes&lt;br /&gt;
|-&lt;br /&gt;
| SSH || 22 || Legacy KEX only (diffie-hellman-group1-sha1)&lt;br /&gt;
|-&lt;br /&gt;
| Telnet API || 23 || &amp;lt;code&amp;gt;cmdld&amp;lt;/code&amp;gt; via xinetd&lt;br /&gt;
|-&lt;br /&gt;
| FTP || 21 || pure-ftpd&lt;br /&gt;
|-&lt;br /&gt;
| HTTP || 80 || Apache + myles + requestHandler&lt;br /&gt;
|-&lt;br /&gt;
| SNMP || 161 || Community &amp;lt;code&amp;gt;public&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| mDNS || 5353 || &amp;lt;code&amp;gt;GOFFERT.local&amp;lt;/code&amp;gt;&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
# SSH/SCP&lt;br /&gt;
ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa root@&amp;lt;ip&amp;gt;&lt;br /&gt;
scp -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa root@&amp;lt;ip&amp;gt;:/path /local&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Credentials (Default/Hardcoded - ZSL-2020-5603 / ExploitDB 48954) ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! User !! Password !! Notes&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;root&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;1root!&amp;lt;/code&amp;gt; || Full root SSH&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;admin&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;1admin!&amp;lt;/code&amp;gt; || Also root via sudoers&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;adtec&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;none&amp;lt;/code&amp;gt; || Telnet API / web UI&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;adtecftp&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;adtecftp2231&amp;lt;/code&amp;gt; || FTP only&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
* Password hashes: DES crypt which is crackable in seconds with &amp;lt;code&amp;gt;john&amp;lt;/code&amp;gt;&lt;br /&gt;
* &amp;lt;code&amp;gt;apache ALL=(ALL) NOPASSWD: ALL&amp;lt;/code&amp;gt; in sudoers&lt;br /&gt;
* Diagnostic package passphrase: &#039;&#039;&#039;&amp;lt;code&amp;gt;iMoo3jio&amp;lt;/code&amp;gt;&#039;&#039;&#039; (hardcoded, leaks in &amp;lt;code&amp;gt;ps aux&amp;lt;/code&amp;gt;)&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
gpg --passphrase &amp;quot;iMoo3jio&amp;quot; --batch --ignore-mdc-error --decrypt RD-60_*.tar.gpg | tar xf -&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== APIs ==&lt;br /&gt;
&lt;br /&gt;
=== Telnet API ===&lt;br /&gt;
&lt;br /&gt;
Connect: &amp;lt;code&amp;gt;telnet &amp;lt;ip&amp;gt;&amp;lt;/code&amp;gt;, login &amp;lt;code&amp;gt;adtec&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;none&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
*.SYSD SHELLCMD &amp;lt;cmd&amp;gt;          # arbitrary root shell execution!&lt;br /&gt;
*.SNMP ADTEC-NT-DEMOD-MIB::satFeedType.0 = dvbs2   # configure tuner&lt;br /&gt;
*.SNMP ADTEC-NT-DEMOD-MIB::satFeedDownlink.0 = 10960000&lt;br /&gt;
*.SNMP .1.3.6.1.4.1.19587.6000.3.999.0 i 0         # commit/apply&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== SNMP &amp;amp; Newtec Demodulator MIB ===&lt;br /&gt;
&lt;br /&gt;
OID base: &amp;lt;code&amp;gt;.1.3.6.1.4.1.19587&amp;lt;/code&amp;gt;, MIB: &amp;lt;code&amp;gt;ADTEC-NT-DEMOD-MIB&amp;lt;/code&amp;gt;, community: &amp;lt;code&amp;gt;public&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
snmpwalk -v2c -c public &amp;lt;ip&amp;gt; .1.3.6.1.4.1.19587&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Key OIDs: &amp;lt;code&amp;gt;tunerLock&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;recvLevel&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;esNo&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;linkMargin&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;modFec&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;rolloff&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;pilot&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;fecFrameType&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;unCorrFs&amp;lt;/code&amp;gt;, &#039;&#039;&#039;&amp;lt;code&amp;gt;bbCrcerrors&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &#039;&#039;&#039;&amp;lt;code&amp;gt;basebandLen&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &#039;&#039;&#039;&amp;lt;code&amp;gt;dummyPlRatio&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &#039;&#039;&#039;&amp;lt;code&amp;gt;isiFilterByte&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &#039;&#039;&#039;&amp;lt;code&amp;gt;framesSec&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &amp;lt;code&amp;gt;satFeedType&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;satFeedDownlink&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;satFeedSymRate&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;satFeedModulation&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;lnbEnable&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;lnbPolarity&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;lnbTone&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== DVC Profile Format ===&lt;br /&gt;
&lt;br /&gt;
SNMP SET commands as tuner presets, applied via Telnet API or web UI.&lt;br /&gt;
&lt;br /&gt;
== Saved Tuner Profiles ==&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;prfturktest.DVC&amp;lt;/code&amp;gt; (2018-04-28) ===&lt;br /&gt;
&lt;br /&gt;
* DVB-S, &#039;&#039;&#039;10762 MHz&#039;&#039;&#039;, KU 9750 LO → &#039;&#039;&#039;1012 MHz&#039;&#039;&#039; L-band&lt;br /&gt;
* &#039;&#039;&#039;30 MSym/s&#039;&#039;&#039;, QPSK 3/4, roll-off 35%&lt;br /&gt;
* Was &#039;&#039;&#039;LOCKED&#039;&#039;&#039; at -32 dBm when saved&lt;br /&gt;
* &amp;lt;code&amp;gt;bbCrcerrors = 1&amp;lt;/code&amp;gt; &#039;&#039;&#039;BBFrame counter was active and non-zero!&#039;&#039;&#039;&lt;br /&gt;
* Likely &#039;&#039;&#039;Türksat 42°E&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;prfMUX.DVC&amp;lt;/code&amp;gt; (2018-04-28) ===&lt;br /&gt;
&lt;br /&gt;
* DVB-S2, &#039;&#039;&#039;10960 MHz&#039;&#039;&#039;, KU 9750 LO → &#039;&#039;&#039;1210 MHz&#039;&#039;&#039; L-band&lt;br /&gt;
* &#039;&#039;&#039;8.352 MSym/s&#039;&#039;&#039;, 16APSK 2/3, roll-off 20%, pilot ON, normal frames, CCM&lt;br /&gt;
* Was unlocked when saved&lt;br /&gt;
&lt;br /&gt;
== Licensed Features (Key ID 165) ==&lt;br /&gt;
&lt;br /&gt;
DVB-DSNG + DVB-S2 + QPSK + 8-PSK + 16-QAM/16APSK + 32APSK + Symbol Rate &amp;lt;= 33 MBaud + ACM + &#039;&#039;&#039;Single TS/GS or Multiple Streams&#039;&#039;&#039; + &#039;&#039;&#039;(Baseband Frames)&#039;&#039;&#039; + no ACM client + no AES&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;BBFrame access is explicitly licensed and enabled.&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
== Encryption / CA ==&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;BISS-1 key&#039;&#039;&#039; in &amp;lt;code&amp;gt;dtrans.xml&amp;lt;/code&amp;gt;: &amp;lt;code&amp;gt;69A969BBECA0&amp;lt;/code&amp;gt;&lt;br /&gt;
* &#039;&#039;&#039;Viaccess&#039;&#039;&#039; (CA ID 0x0005) feed seen in logs &amp;amp; no card present, could not decrypt&lt;br /&gt;
&lt;br /&gt;
== IP-over-Satellite ==&lt;br /&gt;
&lt;br /&gt;
The unit has a full satellite IP receive stack beyond TS decoding:&lt;br /&gt;
&lt;br /&gt;
* &amp;lt;code&amp;gt;rddma_ip&amp;lt;/code&amp;gt; - FPGA-backed DMA for IP-from-satellite&lt;br /&gt;
* &amp;lt;code&amp;gt;ip_ingress_main&amp;lt;/code&amp;gt; - GSE/MPE ingress pipeline&lt;br /&gt;
* FPGA Channel 3 active at &amp;lt;code&amp;gt;03F01C00&amp;lt;/code&amp;gt;&lt;br /&gt;
* Currently idle - no GSE/MPE stream configured&lt;br /&gt;
&lt;br /&gt;
== Security Summary ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Issue !! Detail&lt;br /&gt;
|-&lt;br /&gt;
| Default root creds || &amp;lt;code&amp;gt;root&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;1root!&amp;lt;/code&amp;gt; over SSH&lt;br /&gt;
|-&lt;br /&gt;
| Telnet RCE || &amp;lt;code&amp;gt;*.SYSD SHELLCMD&amp;lt;/code&amp;gt; = root shell with &amp;lt;code&amp;gt;adtec&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;none&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Sudoers || &amp;lt;code&amp;gt;apache ALL=(ALL) NOPASSWD: ALL&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Shared SSH host keys || Same across all units (stored on CF card)&lt;br /&gt;
|-&lt;br /&gt;
| Weak password hashes || DES crypt, trivially crackable&lt;br /&gt;
|-&lt;br /&gt;
| GPG passphrase leak || &amp;lt;code&amp;gt;iMoo3jio&amp;lt;/code&amp;gt; visible in &amp;lt;code&amp;gt;ps aux&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Public exploit || ZSL-2020-5603 / ExploitDB 48954&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Other ==&lt;br /&gt;
== Front Panel ==&lt;br /&gt;
&lt;br /&gt;
* Driver: &amp;lt;code&amp;gt;frpanel.ko&amp;lt;/code&amp;gt; (depends on &amp;lt;code&amp;gt;pc93&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;pc73a&amp;lt;/code&amp;gt;)&lt;br /&gt;
* Device nodes: &amp;lt;code&amp;gt;/dev/frpanel0&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;/dev/frpanel1&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;/dev/frpanel2&amp;lt;/code&amp;gt;&lt;br /&gt;
* Display: 2 rows × 40 columns character LCD (PC93 I2C MCU)&lt;br /&gt;
* LCD API in &amp;lt;code&amp;gt;libsolib.so&amp;lt;/code&amp;gt;: &amp;lt;code&amp;gt;FpLcdKpInit()&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;LcdClear()&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;LcdWriteStr(char*, pos, len)&amp;lt;/code&amp;gt;&lt;br /&gt;
* Writing to &amp;lt;code&amp;gt;/dev/frpanel2&amp;lt;/code&amp;gt; activates the backlight&lt;br /&gt;
* &amp;lt;code&amp;gt;menud&amp;lt;/code&amp;gt; daemon owns the display - must be stopped before direct writes&lt;br /&gt;
* Proc interface: &amp;lt;code&amp;gt;/proc/driver/frpanel/&amp;lt;/code&amp;gt; (rows, cols, screen, type, version, access)&lt;br /&gt;
&lt;br /&gt;
== IP Reception ==&lt;br /&gt;
&lt;br /&gt;
The RD-60 supports multiple IP-based protocols for receiving transport streams:&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Protocol !! Max throughput !! Notes&lt;br /&gt;
|-&lt;br /&gt;
| UDP (unicast/multicast) || 100 Mbps || 7 DVB packets per UDP packet. No packet loss protection. Not recommended over public internet.&lt;br /&gt;
|-&lt;br /&gt;
| RTP (unicast/multicast) || 100 Mbps || 7 DVB packets per RTP packet. Adds packet sequencing for out-of-order correction.&lt;br /&gt;
|-&lt;br /&gt;
| RTP + FEC (SMPTE-2022) || 45 Mbps || FEC streams on base port N, with two FEC streams on N+2 and N+4. Handles lost packets at cost of latency/overhead.&lt;br /&gt;
|-&lt;br /&gt;
| TCP (unicast only) || 15 Mbps || No multicast support. Higher latency but reliable delivery. Recently added.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
The RD-60 automatically detects whether an incoming stream is UDP, RTP, or SMPTE-2022 FEC. TCP must be explicitly configured.&lt;br /&gt;
&lt;br /&gt;
The default mode is UDP/RTP. Switching between UDP/RTP and TCP requires a unit reboot. FEC streams require ports N+2 and N+4 to be open in addition to the base port N.&lt;br /&gt;
&lt;br /&gt;
Our unit was observed configured for UDP multicast at &amp;lt;code&amp;gt;224.0.0.5:5520&amp;lt;/code&amp;gt; (see &amp;lt;code&amp;gt;dtrans.xml&amp;lt;/code&amp;gt;).&lt;br /&gt;
&lt;br /&gt;
== Images ==&lt;br /&gt;
&amp;lt;gallery&amp;gt;&lt;br /&gt;
Adtec_rd60_internals_overview.jpg&lt;br /&gt;
Adtec_rd60_internals1.jpg&lt;br /&gt;
Adtec_rd60_internals2.jpg&lt;br /&gt;
Adtec_rd60_internals3.jpg&lt;br /&gt;
Adtec_rd60_internals4.jpg&lt;br /&gt;
Adtec_rd60_internals5.jpg&lt;br /&gt;
&amp;lt;/gallery&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== TODO (requires dish connected) ==&lt;br /&gt;
&lt;br /&gt;
* [ ] Read &amp;lt;code&amp;gt;/proc/driver/dvblite/fe0/stats&amp;lt;/code&amp;gt; with live signal - observe all BB* fields&lt;br /&gt;
* [ ] SNMP walk full &amp;lt;code&amp;gt;.1.3.6.1.4.1.19587&amp;lt;/code&amp;gt; with live signal&lt;br /&gt;
* [ ] Investigate &amp;lt;code&amp;gt;dvblite_ioctl&amp;lt;/code&amp;gt; on &amp;lt;code&amp;gt;/dev/dvblite0&amp;lt;/code&amp;gt;&lt;br /&gt;
* [ ] Enable &amp;lt;code&amp;gt;ntc_debug&amp;lt;/code&amp;gt; module param and watch dmesg&lt;br /&gt;
* [ ] Try ISI multistream filtering via SNMP SET&lt;br /&gt;
* [ ] Investigate &amp;lt;code&amp;gt;rddma_ip&amp;lt;/code&amp;gt; with GSE/MPE satellite signal&lt;br /&gt;
* [ ] Lock on Türksat 42°E: 10762 MHz / 30 MSym/s / QPSK 3/4 (known working)&lt;br /&gt;
* [ ] Identify prfMUX transponder on Lyngsat (10960 MHz / 8.352 MSym/s / 16APSK 2/3)&lt;br /&gt;
* [ ] Explore Telnet API &amp;lt;code&amp;gt;*.NTC&amp;lt;/code&amp;gt; command namespace&lt;br /&gt;
* [ ] Investigate &amp;lt;code&amp;gt;xcpServerd&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;xcpClientd&amp;lt;/code&amp;gt; XCP protocol capabilities&lt;br /&gt;
* [ ] Check if &amp;lt;code&amp;gt;schnv.DVC&amp;lt;/code&amp;gt; populates after a lock (empty offline)&lt;br /&gt;
* [ ] Read &amp;lt;code&amp;gt;freg.db&amp;lt;/code&amp;gt; contents, full feature registry dump&lt;br /&gt;
* [ ] Send RMCP command via &amp;lt;code&amp;gt;rmcp_i2c&amp;lt;/code&amp;gt; to switch NTC/7044/BB output to BBFrame mode&lt;br /&gt;
&lt;br /&gt;
== Links == &lt;br /&gt;
- [https://www.tonercable.com/pdf/RD-60_Manual.pdf manual]&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=Intellian_i4_Satellite_dish&amp;diff=15927</id>
		<title>Intellian i4 Satellite dish</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=Intellian_i4_Satellite_dish&amp;diff=15927"/>
		<updated>2026-04-14T17:31:06Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=Intellian i4 Satellite dish&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Sdr&lt;br /&gt;
|Tool=No&lt;br /&gt;
|Location=the roof&lt;br /&gt;
}}&lt;br /&gt;
= Intellian i4 Satellite Dish =&lt;br /&gt;
&lt;br /&gt;
The &#039;&#039;&#039;Intellian i4&#039;&#039;&#039; is a motorised Ku-band maritime satellite TV antenna system installed on the NURDspace roof.&lt;br /&gt;
Acquired secondhand via Marktplaats, it functions as a fully steerable ground station capable of pointing at any satellite on the geostationary arc on command.&lt;br /&gt;
&lt;br /&gt;
== Hardware ==&lt;br /&gt;
&lt;br /&gt;
=== Antenna ===&lt;br /&gt;
* &#039;&#039;&#039;Model:&#039;&#039;&#039; Intellian i4 (compact motorised VSAT-style pedestal mount)&lt;br /&gt;
* &#039;&#039;&#039;Band:&#039;&#039;&#039; Ku-band (10.7–12.75 GHz receive)&lt;br /&gt;
* &#039;&#039;&#039;LNB output (IF):&#039;&#039;&#039; 950–2150 MHz&lt;br /&gt;
* &#039;&#039;&#039;Mount:&#039;&#039;&#039; Full azimuth + elevation motorised pedestal (designed for maritime/land-mobile use)&lt;br /&gt;
&lt;br /&gt;
=== Antenna Control Unit (ACU) ===&lt;br /&gt;
* RS-232 serial interface (19200 baud, 8N1)&lt;br /&gt;
* Ethernet port (TCP/IP, &amp;lt;code&amp;gt;10.208.2.223:4002&amp;lt;/code&amp;gt;) (preferred for scripting)&lt;br /&gt;
* Official control software: &#039;&#039;&#039;Aptus&#039;&#039;&#039; (Windows-only; works via Wine)&lt;br /&gt;
&lt;br /&gt;
== Control Protocol ==&lt;br /&gt;
&lt;br /&gt;
The ACU speaks a straightforward ASCII framed protocol over serial or TCP. Commands are wrapped in curly braces with a checksum suffix.&lt;br /&gt;
&lt;br /&gt;
=== Key Commands ===&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Command !! Description !! Notes&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;{QP}&amp;lt;/code&amp;gt; || Query current antenna position || Returns azimuth + elevation&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;{AP az el}&amp;lt;/code&amp;gt; || Send antenna position response || az/el in ×100 format (e.g. 18000 = 180.00°)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;{GO az el}&amp;lt;/code&amp;gt; || Go to position || az/el in ×100 format&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;{SH heading type}&amp;lt;/code&amp;gt; || Set heading reference || type 7 = Ground Test&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;{GN}&amp;lt;/code&amp;gt; || Gyro/heading query || Returns heading in ×100 format&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Azimuth and elevation values are always &#039;&#039;&#039;×100 integers&#039;&#039;&#039; (e.g. 16250 = 162.50°).&lt;br /&gt;
&lt;br /&gt;
== Demonstrated Uses ==&lt;br /&gt;
&lt;br /&gt;
=== Watching Chinese Propaganda Beamed from Astra 1L ===&lt;br /&gt;
&lt;br /&gt;
One of the first use cases was watching CGTN HD via Astra 1L.&lt;br /&gt;
&lt;br /&gt;
=== Clarke Belt Sky Scan ===&lt;br /&gt;
&lt;br /&gt;
The dish has been used to produce 2D heatmap images of the geostationary arc by sweeping azimuth 140°–230° at elevation ~20–33° while logging RF signal level. Multiple satellites are clearly resolved as distinct bright blobs.&lt;br /&gt;
&lt;br /&gt;
Signal level was read from the ACU&#039;s internal AGC output (not via SDR), building up a power-vs-position map as the dish swept.&lt;br /&gt;
A future goal is to replace the ACU signal level readout with a modified satellite finder connected to an Arduino + ADC for more direct RF power measurement.&lt;br /&gt;
&lt;br /&gt;
[[File:Sky scan 20260126-013235.png|thumb|center|Clarke Belt sky scan geostationary arc, azimuth 140°–230°]]&lt;br /&gt;
&lt;br /&gt;
== Goals ==&lt;br /&gt;
&lt;br /&gt;
=== Auto-Skew ===&lt;br /&gt;
&lt;br /&gt;
It might be interesting to add auto-skew control to the LNB.&lt;br /&gt;
&lt;br /&gt;
=== dontlookup Integration ===&lt;br /&gt;
&lt;br /&gt;
The plan is to use the dish with the [[dontlookup]] project to capture and analyse satellite internet traffic.&lt;br /&gt;
&lt;br /&gt;
=== IRC Plugin ===&lt;br /&gt;
&lt;br /&gt;
It would be cool to have an IRC plugin showing the coordinates the dish is currently pointed at, and optionally signal levels.&lt;br /&gt;
&lt;br /&gt;
=== Move the dish ===&lt;br /&gt;
The dish&#039;s current position on the roof might not be the optimal location, we might have to move the dish.&lt;br /&gt;
&lt;br /&gt;
=== Pretend-to-be-a-boat ===&lt;br /&gt;
Add a MCU + RS422 to the NMEA IN on the ACU and pretend our heading is 0° so the dish can calculate the correct offsets.&lt;br /&gt;
&lt;br /&gt;
== Links ==&lt;br /&gt;
&lt;br /&gt;
* [https://intelliantech.com/en/products/marine-satellite-tv/i4 Intellian i4 product page]&lt;br /&gt;
* [https://drive.google.com/drive/folders/1JSQBLE6q4ek3xGKxx8AiK_yDOuuoIicD?usp=drive_link Aptus Software]&lt;br /&gt;
* [https://gist.github.com/Melanpan/83196f626b3851ecf726993364770c5a ACU Protocol specification]&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=Dontlookup&amp;diff=15926</id>
		<title>Dontlookup</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=Dontlookup&amp;diff=15926"/>
		<updated>2026-04-14T17:30:43Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=dontlookup&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Sdr&lt;br /&gt;
|Tool=No&lt;br /&gt;
|Location=&lt;br /&gt;
}}&lt;br /&gt;
= dontlookup =&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;dontlookup&#039;&#039;&#039; is an open-source tool by researchers at UC San Diego for parsing IP traffic encapsulated in raw DVB-S2(X) satellite captures. It was presented at CCS 2025.&lt;br /&gt;
&lt;br /&gt;
The name is a reference to the fact that satellite internet providers apparently did not expect anyone to be passively listening.&lt;br /&gt;
&lt;br /&gt;
NURDspace uses it (or plans to) in combination with the [[Intellian_i4_Satellite_dish]] and a DVB-S2 receiver to capture and inspect unencrypted satellite internet traffic off the air.&lt;br /&gt;
&lt;br /&gt;
== What It Does ==&lt;br /&gt;
&lt;br /&gt;
Many satellite internet providers beam IP traffic down to large coverage areas using DVB-S2 or DVB-S2X. A significant portion of this traffic is unencrypted. By capturing the raw transport stream with a DVB-S2 receiver and running it through dontlookup, you can extract actual IP packets and open them in Wireshark.&lt;br /&gt;
&lt;br /&gt;
== Capturing ==&lt;br /&gt;
&lt;br /&gt;
=== Background: BBframes ===&lt;br /&gt;
&lt;br /&gt;
DVB-S2 transmits data in &#039;&#039;&#039;Baseband Frames (BBframes)&#039;&#039;&#039; (the lowest-level data unit after forward error correction). IP traffic is encapsulated inside these frames, either directly or via GSE or MPEG-TS wrappers. dontlookup operates on raw BBframe payloads.&lt;br /&gt;
&lt;br /&gt;
The problem is that virtually every DVB-S2 receiver card exposes only a processed &#039;&#039;&#039;MPEG-TS&#039;&#039;&#039; stream to userspace. The DVB API in Linux was designed for TV reception, so the driver demodulates the signal and hands you PIDs (the raw BBframe layer is discarded). If the satellite provider uses MPEG-TS encapsulation you get lucky and this works fine. If they use direct IP or GSE encapsulation, which does not map to MPEG-TS PIDs, you get nothing.&lt;br /&gt;
&lt;br /&gt;
=== Background: Blind Scan ===&lt;br /&gt;
&lt;br /&gt;
When tuning a satellite receiver normally, you already know what you are looking for: frequency,&lt;br /&gt;
symbol rate, polarisation, and FEC parameters. These are typically sourced from a database like&lt;br /&gt;
[[https://www.lyngsat.com/ LyngSat]] or a channel list. Blind scan is the alternative: the&lt;br /&gt;
receiver sweeps the entire band and attempts to lock onto any signal it finds, determining the&lt;br /&gt;
parameters itself.&lt;br /&gt;
&lt;br /&gt;
This matters for dontlookup because the most interesting transponders, those carrying&lt;br /&gt;
unencrypted IP backhaul, are generally not listed in any public database. They are not&lt;br /&gt;
broadcast television services; they are private data links that nobody was expected to be&lt;br /&gt;
looking at. A receiver limited to known transponders will never find them.&lt;br /&gt;
&lt;br /&gt;
Blind scan is more computationally intensive than directed tuning and takes longer to complete&lt;br /&gt;
a full sweep, but it is the only reliable method to discover unknown transponders.&lt;br /&gt;
Not all DVB-S2 receiver hardware exposes blind scan capability to the Linux DVB API, even if&lt;br /&gt;
the underlying demodulator chipset supports it which is one of the reasons the [[#TBS Driver Patch|TBS5927]]&lt;br /&gt;
became the reference hardware for this project.&lt;br /&gt;
&lt;br /&gt;
=== TBS Driver Patch ===&lt;br /&gt;
&lt;br /&gt;
The dontlookup repo ships a kernel patch (&amp;lt;code&amp;gt;tbsdriver.patch&amp;lt;/code&amp;gt;) for TBS DVB-S2 receiver cards that exposes the raw BBframe stream to userspace, bypassing the normal DVB API. This is required to capture proprietary or non-MPEG-TS encapsulations.&lt;br /&gt;
&lt;br /&gt;
However, the researchers used a &#039;&#039;&#039;TBS5927&#039;&#039;&#039; which has become unobtainium.&lt;br /&gt;
&lt;br /&gt;
A &#039;&#039;&#039;TBS5925&#039;&#039;&#039; may work and is on its way to NURDspace for testing. [[User:20h]] also generously acquired a &#039;&#039;&#039;TBS-5580&#039;&#039;&#039;. Neither has been confirmed working yet.&lt;br /&gt;
&lt;br /&gt;
The TBS5925 is documented to work with EUMETCast: [https://www-cdn.eumetsat.int/files/2020-07/TBS%205925%20DVB-S2%20Receiver%20EUMETCast%20Windows%20Setup%20Guide.pdf TBS5925 EUMETCast setup guide].&lt;br /&gt;
&lt;br /&gt;
=== SAT&amp;gt;IP Devices ===&lt;br /&gt;
&lt;br /&gt;
The &#039;&#039;&#039;Digibit R1&#039;&#039;&#039; SAT&amp;gt;IP tuner used at NURDspace presents itself as a network-attached DVB-S2 tuner. It handles LNB power, DiSEqC, and tuning over the network, but only streams MPEG-TS over SAT&amp;gt;IP. There is no way to get raw BBframes out of it without hardware modifications.&lt;br /&gt;
&lt;br /&gt;
Further investigation revealed it runs STMicro&#039;s proprietary &#039;&#039;&#039;STAPI&#039;&#039;&#039; stack internally: &amp;lt;code&amp;gt;stpti5_core&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;stfdma_core&amp;lt;/code&amp;gt; etc with no &amp;lt;code&amp;gt;/dev/dvb/&amp;lt;/code&amp;gt; device exposed. minisatip talks directly to STAPI, bypassing the Linux DVB API entirely. Intercepting data at the STAPI layer to get raw BBframes would require significant reverse engineering effort.&lt;br /&gt;
&lt;br /&gt;
=== STV090x Based Chipsets ===&lt;br /&gt;
&lt;br /&gt;
The STV090x demodulator (used in many DVB-S2 cards) is capable of outputting raw BBframes at the hardware level, but the Linux driver simply never implements it. Investigation of &amp;lt;code&amp;gt;stv090x.c&amp;lt;/code&amp;gt; showed it writes an output configuration register at init:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
{ STV090x_OUTCFG, 0x00 },  /* serial TS output, hardware default */&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
The crucial register is &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt; with &amp;lt;code&amp;gt;FRAME_MODE_FIELD&amp;lt;/code&amp;gt; set to 1 — discovered via a [https://www.spinics.net/lists/linux-media/msg45597.html 2012 linux-media mailing list post] documenting exactly this on a TBS6925. One register bit is all it takes.&lt;br /&gt;
&lt;br /&gt;
It might be possible to use a [[SkyStar 2 eXpress HD]] (SAA716x + STV090x) an attempt to patch the drives has been made, but has yet to be tested. &lt;br /&gt;
&lt;br /&gt;
=== MiniTiouner / Longmynd ===&lt;br /&gt;
&lt;br /&gt;
The &#039;&#039;&#039;MiniTiouner&#039;&#039;&#039; is a USB DVB-S2 receiver designed by the British Amateur Television Club (BATC) for amateur TV reception, primarily targeting the QO-100 geostationary amateur transponder. Unlike the TBS cards, it uses the &#039;&#039;&#039;STV0910&#039;&#039;&#039; demodulator which outputs raw BBframes natively — no kernel patching required.&lt;br /&gt;
&lt;br /&gt;
The &#039;&#039;&#039;Longmynd&#039;&#039;&#039; software (also by BATC) drives the MiniTiouner and outputs BBframes directly over UDP, making it straightforwardly compatible with dontlookup.&lt;br /&gt;
&lt;br /&gt;
The catch is availability: purchasing the kit requires a BATC membership, and the hardware is not sold elsewhere.&lt;br /&gt;
&lt;br /&gt;
=== Professional IRD: Adtec RD-60 ===&lt;br /&gt;
&lt;br /&gt;
An [[ Adtec RD-60 ]] professional broadcast IRD is also available. This is the kind of kit used by actual broadcasters to receive satellite feeds.&lt;br /&gt;
&lt;br /&gt;
=== GNU Radio / gr-dvbs2rx ===&lt;br /&gt;
&lt;br /&gt;
An SDR-based approach using [https://github.com/igorauad/gr-dvbs2rx gr-dvbs2rx] (a GNU Radio out-of-tree module for DVB-S2 demodulation) was also explored. This would allow a HackRF or similar SDR to demodulate DVB-S2 and potentially extract BBframes entirely in software, without any dedicated DVB receiver hardware.&lt;br /&gt;
&lt;br /&gt;
The main constraint is bandwidth. Typical Ku-band transponders run at 27–45 Msym/s, requiring roughly that much RF bandwidth — well beyond the HackRF&#039;s 20 MHz maximum. However, some data-only transponders run significantly narrower symbol rates and could fit within an SDR&#039;s bandwidth.&lt;br /&gt;
&lt;br /&gt;
Combining two HackRFs in a phase-coherent configuration (the HackRF has explicit support for clock synchronisation between units) could double the available bandwidth and is cheaper than a LimeSDR.&lt;br /&gt;
&lt;br /&gt;
== Links ==&lt;br /&gt;
&lt;br /&gt;
* [https://github.com/ucsdsysnet/dontlookup GitHub — ucsdsysnet/dontlookup]&lt;br /&gt;
* [https://satcom.sysnet.ucsd.edu/docs/dontlookup_ccs25_fullpaper.pdf CCS 2025 paper (PDF)]&lt;br /&gt;
* [https://forums.radioreference.com/threads/dont-look-up-research-paper-on-satcom-interception.493532/]&lt;br /&gt;
* [https://youtu.be/VE7S1nk4F04 saveitforparts — Intercepting Sensitive Satellite Data Is (Scarily) Easier Than I Thought!]&lt;br /&gt;
* [https://www.spinics.net/lists/linux-media/msg45597.html linux-media 2012: STV090x BBframe patch]&lt;br /&gt;
* [https://www-cdn.eumetsat.int/files/2020-07/TBS%205925%20DVB-S2%20Receiver%20EUMETCast%20Windows%20Setup%20Guide.pdf TBS5925 EUMETCast setup guide]&lt;br /&gt;
* [https://www.satsignal.eu/wxsat/atovs/index.html SatSignal — EUMETCast receiver hardware notes]&lt;br /&gt;
* [[Intellian_i4_Satellite_dish]]&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=SkyStar_2_eXpress_HD&amp;diff=15925</id>
		<title>SkyStar 2 eXpress HD</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=SkyStar_2_eXpress_HD&amp;diff=15925"/>
		<updated>2026-04-14T17:28:35Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=SkyStar 2 eXpress HD&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Sdr&lt;br /&gt;
|Tool=No&lt;br /&gt;
|Location=&lt;br /&gt;
}}&lt;br /&gt;
&lt;br /&gt;
== Overview ==&lt;br /&gt;
&lt;br /&gt;
This page describes the process of getting raw DVB-S2 BBframe capture working on a &#039;&#039;&#039;TechniSat SkyStar 2 eXpress HD&#039;&#039;&#039; PCIe card under Debian trixie (kernel 6.12), as part of replicating the [https://github.com/ucsdsysnet/dontlookup dontlookup] research project.&lt;br /&gt;
&lt;br /&gt;
The dontlookup paper uses a TBS5927 USB stick with a one-line driver patch to capture raw BBframes. This write-up ports that approach to the SkyStar 2 eXpress HD, which uses a different (and more interesting) chipset.&lt;br /&gt;
=== Raspberry Pi 5 ===&lt;br /&gt;
&lt;br /&gt;
The card has been confirmed working on a &#039;&#039;&#039;Raspberry Pi 5&#039;&#039;&#039; with a [https://www.suptronics.com/Xseries/x1010.html SupTronics X1010] PCIe x4 HAT. The Pi 5 exposes a PCIe Gen 2 x1 lane which is more than sufficient for a DVB card, and crucially &#039;&#039;&#039;provides 3.3V on the slot&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
The SkyStar requires a Molex power connector in addition to PCIe slot power. The X1010 HAT has a DC12V Molex input, providing 12V directly. A small buck converter is needed to generate the 5V rail for the Molex connector on the card (3.3V comes from the PCIe slot, 12V from the HAT Molex).&lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;lspci&amp;lt;/code&amp;gt; output on Pi 5:&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
0001:00:00.0 PCI bridge: Broadcom Inc. and subsidiaries BCM2712 PCIe Bridge (rev 30)&lt;br /&gt;
0001:01:00.0 Multimedia controller: Philips Semiconductors SAA7160 (rev 03)&lt;br /&gt;
0002:00:00.0 PCI bridge: Broadcom Inc. and subsidiaries BCM2712 PCIe Bridge (rev 30)&lt;br /&gt;
0002:01:00.0 Ethernet controller: Raspberry Pi Ltd RP1 PCIe 2.0 South Bridge&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
dmesg on Pi 5 (kernel &amp;lt;code&amp;gt;6.12.62+rpt-rpi-2712&amp;lt;/code&amp;gt;):&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
[  543.603095] saa716x_core: loading out-of-tree module taints kernel.&lt;br /&gt;
[  543.603753] SAA716x Budget 0001:01:00.0: found a SkyStar 2 eXpress HD PCIe card&lt;br /&gt;
[  543.603770] SAA716x Budget 0001:01:00.0: enabling device (0000 -&amp;gt; 0002)&lt;br /&gt;
[  543.603881] SAA716x Budget 0001:01:00.0:  SAA7160 Rev 3, irq: 186 (MSI)&lt;br /&gt;
[  543.613413] SAA716x Budget 0001:01:00.0: Initializing SAA716x I2C Core 0 @ 100kHz&lt;br /&gt;
[  543.616467] SAA716x Budget 0001:01:00.0: Initializing SAA716x I2C Core 1 @ 100kHz&lt;br /&gt;
[  543.619278] dvbdev: DVB: registering new adapter (SAA716x dvb adapter)&lt;br /&gt;
[  543.773006] i2c i2c-15: Attaching STV6110x&lt;br /&gt;
[  543.830525] SAA716x Budget 0001:01:00.0: DVB: registering adapter 0 frontend 0 (STV090x Multistandard)...&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Hardware ==&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;BBframe capture has not yet been tested with an actual satellite signal. Testing pending dish access at NURDspace.&lt;br /&gt;
&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;TechniSat SkyStar 2 eXpress HD&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Component !! Details&lt;br /&gt;
|-&lt;br /&gt;
| PCIe bridge || NXP SAA7160 (rev 3)&lt;br /&gt;
|-&lt;br /&gt;
| DVB-S2 demodulator || &#039;&#039;&#039;STV0903B&#039;&#039;&#039; (STV090x family)&lt;br /&gt;
|-&lt;br /&gt;
| Tuner || &#039;&#039;&#039;STV6110A&#039;&#039;&#039;&lt;br /&gt;
|-&lt;br /&gt;
| PCI ID || Appears as &amp;lt;code&amp;gt;Philips Semiconductors SAA7160&amp;lt;/code&amp;gt; in lspci&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Why This Card ===&lt;br /&gt;
&lt;br /&gt;
The STV090x family was specifically targeted because:&lt;br /&gt;
* It has hardware-level BBframe support via the &amp;lt;code&amp;gt;FRAME_MODE_FIELD&amp;lt;/code&amp;gt; bit in &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt;&lt;br /&gt;
* The mainline kernel driver (&amp;lt;code&amp;gt;stv090x&amp;lt;/code&amp;gt;) is well maintained&lt;br /&gt;
* The chip is well documented compared to alternatives&lt;br /&gt;
&lt;br /&gt;
=== 3.3V PCIe Issue ===&lt;br /&gt;
&lt;br /&gt;
AMD Ryzen systems (and many modern motherboards) do not provide 3.3V on PCIe slots, as modern GPUs don&#039;t require it. DVB cards like the SkyStar 2 eXpress HD use 3.3V for their logic and will not enumerate (&amp;lt;code&amp;gt;lspci&amp;lt;/code&amp;gt; shows nothing) on affected systems.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Workaround:&#039;&#039;&#039; Use an Intel-based system. The card was confirmed working in an X99 board. PCIe 3.3V injector risers from AliExpress are an alternative for AMD systems.&lt;br /&gt;
&lt;br /&gt;
== Software Environment ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! !! Details&lt;br /&gt;
|-&lt;br /&gt;
| OS || Debian trixie&lt;br /&gt;
|-&lt;br /&gt;
| Kernel || &amp;lt;code&amp;gt;6.12.74+deb13+1-amd64&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Driver source || [https://github.com/s-moch/linux-saa716x s-moch/linux-saa716x] (out-of-tree saa716x driver, maintained as kernel-version-specific diffs)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Building the saa716x Driver ==&lt;br /&gt;
&lt;br /&gt;
The &amp;lt;code&amp;gt;saa716x&amp;lt;/code&amp;gt; driver is not in the mainline kernel. The s-moch repo provides diffs that patch it into the kernel source tree.&lt;br /&gt;
&lt;br /&gt;
=== Install dependencies ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sudo apt install linux-source-6.12 linux-headers-$(uname -r) \&lt;br /&gt;
    libelf-dev build-essential flex bison libssl-dev wget&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Extract kernel source and apply patch ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
mkdir ~/kernel-compile &amp;amp;&amp;amp; cd ~/kernel-compile&lt;br /&gt;
wget https://github.com/s-moch/linux-saa716x/compare/saa716x-6.12.diff&lt;br /&gt;
tar xJf /usr/src/linux-source-6.12.tar.xz&lt;br /&gt;
cd linux-source-6.12&lt;br /&gt;
cp /boot/config-$(uname -r) .config&lt;br /&gt;
cp /usr/src/linux-headers-$(uname -r)/Module.symvers .&lt;br /&gt;
patch -p1 &amp;lt; ../saa716x-6.12.diff&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Configure and build ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
make olddefconfig&lt;br /&gt;
make modules_prepare&lt;br /&gt;
make syncconfig&lt;br /&gt;
&lt;br /&gt;
# Enable saa716x in config&lt;br /&gt;
scripts/config --enable SAA716X_SUPPORT&lt;br /&gt;
scripts/config --enable DVB_SAA716X_BUDGET&lt;br /&gt;
make syncconfig&lt;br /&gt;
&lt;br /&gt;
# Build just the saa716x driver&lt;br /&gt;
make -C . M=drivers/media/pci/saa716x modules -j$(nproc)&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Install ===&lt;br /&gt;
Extra step on Raspbian&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sudo mkdir -p /lib/modules/$(uname -r)/kernel/drivers/media/pci&lt;br /&gt;
sudo mkdir -p /lib/modules/$(uname -r)/kernel/drivers/media/dvb-frontends&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_core.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_budget.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo depmod -a&lt;br /&gt;
sudo modprobe saa716x_budget&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Expected dmesg output ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;text&amp;quot;&amp;gt;&lt;br /&gt;
SAA716x Budget 0000:06:00.0: found a SkyStar 2 eXpress HD PCIe card&lt;br /&gt;
SAA716x Budget 0000:06:00.0:  SAA7160 Rev 3, irq: 55 (MSI)&lt;br /&gt;
SAA716x Budget 0000:06:00.0: Initializing SAA716x I2C Core 0 @ 100kHz&lt;br /&gt;
SAA716x Budget 0000:06:00.0: Initializing SAA716x I2C Core 1 @ 100kHz&lt;br /&gt;
dvbdev: DVB: registering new adapter (SAA716x dvb adapter)&lt;br /&gt;
i2c i2c-2: Attaching STV6110x&lt;br /&gt;
SAA716x Budget 0000:06:00.0: DVB: registering adapter 0 frontend 0 (STV090x Multistandard)...&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
DVB devices appear at &amp;lt;code&amp;gt;/dev/dvb/adapter0/{demux0,dvr0,frontend0,net0}&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
== BBframe Patches ==&lt;br /&gt;
&lt;br /&gt;
Two patches are required:&lt;br /&gt;
&lt;br /&gt;
# &#039;&#039;&#039;&amp;lt;code&amp;gt;saa716x_adap.c&amp;lt;/code&amp;gt;&#039;&#039;&#039;: swap &amp;lt;code&amp;gt;dvb_dmx_swfilter&amp;lt;/code&amp;gt; for &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw&amp;lt;/code&amp;gt; so the DMA data is passed raw to userspace instead of being parsed as 188-byte TS packets&lt;br /&gt;
# &#039;&#039;&#039;&amp;lt;code&amp;gt;stv090x.c&amp;lt;/code&amp;gt;&#039;&#039;&#039;: set &amp;lt;code&amp;gt;FRAME_MODE_FIELD=1&amp;lt;/code&amp;gt; in &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt; after lock, which tells the STV0903B to output raw BBframes instead of decoded TS&lt;br /&gt;
&lt;br /&gt;
=== Background: How dontlookup&#039;s TBS5927 patch works ===&lt;br /&gt;
&lt;br /&gt;
The original dontlookup patch for the TBS5927 is a single line added to &amp;lt;code&amp;gt;tbs5927.c&amp;lt;/code&amp;gt;:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;c&amp;quot;&amp;gt;&lt;br /&gt;
.caps = DVB_USB_ADAP_RECEIVES_RAW_PAYLOAD,&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
This flag causes the dvb-usb layer to call &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw()&amp;lt;/code&amp;gt; instead of &amp;lt;code&amp;gt;dvb_dmx_swfilter()&amp;lt;/code&amp;gt;, passing raw bytes straight through. The saa716x patch replicates this at the PCI driver level.&lt;br /&gt;
&lt;br /&gt;
=== Patch 1: saa716x_adap.c (Raw DMA passthrough) ===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;File:&#039;&#039;&#039; &amp;lt;code&amp;gt;drivers/media/pci/saa716x/saa716x_adap.c&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Change &amp;lt;code&amp;gt;dvb_dmx_swfilter&amp;lt;/code&amp;gt; to &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw&amp;lt;/code&amp;gt; in the DMA completion handler:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;diff&amp;quot;&amp;gt;&lt;br /&gt;
-               dvb_dmx_swfilter(demux, data, 348 * 188);&lt;br /&gt;
+               dvb_dmx_swfilter_raw(demux, data, 348 * 188);&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Apply with:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sed -i &#039;s/dvb_dmx_swfilter(demux, data, 348 \* 188)/dvb_dmx_swfilter_raw(demux, data, 348 * 188)/&#039; \&lt;br /&gt;
    drivers/media/pci/saa716x/saa716x_adap.c&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Note:&#039;&#039;&#039; The buffer size &amp;lt;code&amp;gt;348 * 188 = 65424&amp;lt;/code&amp;gt; bytes is the DMA buffer size and is passed as-is. &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw&amp;lt;/code&amp;gt; does not assume 188-byte alignment so this is fine.&lt;br /&gt;
&lt;br /&gt;
=== Patch 2: stv090x.c (Enable BBframe mode after lock) ===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;File:&#039;&#039;&#039; &amp;lt;code&amp;gt;drivers/media/dvb-frontends/stv090x.c&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
After the demodulator achieves DVB-S2 lock, set &amp;lt;code&amp;gt;FRAME_MODE_FIELD=1&amp;lt;/code&amp;gt; in &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt;. This tells the STV0903B to output raw BBframes rather than decoded transport stream packets.&lt;br /&gt;
&lt;br /&gt;
The relevant register is defined in &amp;lt;code&amp;gt;stv090x_reg.h&amp;lt;/code&amp;gt;:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;c&amp;quot;&amp;gt;&lt;br /&gt;
#define STV090x_OFFST_Px_FRAME_MODE_FIELD  1&lt;br /&gt;
#define STV090x_WIDTH_Px_FRAME_MODE_FIELD  1&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Insert the following block after the &amp;lt;code&amp;gt;RESET_UPKO_COUNT&amp;lt;/code&amp;gt; sequence (around line 3397), immediately before the &amp;lt;code&amp;gt;ERRCTRL1&amp;lt;/code&amp;gt; write:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;diff&amp;quot;&amp;gt;&lt;br /&gt;
+                               /* Enable BBframe mode */&lt;br /&gt;
+                               reg = STV090x_READ_DEMOD(state, PDELCTRL2);&lt;br /&gt;
+                               STV090x_SETFIELD_Px(reg, FRAME_MODE_FIELD, 1);&lt;br /&gt;
+                               if (STV090x_WRITE_DEMOD(state, PDELCTRL2, reg) &amp;lt; 0)&lt;br /&gt;
+                                       goto err;&lt;br /&gt;
                                if (STV090x_WRITE_DEMOD(state, ERRCTRL1, 0x67) &amp;lt; 0) /* PER */&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Apply with Python (handles tabs correctly):&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;python&amp;quot;&amp;gt;&lt;br /&gt;
with open(&#039;drivers/media/dvb-frontends/stv090x.c&#039;, &#039;r&#039;) as f:&lt;br /&gt;
    content = f.read()&lt;br /&gt;
&lt;br /&gt;
old = &#039;\t\t\t\tif (STV090x_WRITE_DEMOD(state, ERRCTRL1, 0x67) &amp;lt; 0) /* PER */&#039;&lt;br /&gt;
new = (&#039;\t\t\t\t/* Enable BBframe mode */\n&#039;&lt;br /&gt;
       &#039;\t\t\t\treg = STV090x_READ_DEMOD(state, PDELCTRL2);\n&#039;&lt;br /&gt;
       &#039;\t\t\t\tSTV090x_SETFIELD_Px(reg, FRAME_MODE_FIELD, 1);\n&#039;&lt;br /&gt;
       &#039;\t\t\t\tif (STV090x_WRITE_DEMOD(state, PDELCTRL2, reg) &amp;lt; 0)\n&#039;&lt;br /&gt;
       &#039;\t\t\t\t\tgoto err;\n&#039;&lt;br /&gt;
       &#039;\t\t\t\tif (STV090x_WRITE_DEMOD(state, ERRCTRL1, 0x67) &amp;lt; 0) /* PER */&#039;)&lt;br /&gt;
&lt;br /&gt;
content = content.replace(old, new, 1)&lt;br /&gt;
&lt;br /&gt;
with open(&#039;drivers/media/dvb-frontends/stv090x.c&#039;, &#039;w&#039;) as f:&lt;br /&gt;
    f.write(content)&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Building and installing the patched modules ===&lt;br /&gt;
&lt;br /&gt;
After applying both patches:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
cd ~/kernel-compile/linux-source-6.12&lt;br /&gt;
&lt;br /&gt;
# Rebuild saa716x&lt;br /&gt;
make -C . M=drivers/media/pci/saa716x modules -j$(nproc)&lt;br /&gt;
&lt;br /&gt;
# Rebuild stv090x frontend&lt;br /&gt;
make -C . M=drivers/media/dvb-frontends modules -j$(nproc)&lt;br /&gt;
&lt;br /&gt;
# Install&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_core.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_budget.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo cp drivers/media/dvb-frontends/stv090x.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/dvb-frontends/&lt;br /&gt;
&lt;br /&gt;
sudo depmod -a&lt;br /&gt;
sudo modprobe -r saa716x_budget&lt;br /&gt;
sudo modprobe saa716x_budget&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Capture Procedure ==&lt;br /&gt;
&lt;br /&gt;
Once the card is connected to a dish:&lt;br /&gt;
&lt;br /&gt;
=== 1. Create a channels.conf for the target transponder ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;text&amp;quot;&amp;gt;&lt;br /&gt;
[SomeTransponder]&lt;br /&gt;
        DELIVERY_SYSTEM = DVBS2&lt;br /&gt;
        FREQUENCY = 1550000&lt;br /&gt;
        SYMBOL_RATE = 30000000&lt;br /&gt;
        POLARIZATION = HORIZONTAL&lt;br /&gt;
        MODULATION = QPSK&lt;br /&gt;
        INNER_FEC = AUTO&lt;br /&gt;
        ROLLOFF = AUTO&lt;br /&gt;
        STREAM_ID = -1&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Note:&#039;&#039;&#039; frequency is the &#039;&#039;&#039;IF frequency&#039;&#039;&#039; after LNB downconversion, not the satellite frequency. For a universal LNB (LO = 9750 MHz low band / 10600 MHz high band), subtract accordingly.&lt;br /&gt;
&lt;br /&gt;
=== 2. Capture raw BBframes ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
dvbv5-zap -a 0 -S 0x80000000 -o capture.ts -c channels.conf &amp;quot;SomeTransponder&amp;quot;&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;-S 0x80000000&amp;lt;/code&amp;gt; sets &amp;lt;code&amp;gt;DTV_STREAM_ID&amp;lt;/code&amp;gt; to request all streams in raw mode.&lt;br /&gt;
&lt;br /&gt;
=== 3. Run dontlookup ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
git clone https://github.com/ucsdsysnet/dontlookup&lt;br /&gt;
cd dontlookup&lt;br /&gt;
pip install -r requirements.txt&lt;br /&gt;
python3 dontlookup.py capture.ts -p all&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Output IP pcaps will appear in &amp;lt;code&amp;gt;output/&amp;lt;/code&amp;gt;, open with Wireshark.&lt;br /&gt;
&lt;br /&gt;
== Known Issues / TODO ==&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;Blindscan:&#039;&#039;&#039; The STV090x driver has a &amp;lt;code&amp;gt;stv090x_blind_search()&amp;lt;/code&amp;gt; function internally but it is never triggered from userspace. The DVB core rejects symbol rate = 0. A follow-up patch to enable blindscan via srate=0 is needed.&lt;br /&gt;
* &#039;&#039;&#039;BTF generation skipped:&#039;&#039;&#039; &amp;lt;code&amp;gt;vmlinux&amp;lt;/code&amp;gt; not available for BTF, modules load fine but may affect BPF tooling.&lt;br /&gt;
* &#039;&#039;&#039;BBframe capture unverified:&#039;&#039;&#039; Patches compile and load cleanly but have not yet been tested with an actual satellite signal. Testing pending dish access at NURDspace.&lt;br /&gt;
* Test to see if we can get this working on a Raspberry Pi 5&lt;br /&gt;
&lt;br /&gt;
== References ==&lt;br /&gt;
&lt;br /&gt;
* [https://github.com/ucsdsysnet/dontlookup dontlookup paper/tool]&lt;br /&gt;
* [https://github.com/s-moch/linux-saa716x s-moch/linux-saa716x]&lt;br /&gt;
* [https://github.com/xenpac/Linux-DVB-S2-SatReceiver xenpac/Linux-DVB-S2-SatReceiver]&lt;br /&gt;
* [https://github.com/newspaperman/bbframe-tools newspaperman/bbframe-tools]&lt;br /&gt;
* [https://linuxtv.org/wiki/index.php/DVBSky_T9580 LinuxTV wiki: DVBSky T9580]&lt;br /&gt;
* [https://www.linuxtv.org/wiki/index.php/Hauppauge_WinTV-HVR-5500 LinuxTV wiki: Hauppauge WinTV-HVR-5500]&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=SkyStar_2_eXpress_HD&amp;diff=15924</id>
		<title>SkyStar 2 eXpress HD</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=SkyStar_2_eXpress_HD&amp;diff=15924"/>
		<updated>2026-04-14T17:24:32Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=SkyStar 2 eXpress HD&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Sdr&lt;br /&gt;
|Tool=No&lt;br /&gt;
|Location=&lt;br /&gt;
}}&lt;br /&gt;
&lt;br /&gt;
== Overview ==&lt;br /&gt;
&lt;br /&gt;
This page describes the process of getting raw DVB-S2 BBframe capture working on a &#039;&#039;&#039;TechniSat SkyStar 2 eXpress HD&#039;&#039;&#039; PCIe card under Debian trixie (kernel 6.12), as part of replicating the [https://github.com/ucsdsysnet/dontlookup dontlookup] research project.&lt;br /&gt;
&lt;br /&gt;
The dontlookup paper uses a TBS5927 USB stick with a one-line driver patch to capture raw BBframes. This write-up ports that approach to the SkyStar 2 eXpress HD, which uses a different (and more interesting) chipset.&lt;br /&gt;
=== Raspberry Pi 5 ===&lt;br /&gt;
&lt;br /&gt;
The card has been confirmed working on a &#039;&#039;&#039;Raspberry Pi 5&#039;&#039;&#039; with a [https://www.suptronics.com/Xseries/x1010.html SupTronics X1010] PCIe x4 HAT. The Pi 5 exposes a PCIe Gen 2 x1 lane which is more than sufficient for a DVB card, and crucially &#039;&#039;&#039;provides 3.3V on the slot&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
The SkyStar requires a Molex power connector in addition to PCIe slot power. The X1010 HAT has a DC12V Molex input, providing 12V directly. A small buck converter is needed to generate the 5V rail for the Molex connector on the card (3.3V comes from the PCIe slot, 12V from the HAT Molex).&lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;lspci&amp;lt;/code&amp;gt; output on Pi 5:&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
0001:00:00.0 PCI bridge: Broadcom Inc. and subsidiaries BCM2712 PCIe Bridge (rev 30)&lt;br /&gt;
0001:01:00.0 Multimedia controller: Philips Semiconductors SAA7160 (rev 03)&lt;br /&gt;
0002:00:00.0 PCI bridge: Broadcom Inc. and subsidiaries BCM2712 PCIe Bridge (rev 30)&lt;br /&gt;
0002:01:00.0 Ethernet controller: Raspberry Pi Ltd RP1 PCIe 2.0 South Bridge&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
dmesg on Pi 5 (kernel &amp;lt;code&amp;gt;6.12.62+rpt-rpi-2712&amp;lt;/code&amp;gt;):&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
[  543.603095] saa716x_core: loading out-of-tree module taints kernel.&lt;br /&gt;
[  543.603753] SAA716x Budget 0001:01:00.0: found a SkyStar 2 eXpress HD PCIe card&lt;br /&gt;
[  543.603770] SAA716x Budget 0001:01:00.0: enabling device (0000 -&amp;gt; 0002)&lt;br /&gt;
[  543.603881] SAA716x Budget 0001:01:00.0:  SAA7160 Rev 3, irq: 186 (MSI)&lt;br /&gt;
[  543.613413] SAA716x Budget 0001:01:00.0: Initializing SAA716x I2C Core 0 @ 100kHz&lt;br /&gt;
[  543.616467] SAA716x Budget 0001:01:00.0: Initializing SAA716x I2C Core 1 @ 100kHz&lt;br /&gt;
[  543.619278] dvbdev: DVB: registering new adapter (SAA716x dvb adapter)&lt;br /&gt;
[  543.773006] i2c i2c-15: Attaching STV6110x&lt;br /&gt;
[  543.830525] SAA716x Budget 0001:01:00.0: DVB: registering adapter 0 frontend 0 (STV090x Multistandard)...&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Hardware ==&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;BBframe capture has not yet been tested with an actual satellite signal. Testing pending dish access at NURDspace.&lt;br /&gt;
&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;TechniSat SkyStar 2 eXpress HD&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Component !! Details&lt;br /&gt;
|-&lt;br /&gt;
| PCIe bridge || NXP SAA7160 (rev 3)&lt;br /&gt;
|-&lt;br /&gt;
| DVB-S2 demodulator || &#039;&#039;&#039;STV0903B&#039;&#039;&#039; (STV090x family)&lt;br /&gt;
|-&lt;br /&gt;
| Tuner || &#039;&#039;&#039;STV6110A&#039;&#039;&#039;&lt;br /&gt;
|-&lt;br /&gt;
| PCI ID || Appears as &amp;lt;code&amp;gt;Philips Semiconductors SAA7160&amp;lt;/code&amp;gt; in lspci&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Why This Card ===&lt;br /&gt;
&lt;br /&gt;
The STV090x family was specifically targeted because:&lt;br /&gt;
* It has hardware-level BBframe support via the &amp;lt;code&amp;gt;FRAME_MODE_FIELD&amp;lt;/code&amp;gt; bit in &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt;&lt;br /&gt;
* The mainline kernel driver (&amp;lt;code&amp;gt;stv090x&amp;lt;/code&amp;gt;) is well maintained&lt;br /&gt;
* The chip is well documented compared to alternatives&lt;br /&gt;
&lt;br /&gt;
=== 3.3V PCIe Issue ===&lt;br /&gt;
&lt;br /&gt;
AMD Ryzen systems (and many modern motherboards) do not provide 3.3V on PCIe slots, as modern GPUs don&#039;t require it. DVB cards like the SkyStar 2 eXpress HD use 3.3V for their logic and will not enumerate (&amp;lt;code&amp;gt;lspci&amp;lt;/code&amp;gt; shows nothing) on affected systems.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Workaround:&#039;&#039;&#039; Use an Intel-based system. The card was confirmed working in an X99 board. PCIe 3.3V injector risers from AliExpress are an alternative for AMD systems.&lt;br /&gt;
&lt;br /&gt;
== Software Environment ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! !! Details&lt;br /&gt;
|-&lt;br /&gt;
| OS || Debian trixie&lt;br /&gt;
|-&lt;br /&gt;
| Kernel || &amp;lt;code&amp;gt;6.12.74+deb13+1-amd64&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Driver source || [https://github.com/s-moch/linux-saa716x s-moch/linux-saa716x] (out-of-tree saa716x driver, maintained as kernel-version-specific diffs)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Building the saa716x Driver ==&lt;br /&gt;
&lt;br /&gt;
The &amp;lt;code&amp;gt;saa716x&amp;lt;/code&amp;gt; driver is not in the mainline kernel. The s-moch repo provides diffs that patch it into the kernel source tree.&lt;br /&gt;
&lt;br /&gt;
=== Install dependencies ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sudo apt install linux-source-6.12 linux-headers-$(uname -r) \&lt;br /&gt;
    libelf-dev build-essential flex bison libssl-dev wget&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Extract kernel source and apply patch ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
mkdir ~/kernel-compile &amp;amp;&amp;amp; cd ~/kernel-compile&lt;br /&gt;
wget https://github.com/s-moch/linux-saa716x/compare/saa716x-6.12.diff&lt;br /&gt;
tar xJf /usr/src/linux-source-6.12.tar.xz&lt;br /&gt;
cd linux-source-6.12&lt;br /&gt;
cp /boot/config-$(uname -r) .config&lt;br /&gt;
cp /usr/src/linux-headers-$(uname -r)/Module.symvers .&lt;br /&gt;
patch -p1 &amp;lt; ../saa716x-6.12.diff&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Configure and build ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
make olddefconfig&lt;br /&gt;
make modules_prepare&lt;br /&gt;
make syncconfig&lt;br /&gt;
&lt;br /&gt;
# Enable saa716x in config&lt;br /&gt;
scripts/config --enable SAA716X_SUPPORT&lt;br /&gt;
scripts/config --enable DVB_SAA716X_BUDGET&lt;br /&gt;
make syncconfig&lt;br /&gt;
&lt;br /&gt;
# Build just the saa716x driver&lt;br /&gt;
make -C . M=drivers/media/pci/saa716x modules -j$(nproc)&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Install ===&lt;br /&gt;
Extra step on Raspbian&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sudo mkdir -p /lib/modules/$(uname -r)/kernel/drivers/media/pci&lt;br /&gt;
sudo mkdir -p /lib/modules/$(uname -r)/kernel/drivers/media/dvb-frontends&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_core.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_budget.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo depmod -a&lt;br /&gt;
sudo modprobe saa716x_budget&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Expected dmesg output ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;text&amp;quot;&amp;gt;&lt;br /&gt;
SAA716x Budget 0000:06:00.0: found a SkyStar 2 eXpress HD PCIe card&lt;br /&gt;
SAA716x Budget 0000:06:00.0:  SAA7160 Rev 3, irq: 55 (MSI)&lt;br /&gt;
SAA716x Budget 0000:06:00.0: Initializing SAA716x I2C Core 0 @ 100kHz&lt;br /&gt;
SAA716x Budget 0000:06:00.0: Initializing SAA716x I2C Core 1 @ 100kHz&lt;br /&gt;
dvbdev: DVB: registering new adapter (SAA716x dvb adapter)&lt;br /&gt;
i2c i2c-2: Attaching STV6110x&lt;br /&gt;
SAA716x Budget 0000:06:00.0: DVB: registering adapter 0 frontend 0 (STV090x Multistandard)...&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
DVB devices appear at &amp;lt;code&amp;gt;/dev/dvb/adapter0/{demux0,dvr0,frontend0,net0}&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
== BBframe Patches ==&lt;br /&gt;
&lt;br /&gt;
Two patches are required:&lt;br /&gt;
&lt;br /&gt;
# &#039;&#039;&#039;&amp;lt;code&amp;gt;saa716x_adap.c&amp;lt;/code&amp;gt;&#039;&#039;&#039; — swap &amp;lt;code&amp;gt;dvb_dmx_swfilter&amp;lt;/code&amp;gt; for &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw&amp;lt;/code&amp;gt; so the DMA data is passed raw to userspace instead of being parsed as 188-byte TS packets&lt;br /&gt;
# &#039;&#039;&#039;&amp;lt;code&amp;gt;stv090x.c&amp;lt;/code&amp;gt;&#039;&#039;&#039; — set &amp;lt;code&amp;gt;FRAME_MODE_FIELD=1&amp;lt;/code&amp;gt; in &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt; after lock, which tells the STV0903B to output raw BBframes instead of decoded TS&lt;br /&gt;
&lt;br /&gt;
=== Background: How dontlookup&#039;s TBS5927 patch works ===&lt;br /&gt;
&lt;br /&gt;
The original dontlookup patch for the TBS5927 is a single line added to &amp;lt;code&amp;gt;tbs5927.c&amp;lt;/code&amp;gt;:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;c&amp;quot;&amp;gt;&lt;br /&gt;
.caps = DVB_USB_ADAP_RECEIVES_RAW_PAYLOAD,&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
This flag causes the dvb-usb layer to call &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw()&amp;lt;/code&amp;gt; instead of &amp;lt;code&amp;gt;dvb_dmx_swfilter()&amp;lt;/code&amp;gt;, passing raw bytes straight through. The saa716x patch replicates this at the PCI driver level.&lt;br /&gt;
&lt;br /&gt;
=== Patch 1: saa716x_adap.c Raw DMA passthrough ===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;File:&#039;&#039;&#039; &amp;lt;code&amp;gt;drivers/media/pci/saa716x/saa716x_adap.c&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Change &amp;lt;code&amp;gt;dvb_dmx_swfilter&amp;lt;/code&amp;gt; to &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw&amp;lt;/code&amp;gt; in the DMA completion handler:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;diff&amp;quot;&amp;gt;&lt;br /&gt;
-               dvb_dmx_swfilter(demux, data, 348 * 188);&lt;br /&gt;
+               dvb_dmx_swfilter_raw(demux, data, 348 * 188);&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Apply with:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sed -i &#039;s/dvb_dmx_swfilter(demux, data, 348 \* 188)/dvb_dmx_swfilter_raw(demux, data, 348 * 188)/&#039; \&lt;br /&gt;
    drivers/media/pci/saa716x/saa716x_adap.c&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Note:&#039;&#039;&#039; The buffer size &amp;lt;code&amp;gt;348 * 188 = 65424&amp;lt;/code&amp;gt; bytes is the DMA buffer size and is passed as-is. &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw&amp;lt;/code&amp;gt; does not assume 188-byte alignment so this is fine.&lt;br /&gt;
&lt;br /&gt;
=== Patch 2: stv090x.c Enable BBframe mode after lock ===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;File:&#039;&#039;&#039; &amp;lt;code&amp;gt;drivers/media/dvb-frontends/stv090x.c&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
After the demodulator achieves DVB-S2 lock, set &amp;lt;code&amp;gt;FRAME_MODE_FIELD=1&amp;lt;/code&amp;gt; in &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt;. This tells the STV0903B to output raw BBframes rather than decoded transport stream packets.&lt;br /&gt;
&lt;br /&gt;
The relevant register is defined in &amp;lt;code&amp;gt;stv090x_reg.h&amp;lt;/code&amp;gt;:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;c&amp;quot;&amp;gt;&lt;br /&gt;
#define STV090x_OFFST_Px_FRAME_MODE_FIELD  1&lt;br /&gt;
#define STV090x_WIDTH_Px_FRAME_MODE_FIELD  1&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Insert the following block after the &amp;lt;code&amp;gt;RESET_UPKO_COUNT&amp;lt;/code&amp;gt; sequence (around line 3397), immediately before the &amp;lt;code&amp;gt;ERRCTRL1&amp;lt;/code&amp;gt; write:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;diff&amp;quot;&amp;gt;&lt;br /&gt;
+                               /* Enable BBframe mode */&lt;br /&gt;
+                               reg = STV090x_READ_DEMOD(state, PDELCTRL2);&lt;br /&gt;
+                               STV090x_SETFIELD_Px(reg, FRAME_MODE_FIELD, 1);&lt;br /&gt;
+                               if (STV090x_WRITE_DEMOD(state, PDELCTRL2, reg) &amp;lt; 0)&lt;br /&gt;
+                                       goto err;&lt;br /&gt;
                                if (STV090x_WRITE_DEMOD(state, ERRCTRL1, 0x67) &amp;lt; 0) /* PER */&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Apply with Python (handles tabs correctly):&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;python&amp;quot;&amp;gt;&lt;br /&gt;
with open(&#039;drivers/media/dvb-frontends/stv090x.c&#039;, &#039;r&#039;) as f:&lt;br /&gt;
    content = f.read()&lt;br /&gt;
&lt;br /&gt;
old = &#039;\t\t\t\tif (STV090x_WRITE_DEMOD(state, ERRCTRL1, 0x67) &amp;lt; 0) /* PER */&#039;&lt;br /&gt;
new = (&#039;\t\t\t\t/* Enable BBframe mode */\n&#039;&lt;br /&gt;
       &#039;\t\t\t\treg = STV090x_READ_DEMOD(state, PDELCTRL2);\n&#039;&lt;br /&gt;
       &#039;\t\t\t\tSTV090x_SETFIELD_Px(reg, FRAME_MODE_FIELD, 1);\n&#039;&lt;br /&gt;
       &#039;\t\t\t\tif (STV090x_WRITE_DEMOD(state, PDELCTRL2, reg) &amp;lt; 0)\n&#039;&lt;br /&gt;
       &#039;\t\t\t\t\tgoto err;\n&#039;&lt;br /&gt;
       &#039;\t\t\t\tif (STV090x_WRITE_DEMOD(state, ERRCTRL1, 0x67) &amp;lt; 0) /* PER */&#039;)&lt;br /&gt;
&lt;br /&gt;
content = content.replace(old, new, 1)&lt;br /&gt;
&lt;br /&gt;
with open(&#039;drivers/media/dvb-frontends/stv090x.c&#039;, &#039;w&#039;) as f:&lt;br /&gt;
    f.write(content)&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Building and installing the patched modules ===&lt;br /&gt;
&lt;br /&gt;
After applying both patches:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
cd ~/kernel-compile/linux-source-6.12&lt;br /&gt;
&lt;br /&gt;
# Rebuild saa716x&lt;br /&gt;
make -C . M=drivers/media/pci/saa716x modules -j$(nproc)&lt;br /&gt;
&lt;br /&gt;
# Rebuild stv090x frontend&lt;br /&gt;
make -C . M=drivers/media/dvb-frontends modules -j$(nproc)&lt;br /&gt;
&lt;br /&gt;
# Install&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_core.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_budget.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo cp drivers/media/dvb-frontends/stv090x.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/dvb-frontends/&lt;br /&gt;
&lt;br /&gt;
sudo depmod -a&lt;br /&gt;
sudo modprobe -r saa716x_budget&lt;br /&gt;
sudo modprobe saa716x_budget&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Capture Procedure ==&lt;br /&gt;
&lt;br /&gt;
Once the card is connected to a dish:&lt;br /&gt;
&lt;br /&gt;
=== 1. Create a channels.conf for the target transponder ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;text&amp;quot;&amp;gt;&lt;br /&gt;
[SomeTransponder]&lt;br /&gt;
        DELIVERY_SYSTEM = DVBS2&lt;br /&gt;
        FREQUENCY = 1550000&lt;br /&gt;
        SYMBOL_RATE = 30000000&lt;br /&gt;
        POLARIZATION = HORIZONTAL&lt;br /&gt;
        MODULATION = QPSK&lt;br /&gt;
        INNER_FEC = AUTO&lt;br /&gt;
        ROLLOFF = AUTO&lt;br /&gt;
        STREAM_ID = -1&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Note:&#039;&#039;&#039; frequency is the &#039;&#039;&#039;IF frequency&#039;&#039;&#039; after LNB downconversion, not the satellite frequency. For a universal LNB (LO = 9750 MHz low band / 10600 MHz high band), subtract accordingly.&lt;br /&gt;
&lt;br /&gt;
=== 2. Capture raw BBframes ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
dvbv5-zap -a 0 -S 0x80000000 -o capture.ts -c channels.conf &amp;quot;SomeTransponder&amp;quot;&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;-S 0x80000000&amp;lt;/code&amp;gt; sets &amp;lt;code&amp;gt;DTV_STREAM_ID&amp;lt;/code&amp;gt; to request all streams in raw mode.&lt;br /&gt;
&lt;br /&gt;
=== 3. Run dontlookup ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
git clone https://github.com/ucsdsysnet/dontlookup&lt;br /&gt;
cd dontlookup&lt;br /&gt;
pip install -r requirements.txt&lt;br /&gt;
python3 dontlookup.py capture.ts -p all&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Output IP pcaps will appear in &amp;lt;code&amp;gt;output/&amp;lt;/code&amp;gt; — open with Wireshark.&lt;br /&gt;
&lt;br /&gt;
== Known Issues / TODO ==&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;Blindscan:&#039;&#039;&#039; The STV090x driver has a &amp;lt;code&amp;gt;stv090x_blind_search()&amp;lt;/code&amp;gt; function internally but it is never triggered from userspace. The DVB core rejects symbol rate = 0. A follow-up patch to enable blindscan via srate=0 is needed.&lt;br /&gt;
* &#039;&#039;&#039;BTF generation skipped:&#039;&#039;&#039; &amp;lt;code&amp;gt;vmlinux&amp;lt;/code&amp;gt; not available for BTF, modules load fine but may affect BPF tooling.&lt;br /&gt;
* &#039;&#039;&#039;BBframe capture unverified:&#039;&#039;&#039; Patches compile and load cleanly but have not yet been tested with an actual satellite signal. Testing pending dish access at NURDspace.&lt;br /&gt;
* Test to see if we can get this working on a Raspberry Pi 5&lt;br /&gt;
&lt;br /&gt;
== References ==&lt;br /&gt;
&lt;br /&gt;
* [https://github.com/ucsdsysnet/dontlookup dontlookup paper/tool]&lt;br /&gt;
* [https://github.com/s-moch/linux-saa716x s-moch/linux-saa716x]&lt;br /&gt;
* [https://github.com/xenpac/Linux-DVB-S2-SatReceiver xenpac/Linux-DVB-S2-SatReceiver]&lt;br /&gt;
* [https://github.com/newspaperman/bbframe-tools newspaperman/bbframe-tools]&lt;br /&gt;
* [https://linuxtv.org/wiki/index.php/DVBSky_T9580 LinuxTV wiki: DVBSky T9580]&lt;br /&gt;
* [https://www.linuxtv.org/wiki/index.php/Hauppauge_WinTV-HVR-5500 LinuxTV wiki: Hauppauge WinTV-HVR-5500]&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=File:SkyStar_2_eXpress_HD.jpg&amp;diff=15923</id>
		<title>File:SkyStar 2 eXpress HD.jpg</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=File:SkyStar_2_eXpress_HD.jpg&amp;diff=15923"/>
		<updated>2026-04-14T16:34:13Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=SkyStar_2_eXpress_HD&amp;diff=15922</id>
		<title>SkyStar 2 eXpress HD</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=SkyStar_2_eXpress_HD&amp;diff=15922"/>
		<updated>2026-04-14T16:32:52Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=SkyStar 2 eXpress HD&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Sdr&lt;br /&gt;
|Tool=No&lt;br /&gt;
|Location=&lt;br /&gt;
}}&lt;br /&gt;
&lt;br /&gt;
== Overview ==&lt;br /&gt;
&lt;br /&gt;
This page describes the process of getting raw DVB-S2 BBframe capture working on a &#039;&#039;&#039;TechniSat SkyStar 2 eXpress HD&#039;&#039;&#039; PCIe card under Debian trixie (kernel 6.12), as part of replicating the [https://github.com/ucsdsysnet/dontlookup dontlookup] research project.&lt;br /&gt;
&lt;br /&gt;
The dontlookup paper uses a TBS5927 USB stick with a one-line driver patch to capture raw BBframes. This write-up ports that approach to the SkyStar 2 eXpress HD, which uses a different (and more interesting) chipset.&lt;br /&gt;
=== Raspberry Pi 5 ===&lt;br /&gt;
&lt;br /&gt;
The card has been confirmed working on a &#039;&#039;&#039;Raspberry Pi 5&#039;&#039;&#039; with a [https://www.suptronics.com/Xseries/x1010.html SupTronics X1010] PCIe x4 HAT. The Pi 5 exposes a PCIe Gen 2 x1 lane which is more than sufficient for a DVB card, and crucially &#039;&#039;&#039;provides 3.3V on the slot&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
The SkyStar requires a Molex power connector in addition to PCIe slot power. The X1010 HAT has a DC12V Molex input, providing 12V directly. A small buck converter is needed to generate the 5V rail for the Molex connector on the card (3.3V comes from the PCIe slot, 12V from the HAT Molex).&lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;lspci&amp;lt;/code&amp;gt; output on Pi 5:&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
0001:00:00.0 PCI bridge: Broadcom Inc. and subsidiaries BCM2712 PCIe Bridge (rev 30)&lt;br /&gt;
0001:01:00.0 Multimedia controller: Philips Semiconductors SAA7160 (rev 03)&lt;br /&gt;
0002:00:00.0 PCI bridge: Broadcom Inc. and subsidiaries BCM2712 PCIe Bridge (rev 30)&lt;br /&gt;
0002:01:00.0 Ethernet controller: Raspberry Pi Ltd RP1 PCIe 2.0 South Bridge&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
dmesg on Pi 5 (kernel &amp;lt;code&amp;gt;6.12.62+rpt-rpi-2712&amp;lt;/code&amp;gt;):&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
[  543.603095] saa716x_core: loading out-of-tree module taints kernel.&lt;br /&gt;
[  543.603753] SAA716x Budget 0001:01:00.0: found a SkyStar 2 eXpress HD PCIe card&lt;br /&gt;
[  543.603770] SAA716x Budget 0001:01:00.0: enabling device (0000 -&amp;gt; 0002)&lt;br /&gt;
[  543.603881] SAA716x Budget 0001:01:00.0:  SAA7160 Rev 3, irq: 186 (MSI)&lt;br /&gt;
[  543.613413] SAA716x Budget 0001:01:00.0: Initializing SAA716x I2C Core 0 @ 100kHz&lt;br /&gt;
[  543.616467] SAA716x Budget 0001:01:00.0: Initializing SAA716x I2C Core 1 @ 100kHz&lt;br /&gt;
[  543.619278] dvbdev: DVB: registering new adapter (SAA716x dvb adapter)&lt;br /&gt;
[  543.773006] i2c i2c-15: Attaching STV6110x&lt;br /&gt;
[  543.830525] SAA716x Budget 0001:01:00.0: DVB: registering adapter 0 frontend 0 (STV090x Multistandard)...&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Hardware ==&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;BBframe capture has not yet been tested with an actual satellite signal. Testing pending dish access at NURDspace.&lt;br /&gt;
&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;TechniSat SkyStar 2 eXpress HD&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Component !! Details&lt;br /&gt;
|-&lt;br /&gt;
| PCIe bridge || NXP SAA7160 (rev 3)&lt;br /&gt;
|-&lt;br /&gt;
| DVB-S2 demodulator || &#039;&#039;&#039;STV0903B&#039;&#039;&#039; (STV090x family)&lt;br /&gt;
|-&lt;br /&gt;
| Tuner || &#039;&#039;&#039;STV6110A&#039;&#039;&#039;&lt;br /&gt;
|-&lt;br /&gt;
| PCI ID || Appears as &amp;lt;code&amp;gt;Philips Semiconductors SAA7160&amp;lt;/code&amp;gt; in lspci&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Why This Card ===&lt;br /&gt;
&lt;br /&gt;
The STV090x family was specifically targeted because:&lt;br /&gt;
* It has hardware-level BBframe support via the &amp;lt;code&amp;gt;FRAME_MODE_FIELD&amp;lt;/code&amp;gt; bit in &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt;&lt;br /&gt;
* The mainline kernel driver (&amp;lt;code&amp;gt;stv090x&amp;lt;/code&amp;gt;) is well maintained&lt;br /&gt;
* The chip is well documented compared to alternatives&lt;br /&gt;
&lt;br /&gt;
=== 3.3V PCIe Issue ===&lt;br /&gt;
&lt;br /&gt;
AMD Ryzen systems (and many modern motherboards) do not provide 3.3V on PCIe slots, as modern GPUs don&#039;t require it. DVB cards like the SkyStar 2 eXpress HD use 3.3V for their logic and will not enumerate (&amp;lt;code&amp;gt;lspci&amp;lt;/code&amp;gt; shows nothing) on affected systems.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Workaround:&#039;&#039;&#039; Use an Intel-based system. The card was confirmed working in an X99 board. PCIe 3.3V injector risers from AliExpress are an alternative for AMD systems.&lt;br /&gt;
&lt;br /&gt;
== Software Environment ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! !! Details&lt;br /&gt;
|-&lt;br /&gt;
| OS || Debian trixie&lt;br /&gt;
|-&lt;br /&gt;
| Kernel || &amp;lt;code&amp;gt;6.12.74+deb13+1-amd64&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Driver source || [https://github.com/s-moch/linux-saa716x s-moch/linux-saa716x] — out-of-tree saa716x driver, maintained as kernel-version-specific diffs&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Building the saa716x Driver ==&lt;br /&gt;
&lt;br /&gt;
The &amp;lt;code&amp;gt;saa716x&amp;lt;/code&amp;gt; driver is not in the mainline kernel. The s-moch repo provides diffs that patch it into the kernel source tree.&lt;br /&gt;
&lt;br /&gt;
=== Install dependencies ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sudo apt install linux-source-6.12 linux-headers-$(uname -r) \&lt;br /&gt;
    libelf-dev build-essential flex bison libssl-dev wget&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Extract kernel source and apply patch ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
mkdir ~/kernel-compile &amp;amp;&amp;amp; cd ~/kernel-compile&lt;br /&gt;
wget https://github.com/s-moch/linux-saa716x/compare/saa716x-6.12.diff&lt;br /&gt;
tar xJf /usr/src/linux-source-6.12.tar.xz&lt;br /&gt;
cd linux-source-6.12&lt;br /&gt;
cp /boot/config-$(uname -r) .config&lt;br /&gt;
cp /usr/src/linux-headers-$(uname -r)/Module.symvers .&lt;br /&gt;
patch -p1 &amp;lt; ../saa716x-6.12.diff&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Configure and build ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
make olddefconfig&lt;br /&gt;
make modules_prepare&lt;br /&gt;
make syncconfig&lt;br /&gt;
&lt;br /&gt;
# Enable saa716x in config&lt;br /&gt;
scripts/config --enable SAA716X_SUPPORT&lt;br /&gt;
scripts/config --enable DVB_SAA716X_BUDGET&lt;br /&gt;
make syncconfig&lt;br /&gt;
&lt;br /&gt;
# Build just the saa716x driver&lt;br /&gt;
make -C . M=drivers/media/pci/saa716x modules -j$(nproc)&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Install ===&lt;br /&gt;
Extra step on Raspbian&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sudo mkdir -p /lib/modules/$(uname -r)/kernel/drivers/media/pci&lt;br /&gt;
sudo mkdir -p /lib/modules/$(uname -r)/kernel/drivers/media/dvb-frontends&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_core.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_budget.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo depmod -a&lt;br /&gt;
sudo modprobe saa716x_budget&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Expected dmesg output ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;text&amp;quot;&amp;gt;&lt;br /&gt;
SAA716x Budget 0000:06:00.0: found a SkyStar 2 eXpress HD PCIe card&lt;br /&gt;
SAA716x Budget 0000:06:00.0:  SAA7160 Rev 3, irq: 55 (MSI)&lt;br /&gt;
SAA716x Budget 0000:06:00.0: Initializing SAA716x I2C Core 0 @ 100kHz&lt;br /&gt;
SAA716x Budget 0000:06:00.0: Initializing SAA716x I2C Core 1 @ 100kHz&lt;br /&gt;
dvbdev: DVB: registering new adapter (SAA716x dvb adapter)&lt;br /&gt;
i2c i2c-2: Attaching STV6110x&lt;br /&gt;
SAA716x Budget 0000:06:00.0: DVB: registering adapter 0 frontend 0 (STV090x Multistandard)...&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
DVB devices appear at &amp;lt;code&amp;gt;/dev/dvb/adapter0/{demux0,dvr0,frontend0,net0}&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
== BBframe Patches ==&lt;br /&gt;
&lt;br /&gt;
Two patches are required:&lt;br /&gt;
&lt;br /&gt;
# &#039;&#039;&#039;&amp;lt;code&amp;gt;saa716x_adap.c&amp;lt;/code&amp;gt;&#039;&#039;&#039; — swap &amp;lt;code&amp;gt;dvb_dmx_swfilter&amp;lt;/code&amp;gt; for &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw&amp;lt;/code&amp;gt; so the DMA data is passed raw to userspace instead of being parsed as 188-byte TS packets&lt;br /&gt;
# &#039;&#039;&#039;&amp;lt;code&amp;gt;stv090x.c&amp;lt;/code&amp;gt;&#039;&#039;&#039; — set &amp;lt;code&amp;gt;FRAME_MODE_FIELD=1&amp;lt;/code&amp;gt; in &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt; after lock, which tells the STV0903B to output raw BBframes instead of decoded TS&lt;br /&gt;
&lt;br /&gt;
=== Background: How dontlookup&#039;s TBS5927 patch works ===&lt;br /&gt;
&lt;br /&gt;
The original dontlookup patch for the TBS5927 is a single line added to &amp;lt;code&amp;gt;tbs5927.c&amp;lt;/code&amp;gt;:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;c&amp;quot;&amp;gt;&lt;br /&gt;
.caps = DVB_USB_ADAP_RECEIVES_RAW_PAYLOAD,&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
This flag causes the dvb-usb layer to call &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw()&amp;lt;/code&amp;gt; instead of &amp;lt;code&amp;gt;dvb_dmx_swfilter()&amp;lt;/code&amp;gt;, passing raw bytes straight through. The saa716x patch replicates this at the PCI driver level.&lt;br /&gt;
&lt;br /&gt;
=== Patch 1: saa716x_adap.c — Raw DMA passthrough ===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;File:&#039;&#039;&#039; &amp;lt;code&amp;gt;drivers/media/pci/saa716x/saa716x_adap.c&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Change &amp;lt;code&amp;gt;dvb_dmx_swfilter&amp;lt;/code&amp;gt; to &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw&amp;lt;/code&amp;gt; in the DMA completion handler:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;diff&amp;quot;&amp;gt;&lt;br /&gt;
-               dvb_dmx_swfilter(demux, data, 348 * 188);&lt;br /&gt;
+               dvb_dmx_swfilter_raw(demux, data, 348 * 188);&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Apply with:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sed -i &#039;s/dvb_dmx_swfilter(demux, data, 348 \* 188)/dvb_dmx_swfilter_raw(demux, data, 348 * 188)/&#039; \&lt;br /&gt;
    drivers/media/pci/saa716x/saa716x_adap.c&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Note:&#039;&#039;&#039; The buffer size &amp;lt;code&amp;gt;348 * 188 = 65424&amp;lt;/code&amp;gt; bytes is the DMA buffer size and is passed as-is. &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw&amp;lt;/code&amp;gt; does not assume 188-byte alignment so this is fine.&lt;br /&gt;
&lt;br /&gt;
=== Patch 2: stv090x.c — Enable BBframe mode after lock ===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;File:&#039;&#039;&#039; &amp;lt;code&amp;gt;drivers/media/dvb-frontends/stv090x.c&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
After the demodulator achieves DVB-S2 lock, set &amp;lt;code&amp;gt;FRAME_MODE_FIELD=1&amp;lt;/code&amp;gt; in &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt;. This tells the STV0903B to output raw BBframes rather than decoded transport stream packets.&lt;br /&gt;
&lt;br /&gt;
The relevant register is defined in &amp;lt;code&amp;gt;stv090x_reg.h&amp;lt;/code&amp;gt;:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;c&amp;quot;&amp;gt;&lt;br /&gt;
#define STV090x_OFFST_Px_FRAME_MODE_FIELD  1&lt;br /&gt;
#define STV090x_WIDTH_Px_FRAME_MODE_FIELD  1&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Insert the following block after the &amp;lt;code&amp;gt;RESET_UPKO_COUNT&amp;lt;/code&amp;gt; sequence (around line 3397), immediately before the &amp;lt;code&amp;gt;ERRCTRL1&amp;lt;/code&amp;gt; write:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;diff&amp;quot;&amp;gt;&lt;br /&gt;
+                               /* Enable BBframe mode */&lt;br /&gt;
+                               reg = STV090x_READ_DEMOD(state, PDELCTRL2);&lt;br /&gt;
+                               STV090x_SETFIELD_Px(reg, FRAME_MODE_FIELD, 1);&lt;br /&gt;
+                               if (STV090x_WRITE_DEMOD(state, PDELCTRL2, reg) &amp;lt; 0)&lt;br /&gt;
+                                       goto err;&lt;br /&gt;
                                if (STV090x_WRITE_DEMOD(state, ERRCTRL1, 0x67) &amp;lt; 0) /* PER */&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Apply with Python (handles tabs correctly):&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;python&amp;quot;&amp;gt;&lt;br /&gt;
with open(&#039;drivers/media/dvb-frontends/stv090x.c&#039;, &#039;r&#039;) as f:&lt;br /&gt;
    content = f.read()&lt;br /&gt;
&lt;br /&gt;
old = &#039;\t\t\t\tif (STV090x_WRITE_DEMOD(state, ERRCTRL1, 0x67) &amp;lt; 0) /* PER */&#039;&lt;br /&gt;
new = (&#039;\t\t\t\t/* Enable BBframe mode */\n&#039;&lt;br /&gt;
       &#039;\t\t\t\treg = STV090x_READ_DEMOD(state, PDELCTRL2);\n&#039;&lt;br /&gt;
       &#039;\t\t\t\tSTV090x_SETFIELD_Px(reg, FRAME_MODE_FIELD, 1);\n&#039;&lt;br /&gt;
       &#039;\t\t\t\tif (STV090x_WRITE_DEMOD(state, PDELCTRL2, reg) &amp;lt; 0)\n&#039;&lt;br /&gt;
       &#039;\t\t\t\t\tgoto err;\n&#039;&lt;br /&gt;
       &#039;\t\t\t\tif (STV090x_WRITE_DEMOD(state, ERRCTRL1, 0x67) &amp;lt; 0) /* PER */&#039;)&lt;br /&gt;
&lt;br /&gt;
content = content.replace(old, new, 1)&lt;br /&gt;
&lt;br /&gt;
with open(&#039;drivers/media/dvb-frontends/stv090x.c&#039;, &#039;w&#039;) as f:&lt;br /&gt;
    f.write(content)&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Building and installing the patched modules ===&lt;br /&gt;
&lt;br /&gt;
After applying both patches:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
cd ~/kernel-compile/linux-source-6.12&lt;br /&gt;
&lt;br /&gt;
# Rebuild saa716x&lt;br /&gt;
make -C . M=drivers/media/pci/saa716x modules -j$(nproc)&lt;br /&gt;
&lt;br /&gt;
# Rebuild stv090x frontend&lt;br /&gt;
make -C . M=drivers/media/dvb-frontends modules -j$(nproc)&lt;br /&gt;
&lt;br /&gt;
# Install&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_core.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_budget.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo cp drivers/media/dvb-frontends/stv090x.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/dvb-frontends/&lt;br /&gt;
&lt;br /&gt;
sudo depmod -a&lt;br /&gt;
sudo modprobe -r saa716x_budget&lt;br /&gt;
sudo modprobe saa716x_budget&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Capture Procedure ==&lt;br /&gt;
&lt;br /&gt;
Once the card is connected to a dish:&lt;br /&gt;
&lt;br /&gt;
=== 1. Create a channels.conf for the target transponder ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;text&amp;quot;&amp;gt;&lt;br /&gt;
[SomeTransponder]&lt;br /&gt;
        DELIVERY_SYSTEM = DVBS2&lt;br /&gt;
        FREQUENCY = 1550000&lt;br /&gt;
        SYMBOL_RATE = 30000000&lt;br /&gt;
        POLARIZATION = HORIZONTAL&lt;br /&gt;
        MODULATION = QPSK&lt;br /&gt;
        INNER_FEC = AUTO&lt;br /&gt;
        ROLLOFF = AUTO&lt;br /&gt;
        STREAM_ID = -1&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Note:&#039;&#039;&#039; frequency is the &#039;&#039;&#039;IF frequency&#039;&#039;&#039; after LNB downconversion, not the satellite frequency. For a universal LNB (LO = 9750 MHz low band / 10600 MHz high band), subtract accordingly.&lt;br /&gt;
&lt;br /&gt;
=== 2. Capture raw BBframes ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
dvbv5-zap -a 0 -S 0x80000000 -o capture.ts -c channels.conf &amp;quot;SomeTransponder&amp;quot;&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;-S 0x80000000&amp;lt;/code&amp;gt; sets &amp;lt;code&amp;gt;DTV_STREAM_ID&amp;lt;/code&amp;gt; to request all streams in raw mode.&lt;br /&gt;
&lt;br /&gt;
=== 3. Run dontlookup ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
git clone https://github.com/ucsdsysnet/dontlookup&lt;br /&gt;
cd dontlookup&lt;br /&gt;
pip install -r requirements.txt&lt;br /&gt;
python3 dontlookup.py capture.ts -p all&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Output IP pcaps will appear in &amp;lt;code&amp;gt;output/&amp;lt;/code&amp;gt; — open with Wireshark.&lt;br /&gt;
&lt;br /&gt;
== Known Issues / TODO ==&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;Blindscan:&#039;&#039;&#039; The STV090x driver has a &amp;lt;code&amp;gt;stv090x_blind_search()&amp;lt;/code&amp;gt; function internally but it is never triggered from userspace. The DVB core rejects symbol rate = 0. A follow-up patch to enable blindscan via srate=0 is needed.&lt;br /&gt;
* &#039;&#039;&#039;BTF generation skipped:&#039;&#039;&#039; &amp;lt;code&amp;gt;vmlinux&amp;lt;/code&amp;gt; not available for BTF, modules load fine but may affect BPF tooling.&lt;br /&gt;
* &#039;&#039;&#039;BBframe capture unverified:&#039;&#039;&#039; Patches compile and load cleanly but have not yet been tested with an actual satellite signal. Testing pending dish access at NURDspace.&lt;br /&gt;
* Test to see if we can get this working on a Raspberry Pi 5&lt;br /&gt;
&lt;br /&gt;
== References ==&lt;br /&gt;
&lt;br /&gt;
* [https://github.com/ucsdsysnet/dontlookup dontlookup paper/tool]&lt;br /&gt;
* [https://github.com/s-moch/linux-saa716x s-moch/linux-saa716x]&lt;br /&gt;
* [https://github.com/xenpac/Linux-DVB-S2-SatReceiver xenpac/Linux-DVB-S2-SatReceiver]&lt;br /&gt;
* [https://github.com/newspaperman/bbframe-tools newspaperman/bbframe-tools]&lt;br /&gt;
* [https://linuxtv.org/wiki/index.php/DVBSky_T9580 LinuxTV wiki: DVBSky T9580]&lt;br /&gt;
* [https://www.linuxtv.org/wiki/index.php/Hauppauge_WinTV-HVR-5500 LinuxTV wiki: Hauppauge WinTV-HVR-5500]&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=SkyStar_2_eXpress_HD&amp;diff=15920</id>
		<title>SkyStar 2 eXpress HD</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=SkyStar_2_eXpress_HD&amp;diff=15920"/>
		<updated>2026-04-13T14:01:23Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=SkyStar 2 eXpress HD&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Sdr&lt;br /&gt;
|Tool=No&lt;br /&gt;
|Location=&lt;br /&gt;
}}&lt;br /&gt;
&lt;br /&gt;
== Overview ==&lt;br /&gt;
&lt;br /&gt;
This page describes the process of getting raw DVB-S2 BBframe capture working on a &#039;&#039;&#039;TechniSat SkyStar 2 eXpress HD&#039;&#039;&#039; PCIe card under Debian trixie (kernel 6.12), as part of replicating the [https://github.com/ucsdsysnet/dontlookup dontlookup] research project.&lt;br /&gt;
&lt;br /&gt;
The dontlookup paper uses a TBS5927 USB stick with a one-line driver patch to capture raw BBframes. This write-up ports that approach to the SkyStar 2 eXpress HD, which uses a different (and more interesting) chipset.&lt;br /&gt;
&lt;br /&gt;
== Hardware ==&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;BBframe capture has not yet been tested with an actual satellite signal. Testing pending dish access at NURDspace.&lt;br /&gt;
&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;TechniSat SkyStar 2 eXpress HD&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Component !! Details&lt;br /&gt;
|-&lt;br /&gt;
| PCIe bridge || NXP SAA7160 (rev 3)&lt;br /&gt;
|-&lt;br /&gt;
| DVB-S2 demodulator || &#039;&#039;&#039;STV0903B&#039;&#039;&#039; (STV090x family)&lt;br /&gt;
|-&lt;br /&gt;
| Tuner || &#039;&#039;&#039;STV6110A&#039;&#039;&#039;&lt;br /&gt;
|-&lt;br /&gt;
| PCI ID || Appears as &amp;lt;code&amp;gt;Philips Semiconductors SAA7160&amp;lt;/code&amp;gt; in lspci&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Why This Card ===&lt;br /&gt;
&lt;br /&gt;
The STV090x family was specifically targeted because:&lt;br /&gt;
* It has hardware-level BBframe support via the &amp;lt;code&amp;gt;FRAME_MODE_FIELD&amp;lt;/code&amp;gt; bit in &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt;&lt;br /&gt;
* The mainline kernel driver (&amp;lt;code&amp;gt;stv090x&amp;lt;/code&amp;gt;) is well maintained&lt;br /&gt;
* The chip is well documented compared to alternatives&lt;br /&gt;
&lt;br /&gt;
=== 3.3V PCIe Issue ===&lt;br /&gt;
&lt;br /&gt;
AMD Ryzen systems (and many modern motherboards) do not provide 3.3V on PCIe slots, as modern GPUs don&#039;t require it. DVB cards like the SkyStar 2 eXpress HD use 3.3V for their logic and will not enumerate (&amp;lt;code&amp;gt;lspci&amp;lt;/code&amp;gt; shows nothing) on affected systems.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Workaround:&#039;&#039;&#039; Use an Intel-based system. The card was confirmed working in an X99 board. PCIe 3.3V injector risers from AliExpress are an alternative for AMD systems.&lt;br /&gt;
&lt;br /&gt;
== Software Environment ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! !! Details&lt;br /&gt;
|-&lt;br /&gt;
| OS || Debian trixie&lt;br /&gt;
|-&lt;br /&gt;
| Kernel || &amp;lt;code&amp;gt;6.12.74+deb13+1-amd64&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Driver source || [https://github.com/s-moch/linux-saa716x s-moch/linux-saa716x] — out-of-tree saa716x driver, maintained as kernel-version-specific diffs&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Building the saa716x Driver ==&lt;br /&gt;
&lt;br /&gt;
The &amp;lt;code&amp;gt;saa716x&amp;lt;/code&amp;gt; driver is not in the mainline kernel. The s-moch repo provides diffs that patch it into the kernel source tree.&lt;br /&gt;
&lt;br /&gt;
=== Install dependencies ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sudo apt install linux-source-6.12 linux-headers-$(uname -r) \&lt;br /&gt;
    libelf-dev build-essential flex bison libssl-dev wget&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Extract kernel source and apply patch ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
mkdir ~/kernel-compile &amp;amp;&amp;amp; cd ~/kernel-compile&lt;br /&gt;
wget https://github.com/s-moch/linux-saa716x/compare/saa716x-6.12.diff&lt;br /&gt;
tar xJf /usr/src/linux-source-6.12.tar.xz&lt;br /&gt;
cd linux-source-6.12&lt;br /&gt;
cp /boot/config-$(uname -r) .config&lt;br /&gt;
cp /usr/src/linux-headers-$(uname -r)/Module.symvers .&lt;br /&gt;
patch -p1 &amp;lt; ../saa716x-6.12.diff&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Configure and build ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
make olddefconfig&lt;br /&gt;
make modules_prepare&lt;br /&gt;
make syncconfig&lt;br /&gt;
&lt;br /&gt;
# Enable saa716x in config&lt;br /&gt;
scripts/config --enable SAA716X_SUPPORT&lt;br /&gt;
scripts/config --enable DVB_SAA716X_BUDGET&lt;br /&gt;
make syncconfig&lt;br /&gt;
&lt;br /&gt;
# Build just the saa716x driver&lt;br /&gt;
make -C . M=drivers/media/pci/saa716x modules -j$(nproc)&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Install ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_core.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_budget.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo depmod -a&lt;br /&gt;
sudo modprobe saa716x_budget&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Expected dmesg output ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;text&amp;quot;&amp;gt;&lt;br /&gt;
SAA716x Budget 0000:06:00.0: found a SkyStar 2 eXpress HD PCIe card&lt;br /&gt;
SAA716x Budget 0000:06:00.0:  SAA7160 Rev 3, irq: 55 (MSI)&lt;br /&gt;
SAA716x Budget 0000:06:00.0: Initializing SAA716x I2C Core 0 @ 100kHz&lt;br /&gt;
SAA716x Budget 0000:06:00.0: Initializing SAA716x I2C Core 1 @ 100kHz&lt;br /&gt;
dvbdev: DVB: registering new adapter (SAA716x dvb adapter)&lt;br /&gt;
i2c i2c-2: Attaching STV6110x&lt;br /&gt;
SAA716x Budget 0000:06:00.0: DVB: registering adapter 0 frontend 0 (STV090x Multistandard)...&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
DVB devices appear at &amp;lt;code&amp;gt;/dev/dvb/adapter0/{demux0,dvr0,frontend0,net0}&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
== BBframe Patches ==&lt;br /&gt;
&lt;br /&gt;
Two patches are required:&lt;br /&gt;
&lt;br /&gt;
# &#039;&#039;&#039;&amp;lt;code&amp;gt;saa716x_adap.c&amp;lt;/code&amp;gt;&#039;&#039;&#039; — swap &amp;lt;code&amp;gt;dvb_dmx_swfilter&amp;lt;/code&amp;gt; for &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw&amp;lt;/code&amp;gt; so the DMA data is passed raw to userspace instead of being parsed as 188-byte TS packets&lt;br /&gt;
# &#039;&#039;&#039;&amp;lt;code&amp;gt;stv090x.c&amp;lt;/code&amp;gt;&#039;&#039;&#039; — set &amp;lt;code&amp;gt;FRAME_MODE_FIELD=1&amp;lt;/code&amp;gt; in &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt; after lock, which tells the STV0903B to output raw BBframes instead of decoded TS&lt;br /&gt;
&lt;br /&gt;
=== Background: How dontlookup&#039;s TBS5927 patch works ===&lt;br /&gt;
&lt;br /&gt;
The original dontlookup patch for the TBS5927 is a single line added to &amp;lt;code&amp;gt;tbs5927.c&amp;lt;/code&amp;gt;:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;c&amp;quot;&amp;gt;&lt;br /&gt;
.caps = DVB_USB_ADAP_RECEIVES_RAW_PAYLOAD,&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
This flag causes the dvb-usb layer to call &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw()&amp;lt;/code&amp;gt; instead of &amp;lt;code&amp;gt;dvb_dmx_swfilter()&amp;lt;/code&amp;gt;, passing raw bytes straight through. The saa716x patch replicates this at the PCI driver level.&lt;br /&gt;
&lt;br /&gt;
=== Patch 1: saa716x_adap.c — Raw DMA passthrough ===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;File:&#039;&#039;&#039; &amp;lt;code&amp;gt;drivers/media/pci/saa716x/saa716x_adap.c&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Change &amp;lt;code&amp;gt;dvb_dmx_swfilter&amp;lt;/code&amp;gt; to &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw&amp;lt;/code&amp;gt; in the DMA completion handler:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;diff&amp;quot;&amp;gt;&lt;br /&gt;
-               dvb_dmx_swfilter(demux, data, 348 * 188);&lt;br /&gt;
+               dvb_dmx_swfilter_raw(demux, data, 348 * 188);&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Apply with:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sed -i &#039;s/dvb_dmx_swfilter(demux, data, 348 \* 188)/dvb_dmx_swfilter_raw(demux, data, 348 * 188)/&#039; \&lt;br /&gt;
    drivers/media/pci/saa716x/saa716x_adap.c&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Note:&#039;&#039;&#039; The buffer size &amp;lt;code&amp;gt;348 * 188 = 65424&amp;lt;/code&amp;gt; bytes is the DMA buffer size and is passed as-is. &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw&amp;lt;/code&amp;gt; does not assume 188-byte alignment so this is fine.&lt;br /&gt;
&lt;br /&gt;
=== Patch 2: stv090x.c — Enable BBframe mode after lock ===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;File:&#039;&#039;&#039; &amp;lt;code&amp;gt;drivers/media/dvb-frontends/stv090x.c&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
After the demodulator achieves DVB-S2 lock, set &amp;lt;code&amp;gt;FRAME_MODE_FIELD=1&amp;lt;/code&amp;gt; in &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt;. This tells the STV0903B to output raw BBframes rather than decoded transport stream packets.&lt;br /&gt;
&lt;br /&gt;
The relevant register is defined in &amp;lt;code&amp;gt;stv090x_reg.h&amp;lt;/code&amp;gt;:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;c&amp;quot;&amp;gt;&lt;br /&gt;
#define STV090x_OFFST_Px_FRAME_MODE_FIELD  1&lt;br /&gt;
#define STV090x_WIDTH_Px_FRAME_MODE_FIELD  1&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Insert the following block after the &amp;lt;code&amp;gt;RESET_UPKO_COUNT&amp;lt;/code&amp;gt; sequence (around line 3397), immediately before the &amp;lt;code&amp;gt;ERRCTRL1&amp;lt;/code&amp;gt; write:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;diff&amp;quot;&amp;gt;&lt;br /&gt;
+                               /* Enable BBframe mode */&lt;br /&gt;
+                               reg = STV090x_READ_DEMOD(state, PDELCTRL2);&lt;br /&gt;
+                               STV090x_SETFIELD_Px(reg, FRAME_MODE_FIELD, 1);&lt;br /&gt;
+                               if (STV090x_WRITE_DEMOD(state, PDELCTRL2, reg) &amp;lt; 0)&lt;br /&gt;
+                                       goto err;&lt;br /&gt;
                                if (STV090x_WRITE_DEMOD(state, ERRCTRL1, 0x67) &amp;lt; 0) /* PER */&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Apply with Python (handles tabs correctly):&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;python&amp;quot;&amp;gt;&lt;br /&gt;
with open(&#039;drivers/media/dvb-frontends/stv090x.c&#039;, &#039;r&#039;) as f:&lt;br /&gt;
    content = f.read()&lt;br /&gt;
&lt;br /&gt;
old = &#039;\t\t\t\tif (STV090x_WRITE_DEMOD(state, ERRCTRL1, 0x67) &amp;lt; 0) /* PER */&#039;&lt;br /&gt;
new = (&#039;\t\t\t\t/* Enable BBframe mode */\n&#039;&lt;br /&gt;
       &#039;\t\t\t\treg = STV090x_READ_DEMOD(state, PDELCTRL2);\n&#039;&lt;br /&gt;
       &#039;\t\t\t\tSTV090x_SETFIELD_Px(reg, FRAME_MODE_FIELD, 1);\n&#039;&lt;br /&gt;
       &#039;\t\t\t\tif (STV090x_WRITE_DEMOD(state, PDELCTRL2, reg) &amp;lt; 0)\n&#039;&lt;br /&gt;
       &#039;\t\t\t\t\tgoto err;\n&#039;&lt;br /&gt;
       &#039;\t\t\t\tif (STV090x_WRITE_DEMOD(state, ERRCTRL1, 0x67) &amp;lt; 0) /* PER */&#039;)&lt;br /&gt;
&lt;br /&gt;
content = content.replace(old, new, 1)&lt;br /&gt;
&lt;br /&gt;
with open(&#039;drivers/media/dvb-frontends/stv090x.c&#039;, &#039;w&#039;) as f:&lt;br /&gt;
    f.write(content)&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Building and installing the patched modules ===&lt;br /&gt;
&lt;br /&gt;
After applying both patches:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
cd ~/kernel-compile/linux-source-6.12&lt;br /&gt;
&lt;br /&gt;
# Rebuild saa716x&lt;br /&gt;
make -C . M=drivers/media/pci/saa716x modules -j$(nproc)&lt;br /&gt;
&lt;br /&gt;
# Rebuild stv090x frontend&lt;br /&gt;
make -C . M=drivers/media/dvb-frontends modules -j$(nproc)&lt;br /&gt;
&lt;br /&gt;
# Install&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_core.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_budget.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo cp drivers/media/dvb-frontends/stv090x.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/dvb-frontends/&lt;br /&gt;
&lt;br /&gt;
sudo depmod -a&lt;br /&gt;
sudo modprobe -r saa716x_budget&lt;br /&gt;
sudo modprobe saa716x_budget&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Capture Procedure ==&lt;br /&gt;
&lt;br /&gt;
Once the card is connected to a dish:&lt;br /&gt;
&lt;br /&gt;
=== 1. Create a channels.conf for the target transponder ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;text&amp;quot;&amp;gt;&lt;br /&gt;
[SomeTransponder]&lt;br /&gt;
        DELIVERY_SYSTEM = DVBS2&lt;br /&gt;
        FREQUENCY = 1550000&lt;br /&gt;
        SYMBOL_RATE = 30000000&lt;br /&gt;
        POLARIZATION = HORIZONTAL&lt;br /&gt;
        MODULATION = QPSK&lt;br /&gt;
        INNER_FEC = AUTO&lt;br /&gt;
        ROLLOFF = AUTO&lt;br /&gt;
        STREAM_ID = -1&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Note:&#039;&#039;&#039; frequency is the &#039;&#039;&#039;IF frequency&#039;&#039;&#039; after LNB downconversion, not the satellite frequency. For a universal LNB (LO = 9750 MHz low band / 10600 MHz high band), subtract accordingly.&lt;br /&gt;
&lt;br /&gt;
=== 2. Capture raw BBframes ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
dvbv5-zap -a 0 -S 0x80000000 -o capture.ts -c channels.conf &amp;quot;SomeTransponder&amp;quot;&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;-S 0x80000000&amp;lt;/code&amp;gt; sets &amp;lt;code&amp;gt;DTV_STREAM_ID&amp;lt;/code&amp;gt; to request all streams in raw mode.&lt;br /&gt;
&lt;br /&gt;
=== 3. Run dontlookup ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
git clone https://github.com/ucsdsysnet/dontlookup&lt;br /&gt;
cd dontlookup&lt;br /&gt;
pip install -r requirements.txt&lt;br /&gt;
python3 dontlookup.py capture.ts -p all&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Output IP pcaps will appear in &amp;lt;code&amp;gt;output/&amp;lt;/code&amp;gt; — open with Wireshark.&lt;br /&gt;
&lt;br /&gt;
== Known Issues / TODO ==&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;Blindscan:&#039;&#039;&#039; The STV090x driver has a &amp;lt;code&amp;gt;stv090x_blind_search()&amp;lt;/code&amp;gt; function internally but it is never triggered from userspace. The DVB core rejects symbol rate = 0. A follow-up patch to enable blindscan via srate=0 is needed.&lt;br /&gt;
* &#039;&#039;&#039;BTF generation skipped:&#039;&#039;&#039; &amp;lt;code&amp;gt;vmlinux&amp;lt;/code&amp;gt; not available for BTF, modules load fine but may affect BPF tooling.&lt;br /&gt;
* &#039;&#039;&#039;BBframe capture unverified:&#039;&#039;&#039; Patches compile and load cleanly but have not yet been tested with an actual satellite signal. Testing pending dish access at NURDspace.&lt;br /&gt;
* Test to see if we can get this working on a Raspberry Pi 5&lt;br /&gt;
&lt;br /&gt;
== References ==&lt;br /&gt;
&lt;br /&gt;
* [https://github.com/ucsdsysnet/dontlookup dontlookup paper/tool]&lt;br /&gt;
* [https://github.com/s-moch/linux-saa716x s-moch/linux-saa716x]&lt;br /&gt;
* [https://github.com/xenpac/Linux-DVB-S2-SatReceiver xenpac/Linux-DVB-S2-SatReceiver]&lt;br /&gt;
* [https://github.com/newspaperman/bbframe-tools newspaperman/bbframe-tools]&lt;br /&gt;
* [https://linuxtv.org/wiki/index.php/DVBSky_T9580 LinuxTV wiki: DVBSky T9580]&lt;br /&gt;
* [https://www.linuxtv.org/wiki/index.php/Hauppauge_WinTV-HVR-5500 LinuxTV wiki: Hauppauge WinTV-HVR-5500]&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=SkyStar_2_eXpress_HD&amp;diff=15919</id>
		<title>SkyStar 2 eXpress HD</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=SkyStar_2_eXpress_HD&amp;diff=15919"/>
		<updated>2026-04-13T14:00:14Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=SkyStar 2 eXpress HD&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Sdr&lt;br /&gt;
|Tool=No&lt;br /&gt;
|Location=&lt;br /&gt;
}}&lt;br /&gt;
&lt;br /&gt;
== Overview ==&lt;br /&gt;
&lt;br /&gt;
This page describes the process of getting raw DVB-S2 BBframe capture working on a &#039;&#039;&#039;TechniSat SkyStar 2 eXpress HD&#039;&#039;&#039; PCIe card under Debian trixie (kernel 6.12), as part of replicating the [https://github.com/ucsdsysnet/dontlookup dontlookup] research project.&lt;br /&gt;
&lt;br /&gt;
The dontlookup paper uses a TBS5927 USB stick with a one-line driver patch to capture raw BBframes. This write-up ports that approach to the SkyStar 2 eXpress HD, which uses a different (and more interesting) chipset.&lt;br /&gt;
&lt;br /&gt;
== Hardware ==&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;BBframe capture has not yet been tested with an actual satellite signal. Testing pending dish access at NURDspace.&lt;br /&gt;
&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;TechniSat SkyStar 2 eXpress HD&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Component !! Details&lt;br /&gt;
|-&lt;br /&gt;
| PCIe bridge || NXP SAA7160 (rev 3)&lt;br /&gt;
|-&lt;br /&gt;
| DVB-S2 demodulator || &#039;&#039;&#039;STV0903B&#039;&#039;&#039; (STV090x family)&lt;br /&gt;
|-&lt;br /&gt;
| Tuner || &#039;&#039;&#039;STV6110A&#039;&#039;&#039;&lt;br /&gt;
|-&lt;br /&gt;
| PCI ID || Appears as &amp;lt;code&amp;gt;Philips Semiconductors SAA7160&amp;lt;/code&amp;gt; in lspci&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Why This Card ===&lt;br /&gt;
&lt;br /&gt;
The STV090x family was specifically targeted because:&lt;br /&gt;
* It has hardware-level BBframe support via the &amp;lt;code&amp;gt;FRAME_MODE_FIELD&amp;lt;/code&amp;gt; bit in &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt;&lt;br /&gt;
* The mainline kernel driver (&amp;lt;code&amp;gt;stv090x&amp;lt;/code&amp;gt;) is well maintained&lt;br /&gt;
* The chip is well documented compared to alternatives&lt;br /&gt;
&lt;br /&gt;
=== 3.3V PCIe Issue ===&lt;br /&gt;
&lt;br /&gt;
AMD Ryzen systems (and many modern motherboards) do not provide 3.3V on PCIe slots, as modern GPUs don&#039;t require it. DVB cards like the SkyStar 2 eXpress HD use 3.3V for their logic and will not enumerate (&amp;lt;code&amp;gt;lspci&amp;lt;/code&amp;gt; shows nothing) on affected systems.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Workaround:&#039;&#039;&#039; Use an Intel-based system. The card was confirmed working in an X99 board. PCIe 3.3V injector risers from AliExpress are an alternative for AMD systems.&lt;br /&gt;
&lt;br /&gt;
== Software Environment ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! !! Details&lt;br /&gt;
|-&lt;br /&gt;
| OS || Debian trixie&lt;br /&gt;
|-&lt;br /&gt;
| Kernel || &amp;lt;code&amp;gt;6.12.74+deb13+1-amd64&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Driver source || [https://github.com/s-moch/linux-saa716x s-moch/linux-saa716x] — out-of-tree saa716x driver, maintained as kernel-version-specific diffs&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Building the saa716x Driver ==&lt;br /&gt;
&lt;br /&gt;
The &amp;lt;code&amp;gt;saa716x&amp;lt;/code&amp;gt; driver is not in the mainline kernel. The s-moch repo provides diffs that patch it into the kernel source tree.&lt;br /&gt;
&lt;br /&gt;
=== Install dependencies ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sudo apt install linux-source-6.12 linux-headers-$(uname -r) \&lt;br /&gt;
    libelf-dev build-essential flex bison libssl-dev wget&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Extract kernel source and apply patch ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
mkdir ~/kernel-compile &amp;amp;&amp;amp; cd ~/kernel-compile&lt;br /&gt;
wget https://github.com/s-moch/linux-saa716x/compare/saa716x-6.12.diff&lt;br /&gt;
tar xJf /usr/src/linux-source-6.12.tar.xz&lt;br /&gt;
cd linux-source-6.12&lt;br /&gt;
cp /boot/config-$(uname -r) .config&lt;br /&gt;
cp /usr/src/linux-headers-$(uname -r)/Module.symvers .&lt;br /&gt;
patch -p1 &amp;lt; ../saa716x-6.12.diff&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Configure and build ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
make olddefconfig&lt;br /&gt;
make modules_prepare&lt;br /&gt;
make syncconfig&lt;br /&gt;
&lt;br /&gt;
# Enable saa716x in config&lt;br /&gt;
scripts/config --enable SAA716X_SUPPORT&lt;br /&gt;
scripts/config --enable DVB_SAA716X_BUDGET&lt;br /&gt;
make syncconfig&lt;br /&gt;
&lt;br /&gt;
# Build just the saa716x driver&lt;br /&gt;
make -C . M=drivers/media/pci/saa716x modules -j$(nproc)&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Install ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_core.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_budget.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo depmod -a&lt;br /&gt;
sudo modprobe saa716x_budget&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Expected dmesg output ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;text&amp;quot;&amp;gt;&lt;br /&gt;
SAA716x Budget 0000:06:00.0: found a SkyStar 2 eXpress HD PCIe card&lt;br /&gt;
SAA716x Budget 0000:06:00.0:  SAA7160 Rev 3, irq: 55 (MSI)&lt;br /&gt;
SAA716x Budget 0000:06:00.0: Initializing SAA716x I2C Core 0 @ 100kHz&lt;br /&gt;
SAA716x Budget 0000:06:00.0: Initializing SAA716x I2C Core 1 @ 100kHz&lt;br /&gt;
dvbdev: DVB: registering new adapter (SAA716x dvb adapter)&lt;br /&gt;
i2c i2c-2: Attaching STV6110x&lt;br /&gt;
SAA716x Budget 0000:06:00.0: DVB: registering adapter 0 frontend 0 (STV090x Multistandard)...&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
DVB devices appear at &amp;lt;code&amp;gt;/dev/dvb/adapter0/{demux0,dvr0,frontend0,net0}&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
== BBframe Patches ==&lt;br /&gt;
&lt;br /&gt;
Two patches are required:&lt;br /&gt;
&lt;br /&gt;
# &#039;&#039;&#039;&amp;lt;code&amp;gt;saa716x_adap.c&amp;lt;/code&amp;gt;&#039;&#039;&#039; — swap &amp;lt;code&amp;gt;dvb_dmx_swfilter&amp;lt;/code&amp;gt; for &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw&amp;lt;/code&amp;gt; so the DMA data is passed raw to userspace instead of being parsed as 188-byte TS packets&lt;br /&gt;
# &#039;&#039;&#039;&amp;lt;code&amp;gt;stv090x.c&amp;lt;/code&amp;gt;&#039;&#039;&#039; — set &amp;lt;code&amp;gt;FRAME_MODE_FIELD=1&amp;lt;/code&amp;gt; in &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt; after lock, which tells the STV0903B to output raw BBframes instead of decoded TS&lt;br /&gt;
&lt;br /&gt;
=== Background: How dontlookup&#039;s TBS5927 patch works ===&lt;br /&gt;
&lt;br /&gt;
The original dontlookup patch for the TBS5927 is a single line added to &amp;lt;code&amp;gt;tbs5927.c&amp;lt;/code&amp;gt;:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;c&amp;quot;&amp;gt;&lt;br /&gt;
.caps = DVB_USB_ADAP_RECEIVES_RAW_PAYLOAD,&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
This flag causes the dvb-usb layer to call &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw()&amp;lt;/code&amp;gt; instead of &amp;lt;code&amp;gt;dvb_dmx_swfilter()&amp;lt;/code&amp;gt;, passing raw bytes straight through. The saa716x patch replicates this at the PCI driver level.&lt;br /&gt;
&lt;br /&gt;
=== Patch 1: saa716x_adap.c — Raw DMA passthrough ===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;File:&#039;&#039;&#039; &amp;lt;code&amp;gt;drivers/media/pci/saa716x/saa716x_adap.c&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Change &amp;lt;code&amp;gt;dvb_dmx_swfilter&amp;lt;/code&amp;gt; to &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw&amp;lt;/code&amp;gt; in the DMA completion handler:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;diff&amp;quot;&amp;gt;&lt;br /&gt;
-               dvb_dmx_swfilter(demux, data, 348 * 188);&lt;br /&gt;
+               dvb_dmx_swfilter_raw(demux, data, 348 * 188);&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Apply with:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sed -i &#039;s/dvb_dmx_swfilter(demux, data, 348 \* 188)/dvb_dmx_swfilter_raw(demux, data, 348 * 188)/&#039; \&lt;br /&gt;
    drivers/media/pci/saa716x/saa716x_adap.c&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Note:&#039;&#039;&#039; The buffer size &amp;lt;code&amp;gt;348 * 188 = 65424&amp;lt;/code&amp;gt; bytes is the DMA buffer size and is passed as-is. &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw&amp;lt;/code&amp;gt; does not assume 188-byte alignment so this is fine.&lt;br /&gt;
&lt;br /&gt;
=== Patch 2: stv090x.c — Enable BBframe mode after lock ===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;File:&#039;&#039;&#039; &amp;lt;code&amp;gt;drivers/media/dvb-frontends/stv090x.c&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
After the demodulator achieves DVB-S2 lock, set &amp;lt;code&amp;gt;FRAME_MODE_FIELD=1&amp;lt;/code&amp;gt; in &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt;. This tells the STV0903B to output raw BBframes rather than decoded transport stream packets.&lt;br /&gt;
&lt;br /&gt;
The relevant register is defined in &amp;lt;code&amp;gt;stv090x_reg.h&amp;lt;/code&amp;gt;:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;c&amp;quot;&amp;gt;&lt;br /&gt;
#define STV090x_OFFST_Px_FRAME_MODE_FIELD  1&lt;br /&gt;
#define STV090x_WIDTH_Px_FRAME_MODE_FIELD  1&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Insert the following block after the &amp;lt;code&amp;gt;RESET_UPKO_COUNT&amp;lt;/code&amp;gt; sequence (around line 3397), immediately before the &amp;lt;code&amp;gt;ERRCTRL1&amp;lt;/code&amp;gt; write:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;diff&amp;quot;&amp;gt;&lt;br /&gt;
+                               /* Enable BBframe mode */&lt;br /&gt;
+                               reg = STV090x_READ_DEMOD(state, PDELCTRL2);&lt;br /&gt;
+                               STV090x_SETFIELD_Px(reg, FRAME_MODE_FIELD, 1);&lt;br /&gt;
+                               if (STV090x_WRITE_DEMOD(state, PDELCTRL2, reg) &amp;lt; 0)&lt;br /&gt;
+                                       goto err;&lt;br /&gt;
                                if (STV090x_WRITE_DEMOD(state, ERRCTRL1, 0x67) &amp;lt; 0) /* PER */&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Apply with Python (handles tabs correctly):&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;python&amp;quot;&amp;gt;&lt;br /&gt;
with open(&#039;drivers/media/dvb-frontends/stv090x.c&#039;, &#039;r&#039;) as f:&lt;br /&gt;
    content = f.read()&lt;br /&gt;
&lt;br /&gt;
old = &#039;\t\t\t\tif (STV090x_WRITE_DEMOD(state, ERRCTRL1, 0x67) &amp;lt; 0) /* PER */&#039;&lt;br /&gt;
new = (&#039;\t\t\t\t/* Enable BBframe mode */\n&#039;&lt;br /&gt;
       &#039;\t\t\t\treg = STV090x_READ_DEMOD(state, PDELCTRL2);\n&#039;&lt;br /&gt;
       &#039;\t\t\t\tSTV090x_SETFIELD_Px(reg, FRAME_MODE_FIELD, 1);\n&#039;&lt;br /&gt;
       &#039;\t\t\t\tif (STV090x_WRITE_DEMOD(state, PDELCTRL2, reg) &amp;lt; 0)\n&#039;&lt;br /&gt;
       &#039;\t\t\t\t\tgoto err;\n&#039;&lt;br /&gt;
       &#039;\t\t\t\tif (STV090x_WRITE_DEMOD(state, ERRCTRL1, 0x67) &amp;lt; 0) /* PER */&#039;)&lt;br /&gt;
&lt;br /&gt;
content = content.replace(old, new, 1)&lt;br /&gt;
&lt;br /&gt;
with open(&#039;drivers/media/dvb-frontends/stv090x.c&#039;, &#039;w&#039;) as f:&lt;br /&gt;
    f.write(content)&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Building and installing the patched modules ===&lt;br /&gt;
&lt;br /&gt;
After applying both patches:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
cd ~/kernel-compile/linux-source-6.12&lt;br /&gt;
&lt;br /&gt;
# Rebuild saa716x&lt;br /&gt;
make -C . M=drivers/media/pci/saa716x modules -j$(nproc)&lt;br /&gt;
&lt;br /&gt;
# Rebuild stv090x frontend&lt;br /&gt;
make -C . M=drivers/media/dvb-frontends modules -j$(nproc)&lt;br /&gt;
&lt;br /&gt;
# Install&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_core.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_budget.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo cp drivers/media/dvb-frontends/stv090x.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/dvb-frontends/&lt;br /&gt;
&lt;br /&gt;
sudo depmod -a&lt;br /&gt;
sudo modprobe -r saa716x_budget&lt;br /&gt;
sudo modprobe saa716x_budget&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Capture Procedure ==&lt;br /&gt;
&lt;br /&gt;
Once the card is connected to a dish:&lt;br /&gt;
&lt;br /&gt;
=== 1. Create a channels.conf for the target transponder ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;text&amp;quot;&amp;gt;&lt;br /&gt;
[SomeTransponder]&lt;br /&gt;
        DELIVERY_SYSTEM = DVBS2&lt;br /&gt;
        FREQUENCY = 1550000&lt;br /&gt;
        SYMBOL_RATE = 30000000&lt;br /&gt;
        POLARIZATION = HORIZONTAL&lt;br /&gt;
        MODULATION = QPSK&lt;br /&gt;
        INNER_FEC = AUTO&lt;br /&gt;
        ROLLOFF = AUTO&lt;br /&gt;
        STREAM_ID = -1&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Note:&#039;&#039;&#039; frequency is the &#039;&#039;&#039;IF frequency&#039;&#039;&#039; after LNB downconversion, not the satellite frequency. For a universal LNB (LO = 9750 MHz low band / 10600 MHz high band), subtract accordingly.&lt;br /&gt;
&lt;br /&gt;
=== 2. Capture raw BBframes ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
dvbv5-zap -a 0 -S 0x80000000 -o capture.ts -c channels.conf &amp;quot;SomeTransponder&amp;quot;&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;-S 0x80000000&amp;lt;/code&amp;gt; sets &amp;lt;code&amp;gt;DTV_STREAM_ID&amp;lt;/code&amp;gt; to request all streams in raw mode.&lt;br /&gt;
&lt;br /&gt;
=== 3. Run dontlookup ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
git clone https://github.com/ucsdsysnet/dontlookup&lt;br /&gt;
cd dontlookup&lt;br /&gt;
pip install -r requirements.txt&lt;br /&gt;
python3 dontlookup.py capture.ts -p all&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Output IP pcaps will appear in &amp;lt;code&amp;gt;output/&amp;lt;/code&amp;gt; — open with Wireshark.&lt;br /&gt;
&lt;br /&gt;
== Known Issues / TODO ==&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;Blindscan:&#039;&#039;&#039; The STV090x driver has a &amp;lt;code&amp;gt;stv090x_blind_search()&amp;lt;/code&amp;gt; function internally but it is never triggered from userspace. The DVB core rejects symbol rate = 0. A follow-up patch to enable blindscan via srate=0 is needed.&lt;br /&gt;
* &#039;&#039;&#039;3.3V on AMD:&#039;&#039;&#039; PCIe 3.3V injector riser needed for AMD systems, or use an Intel machine.&lt;br /&gt;
* &#039;&#039;&#039;BTF generation skipped:&#039;&#039;&#039; &amp;lt;code&amp;gt;vmlinux&amp;lt;/code&amp;gt; not available for BTF, modules load fine but may affect BPF tooling.&lt;br /&gt;
* &#039;&#039;&#039;BBframe capture unverified:&#039;&#039;&#039; Patches compile and load cleanly but have not yet been tested with an actual satellite signal. Testing pending dish access at NURDspace.&lt;br /&gt;
&lt;br /&gt;
== References ==&lt;br /&gt;
&lt;br /&gt;
* [https://github.com/ucsdsysnet/dontlookup dontlookup paper/tool]&lt;br /&gt;
* [https://github.com/s-moch/linux-saa716x s-moch/linux-saa716x]&lt;br /&gt;
* [https://github.com/xenpac/Linux-DVB-S2-SatReceiver xenpac/Linux-DVB-S2-SatReceiver]&lt;br /&gt;
* [https://github.com/newspaperman/bbframe-tools newspaperman/bbframe-tools]&lt;br /&gt;
* [https://linuxtv.org/wiki/index.php/DVBSky_T9580 LinuxTV wiki: DVBSky T9580]&lt;br /&gt;
* [https://www.linuxtv.org/wiki/index.php/Hauppauge_WinTV-HVR-5500 LinuxTV wiki: Hauppauge WinTV-HVR-5500]&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=User:Melan&amp;diff=15918</id>
		<title>User:Melan</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=User:Melan&amp;diff=15918"/>
		<updated>2026-04-13T11:10:38Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Members&lt;br /&gt;
|picture=Melan.png&lt;br /&gt;
|Nickname=Melan&lt;br /&gt;
|Memberstatus=member&lt;br /&gt;
|URL=https://github.com/Melanpan&lt;br /&gt;
|XMPP=melan@space.nurdspace.nl&lt;br /&gt;
|Extension=1515&lt;br /&gt;
|Project=ESP_OPL, MPDTube, Sonic_Amplifier, Slabbar, DIY_Ambilight, Airplane_Tracking, nurdlights, Desk_lights, LaLamp, Nurd Plotter, Sony Vaio Ultraportable, DRIS_Display, HAIrk, Nurdtemps, Spacesound, NurdBot Lora Failover, DIY_DSP, Erratic, Open/closed_sign, Labelprinters, Meshcore, KlikoAI, Intellian_i4_Satellite_dish, Dontlookup, Adtec_RD-60,SkyStar 2 eXpress HD&lt;br /&gt;
|nickname=Melan&lt;br /&gt;
|email=rijst@kopen.nl&lt;br /&gt;
}}&lt;br /&gt;
Will proudly present you the latest trash straight from the local Kringloop.&lt;br /&gt;
&lt;br /&gt;
== Main interests ==&lt;br /&gt;
* Programming: Python and a bit of C++&lt;br /&gt;
* Automation&lt;br /&gt;
* Anime&lt;br /&gt;
* Making Music, playing with Synths, making hark songs and remixes&lt;br /&gt;
* Audio related stuff&lt;br /&gt;
* &#039;&#039;&#039;Leds&#039;&#039;&#039;&lt;br /&gt;
* Airplanes (ADS-B) and HAMkaas radio, radio astronomy&lt;br /&gt;
* Microcontrollers (esp8266, esp32, rp2040)&lt;br /&gt;
* Machine Learning&lt;br /&gt;
* Adding pointless and annoying things to the space&lt;br /&gt;
&lt;br /&gt;
== Part of the following commissions ==&lt;br /&gt;
* RF Commission&lt;br /&gt;
* Media Commission&lt;br /&gt;
* BOFH&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=SkyStar_2_eXpress_HD&amp;diff=15917</id>
		<title>SkyStar 2 eXpress HD</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=SkyStar_2_eXpress_HD&amp;diff=15917"/>
		<updated>2026-04-13T11:10:22Z</updated>

		<summary type="html">&lt;p&gt;Melan: Created page with &amp;quot;{{Project |Name=SkyStar 2 eXpress HD |Status=Active |Niche=Sdr |Tool=No |Location= }}  == Overview ==  This page describes the process of getting raw DVB-S2 BBframe capture working on a &amp;#039;&amp;#039;&amp;#039;TechniSat SkyStar 2 eXpress HD&amp;#039;&amp;#039;&amp;#039; PCIe card under Debian trixie (kernel 6.12), as part of replicating the [https://github.com/ucsdsysnet/dontlookup dontlookup] research project.  The dontlookup paper uses a TBS5927 USB stick with a one-line driver patch to capture raw BBframes. This wr...&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=SkyStar 2 eXpress HD&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Sdr&lt;br /&gt;
|Tool=No&lt;br /&gt;
|Location=&lt;br /&gt;
}}&lt;br /&gt;
&lt;br /&gt;
== Overview ==&lt;br /&gt;
&lt;br /&gt;
This page describes the process of getting raw DVB-S2 BBframe capture working on a &#039;&#039;&#039;TechniSat SkyStar 2 eXpress HD&#039;&#039;&#039; PCIe card under Debian trixie (kernel 6.12), as part of replicating the [https://github.com/ucsdsysnet/dontlookup dontlookup] research project.&lt;br /&gt;
&lt;br /&gt;
The dontlookup paper uses a TBS5927 USB stick with a one-line driver patch to capture raw BBframes. This write-up ports that approach to the SkyStar 2 eXpress HD, which uses a different (and more interesting) chipset.&lt;br /&gt;
&lt;br /&gt;
== Hardware ==&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;TechniSat SkyStar 2 eXpress HD&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Component !! Details&lt;br /&gt;
|-&lt;br /&gt;
| PCIe bridge || NXP SAA7160 (rev 3)&lt;br /&gt;
|-&lt;br /&gt;
| DVB-S2 demodulator || &#039;&#039;&#039;STV0903B&#039;&#039;&#039; (STV090x family)&lt;br /&gt;
|-&lt;br /&gt;
| Tuner || &#039;&#039;&#039;STV6110A&#039;&#039;&#039;&lt;br /&gt;
|-&lt;br /&gt;
| PCI ID || Appears as &amp;lt;code&amp;gt;Philips Semiconductors SAA7160&amp;lt;/code&amp;gt; in lspci&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Why This Card ===&lt;br /&gt;
&lt;br /&gt;
The STV090x family was specifically targeted because:&lt;br /&gt;
* It has hardware-level BBframe support via the &amp;lt;code&amp;gt;FRAME_MODE_FIELD&amp;lt;/code&amp;gt; bit in &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt;&lt;br /&gt;
* The mainline kernel driver (&amp;lt;code&amp;gt;stv090x&amp;lt;/code&amp;gt;) is well maintained&lt;br /&gt;
* The chip is well documented compared to alternatives&lt;br /&gt;
&lt;br /&gt;
=== 3.3V PCIe Issue ===&lt;br /&gt;
&lt;br /&gt;
AMD Ryzen systems (and many modern motherboards) do not provide 3.3V on PCIe slots, as modern GPUs don&#039;t require it. DVB cards like the SkyStar 2 eXpress HD use 3.3V for their logic and will not enumerate (&amp;lt;code&amp;gt;lspci&amp;lt;/code&amp;gt; shows nothing) on affected systems.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Workaround:&#039;&#039;&#039; Use an Intel-based system. The card was confirmed working in an X99 board. PCIe 3.3V injector risers from AliExpress are an alternative for AMD systems.&lt;br /&gt;
&lt;br /&gt;
== Software Environment ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! !! Details&lt;br /&gt;
|-&lt;br /&gt;
| OS || Debian trixie&lt;br /&gt;
|-&lt;br /&gt;
| Kernel || &amp;lt;code&amp;gt;6.12.74+deb13+1-amd64&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Driver source || [https://github.com/s-moch/linux-saa716x s-moch/linux-saa716x] — out-of-tree saa716x driver, maintained as kernel-version-specific diffs&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Building the saa716x Driver ==&lt;br /&gt;
&lt;br /&gt;
The &amp;lt;code&amp;gt;saa716x&amp;lt;/code&amp;gt; driver is not in the mainline kernel. The s-moch repo provides diffs that patch it into the kernel source tree.&lt;br /&gt;
&lt;br /&gt;
=== Install dependencies ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sudo apt install linux-source-6.12 linux-headers-$(uname -r) \&lt;br /&gt;
    libelf-dev build-essential flex bison libssl-dev wget&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Extract kernel source and apply patch ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
mkdir ~/kernel-compile &amp;amp;&amp;amp; cd ~/kernel-compile&lt;br /&gt;
wget https://github.com/s-moch/linux-saa716x/compare/saa716x-6.12.diff&lt;br /&gt;
tar xJf /usr/src/linux-source-6.12.tar.xz&lt;br /&gt;
cd linux-source-6.12&lt;br /&gt;
cp /boot/config-$(uname -r) .config&lt;br /&gt;
cp /usr/src/linux-headers-$(uname -r)/Module.symvers .&lt;br /&gt;
patch -p1 &amp;lt; ../saa716x-6.12.diff&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Configure and build ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
make olddefconfig&lt;br /&gt;
make modules_prepare&lt;br /&gt;
make syncconfig&lt;br /&gt;
&lt;br /&gt;
# Enable saa716x in config&lt;br /&gt;
scripts/config --enable SAA716X_SUPPORT&lt;br /&gt;
scripts/config --enable DVB_SAA716X_BUDGET&lt;br /&gt;
make syncconfig&lt;br /&gt;
&lt;br /&gt;
# Build just the saa716x driver&lt;br /&gt;
make -C . M=drivers/media/pci/saa716x modules -j$(nproc)&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Install ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_core.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_budget.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo depmod -a&lt;br /&gt;
sudo modprobe saa716x_budget&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Expected dmesg output ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;text&amp;quot;&amp;gt;&lt;br /&gt;
SAA716x Budget 0000:06:00.0: found a SkyStar 2 eXpress HD PCIe card&lt;br /&gt;
SAA716x Budget 0000:06:00.0:  SAA7160 Rev 3, irq: 55 (MSI)&lt;br /&gt;
SAA716x Budget 0000:06:00.0: Initializing SAA716x I2C Core 0 @ 100kHz&lt;br /&gt;
SAA716x Budget 0000:06:00.0: Initializing SAA716x I2C Core 1 @ 100kHz&lt;br /&gt;
dvbdev: DVB: registering new adapter (SAA716x dvb adapter)&lt;br /&gt;
i2c i2c-2: Attaching STV6110x&lt;br /&gt;
SAA716x Budget 0000:06:00.0: DVB: registering adapter 0 frontend 0 (STV090x Multistandard)...&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
DVB devices appear at &amp;lt;code&amp;gt;/dev/dvb/adapter0/{demux0,dvr0,frontend0,net0}&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
== BBframe Patches ==&lt;br /&gt;
&lt;br /&gt;
Two patches are required:&lt;br /&gt;
&lt;br /&gt;
# &#039;&#039;&#039;&amp;lt;code&amp;gt;saa716x_adap.c&amp;lt;/code&amp;gt;&#039;&#039;&#039; — swap &amp;lt;code&amp;gt;dvb_dmx_swfilter&amp;lt;/code&amp;gt; for &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw&amp;lt;/code&amp;gt; so the DMA data is passed raw to userspace instead of being parsed as 188-byte TS packets&lt;br /&gt;
# &#039;&#039;&#039;&amp;lt;code&amp;gt;stv090x.c&amp;lt;/code&amp;gt;&#039;&#039;&#039; — set &amp;lt;code&amp;gt;FRAME_MODE_FIELD=1&amp;lt;/code&amp;gt; in &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt; after lock, which tells the STV0903B to output raw BBframes instead of decoded TS&lt;br /&gt;
&lt;br /&gt;
=== Background: How dontlookup&#039;s TBS5927 patch works ===&lt;br /&gt;
&lt;br /&gt;
The original dontlookup patch for the TBS5927 is a single line added to &amp;lt;code&amp;gt;tbs5927.c&amp;lt;/code&amp;gt;:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;c&amp;quot;&amp;gt;&lt;br /&gt;
.caps = DVB_USB_ADAP_RECEIVES_RAW_PAYLOAD,&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
This flag causes the dvb-usb layer to call &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw()&amp;lt;/code&amp;gt; instead of &amp;lt;code&amp;gt;dvb_dmx_swfilter()&amp;lt;/code&amp;gt;, passing raw bytes straight through. The saa716x patch replicates this at the PCI driver level.&lt;br /&gt;
&lt;br /&gt;
=== Patch 1: saa716x_adap.c — Raw DMA passthrough ===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;File:&#039;&#039;&#039; &amp;lt;code&amp;gt;drivers/media/pci/saa716x/saa716x_adap.c&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Change &amp;lt;code&amp;gt;dvb_dmx_swfilter&amp;lt;/code&amp;gt; to &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw&amp;lt;/code&amp;gt; in the DMA completion handler:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;diff&amp;quot;&amp;gt;&lt;br /&gt;
-               dvb_dmx_swfilter(demux, data, 348 * 188);&lt;br /&gt;
+               dvb_dmx_swfilter_raw(demux, data, 348 * 188);&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Apply with:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
sed -i &#039;s/dvb_dmx_swfilter(demux, data, 348 \* 188)/dvb_dmx_swfilter_raw(demux, data, 348 * 188)/&#039; \&lt;br /&gt;
    drivers/media/pci/saa716x/saa716x_adap.c&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Note:&#039;&#039;&#039; The buffer size &amp;lt;code&amp;gt;348 * 188 = 65424&amp;lt;/code&amp;gt; bytes is the DMA buffer size and is passed as-is. &amp;lt;code&amp;gt;dvb_dmx_swfilter_raw&amp;lt;/code&amp;gt; does not assume 188-byte alignment so this is fine.&lt;br /&gt;
&lt;br /&gt;
=== Patch 2: stv090x.c — Enable BBframe mode after lock ===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;File:&#039;&#039;&#039; &amp;lt;code&amp;gt;drivers/media/dvb-frontends/stv090x.c&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
After the demodulator achieves DVB-S2 lock, set &amp;lt;code&amp;gt;FRAME_MODE_FIELD=1&amp;lt;/code&amp;gt; in &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt;. This tells the STV0903B to output raw BBframes rather than decoded transport stream packets.&lt;br /&gt;
&lt;br /&gt;
The relevant register is defined in &amp;lt;code&amp;gt;stv090x_reg.h&amp;lt;/code&amp;gt;:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;c&amp;quot;&amp;gt;&lt;br /&gt;
#define STV090x_OFFST_Px_FRAME_MODE_FIELD  1&lt;br /&gt;
#define STV090x_WIDTH_Px_FRAME_MODE_FIELD  1&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Insert the following block after the &amp;lt;code&amp;gt;RESET_UPKO_COUNT&amp;lt;/code&amp;gt; sequence (around line 3397), immediately before the &amp;lt;code&amp;gt;ERRCTRL1&amp;lt;/code&amp;gt; write:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;diff&amp;quot;&amp;gt;&lt;br /&gt;
+                               /* Enable BBframe mode */&lt;br /&gt;
+                               reg = STV090x_READ_DEMOD(state, PDELCTRL2);&lt;br /&gt;
+                               STV090x_SETFIELD_Px(reg, FRAME_MODE_FIELD, 1);&lt;br /&gt;
+                               if (STV090x_WRITE_DEMOD(state, PDELCTRL2, reg) &amp;lt; 0)&lt;br /&gt;
+                                       goto err;&lt;br /&gt;
                                if (STV090x_WRITE_DEMOD(state, ERRCTRL1, 0x67) &amp;lt; 0) /* PER */&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Apply with Python (handles tabs correctly):&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;python&amp;quot;&amp;gt;&lt;br /&gt;
with open(&#039;drivers/media/dvb-frontends/stv090x.c&#039;, &#039;r&#039;) as f:&lt;br /&gt;
    content = f.read()&lt;br /&gt;
&lt;br /&gt;
old = &#039;\t\t\t\tif (STV090x_WRITE_DEMOD(state, ERRCTRL1, 0x67) &amp;lt; 0) /* PER */&#039;&lt;br /&gt;
new = (&#039;\t\t\t\t/* Enable BBframe mode */\n&#039;&lt;br /&gt;
       &#039;\t\t\t\treg = STV090x_READ_DEMOD(state, PDELCTRL2);\n&#039;&lt;br /&gt;
       &#039;\t\t\t\tSTV090x_SETFIELD_Px(reg, FRAME_MODE_FIELD, 1);\n&#039;&lt;br /&gt;
       &#039;\t\t\t\tif (STV090x_WRITE_DEMOD(state, PDELCTRL2, reg) &amp;lt; 0)\n&#039;&lt;br /&gt;
       &#039;\t\t\t\t\tgoto err;\n&#039;&lt;br /&gt;
       &#039;\t\t\t\tif (STV090x_WRITE_DEMOD(state, ERRCTRL1, 0x67) &amp;lt; 0) /* PER */&#039;)&lt;br /&gt;
&lt;br /&gt;
content = content.replace(old, new, 1)&lt;br /&gt;
&lt;br /&gt;
with open(&#039;drivers/media/dvb-frontends/stv090x.c&#039;, &#039;w&#039;) as f:&lt;br /&gt;
    f.write(content)&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Building and installing the patched modules ===&lt;br /&gt;
&lt;br /&gt;
After applying both patches:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
cd ~/kernel-compile/linux-source-6.12&lt;br /&gt;
&lt;br /&gt;
# Rebuild saa716x&lt;br /&gt;
make -C . M=drivers/media/pci/saa716x modules -j$(nproc)&lt;br /&gt;
&lt;br /&gt;
# Rebuild stv090x frontend&lt;br /&gt;
make -C . M=drivers/media/dvb-frontends modules -j$(nproc)&lt;br /&gt;
&lt;br /&gt;
# Install&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_core.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo cp drivers/media/pci/saa716x/saa716x_budget.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/pci/&lt;br /&gt;
sudo cp drivers/media/dvb-frontends/stv090x.ko \&lt;br /&gt;
    /lib/modules/$(uname -r)/kernel/drivers/media/dvb-frontends/&lt;br /&gt;
&lt;br /&gt;
sudo depmod -a&lt;br /&gt;
sudo modprobe -r saa716x_budget&lt;br /&gt;
sudo modprobe saa716x_budget&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Capture Procedure ==&lt;br /&gt;
&lt;br /&gt;
{{Notice|BBframe capture has not yet been tested with an actual satellite signal. Testing pending dish access at NURDspace.}}&lt;br /&gt;
&lt;br /&gt;
Once the card is connected to a dish:&lt;br /&gt;
&lt;br /&gt;
=== 1. Create a channels.conf for the target transponder ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;text&amp;quot;&amp;gt;&lt;br /&gt;
[SomeTransponder]&lt;br /&gt;
        DELIVERY_SYSTEM = DVBS2&lt;br /&gt;
        FREQUENCY = 1550000&lt;br /&gt;
        SYMBOL_RATE = 30000000&lt;br /&gt;
        POLARIZATION = HORIZONTAL&lt;br /&gt;
        MODULATION = QPSK&lt;br /&gt;
        INNER_FEC = AUTO&lt;br /&gt;
        ROLLOFF = AUTO&lt;br /&gt;
        STREAM_ID = -1&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Note:&#039;&#039;&#039; frequency is the &#039;&#039;&#039;IF frequency&#039;&#039;&#039; after LNB downconversion, not the satellite frequency. For a universal LNB (LO = 9750 MHz low band / 10600 MHz high band), subtract accordingly.&lt;br /&gt;
&lt;br /&gt;
=== 2. Capture raw BBframes ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
dvbv5-zap -a 0 -S 0x80000000 -o capture.ts -c channels.conf &amp;quot;SomeTransponder&amp;quot;&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;-S 0x80000000&amp;lt;/code&amp;gt; sets &amp;lt;code&amp;gt;DTV_STREAM_ID&amp;lt;/code&amp;gt; to request all streams in raw mode.&lt;br /&gt;
&lt;br /&gt;
=== 3. Run dontlookup ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
git clone https://github.com/ucsdsysnet/dontlookup&lt;br /&gt;
cd dontlookup&lt;br /&gt;
pip install -r requirements.txt&lt;br /&gt;
python3 dontlookup.py capture.ts -p all&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Output IP pcaps will appear in &amp;lt;code&amp;gt;output/&amp;lt;/code&amp;gt; — open with Wireshark.&lt;br /&gt;
&lt;br /&gt;
== Known Issues / TODO ==&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;Blindscan:&#039;&#039;&#039; The STV090x driver has a &amp;lt;code&amp;gt;stv090x_blind_search()&amp;lt;/code&amp;gt; function internally but it is never triggered from userspace. The DVB core rejects symbol rate = 0. A follow-up patch to enable blindscan via srate=0 is needed.&lt;br /&gt;
* &#039;&#039;&#039;3.3V on AMD:&#039;&#039;&#039; PCIe 3.3V injector riser needed for AMD systems, or use an Intel machine.&lt;br /&gt;
* &#039;&#039;&#039;BTF generation skipped:&#039;&#039;&#039; &amp;lt;code&amp;gt;vmlinux&amp;lt;/code&amp;gt; not available for BTF, modules load fine but may affect BPF tooling.&lt;br /&gt;
* &#039;&#039;&#039;BBframe capture unverified:&#039;&#039;&#039; Patches compile and load cleanly but have not yet been tested with an actual satellite signal. Testing pending dish access at NURDspace.&lt;br /&gt;
&lt;br /&gt;
== References ==&lt;br /&gt;
&lt;br /&gt;
* [https://github.com/ucsdsysnet/dontlookup dontlookup paper/tool]&lt;br /&gt;
* [https://github.com/s-moch/linux-saa716x s-moch/linux-saa716x]&lt;br /&gt;
* [https://github.com/xenpac/Linux-DVB-S2-SatReceiver xenpac/Linux-DVB-S2-SatReceiver]&lt;br /&gt;
* [https://github.com/newspaperman/bbframe-tools newspaperman/bbframe-tools]&lt;br /&gt;
* [https://linuxtv.org/wiki/index.php/DVBSky_T9580 LinuxTV wiki: DVBSky T9580]&lt;br /&gt;
* [https://www.linuxtv.org/wiki/index.php/Hauppauge_WinTV-HVR-5500 LinuxTV wiki: Hauppauge WinTV-HVR-5500]&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=Dontlookup&amp;diff=15916</id>
		<title>Dontlookup</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=Dontlookup&amp;diff=15916"/>
		<updated>2026-04-13T11:10:12Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=dontlookup&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Sdr&lt;br /&gt;
|Tool=No&lt;br /&gt;
|Location=&lt;br /&gt;
}}&lt;br /&gt;
= dontlookup =&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;dontlookup&#039;&#039;&#039; is an open-source tool by researchers at UC San Diego for parsing IP traffic encapsulated in raw DVB-S2(X) satellite captures. It was presented at CCS 2025.&lt;br /&gt;
&lt;br /&gt;
The name is a reference to the fact that satellite internet providers apparently did not expect anyone to be passively listening.&lt;br /&gt;
&lt;br /&gt;
NURDspace uses it (or plans to) in combination with the [[Intellian_i4_Satellite_dish]] and a DVB-S2 receiver to capture and inspect unencrypted satellite internet traffic off the air.&lt;br /&gt;
&lt;br /&gt;
== What It Does ==&lt;br /&gt;
&lt;br /&gt;
Many satellite internet providers beam IP traffic down to large coverage areas using DVB-S2 or DVB-S2X. A significant portion of this traffic is unencrypted. By capturing the raw transport stream with a DVB-S2 receiver and running it through dontlookup, you can extract actual IP packets and open them in Wireshark.&lt;br /&gt;
&lt;br /&gt;
== Capturing ==&lt;br /&gt;
&lt;br /&gt;
=== Background: BBframes ===&lt;br /&gt;
&lt;br /&gt;
DVB-S2 transmits data in &#039;&#039;&#039;Baseband Frames (BBframes)&#039;&#039;&#039; — the lowest-level data unit after forward error correction. IP traffic is encapsulated inside these frames, either directly or via GSE or MPEG-TS wrappers. dontlookup operates on raw BBframe payloads.&lt;br /&gt;
&lt;br /&gt;
The problem is that virtually every DVB-S2 receiver card exposes only a processed &#039;&#039;&#039;MPEG-TS&#039;&#039;&#039; stream to userspace. The DVB API in Linux was designed for TV reception, so the driver demodulates the signal and hands you PIDs — the raw BBframe layer is discarded. If the satellite provider uses MPEG-TS encapsulation you get lucky and this works fine. If they use direct IP or GSE encapsulation, which does not map to MPEG-TS PIDs, you get nothing.&lt;br /&gt;
&lt;br /&gt;
=== Background: Blind Scan ===&lt;br /&gt;
&lt;br /&gt;
When tuning a satellite receiver normally, you already know what you are looking for — frequency,&lt;br /&gt;
symbol rate, polarisation, and FEC parameters. These are typically sourced from a database like&lt;br /&gt;
[[https://www.lyngsat.com/ LyngSat]] or a channel list. Blind scan is the alternative: the&lt;br /&gt;
receiver sweeps the entire band and attempts to lock onto any signal it finds, determining the&lt;br /&gt;
parameters itself.&lt;br /&gt;
&lt;br /&gt;
This matters for dontlookup because the most interesting transponders — those carrying&lt;br /&gt;
unencrypted IP backhaul — are generally not listed in any public database. They are not&lt;br /&gt;
broadcast television services; they are private data links that nobody was expected to be&lt;br /&gt;
looking at. A receiver limited to known transponders will never find them.&lt;br /&gt;
&lt;br /&gt;
Blind scan is more computationally intensive than directed tuning and takes longer to complete&lt;br /&gt;
a full sweep, but it is the only reliable method to discover unknown transponders.&lt;br /&gt;
Not all DVB-S2 receiver hardware exposes blind scan capability to the Linux DVB API, even if&lt;br /&gt;
the underlying demodulator chipset supports it — this is one of the reasons the [[#TBS Driver Patch|TBS5927]]&lt;br /&gt;
became the reference hardware for this project.&lt;br /&gt;
&lt;br /&gt;
=== TBS Driver Patch ===&lt;br /&gt;
&lt;br /&gt;
The dontlookup repo ships a kernel patch (&amp;lt;code&amp;gt;tbsdriver.patch&amp;lt;/code&amp;gt;) for TBS DVB-S2 receiver cards that exposes the raw BBframe stream to userspace, bypassing the normal DVB API. This is required to capture proprietary or non-MPEG-TS encapsulations.&lt;br /&gt;
&lt;br /&gt;
However, the researchers used a &#039;&#039;&#039;TBS5927&#039;&#039;&#039; which has become unobtainium.&lt;br /&gt;
&lt;br /&gt;
A &#039;&#039;&#039;TBS5925&#039;&#039;&#039; may work and is on its way to NURDspace for testing. [[User:20h]] also generously acquired a &#039;&#039;&#039;TBS-5580&#039;&#039;&#039;. Neither has been confirmed working yet.&lt;br /&gt;
&lt;br /&gt;
The TBS5925 is documented to work with EUMETCast: [https://www-cdn.eumetsat.int/files/2020-07/TBS%205925%20DVB-S2%20Receiver%20EUMETCast%20Windows%20Setup%20Guide.pdf TBS5925 EUMETCast setup guide].&lt;br /&gt;
&lt;br /&gt;
=== SAT&amp;gt;IP Devices ===&lt;br /&gt;
&lt;br /&gt;
The &#039;&#039;&#039;Digibit R1&#039;&#039;&#039; SAT&amp;gt;IP tuner used at NURDspace presents itself as a network-attached DVB-S2 tuner. It handles LNB power, DiSEqC, and tuning over the network, but only streams MPEG-TS over SAT&amp;gt;IP. There is no way to get raw BBframes out of it without hardware modifications.&lt;br /&gt;
&lt;br /&gt;
Further investigation revealed it runs STMicro&#039;s proprietary &#039;&#039;&#039;STAPI&#039;&#039;&#039; stack internally — &amp;lt;code&amp;gt;stpti5_core&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;stfdma_core&amp;lt;/code&amp;gt; etc. — with no &amp;lt;code&amp;gt;/dev/dvb/&amp;lt;/code&amp;gt; device exposed. minisatip talks directly to STAPI, bypassing the Linux DVB API entirely. Intercepting data at the STAPI layer to get raw BBframes would require significant reverse engineering effort.&lt;br /&gt;
&lt;br /&gt;
=== STV090x Based Chipsets ===&lt;br /&gt;
&lt;br /&gt;
The STV090x demodulator (used in many DVB-S2 cards) is capable of outputting raw BBframes at the hardware level, but the Linux driver simply never implements it. Investigation of &amp;lt;code&amp;gt;stv090x.c&amp;lt;/code&amp;gt; showed it writes an output configuration register at init:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
{ STV090x_OUTCFG, 0x00 },  /* serial TS output, hardware default */&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
The crucial register is &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt; with &amp;lt;code&amp;gt;FRAME_MODE_FIELD&amp;lt;/code&amp;gt; set to 1 — discovered via a [https://www.spinics.net/lists/linux-media/msg45597.html 2012 linux-media mailing list post] documenting exactly this on a TBS6925. One register bit is all it takes.&lt;br /&gt;
&lt;br /&gt;
It might be possible to use a [[SkyStar 2 eXpress HD]] (SAA716x + STV090x) an attempt to patch the drives has been made, but has yet to be tested. &lt;br /&gt;
&lt;br /&gt;
=== MiniTiouner / Longmynd ===&lt;br /&gt;
&lt;br /&gt;
The &#039;&#039;&#039;MiniTiouner&#039;&#039;&#039; is a USB DVB-S2 receiver designed by the British Amateur Television Club (BATC) for amateur TV reception, primarily targeting the QO-100 geostationary amateur transponder. Unlike the TBS cards, it uses the &#039;&#039;&#039;STV0910&#039;&#039;&#039; demodulator which outputs raw BBframes natively — no kernel patching required.&lt;br /&gt;
&lt;br /&gt;
The &#039;&#039;&#039;Longmynd&#039;&#039;&#039; software (also by BATC) drives the MiniTiouner and outputs BBframes directly over UDP, making it straightforwardly compatible with dontlookup.&lt;br /&gt;
&lt;br /&gt;
The catch is availability: purchasing the kit requires a BATC membership, and the hardware is not sold elsewhere.&lt;br /&gt;
&lt;br /&gt;
=== Professional IRD: Adtec RD-60 ===&lt;br /&gt;
&lt;br /&gt;
An [[ Adtec RD-60 ]] professional broadcast IRD is also available. This is the kind of kit used by actual broadcasters to receive satellite feeds.&lt;br /&gt;
&lt;br /&gt;
=== GNU Radio / gr-dvbs2rx ===&lt;br /&gt;
&lt;br /&gt;
An SDR-based approach using [https://github.com/igorauad/gr-dvbs2rx gr-dvbs2rx] (a GNU Radio out-of-tree module for DVB-S2 demodulation) was also explored. This would allow a HackRF or similar SDR to demodulate DVB-S2 and potentially extract BBframes entirely in software, without any dedicated DVB receiver hardware.&lt;br /&gt;
&lt;br /&gt;
The main constraint is bandwidth. Typical Ku-band transponders run at 27–45 Msym/s, requiring roughly that much RF bandwidth — well beyond the HackRF&#039;s 20 MHz maximum. However, some data-only transponders run significantly narrower symbol rates and could fit within an SDR&#039;s bandwidth.&lt;br /&gt;
&lt;br /&gt;
Combining two HackRFs in a phase-coherent configuration (the HackRF has explicit support for clock synchronisation between units) could double the available bandwidth and is cheaper than a LimeSDR.&lt;br /&gt;
&lt;br /&gt;
== Links ==&lt;br /&gt;
&lt;br /&gt;
* [https://github.com/ucsdsysnet/dontlookup GitHub — ucsdsysnet/dontlookup]&lt;br /&gt;
* [https://satcom.sysnet.ucsd.edu/docs/dontlookup_ccs25_fullpaper.pdf CCS 2025 paper (PDF)]&lt;br /&gt;
* [https://forums.radioreference.com/threads/dont-look-up-research-paper-on-satcom-interception.493532/]&lt;br /&gt;
* [https://youtu.be/VE7S1nk4F04 saveitforparts — Intercepting Sensitive Satellite Data Is (Scarily) Easier Than I Thought!]&lt;br /&gt;
* [https://www.spinics.net/lists/linux-media/msg45597.html linux-media 2012: STV090x BBframe patch]&lt;br /&gt;
* [https://www-cdn.eumetsat.int/files/2020-07/TBS%205925%20DVB-S2%20Receiver%20EUMETCast%20Windows%20Setup%20Guide.pdf TBS5925 EUMETCast setup guide]&lt;br /&gt;
* [https://www.satsignal.eu/wxsat/atovs/index.html SatSignal — EUMETCast receiver hardware notes]&lt;br /&gt;
* [[Intellian_i4_Satellite_dish]]&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=Adtec_RD-60&amp;diff=15915</id>
		<title>Adtec RD-60</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=Adtec_RD-60&amp;diff=15915"/>
		<updated>2026-04-12T17:16:21Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=Adtec RD-60&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Sdr&lt;br /&gt;
|Tool=No&lt;br /&gt;
|Location=the roof&lt;br /&gt;
}}&lt;br /&gt;
== Adtec RD-60 IRD ==&lt;br /&gt;
The &#039;&#039;&#039;Adtec RD-60&#039;&#039;&#039; is a 1RU integrated receiver/decoder (IRD).&lt;br /&gt;
&lt;br /&gt;
It seems the Adtec RD-60 might expose &#039;&#039;&#039;DVB-S2 baseband frames (BBFrames)&#039;&#039;&#039; below the TS layer, this might be very useful as part of the &#039;&#039;&#039;dontlookup&#039;&#039;&#039; satellite interception paper replication project. See [[dontlookup]]&lt;br /&gt;
&lt;br /&gt;
= Reverse Engineering Notes =&lt;br /&gt;
&lt;br /&gt;
== Hardware ==&lt;br /&gt;
[[File:Adtec_rd60_internals_overview.jpg|thumb|center]]&lt;br /&gt;
=== Main Unit ===&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;Model:&#039;&#039;&#039; Adtec RD-60 MultiCODEC Receiver/Decoder (IRD)&lt;br /&gt;
* &#039;&#039;&#039;Hostname:&#039;&#039;&#039; &amp;lt;code&amp;gt;GOFFERT&amp;lt;/code&amp;gt;&lt;br /&gt;
* &#039;&#039;&#039;IP:&#039;&#039;&#039; 10.1.2.172 (DHCP)&lt;br /&gt;
* &#039;&#039;&#039;CPU:&#039;&#039;&#039; IBM PowerPC PPC405GPr @ 399 MHz (GemPPC Iolite platform)&lt;br /&gt;
* &#039;&#039;&#039;PLB bus:&#039;&#039;&#039; 133 MHz | &#039;&#039;&#039;PCI bus:&#039;&#039;&#039; 33 MHz&lt;br /&gt;
* &#039;&#039;&#039;Kernel:&#039;&#039;&#039; Linux 2.6.14-gemppc-iolite&lt;br /&gt;
* &#039;&#039;&#039;Front panel:&#039;&#039;&#039; Character LCD/VFD — text only, ~40 chars wide.&lt;br /&gt;
* &#039;&#039;&#039;Storage:&#039;&#039;&#039; CompactFlash card (8 partitions, 4 used)&lt;br /&gt;
&lt;br /&gt;
It seems that the hardware doesn&#039;t do blind scan, but scripted sequential tuning might be a workaround?&lt;br /&gt;
&lt;br /&gt;
=== Demodulator Board ===&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;Slot 2:&#039;&#039;&#039; &amp;lt;code&amp;gt;BA14&amp;lt;/code&amp;gt; — PC87 ver 1.4 (main decoder board)&lt;br /&gt;
* &#039;&#039;&#039;Slot 99:&#039;&#039;&#039; &amp;lt;code&amp;gt;7044BB&amp;lt;/code&amp;gt; — &#039;&#039;&#039;Newtec NTC/7044/BB DVB Demodulator&#039;&#039;&#039;&lt;br /&gt;
** PRM firmware: &#039;&#039;&#039;v2.34&#039;&#039;&#039; (20/03/13)&lt;br /&gt;
** FPGA bitfile: v1.01 (09/01/12)&lt;br /&gt;
** Hardware: v3.0&lt;br /&gt;
** Serial: &#039;&#039;&#039;30091216&#039;&#039;&#039;&lt;br /&gt;
** Software ID: NTC/6381 DVB Demodulator&lt;br /&gt;
** Product ID: NTC/7044/BB.BCDCBCAA.x.B&lt;br /&gt;
** License: &#039;&#039;&#039;165&#039;&#039;&#039; (includes Baseband Frames — see below)&lt;br /&gt;
** Communicates via I2C (&amp;lt;code&amp;gt;rmcp_i2c&amp;lt;/code&amp;gt; kernel module)&lt;br /&gt;
** &amp;lt;code&amp;gt;BB&amp;lt;/code&amp;gt; suffix = BaseBand licensed and capable&lt;br /&gt;
&lt;br /&gt;
According to the official Newtec datasheet, the NTC/7044/BB supports explicit &#039;&#039;&#039;output mode switching&#039;&#039;&#039; between:&lt;br /&gt;
* Single transport stream&lt;br /&gt;
* Generic stream  &lt;br /&gt;
* &#039;&#039;&#039;Base Band Frames&#039;&#039;&#039; (BBFrames)&lt;br /&gt;
&lt;br /&gt;
The control interface is &#039;&#039;&#039;RMCPv2 protocol&#039;&#039;&#039; over async serial TTL or I2C — implemented by the &amp;lt;code&amp;gt;rmcp_i2c&amp;lt;/code&amp;gt; kernel module. &lt;br /&gt;
This is the mechanism to switch output to BBFrame mode.&lt;br /&gt;
&lt;br /&gt;
See also this PDF: https://www.melcom.co.uk/uploads/newdvbdemodntc7044_01.pdf&lt;br /&gt;
&lt;br /&gt;
RMCP protocol docs: https://newerasystems.net/wp-content/uploads/2017/02/RMCP-Manual-1_8.pdf&lt;br /&gt;
&lt;br /&gt;
[[File:20250429 153804.jpg|thumb|center]]&lt;br /&gt;
&lt;br /&gt;
=== Inputs/Outputs ===&lt;br /&gt;
&lt;br /&gt;
* 2x RF/satellite inputs (RF1, RF2) — 950–2150 MHz, 256 kSym/s – 45 MSym/s&lt;br /&gt;
* DVB-ASI input/output (currently set to RECEIVE mode)&lt;br /&gt;
* 2x SDI outputs (SD scaling)&lt;br /&gt;
* CVBS output&lt;br /&gt;
* 3x Ethernet (eth0, eth1, eth2)&lt;br /&gt;
* Serial: ttyS0 @ 115200, ttyBA&lt;br /&gt;
* L-Band Modulator option slot — &#039;&#039;&#039;not populated&#039;&#039;&#039; (&amp;lt;code&amp;gt;/dev/ntmod&amp;lt;/code&amp;gt; = &amp;quot;No such device&amp;quot;)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Firmware / Software ==&lt;br /&gt;
&lt;br /&gt;
=== CF Card Partition Layout ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Partition !! Size !! Contents&lt;br /&gt;
|-&lt;br /&gt;
| p5 || 137M || GNU sysroot — gcc-3.4.4 / glibc-2.3.5, PPC cross toolchain&lt;br /&gt;
|-&lt;br /&gt;
| p6 || 1.1M || &#039;&#039;&#039;Firmware&#039;&#039;&#039; — adtec/RD-60/1.12.08 and 1.12.12&lt;br /&gt;
|-&lt;br /&gt;
| p7 || 3.4M || Minimal initrd (busybox, bash, minimal libs)&lt;br /&gt;
|-&lt;br /&gt;
| p8 || 24M || Runtime/data (logs, DVC profiles, media)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
* Current firmware: &#039;&#039;&#039;1.12.12&#039;&#039;&#039; (symlinked at &amp;lt;code&amp;gt;/opt/pkg/oem&amp;lt;/code&amp;gt;)&lt;br /&gt;
* Previous firmware: &#039;&#039;&#039;1.12.08&#039;&#039;&#039; (symlinked at &amp;lt;code&amp;gt;/opt/pkg/oem_prev&amp;lt;/code&amp;gt;)&lt;br /&gt;
&lt;br /&gt;
=== p8 Runtime Directories ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Dir !! Purpose&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;dvc/&amp;lt;/code&amp;gt; || Tuner device profile files (.DVC)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;keys/&amp;lt;/code&amp;gt; || Empty — key material generated at runtime&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;log/&amp;lt;/code&amp;gt; || Rotated system logs&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;media/&amp;lt;/code&amp;gt; || Media files&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;.meta/&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;freg.db&amp;lt;/code&amp;gt; — feature registry SQLite DB&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;mvl/&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;osd/&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;rdy/&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;schmi/&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;shd/&amp;lt;/code&amp;gt; || Runtime state dirs (mostly empty)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Key Binaries (&amp;lt;code&amp;gt;/usr/local/sbin/&amp;lt;/code&amp;gt;) ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Binary !! Purpose&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;sysd&amp;lt;/code&amp;gt; || Main system daemon — tuner/demodulator config via XML&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;cmdld&amp;lt;/code&amp;gt; || Telnet API daemon (3 processes)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;menud&amp;lt;/code&amp;gt; || Front panel menu daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;fregd&amp;lt;/code&amp;gt; || Feature/license registry daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;dtrans&amp;lt;/code&amp;gt; || TS transport handler (&amp;lt;code&amp;gt;--slot=2 --id=BA14&amp;lt;/code&amp;gt;)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;dcmd&amp;lt;/code&amp;gt; || Device command interface for BA14&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;myles&amp;lt;/code&amp;gt; || Web API backend (SQLite)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;requestHandler&amp;lt;/code&amp;gt; || Apache CGI/FastCGI handler&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;snmpd&amp;lt;/code&amp;gt; || SNMP daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;snmpl&amp;lt;/code&amp;gt; || Internal SNMP poller — continuously queries Newtec MIB&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;vtosfifo&amp;lt;/code&amp;gt; || TS-to-FIFO bridge to &amp;lt;code&amp;gt;/dev/vtosfifo4&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;xcpServerd&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;xcpClientd&amp;lt;/code&amp;gt; || XCP protocol daemons (3 each)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;pard&amp;lt;/code&amp;gt; || Parallel interface daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;pnpd&amp;lt;/code&amp;gt; || PnP device daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;mirror&amp;lt;/code&amp;gt; || Mirror/redundancy daemon (runs as adtec)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Kernel Modules ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Module !! Purpose&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;newtec&amp;lt;/code&amp;gt; || Newtec 7044 demodulator driver — core BBFrame driver&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;newtec_dummy&amp;lt;/code&amp;gt; || Stub for absent optional demodulator hardware&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;dvblite&amp;lt;/code&amp;gt; || DVB lite core (depends on newtec) — exposes &amp;lt;code&amp;gt;dvblite_ioctl&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;rmcp_i2c&amp;lt;/code&amp;gt; || I2C transport for Newtec RMCP protocol&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;vtosfifo&amp;lt;/code&amp;gt; || TS FIFO device driver&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;rddma_ip&amp;lt;/code&amp;gt; || &#039;&#039;&#039;IP-over-satellite receive DMA engine (FPGA-backed)&#039;&#039;&#039;&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;ip_ingress_main&amp;lt;/code&amp;gt; || IP ingress pipeline (GSE/MPE over satellite)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;frpanel&amp;lt;/code&amp;gt; || Front panel driver&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;fanctrl&amp;lt;/code&amp;gt; / &amp;lt;code&amp;gt;pc96&amp;lt;/code&amp;gt; || Fan controller&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;proxyimg&amp;lt;/code&amp;gt; || Image proxy&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;epb&amp;lt;/code&amp;gt; || EPB bus driver&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;pnp&amp;lt;/code&amp;gt; || PnP device manager&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;fec&amp;lt;/code&amp;gt; / &amp;lt;code&amp;gt;ethfrm&amp;lt;/code&amp;gt; || Ethernet/FEC&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;pc73a&amp;lt;/code&amp;gt; / &amp;lt;code&amp;gt;pc93&amp;lt;/code&amp;gt; || Front panel dependencies&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Failed to load (hardware absent): &amp;lt;code&amp;gt;teamcast&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;nim&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;lnb_pwr&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;pc72&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Device Nodes ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Device !! Purpose&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/dvblite0-2&amp;lt;/code&amp;gt; || DVB lite interfaces&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/vtosfifo0-5&amp;lt;/code&amp;gt; || TS FIFO char devices (major 240)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/tuner0-3&amp;lt;/code&amp;gt; || Tuner interfaces (major 123)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/tuner_ledgr0-3&amp;lt;/code&amp;gt; || Tuner lock (green) LEDs&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/tuner_ledrd0-3&amp;lt;/code&amp;gt; || Tuner read LEDs&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/tuner_rst0-3&amp;lt;/code&amp;gt; || Tuner resets&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/ntmod&amp;lt;/code&amp;gt; || Newtec modulator — &#039;&#039;&#039;not populated&#039;&#039;&#039;&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== /proc Driver Interfaces ==&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;/proc/driver/dvblite/fe0/info&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
NAME=NTC/7044/BB DVB Demodulator&lt;br /&gt;
FREQ_MIN=950000 / FREQ_MAX=2150000&lt;br /&gt;
SYMRATE_MIN=256000 / SYMRATE_MAX=45000000&lt;br /&gt;
S_QPSK=1/2, 2/3, 3/4, 5/6, 6/7, 7/8, AUTO&lt;br /&gt;
S_8PSK=2/3, 5/6, 8/9, AUTO&lt;br /&gt;
S2_QPSK=1/4, 1/3, 1/2, 2/5, 2/3, 3/5, 3/4, 4/5, 5/6, 8/9, 9/10&lt;br /&gt;
S2_8PSK=2/3, 3/5, 3/4, 5/6, 8/9, 9/10&lt;br /&gt;
S2_16QAM=3/4, 7/8, AUTO&lt;br /&gt;
S2_16APSK=2/3, 3/4, 4/5, 5/6, 8/9, 9/10&lt;br /&gt;
S2_32APSK=3/4, 4/5, 5/6, 8/9, 9/10&lt;br /&gt;
SOFTWARE_LICENSE=165&lt;br /&gt;
SOFTWARE_VERSION=v2.34   20/03/13&lt;br /&gt;
FPGA_BITFILE_VERSION=v1.01 09/01/12&lt;br /&gt;
HARDWARE_VERSION=v3.0&lt;br /&gt;
SERIAL_NUM=30091216&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;/proc/driver/dvblite/fe0/stats&amp;lt;/code&amp;gt; (no signal) ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
LOCK=UNLOCKED&lt;br /&gt;
RECV_LEVEL=-70.00&lt;br /&gt;
INTRATE=41470588&lt;br /&gt;
MOD_FEC=QPSK_3/4&lt;br /&gt;
BB_CRC_ERRORS=N/A        &amp;lt;- populates with live signal&lt;br /&gt;
DUMMY_PL_RATIO=N/A       &amp;lt;- populates with live signal&lt;br /&gt;
ISI_FILTER_BYTE=N/A      &amp;lt;- populates with live signal&lt;br /&gt;
BASEBAND_LEN=N/A         &amp;lt;- populates with live signal&lt;br /&gt;
FRAMES_SEC=N/A           &amp;lt;- populates with live signal&lt;br /&gt;
ALARMS=0000110001011000&lt;br /&gt;
STATE=READY&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
fe1 has same structure but &amp;lt;code&amp;gt;NAME=NTC7044&amp;lt;/code&amp;gt; (no BB suffix, no license).&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;/proc/driver/vtosfifo/chn&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
Channel 0 processed 16620 TS frames during session. Channel 4 processed 1619.&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;/proc/driver/rddma/&amp;lt;/code&amp;gt; — FPGA DMA engine ===&lt;br /&gt;
&lt;br /&gt;
* Channel 3 active: Control=&amp;lt;code&amp;gt;49C003C0&amp;lt;/code&amp;gt;, Src=&amp;lt;code&amp;gt;03F01C00&amp;lt;/code&amp;gt; (FPGA mapped)&lt;br /&gt;
* 3.98M timer IRQs, 3.98M &amp;quot;No Data&amp;quot; — idle, no satellite IP stream&lt;br /&gt;
* PID &amp;lt;code&amp;gt;0x01E1&amp;lt;/code&amp;gt; (481) being tracked&lt;br /&gt;
&lt;br /&gt;
== Kernel Module Internals (&amp;lt;code&amp;gt;strings&amp;lt;/code&amp;gt; analysis) ==&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;newtec.ko&amp;lt;/code&amp;gt; — BBFrame symbols ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
BB_CRC_ERRORS / BB_CRC_ERRORS_CURRENT / BB_CRC_ERRORS_NEXT&lt;br /&gt;
BB_DATA_FIELD_LEN / BB_DATA_FIELD_LEN_CURRENT / BB_DATA_FIELD_LEN_NEXT&lt;br /&gt;
BB_FRAMES&lt;br /&gt;
BB_GAIN / BB_GAIN_CURRENT / BB_GAIN_NEXT&lt;br /&gt;
BASEBAND_LEN&lt;br /&gt;
ISI / ISI_CTRL / ISI_CTRL_STRUCT / ISI_CTRL_STRUCT_FIELDS&lt;br /&gt;
ISI_FILTER_BYTE / ISI_MASK&lt;br /&gt;
SAT_BB_GAIN&lt;br /&gt;
ntc_debug  (module param, uint)&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;BB_DATA_FIELD_LEN&amp;lt;/code&amp;gt; and &amp;lt;code&amp;gt;BB_FRAMES&amp;lt;/code&amp;gt; suggest the driver tracks individual baseband frames, not just statistics. Very promising for BBFrame capture.&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;dvblite.ko&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
Contains &amp;lt;code&amp;gt;dvblite_ioctl&amp;lt;/code&amp;gt; — a kernel ioctl interface on &amp;lt;code&amp;gt;/dev/dvblite0&amp;lt;/code&amp;gt;. Commands unknown — to be investigated with a live signal.&lt;br /&gt;
&lt;br /&gt;
== Network Services ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Service !! Port !! Notes&lt;br /&gt;
|-&lt;br /&gt;
| SSH || 22 || Legacy KEX only (diffie-hellman-group1-sha1)&lt;br /&gt;
|-&lt;br /&gt;
| Telnet API || 23 || &amp;lt;code&amp;gt;cmdld&amp;lt;/code&amp;gt; via xinetd&lt;br /&gt;
|-&lt;br /&gt;
| FTP || 21 || pure-ftpd&lt;br /&gt;
|-&lt;br /&gt;
| HTTP || 80 || Apache + myles + requestHandler&lt;br /&gt;
|-&lt;br /&gt;
| SNMP || 161 || Community &amp;lt;code&amp;gt;public&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| mDNS || 5353 || &amp;lt;code&amp;gt;GOFFERT.local&amp;lt;/code&amp;gt;&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
# SSH/SCP&lt;br /&gt;
ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa root@&amp;lt;ip&amp;gt;&lt;br /&gt;
scp -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa root@&amp;lt;ip&amp;gt;:/path /local&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Credentials (Default/Hardcoded — ZSL-2020-5603 / ExploitDB 48954) ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! User !! Password !! Notes&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;root&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;1root!&amp;lt;/code&amp;gt; || Full root SSH&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;admin&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;1admin!&amp;lt;/code&amp;gt; || Also root via sudoers&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;adtec&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;none&amp;lt;/code&amp;gt; || Telnet API / web UI&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;adtecftp&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;adtecftp2231&amp;lt;/code&amp;gt; || FTP only&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
* Password hashes: DES crypt — crackable in seconds with &amp;lt;code&amp;gt;john&amp;lt;/code&amp;gt;&lt;br /&gt;
* &amp;lt;code&amp;gt;apache ALL=(ALL) NOPASSWD: ALL&amp;lt;/code&amp;gt; in sudoers&lt;br /&gt;
* Diagnostic package passphrase: &#039;&#039;&#039;&amp;lt;code&amp;gt;iMoo3jio&amp;lt;/code&amp;gt;&#039;&#039;&#039; (hardcoded, leaks in &amp;lt;code&amp;gt;ps aux&amp;lt;/code&amp;gt;)&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
gpg --passphrase &amp;quot;iMoo3jio&amp;quot; --batch --ignore-mdc-error --decrypt RD-60_*.tar.gpg | tar xf -&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== APIs ==&lt;br /&gt;
&lt;br /&gt;
=== Telnet API ===&lt;br /&gt;
&lt;br /&gt;
Connect: &amp;lt;code&amp;gt;telnet &amp;lt;ip&amp;gt;&amp;lt;/code&amp;gt;, login &amp;lt;code&amp;gt;adtec&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;none&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
*.SYSD SHELLCMD &amp;lt;cmd&amp;gt;          # arbitrary root shell execution!&lt;br /&gt;
*.SNMP ADTEC-NT-DEMOD-MIB::satFeedType.0 = dvbs2   # configure tuner&lt;br /&gt;
*.SNMP ADTEC-NT-DEMOD-MIB::satFeedDownlink.0 = 10960000&lt;br /&gt;
*.SNMP .1.3.6.1.4.1.19587.6000.3.999.0 i 0         # commit/apply&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== SNMP — Newtec Demodulator MIB ===&lt;br /&gt;
&lt;br /&gt;
OID base: &amp;lt;code&amp;gt;.1.3.6.1.4.1.19587&amp;lt;/code&amp;gt;, MIB: &amp;lt;code&amp;gt;ADTEC-NT-DEMOD-MIB&amp;lt;/code&amp;gt;, community: &amp;lt;code&amp;gt;public&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
snmpwalk -v2c -c public &amp;lt;ip&amp;gt; .1.3.6.1.4.1.19587&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Key OIDs: &amp;lt;code&amp;gt;tunerLock&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;recvLevel&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;esNo&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;linkMargin&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;modFec&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;rolloff&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;pilot&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;fecFrameType&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;unCorrFs&amp;lt;/code&amp;gt;, &#039;&#039;&#039;&amp;lt;code&amp;gt;bbCrcerrors&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &#039;&#039;&#039;&amp;lt;code&amp;gt;basebandLen&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &#039;&#039;&#039;&amp;lt;code&amp;gt;dummyPlRatio&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &#039;&#039;&#039;&amp;lt;code&amp;gt;isiFilterByte&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &#039;&#039;&#039;&amp;lt;code&amp;gt;framesSec&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &amp;lt;code&amp;gt;satFeedType&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;satFeedDownlink&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;satFeedSymRate&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;satFeedModulation&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;lnbEnable&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;lnbPolarity&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;lnbTone&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== DVC Profile Format ===&lt;br /&gt;
&lt;br /&gt;
SNMP SET commands as tuner presets, applied via Telnet API or web UI.&lt;br /&gt;
&lt;br /&gt;
== Saved Tuner Profiles ==&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;prfturktest.DVC&amp;lt;/code&amp;gt; (2018-04-28) ===&lt;br /&gt;
&lt;br /&gt;
* DVB-S, &#039;&#039;&#039;10762 MHz&#039;&#039;&#039;, KU 9750 LO → &#039;&#039;&#039;1012 MHz&#039;&#039;&#039; L-band&lt;br /&gt;
* &#039;&#039;&#039;30 MSym/s&#039;&#039;&#039;, QPSK 3/4, roll-off 35%&lt;br /&gt;
* Was &#039;&#039;&#039;LOCKED&#039;&#039;&#039; at -32 dBm when saved&lt;br /&gt;
* &amp;lt;code&amp;gt;bbCrcerrors = 1&amp;lt;/code&amp;gt; — &#039;&#039;&#039;BBFrame counter was active and non-zero!&#039;&#039;&#039;&lt;br /&gt;
* Likely &#039;&#039;&#039;Türksat 42°E&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;prfMUX.DVC&amp;lt;/code&amp;gt; (2018-04-28) ===&lt;br /&gt;
&lt;br /&gt;
* DVB-S2, &#039;&#039;&#039;10960 MHz&#039;&#039;&#039;, KU 9750 LO → &#039;&#039;&#039;1210 MHz&#039;&#039;&#039; L-band&lt;br /&gt;
* &#039;&#039;&#039;8.352 MSym/s&#039;&#039;&#039;, 16APSK 2/3, roll-off 20%, pilot ON, normal frames, CCM&lt;br /&gt;
* Was unlocked when saved&lt;br /&gt;
&lt;br /&gt;
== Licensed Features (Key ID 165) ==&lt;br /&gt;
&lt;br /&gt;
DVB-DSNG + DVB-S2 + QPSK + 8-PSK + 16-QAM/16APSK + 32APSK + Symbol Rate &amp;lt;= 33 MBaud + ACM + &#039;&#039;&#039;Single TS/GS or Multiple Streams&#039;&#039;&#039; + &#039;&#039;&#039;(Baseband Frames)&#039;&#039;&#039; + no ACM client + no AES&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;BBFrame access is explicitly licensed and enabled.&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
== Encryption / CA ==&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;BISS-1 key&#039;&#039;&#039; in &amp;lt;code&amp;gt;dtrans.xml&amp;lt;/code&amp;gt;: &amp;lt;code&amp;gt;69A969BBECA0&amp;lt;/code&amp;gt;&lt;br /&gt;
* &#039;&#039;&#039;Viaccess&#039;&#039;&#039; (CA ID 0x0005) feed seen in logs — no card present, could not decrypt&lt;br /&gt;
&lt;br /&gt;
== IP-over-Satellite ==&lt;br /&gt;
&lt;br /&gt;
The unit has a full satellite IP receive stack beyond TS decoding:&lt;br /&gt;
&lt;br /&gt;
* &amp;lt;code&amp;gt;rddma_ip&amp;lt;/code&amp;gt; — FPGA-backed DMA for IP-from-satellite&lt;br /&gt;
* &amp;lt;code&amp;gt;ip_ingress_main&amp;lt;/code&amp;gt; — GSE/MPE ingress pipeline&lt;br /&gt;
* FPGA Channel 3 active at &amp;lt;code&amp;gt;03F01C00&amp;lt;/code&amp;gt;&lt;br /&gt;
* Currently idle — no GSE/MPE stream configured&lt;br /&gt;
&lt;br /&gt;
== Security Summary ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Issue !! Detail&lt;br /&gt;
|-&lt;br /&gt;
| Default root creds || &amp;lt;code&amp;gt;root&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;1root!&amp;lt;/code&amp;gt; over SSH&lt;br /&gt;
|-&lt;br /&gt;
| Telnet RCE || &amp;lt;code&amp;gt;*.SYSD SHELLCMD&amp;lt;/code&amp;gt; = root shell with &amp;lt;code&amp;gt;adtec&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;none&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Sudoers || &amp;lt;code&amp;gt;apache ALL=(ALL) NOPASSWD: ALL&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Shared SSH host keys || Same across all units (stored on CF card)&lt;br /&gt;
|-&lt;br /&gt;
| Weak password hashes || DES crypt, trivially crackable&lt;br /&gt;
|-&lt;br /&gt;
| GPG passphrase leak || &amp;lt;code&amp;gt;iMoo3jio&amp;lt;/code&amp;gt; visible in &amp;lt;code&amp;gt;ps aux&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Public exploit || ZSL-2020-5603 / ExploitDB 48954&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Other ==&lt;br /&gt;
== Front Panel ==&lt;br /&gt;
&lt;br /&gt;
* Driver: &amp;lt;code&amp;gt;frpanel.ko&amp;lt;/code&amp;gt; (depends on &amp;lt;code&amp;gt;pc93&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;pc73a&amp;lt;/code&amp;gt;)&lt;br /&gt;
* Device nodes: &amp;lt;code&amp;gt;/dev/frpanel0&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;/dev/frpanel1&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;/dev/frpanel2&amp;lt;/code&amp;gt;&lt;br /&gt;
* Display: 2 rows × 40 columns character LCD (PC93 I2C MCU)&lt;br /&gt;
* LCD API in &amp;lt;code&amp;gt;libsolib.so&amp;lt;/code&amp;gt;: &amp;lt;code&amp;gt;FpLcdKpInit()&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;LcdClear()&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;LcdWriteStr(char*, pos, len)&amp;lt;/code&amp;gt;&lt;br /&gt;
* Writing to &amp;lt;code&amp;gt;/dev/frpanel2&amp;lt;/code&amp;gt; activates the backlight&lt;br /&gt;
* &amp;lt;code&amp;gt;menud&amp;lt;/code&amp;gt; daemon owns the display — must be stopped before direct writes&lt;br /&gt;
* Proc interface: &amp;lt;code&amp;gt;/proc/driver/frpanel/&amp;lt;/code&amp;gt; (rows, cols, screen, type, version, access)&lt;br /&gt;
&lt;br /&gt;
== IP Reception ==&lt;br /&gt;
&lt;br /&gt;
The RD-60 supports multiple IP-based protocols for receiving transport streams:&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Protocol !! Max throughput !! Notes&lt;br /&gt;
|-&lt;br /&gt;
| UDP (unicast/multicast) || 100 Mbps || 7 DVB packets per UDP packet. No packet loss protection. Not recommended over public internet.&lt;br /&gt;
|-&lt;br /&gt;
| RTP (unicast/multicast) || 100 Mbps || 7 DVB packets per RTP packet. Adds packet sequencing for out-of-order correction.&lt;br /&gt;
|-&lt;br /&gt;
| RTP + FEC (SMPTE-2022) || 45 Mbps || FEC streams on base port N, with two FEC streams on N+2 and N+4. Handles lost packets at cost of latency/overhead.&lt;br /&gt;
|-&lt;br /&gt;
| TCP (unicast only) || 15 Mbps || No multicast support. Higher latency but reliable delivery. Recently added.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
The RD-60 automatically detects whether an incoming stream is UDP, RTP, or SMPTE-2022 FEC. TCP must be explicitly configured.&lt;br /&gt;
&lt;br /&gt;
The default mode is UDP/RTP. Switching between UDP/RTP and TCP requires a unit reboot. FEC streams require ports N+2 and N+4 to be open in addition to the base port N.&lt;br /&gt;
&lt;br /&gt;
Our unit was observed configured for UDP multicast at &amp;lt;code&amp;gt;224.0.0.5:5520&amp;lt;/code&amp;gt; (see &amp;lt;code&amp;gt;dtrans.xml&amp;lt;/code&amp;gt;).&lt;br /&gt;
&lt;br /&gt;
== Images ==&lt;br /&gt;
&amp;lt;gallery&amp;gt;&lt;br /&gt;
Adtec_rd60_internals_overview.jpg&lt;br /&gt;
Adtec_rd60_internals1.jpg&lt;br /&gt;
Adtec_rd60_internals2.jpg&lt;br /&gt;
Adtec_rd60_internals3.jpg&lt;br /&gt;
Adtec_rd60_internals4.jpg&lt;br /&gt;
Adtec_rd60_internals5.jpg&lt;br /&gt;
&amp;lt;/gallery&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== TODO (requires dish connected) ==&lt;br /&gt;
&lt;br /&gt;
* [ ] Read &amp;lt;code&amp;gt;/proc/driver/dvblite/fe0/stats&amp;lt;/code&amp;gt; with live signal — observe all BB* fields&lt;br /&gt;
* [ ] SNMP walk full &amp;lt;code&amp;gt;.1.3.6.1.4.1.19587&amp;lt;/code&amp;gt; with live signal&lt;br /&gt;
* [ ] Investigate &amp;lt;code&amp;gt;dvblite_ioctl&amp;lt;/code&amp;gt; on &amp;lt;code&amp;gt;/dev/dvblite0&amp;lt;/code&amp;gt;&lt;br /&gt;
* [ ] Enable &amp;lt;code&amp;gt;ntc_debug&amp;lt;/code&amp;gt; module param and watch dmesg&lt;br /&gt;
* [ ] Try ISI multistream filtering via SNMP SET&lt;br /&gt;
* [ ] Investigate &amp;lt;code&amp;gt;rddma_ip&amp;lt;/code&amp;gt; with GSE/MPE satellite signal&lt;br /&gt;
* [ ] Lock on Türksat 42°E: 10762 MHz / 30 MSym/s / QPSK 3/4 (known working)&lt;br /&gt;
* [ ] Identify prfMUX transponder on Lyngsat (10960 MHz / 8.352 MSym/s / 16APSK 2/3)&lt;br /&gt;
* [ ] Explore Telnet API &amp;lt;code&amp;gt;*.NTC&amp;lt;/code&amp;gt; command namespace&lt;br /&gt;
* [ ] Investigate &amp;lt;code&amp;gt;xcpServerd&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;xcpClientd&amp;lt;/code&amp;gt; — XCP protocol capabilities&lt;br /&gt;
* [ ] Check if &amp;lt;code&amp;gt;schnv.DVC&amp;lt;/code&amp;gt; populates after a lock (empty offline)&lt;br /&gt;
* [ ] Read &amp;lt;code&amp;gt;freg.db&amp;lt;/code&amp;gt; contents — full feature registry dump&lt;br /&gt;
* [ ] Write to LCD display — cross-compile against glibc 2.3.5 and call &amp;lt;code&amp;gt;LcdWriteStr()&amp;lt;/code&amp;gt; from &amp;lt;code&amp;gt;libsolib.so&amp;lt;/code&amp;gt;&lt;br /&gt;
* [ ] Send RMCP command via &amp;lt;code&amp;gt;rmcp_i2c&amp;lt;/code&amp;gt; to switch NTC/7044/BB output to BBFrame mode&lt;br /&gt;
&lt;br /&gt;
== Links == &lt;br /&gt;
- [https://www.tonercable.com/pdf/RD-60_Manual.pdf manual]&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=Adtec_RD-60&amp;diff=15914</id>
		<title>Adtec RD-60</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=Adtec_RD-60&amp;diff=15914"/>
		<updated>2026-04-12T17:15:38Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=Adtec RD-60&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Sdr&lt;br /&gt;
|Tool=No&lt;br /&gt;
|Location=the roof&lt;br /&gt;
}}&lt;br /&gt;
== Adtec RD-60 IRD ==&lt;br /&gt;
The &#039;&#039;&#039;Adtec RD-60&#039;&#039;&#039; is a 1RU integrated receiver/decoder (IRD).&lt;br /&gt;
&lt;br /&gt;
It seems the Adtec RD-60 might expose &#039;&#039;&#039;DVB-S2 baseband frames (BBFrames)&#039;&#039;&#039; below the TS layer, this might be very useful as part of the &#039;&#039;&#039;dontlookup&#039;&#039;&#039; satellite interception paper replication project. See [[dontlookup]]&lt;br /&gt;
&lt;br /&gt;
= Reverse Engineering Notes =&lt;br /&gt;
&lt;br /&gt;
== Hardware ==&lt;br /&gt;
[[File:Adtec_rd60_internals_overview.jpg|thumb|center]]&lt;br /&gt;
=== Main Unit ===&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;Model:&#039;&#039;&#039; Adtec RD-60 MultiCODEC Receiver/Decoder (IRD)&lt;br /&gt;
* &#039;&#039;&#039;Hostname:&#039;&#039;&#039; &amp;lt;code&amp;gt;GOFFERT&amp;lt;/code&amp;gt;&lt;br /&gt;
* &#039;&#039;&#039;IP:&#039;&#039;&#039; 10.1.2.172 (DHCP)&lt;br /&gt;
* &#039;&#039;&#039;CPU:&#039;&#039;&#039; IBM PowerPC PPC405GPr @ 399 MHz (GemPPC Iolite platform)&lt;br /&gt;
* &#039;&#039;&#039;PLB bus:&#039;&#039;&#039; 133 MHz | &#039;&#039;&#039;PCI bus:&#039;&#039;&#039; 33 MHz&lt;br /&gt;
* &#039;&#039;&#039;Kernel:&#039;&#039;&#039; Linux 2.6.14-gemppc-iolite&lt;br /&gt;
* &#039;&#039;&#039;Front panel:&#039;&#039;&#039; Character LCD/VFD — text only, ~40 chars wide.&lt;br /&gt;
* &#039;&#039;&#039;Storage:&#039;&#039;&#039; CompactFlash card (8 partitions, 4 used)&lt;br /&gt;
&lt;br /&gt;
It seems that the hardware doesn&#039;t do blind scan, but scripted sequential tuning might be a workaround?&lt;br /&gt;
&lt;br /&gt;
=== Demodulator Board ===&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;Slot 2:&#039;&#039;&#039; &amp;lt;code&amp;gt;BA14&amp;lt;/code&amp;gt; — PC87 ver 1.4 (main decoder board)&lt;br /&gt;
* &#039;&#039;&#039;Slot 99:&#039;&#039;&#039; &amp;lt;code&amp;gt;7044BB&amp;lt;/code&amp;gt; — &#039;&#039;&#039;Newtec NTC/7044/BB DVB Demodulator&#039;&#039;&#039;&lt;br /&gt;
** PRM firmware: &#039;&#039;&#039;v2.34&#039;&#039;&#039; (20/03/13)&lt;br /&gt;
** FPGA bitfile: v1.01 (09/01/12)&lt;br /&gt;
** Hardware: v3.0&lt;br /&gt;
** Serial: &#039;&#039;&#039;30091216&#039;&#039;&#039;&lt;br /&gt;
** Software ID: NTC/6381 DVB Demodulator&lt;br /&gt;
** Product ID: NTC/7044/BB.BCDCBCAA.x.B&lt;br /&gt;
** License: &#039;&#039;&#039;165&#039;&#039;&#039; (includes Baseband Frames — see below)&lt;br /&gt;
** Communicates via I2C (&amp;lt;code&amp;gt;rmcp_i2c&amp;lt;/code&amp;gt; kernel module)&lt;br /&gt;
** &amp;lt;code&amp;gt;BB&amp;lt;/code&amp;gt; suffix = BaseBand licensed and capable&lt;br /&gt;
&lt;br /&gt;
According to the official Newtec datasheet, the NTC/7044/BB supports explicit &#039;&#039;&#039;output mode switching&#039;&#039;&#039; between:&lt;br /&gt;
* Single transport stream&lt;br /&gt;
* Generic stream  &lt;br /&gt;
* &#039;&#039;&#039;Base Band Frames&#039;&#039;&#039; (BBFrames)&lt;br /&gt;
&lt;br /&gt;
The control interface is &#039;&#039;&#039;RMCPv2 protocol&#039;&#039;&#039; over async serial TTL or I2C — implemented by the &amp;lt;code&amp;gt;rmcp_i2c&amp;lt;/code&amp;gt; kernel module. &lt;br /&gt;
This is the mechanism to switch output to BBFrame mode.&lt;br /&gt;
&lt;br /&gt;
See also this PDF: https://www.melcom.co.uk/uploads/newdvbdemodntc7044_01.pdf&lt;br /&gt;
&lt;br /&gt;
RMCP protocol docs: https://newerasystems.net/wp-content/uploads/2017/02/RMCP-Manual-1_8.pdf&lt;br /&gt;
&lt;br /&gt;
[[File:20250429 153804.jpg|thumb|center]]&lt;br /&gt;
&lt;br /&gt;
=== Inputs/Outputs ===&lt;br /&gt;
&lt;br /&gt;
* 2x RF/satellite inputs (RF1, RF2) — 950–2150 MHz, 256 kSym/s – 45 MSym/s&lt;br /&gt;
* DVB-ASI input/output (currently set to RECEIVE mode)&lt;br /&gt;
* 2x SDI outputs (SD scaling)&lt;br /&gt;
* CVBS output&lt;br /&gt;
* 3x Ethernet (eth0, eth1, eth2)&lt;br /&gt;
* Serial: ttyS0 @ 115200, ttyBA&lt;br /&gt;
* L-Band Modulator option slot — &#039;&#039;&#039;not populated&#039;&#039;&#039; (&amp;lt;code&amp;gt;/dev/ntmod&amp;lt;/code&amp;gt; = &amp;quot;No such device&amp;quot;)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Firmware / Software ==&lt;br /&gt;
&lt;br /&gt;
=== CF Card Partition Layout ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Partition !! Size !! Contents&lt;br /&gt;
|-&lt;br /&gt;
| p5 || 137M || GNU sysroot — gcc-3.4.4 / glibc-2.3.5, PPC cross toolchain&lt;br /&gt;
|-&lt;br /&gt;
| p6 || 1.1M || &#039;&#039;&#039;Firmware&#039;&#039;&#039; — adtec/RD-60/1.12.08 and 1.12.12&lt;br /&gt;
|-&lt;br /&gt;
| p7 || 3.4M || Minimal initrd (busybox, bash, minimal libs)&lt;br /&gt;
|-&lt;br /&gt;
| p8 || 24M || Runtime/data (logs, DVC profiles, media)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
* Current firmware: &#039;&#039;&#039;1.12.12&#039;&#039;&#039; (symlinked at &amp;lt;code&amp;gt;/opt/pkg/oem&amp;lt;/code&amp;gt;)&lt;br /&gt;
* Previous firmware: &#039;&#039;&#039;1.12.08&#039;&#039;&#039; (symlinked at &amp;lt;code&amp;gt;/opt/pkg/oem_prev&amp;lt;/code&amp;gt;)&lt;br /&gt;
&lt;br /&gt;
=== p8 Runtime Directories ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Dir !! Purpose&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;dvc/&amp;lt;/code&amp;gt; || Tuner device profile files (.DVC)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;keys/&amp;lt;/code&amp;gt; || Empty — key material generated at runtime&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;log/&amp;lt;/code&amp;gt; || Rotated system logs&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;media/&amp;lt;/code&amp;gt; || Media files&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;.meta/&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;freg.db&amp;lt;/code&amp;gt; — feature registry SQLite DB&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;mvl/&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;osd/&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;rdy/&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;schmi/&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;shd/&amp;lt;/code&amp;gt; || Runtime state dirs (mostly empty)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Key Binaries (&amp;lt;code&amp;gt;/usr/local/sbin/&amp;lt;/code&amp;gt;) ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Binary !! Purpose&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;sysd&amp;lt;/code&amp;gt; || Main system daemon — tuner/demodulator config via XML&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;cmdld&amp;lt;/code&amp;gt; || Telnet API daemon (3 processes)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;menud&amp;lt;/code&amp;gt; || Front panel menu daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;fregd&amp;lt;/code&amp;gt; || Feature/license registry daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;dtrans&amp;lt;/code&amp;gt; || TS transport handler (&amp;lt;code&amp;gt;--slot=2 --id=BA14&amp;lt;/code&amp;gt;)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;dcmd&amp;lt;/code&amp;gt; || Device command interface for BA14&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;myles&amp;lt;/code&amp;gt; || Web API backend (SQLite)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;requestHandler&amp;lt;/code&amp;gt; || Apache CGI/FastCGI handler&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;snmpd&amp;lt;/code&amp;gt; || SNMP daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;snmpl&amp;lt;/code&amp;gt; || Internal SNMP poller — continuously queries Newtec MIB&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;vtosfifo&amp;lt;/code&amp;gt; || TS-to-FIFO bridge to &amp;lt;code&amp;gt;/dev/vtosfifo4&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;xcpServerd&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;xcpClientd&amp;lt;/code&amp;gt; || XCP protocol daemons (3 each)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;pard&amp;lt;/code&amp;gt; || Parallel interface daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;pnpd&amp;lt;/code&amp;gt; || PnP device daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;mirror&amp;lt;/code&amp;gt; || Mirror/redundancy daemon (runs as adtec)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Kernel Modules ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Module !! Purpose&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;newtec&amp;lt;/code&amp;gt; || Newtec 7044 demodulator driver — core BBFrame driver&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;newtec_dummy&amp;lt;/code&amp;gt; || Stub for absent optional demodulator hardware&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;dvblite&amp;lt;/code&amp;gt; || DVB lite core (depends on newtec) — exposes &amp;lt;code&amp;gt;dvblite_ioctl&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;rmcp_i2c&amp;lt;/code&amp;gt; || I2C transport for Newtec RMCP protocol&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;vtosfifo&amp;lt;/code&amp;gt; || TS FIFO device driver&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;rddma_ip&amp;lt;/code&amp;gt; || &#039;&#039;&#039;IP-over-satellite receive DMA engine (FPGA-backed)&#039;&#039;&#039;&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;ip_ingress_main&amp;lt;/code&amp;gt; || IP ingress pipeline (GSE/MPE over satellite)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;frpanel&amp;lt;/code&amp;gt; || Front panel driver&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;fanctrl&amp;lt;/code&amp;gt; / &amp;lt;code&amp;gt;pc96&amp;lt;/code&amp;gt; || Fan controller&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;proxyimg&amp;lt;/code&amp;gt; || Image proxy&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;epb&amp;lt;/code&amp;gt; || EPB bus driver&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;pnp&amp;lt;/code&amp;gt; || PnP device manager&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;fec&amp;lt;/code&amp;gt; / &amp;lt;code&amp;gt;ethfrm&amp;lt;/code&amp;gt; || Ethernet/FEC&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;pc73a&amp;lt;/code&amp;gt; / &amp;lt;code&amp;gt;pc93&amp;lt;/code&amp;gt; || Front panel dependencies&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Failed to load (hardware absent): &amp;lt;code&amp;gt;teamcast&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;nim&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;lnb_pwr&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;pc72&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Device Nodes ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Device !! Purpose&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/dvblite0-2&amp;lt;/code&amp;gt; || DVB lite interfaces&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/vtosfifo0-5&amp;lt;/code&amp;gt; || TS FIFO char devices (major 240)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/tuner0-3&amp;lt;/code&amp;gt; || Tuner interfaces (major 123)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/tuner_ledgr0-3&amp;lt;/code&amp;gt; || Tuner lock (green) LEDs&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/tuner_ledrd0-3&amp;lt;/code&amp;gt; || Tuner read LEDs&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/tuner_rst0-3&amp;lt;/code&amp;gt; || Tuner resets&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/ntmod&amp;lt;/code&amp;gt; || Newtec modulator — &#039;&#039;&#039;not populated&#039;&#039;&#039;&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== /proc Driver Interfaces ==&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;/proc/driver/dvblite/fe0/info&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
NAME=NTC/7044/BB DVB Demodulator&lt;br /&gt;
FREQ_MIN=950000 / FREQ_MAX=2150000&lt;br /&gt;
SYMRATE_MIN=256000 / SYMRATE_MAX=45000000&lt;br /&gt;
S_QPSK=1/2, 2/3, 3/4, 5/6, 6/7, 7/8, AUTO&lt;br /&gt;
S_8PSK=2/3, 5/6, 8/9, AUTO&lt;br /&gt;
S2_QPSK=1/4, 1/3, 1/2, 2/5, 2/3, 3/5, 3/4, 4/5, 5/6, 8/9, 9/10&lt;br /&gt;
S2_8PSK=2/3, 3/5, 3/4, 5/6, 8/9, 9/10&lt;br /&gt;
S2_16QAM=3/4, 7/8, AUTO&lt;br /&gt;
S2_16APSK=2/3, 3/4, 4/5, 5/6, 8/9, 9/10&lt;br /&gt;
S2_32APSK=3/4, 4/5, 5/6, 8/9, 9/10&lt;br /&gt;
SOFTWARE_LICENSE=165&lt;br /&gt;
SOFTWARE_VERSION=v2.34   20/03/13&lt;br /&gt;
FPGA_BITFILE_VERSION=v1.01 09/01/12&lt;br /&gt;
HARDWARE_VERSION=v3.0&lt;br /&gt;
SERIAL_NUM=30091216&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;/proc/driver/dvblite/fe0/stats&amp;lt;/code&amp;gt; (no signal) ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
LOCK=UNLOCKED&lt;br /&gt;
RECV_LEVEL=-70.00&lt;br /&gt;
INTRATE=41470588&lt;br /&gt;
MOD_FEC=QPSK_3/4&lt;br /&gt;
BB_CRC_ERRORS=N/A        &amp;lt;- populates with live signal&lt;br /&gt;
DUMMY_PL_RATIO=N/A       &amp;lt;- populates with live signal&lt;br /&gt;
ISI_FILTER_BYTE=N/A      &amp;lt;- populates with live signal&lt;br /&gt;
BASEBAND_LEN=N/A         &amp;lt;- populates with live signal&lt;br /&gt;
FRAMES_SEC=N/A           &amp;lt;- populates with live signal&lt;br /&gt;
ALARMS=0000110001011000&lt;br /&gt;
STATE=READY&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
fe1 has same structure but &amp;lt;code&amp;gt;NAME=NTC7044&amp;lt;/code&amp;gt; (no BB suffix, no license).&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;/proc/driver/vtosfifo/chn&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
Channel 0 processed 16620 TS frames during session. Channel 4 processed 1619.&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;/proc/driver/rddma/&amp;lt;/code&amp;gt; — FPGA DMA engine ===&lt;br /&gt;
&lt;br /&gt;
* Channel 3 active: Control=&amp;lt;code&amp;gt;49C003C0&amp;lt;/code&amp;gt;, Src=&amp;lt;code&amp;gt;03F01C00&amp;lt;/code&amp;gt; (FPGA mapped)&lt;br /&gt;
* 3.98M timer IRQs, 3.98M &amp;quot;No Data&amp;quot; — idle, no satellite IP stream&lt;br /&gt;
* PID &amp;lt;code&amp;gt;0x01E1&amp;lt;/code&amp;gt; (481) being tracked&lt;br /&gt;
&lt;br /&gt;
== Kernel Module Internals (&amp;lt;code&amp;gt;strings&amp;lt;/code&amp;gt; analysis) ==&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;newtec.ko&amp;lt;/code&amp;gt; — BBFrame symbols ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
BB_CRC_ERRORS / BB_CRC_ERRORS_CURRENT / BB_CRC_ERRORS_NEXT&lt;br /&gt;
BB_DATA_FIELD_LEN / BB_DATA_FIELD_LEN_CURRENT / BB_DATA_FIELD_LEN_NEXT&lt;br /&gt;
BB_FRAMES&lt;br /&gt;
BB_GAIN / BB_GAIN_CURRENT / BB_GAIN_NEXT&lt;br /&gt;
BASEBAND_LEN&lt;br /&gt;
ISI / ISI_CTRL / ISI_CTRL_STRUCT / ISI_CTRL_STRUCT_FIELDS&lt;br /&gt;
ISI_FILTER_BYTE / ISI_MASK&lt;br /&gt;
SAT_BB_GAIN&lt;br /&gt;
ntc_debug  (module param, uint)&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;BB_DATA_FIELD_LEN&amp;lt;/code&amp;gt; and &amp;lt;code&amp;gt;BB_FRAMES&amp;lt;/code&amp;gt; suggest the driver tracks individual baseband frames, not just statistics. Very promising for BBFrame capture.&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;dvblite.ko&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
Contains &amp;lt;code&amp;gt;dvblite_ioctl&amp;lt;/code&amp;gt; — a kernel ioctl interface on &amp;lt;code&amp;gt;/dev/dvblite0&amp;lt;/code&amp;gt;. Commands unknown — to be investigated with a live signal.&lt;br /&gt;
&lt;br /&gt;
== Network Services ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Service !! Port !! Notes&lt;br /&gt;
|-&lt;br /&gt;
| SSH || 22 || Legacy KEX only (diffie-hellman-group1-sha1)&lt;br /&gt;
|-&lt;br /&gt;
| Telnet API || 23 || &amp;lt;code&amp;gt;cmdld&amp;lt;/code&amp;gt; via xinetd&lt;br /&gt;
|-&lt;br /&gt;
| FTP || 21 || pure-ftpd&lt;br /&gt;
|-&lt;br /&gt;
| HTTP || 80 || Apache + myles + requestHandler&lt;br /&gt;
|-&lt;br /&gt;
| SNMP || 161 || Community &amp;lt;code&amp;gt;public&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| mDNS || 5353 || &amp;lt;code&amp;gt;GOFFERT.local&amp;lt;/code&amp;gt;&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
# SSH/SCP&lt;br /&gt;
ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa root@&amp;lt;ip&amp;gt;&lt;br /&gt;
scp -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa root@&amp;lt;ip&amp;gt;:/path /local&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Credentials (Default/Hardcoded — ZSL-2020-5603 / ExploitDB 48954) ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! User !! Password !! Notes&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;root&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;1root!&amp;lt;/code&amp;gt; || Full root SSH&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;admin&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;1admin!&amp;lt;/code&amp;gt; || Also root via sudoers&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;adtec&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;none&amp;lt;/code&amp;gt; || Telnet API / web UI&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;adtecftp&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;adtecftp2231&amp;lt;/code&amp;gt; || FTP only&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
* Password hashes: DES crypt — crackable in seconds with &amp;lt;code&amp;gt;john&amp;lt;/code&amp;gt;&lt;br /&gt;
* &amp;lt;code&amp;gt;apache ALL=(ALL) NOPASSWD: ALL&amp;lt;/code&amp;gt; in sudoers&lt;br /&gt;
* Diagnostic package passphrase: &#039;&#039;&#039;&amp;lt;code&amp;gt;iMoo3jio&amp;lt;/code&amp;gt;&#039;&#039;&#039; (hardcoded, leaks in &amp;lt;code&amp;gt;ps aux&amp;lt;/code&amp;gt;)&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
gpg --passphrase &amp;quot;iMoo3jio&amp;quot; --batch --ignore-mdc-error --decrypt RD-60_*.tar.gpg | tar xf -&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== APIs ==&lt;br /&gt;
&lt;br /&gt;
=== Telnet API ===&lt;br /&gt;
&lt;br /&gt;
Connect: &amp;lt;code&amp;gt;telnet &amp;lt;ip&amp;gt;&amp;lt;/code&amp;gt;, login &amp;lt;code&amp;gt;adtec&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;none&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
*.SYSD SHELLCMD &amp;lt;cmd&amp;gt;          # arbitrary root shell execution!&lt;br /&gt;
*.SNMP ADTEC-NT-DEMOD-MIB::satFeedType.0 = dvbs2   # configure tuner&lt;br /&gt;
*.SNMP ADTEC-NT-DEMOD-MIB::satFeedDownlink.0 = 10960000&lt;br /&gt;
*.SNMP .1.3.6.1.4.1.19587.6000.3.999.0 i 0         # commit/apply&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== SNMP — Newtec Demodulator MIB ===&lt;br /&gt;
&lt;br /&gt;
OID base: &amp;lt;code&amp;gt;.1.3.6.1.4.1.19587&amp;lt;/code&amp;gt;, MIB: &amp;lt;code&amp;gt;ADTEC-NT-DEMOD-MIB&amp;lt;/code&amp;gt;, community: &amp;lt;code&amp;gt;public&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
snmpwalk -v2c -c public &amp;lt;ip&amp;gt; .1.3.6.1.4.1.19587&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Key OIDs: &amp;lt;code&amp;gt;tunerLock&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;recvLevel&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;esNo&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;linkMargin&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;modFec&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;rolloff&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;pilot&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;fecFrameType&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;unCorrFs&amp;lt;/code&amp;gt;, &#039;&#039;&#039;&amp;lt;code&amp;gt;bbCrcerrors&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &#039;&#039;&#039;&amp;lt;code&amp;gt;basebandLen&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &#039;&#039;&#039;&amp;lt;code&amp;gt;dummyPlRatio&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &#039;&#039;&#039;&amp;lt;code&amp;gt;isiFilterByte&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &#039;&#039;&#039;&amp;lt;code&amp;gt;framesSec&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &amp;lt;code&amp;gt;satFeedType&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;satFeedDownlink&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;satFeedSymRate&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;satFeedModulation&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;lnbEnable&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;lnbPolarity&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;lnbTone&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== DVC Profile Format ===&lt;br /&gt;
&lt;br /&gt;
SNMP SET commands as tuner presets, applied via Telnet API or web UI.&lt;br /&gt;
&lt;br /&gt;
== Saved Tuner Profiles ==&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;prfturktest.DVC&amp;lt;/code&amp;gt; (2018-04-28) ===&lt;br /&gt;
&lt;br /&gt;
* DVB-S, &#039;&#039;&#039;10762 MHz&#039;&#039;&#039;, KU 9750 LO → &#039;&#039;&#039;1012 MHz&#039;&#039;&#039; L-band&lt;br /&gt;
* &#039;&#039;&#039;30 MSym/s&#039;&#039;&#039;, QPSK 3/4, roll-off 35%&lt;br /&gt;
* Was &#039;&#039;&#039;LOCKED&#039;&#039;&#039; at -32 dBm when saved&lt;br /&gt;
* &amp;lt;code&amp;gt;bbCrcerrors = 1&amp;lt;/code&amp;gt; — &#039;&#039;&#039;BBFrame counter was active and non-zero!&#039;&#039;&#039;&lt;br /&gt;
* Likely &#039;&#039;&#039;Türksat 42°E&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;prfMUX.DVC&amp;lt;/code&amp;gt; (2018-04-28) ===&lt;br /&gt;
&lt;br /&gt;
* DVB-S2, &#039;&#039;&#039;10960 MHz&#039;&#039;&#039;, KU 9750 LO → &#039;&#039;&#039;1210 MHz&#039;&#039;&#039; L-band&lt;br /&gt;
* &#039;&#039;&#039;8.352 MSym/s&#039;&#039;&#039;, 16APSK 2/3, roll-off 20%, pilot ON, normal frames, CCM&lt;br /&gt;
* Was unlocked when saved&lt;br /&gt;
&lt;br /&gt;
== Licensed Features (Key ID 165) ==&lt;br /&gt;
&lt;br /&gt;
DVB-DSNG + DVB-S2 + QPSK + 8-PSK + 16-QAM/16APSK + 32APSK + Symbol Rate &amp;lt;= 33 MBaud + ACM + &#039;&#039;&#039;Single TS/GS or Multiple Streams&#039;&#039;&#039; + &#039;&#039;&#039;(Baseband Frames)&#039;&#039;&#039; + no ACM client + no AES&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;BBFrame access is explicitly licensed and enabled.&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
== Encryption / CA ==&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;BISS-1 key&#039;&#039;&#039; in &amp;lt;code&amp;gt;dtrans.xml&amp;lt;/code&amp;gt;: &amp;lt;code&amp;gt;69A969BBECA0&amp;lt;/code&amp;gt;&lt;br /&gt;
* &#039;&#039;&#039;Viaccess&#039;&#039;&#039; (CA ID 0x0005) feed seen in logs — no card present, could not decrypt&lt;br /&gt;
&lt;br /&gt;
== IP-over-Satellite ==&lt;br /&gt;
&lt;br /&gt;
The unit has a full satellite IP receive stack beyond TS decoding:&lt;br /&gt;
&lt;br /&gt;
* &amp;lt;code&amp;gt;rddma_ip&amp;lt;/code&amp;gt; — FPGA-backed DMA for IP-from-satellite&lt;br /&gt;
* &amp;lt;code&amp;gt;ip_ingress_main&amp;lt;/code&amp;gt; — GSE/MPE ingress pipeline&lt;br /&gt;
* FPGA Channel 3 active at &amp;lt;code&amp;gt;03F01C00&amp;lt;/code&amp;gt;&lt;br /&gt;
* Currently idle — no GSE/MPE stream configured&lt;br /&gt;
&lt;br /&gt;
== Security Summary ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Issue !! Detail&lt;br /&gt;
|-&lt;br /&gt;
| Default root creds || &amp;lt;code&amp;gt;root&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;1root!&amp;lt;/code&amp;gt; over SSH&lt;br /&gt;
|-&lt;br /&gt;
| Telnet RCE || &amp;lt;code&amp;gt;*.SYSD SHELLCMD&amp;lt;/code&amp;gt; = root shell with &amp;lt;code&amp;gt;adtec&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;none&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Sudoers || &amp;lt;code&amp;gt;apache ALL=(ALL) NOPASSWD: ALL&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Shared SSH host keys || Same across all units (stored on CF card)&lt;br /&gt;
|-&lt;br /&gt;
| Weak password hashes || DES crypt, trivially crackable&lt;br /&gt;
|-&lt;br /&gt;
| GPG passphrase leak || &amp;lt;code&amp;gt;iMoo3jio&amp;lt;/code&amp;gt; visible in &amp;lt;code&amp;gt;ps aux&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Public exploit || ZSL-2020-5603 / ExploitDB 48954&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Other ==&lt;br /&gt;
== Front Panel ==&lt;br /&gt;
&lt;br /&gt;
* Driver: &amp;lt;code&amp;gt;frpanel.ko&amp;lt;/code&amp;gt; (depends on &amp;lt;code&amp;gt;pc93&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;pc73a&amp;lt;/code&amp;gt;)&lt;br /&gt;
* Device nodes: &amp;lt;code&amp;gt;/dev/frpanel0&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;/dev/frpanel1&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;/dev/frpanel2&amp;lt;/code&amp;gt;&lt;br /&gt;
* Display: 2 rows × 40 columns character LCD (PC93 I2C MCU)&lt;br /&gt;
* LCD API in &amp;lt;code&amp;gt;libsolib.so&amp;lt;/code&amp;gt;: &amp;lt;code&amp;gt;FpLcdKpInit()&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;LcdClear()&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;LcdWriteStr(char*, pos, len)&amp;lt;/code&amp;gt;&lt;br /&gt;
* Writing to &amp;lt;code&amp;gt;/dev/frpanel2&amp;lt;/code&amp;gt; activates the backlight&lt;br /&gt;
* &amp;lt;code&amp;gt;menud&amp;lt;/code&amp;gt; daemon owns the display — must be stopped before direct writes&lt;br /&gt;
* Proc interface: &amp;lt;code&amp;gt;/proc/driver/frpanel/&amp;lt;/code&amp;gt; (rows, cols, screen, type, version, access)&lt;br /&gt;
&lt;br /&gt;
== IP Reception ==&lt;br /&gt;
&lt;br /&gt;
The RD-60 supports multiple IP-based protocols for receiving transport streams:&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Protocol !! Max throughput !! Notes&lt;br /&gt;
|-&lt;br /&gt;
| UDP (unicast/multicast) || 100 Mbps || 7 DVB packets per UDP packet. No packet loss protection. Not recommended over public internet.&lt;br /&gt;
|-&lt;br /&gt;
| RTP (unicast/multicast) || 100 Mbps || 7 DVB packets per RTP packet. Adds packet sequencing for out-of-order correction.&lt;br /&gt;
|-&lt;br /&gt;
| RTP + FEC (SMPTE-2022) || 45 Mbps || FEC streams on base port N, with two FEC streams on N+2 and N+4. Handles lost packets at cost of latency/overhead.&lt;br /&gt;
|-&lt;br /&gt;
| TCP (unicast only) || 15 Mbps || No multicast support. Higher latency but reliable delivery. Recently added.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
The RD-60 automatically detects whether an incoming stream is UDP, RTP, or SMPTE-2022 FEC. TCP must be explicitly configured.&lt;br /&gt;
&lt;br /&gt;
The default mode is UDP/RTP. Switching between UDP/RTP and TCP requires a unit reboot. FEC streams require ports N+2 and N+4 to be open in addition to the base port N.&lt;br /&gt;
&lt;br /&gt;
Our unit was observed configured for UDP multicast at &amp;lt;code&amp;gt;224.0.0.5:5520&amp;lt;/code&amp;gt; (see &amp;lt;code&amp;gt;dtrans.xml&amp;lt;/code&amp;gt;).&lt;br /&gt;
&lt;br /&gt;
== Images ==&lt;br /&gt;
&amp;lt;gallery&amp;gt;&lt;br /&gt;
Adtec_rd60_internals_overview.jpg&lt;br /&gt;
Adtec_rd60_internals1.jpg&lt;br /&gt;
Adtec_rd60_internals2.jpg&lt;br /&gt;
Adtec_rd60_internals3.jpg&lt;br /&gt;
Adtec_rd60_internals4.jpg&lt;br /&gt;
Adtec_rd60_internals5.jpg&lt;br /&gt;
&amp;lt;/gallery&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== TODO (requires dish connected) ==&lt;br /&gt;
&lt;br /&gt;
* [ ] Read &amp;lt;code&amp;gt;/proc/driver/dvblite/fe0/stats&amp;lt;/code&amp;gt; with live signal — observe all BB* fields&lt;br /&gt;
* [ ] SNMP walk full &amp;lt;code&amp;gt;.1.3.6.1.4.1.19587&amp;lt;/code&amp;gt; with live signal&lt;br /&gt;
* [ ] Investigate &amp;lt;code&amp;gt;dvblite_ioctl&amp;lt;/code&amp;gt; on &amp;lt;code&amp;gt;/dev/dvblite0&amp;lt;/code&amp;gt;&lt;br /&gt;
* [ ] Enable &amp;lt;code&amp;gt;ntc_debug&amp;lt;/code&amp;gt; module param and watch dmesg&lt;br /&gt;
* [ ] Try ISI multistream filtering via SNMP SET&lt;br /&gt;
* [ ] Investigate &amp;lt;code&amp;gt;rddma_ip&amp;lt;/code&amp;gt; with GSE/MPE satellite signal&lt;br /&gt;
* [ ] Lock on Türksat 42°E: 10762 MHz / 30 MSym/s / QPSK 3/4 (known working)&lt;br /&gt;
* [ ] Identify prfMUX transponder on Lyngsat (10960 MHz / 8.352 MSym/s / 16APSK 2/3)&lt;br /&gt;
* [ ] Explore Telnet API &amp;lt;code&amp;gt;*.NTC&amp;lt;/code&amp;gt; command namespace&lt;br /&gt;
* [ ] Investigate &amp;lt;code&amp;gt;xcpServerd&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;xcpClientd&amp;lt;/code&amp;gt; — XCP protocol capabilities&lt;br /&gt;
* [ ] Check if &amp;lt;code&amp;gt;schnv.DVC&amp;lt;/code&amp;gt; populates after a lock (empty offline)&lt;br /&gt;
* [ ] Read &amp;lt;code&amp;gt;freg.db&amp;lt;/code&amp;gt; contents — full feature registry dump&lt;br /&gt;
* [ ] Write to LCD display — cross-compile against glibc 2.3.5 and call &amp;lt;code&amp;gt;LcdWriteStr()&amp;lt;/code&amp;gt; from &amp;lt;code&amp;gt;libsolib.so&amp;lt;/code&amp;gt;&lt;br /&gt;
* [ ] Send RMCP command via &amp;lt;code&amp;gt;rmcp_i2c&amp;lt;/code&amp;gt; to switch NTC/7044/BB output to BBFrame mode&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=Dontlookup&amp;diff=15912</id>
		<title>Dontlookup</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=Dontlookup&amp;diff=15912"/>
		<updated>2026-04-11T23:55:20Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=dontlookup&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Sdr&lt;br /&gt;
|Tool=No&lt;br /&gt;
|Location=&lt;br /&gt;
}}&lt;br /&gt;
= dontlookup =&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;dontlookup&#039;&#039;&#039; is an open-source tool by researchers at UC San Diego for parsing IP traffic encapsulated in raw DVB-S2(X) satellite captures. It was presented at CCS 2025.&lt;br /&gt;
&lt;br /&gt;
The name is a reference to the fact that satellite internet providers apparently did not expect anyone to be passively listening.&lt;br /&gt;
&lt;br /&gt;
NURDspace uses it (or plans to) in combination with the [[Intellian_i4_Satellite_dish]] and a DVB-S2 receiver to capture and inspect unencrypted satellite internet traffic off the air.&lt;br /&gt;
&lt;br /&gt;
== What It Does ==&lt;br /&gt;
&lt;br /&gt;
Many satellite internet providers beam IP traffic down to large coverage areas using DVB-S2 or DVB-S2X. A significant portion of this traffic is unencrypted. By capturing the raw transport stream with a DVB-S2 receiver and running it through dontlookup, you can extract actual IP packets and open them in Wireshark.&lt;br /&gt;
&lt;br /&gt;
== Capturing ==&lt;br /&gt;
&lt;br /&gt;
=== Background: BBframes ===&lt;br /&gt;
&lt;br /&gt;
DVB-S2 transmits data in &#039;&#039;&#039;Baseband Frames (BBframes)&#039;&#039;&#039; — the lowest-level data unit after forward error correction. IP traffic is encapsulated inside these frames, either directly or via GSE or MPEG-TS wrappers. dontlookup operates on raw BBframe payloads.&lt;br /&gt;
&lt;br /&gt;
The problem is that virtually every DVB-S2 receiver card exposes only a processed &#039;&#039;&#039;MPEG-TS&#039;&#039;&#039; stream to userspace. The DVB API in Linux was designed for TV reception, so the driver demodulates the signal and hands you PIDs — the raw BBframe layer is discarded. If the satellite provider uses MPEG-TS encapsulation you get lucky and this works fine. If they use direct IP or GSE encapsulation, which does not map to MPEG-TS PIDs, you get nothing.&lt;br /&gt;
&lt;br /&gt;
=== Background: Blind Scan ===&lt;br /&gt;
&lt;br /&gt;
When tuning a satellite receiver normally, you already know what you are looking for — frequency,&lt;br /&gt;
symbol rate, polarisation, and FEC parameters. These are typically sourced from a database like&lt;br /&gt;
[[https://www.lyngsat.com/ LyngSat]] or a channel list. Blind scan is the alternative: the&lt;br /&gt;
receiver sweeps the entire band and attempts to lock onto any signal it finds, determining the&lt;br /&gt;
parameters itself.&lt;br /&gt;
&lt;br /&gt;
This matters for dontlookup because the most interesting transponders — those carrying&lt;br /&gt;
unencrypted IP backhaul — are generally not listed in any public database. They are not&lt;br /&gt;
broadcast television services; they are private data links that nobody was expected to be&lt;br /&gt;
looking at. A receiver limited to known transponders will never find them.&lt;br /&gt;
&lt;br /&gt;
Blind scan is more computationally intensive than directed tuning and takes longer to complete&lt;br /&gt;
a full sweep, but it is the only reliable method to discover unknown transponders.&lt;br /&gt;
Not all DVB-S2 receiver hardware exposes blind scan capability to the Linux DVB API, even if&lt;br /&gt;
the underlying demodulator chipset supports it — this is one of the reasons the [[#TBS Driver Patch|TBS5927]]&lt;br /&gt;
became the reference hardware for this project.&lt;br /&gt;
&lt;br /&gt;
=== TBS Driver Patch ===&lt;br /&gt;
&lt;br /&gt;
The dontlookup repo ships a kernel patch (&amp;lt;code&amp;gt;tbsdriver.patch&amp;lt;/code&amp;gt;) for TBS DVB-S2 receiver cards that exposes the raw BBframe stream to userspace, bypassing the normal DVB API. This is required to capture proprietary or non-MPEG-TS encapsulations.&lt;br /&gt;
&lt;br /&gt;
However, the researchers used a &#039;&#039;&#039;TBS5927&#039;&#039;&#039; which has become unobtainium.&lt;br /&gt;
&lt;br /&gt;
A &#039;&#039;&#039;TBS5925&#039;&#039;&#039; may work and is on its way to NURDspace for testing. [[User:20h]] also generously acquired a &#039;&#039;&#039;TBS-5580&#039;&#039;&#039;. Neither has been confirmed working yet.&lt;br /&gt;
&lt;br /&gt;
The TBS5925 is documented to work with EUMETCast: [https://www-cdn.eumetsat.int/files/2020-07/TBS%205925%20DVB-S2%20Receiver%20EUMETCast%20Windows%20Setup%20Guide.pdf TBS5925 EUMETCast setup guide].&lt;br /&gt;
&lt;br /&gt;
=== SAT&amp;gt;IP Devices ===&lt;br /&gt;
&lt;br /&gt;
The &#039;&#039;&#039;Digibit R1&#039;&#039;&#039; SAT&amp;gt;IP tuner used at NURDspace presents itself as a network-attached DVB-S2 tuner. It handles LNB power, DiSEqC, and tuning over the network, but only streams MPEG-TS over SAT&amp;gt;IP. There is no way to get raw BBframes out of it without hardware modifications.&lt;br /&gt;
&lt;br /&gt;
Further investigation revealed it runs STMicro&#039;s proprietary &#039;&#039;&#039;STAPI&#039;&#039;&#039; stack internally — &amp;lt;code&amp;gt;stpti5_core&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;stfdma_core&amp;lt;/code&amp;gt; etc. — with no &amp;lt;code&amp;gt;/dev/dvb/&amp;lt;/code&amp;gt; device exposed. minisatip talks directly to STAPI, bypassing the Linux DVB API entirely. Intercepting data at the STAPI layer to get raw BBframes would require significant reverse engineering effort.&lt;br /&gt;
&lt;br /&gt;
=== STV090x Based Chipsets ===&lt;br /&gt;
&lt;br /&gt;
The STV090x demodulator (used in many DVB-S2 cards) is capable of outputting raw BBframes at the hardware level, but the Linux driver simply never implements it. Investigation of &amp;lt;code&amp;gt;stv090x.c&amp;lt;/code&amp;gt; showed it writes an output configuration register at init:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
{ STV090x_OUTCFG, 0x00 },  /* serial TS output, hardware default */&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
The crucial register is &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt; with &amp;lt;code&amp;gt;FRAME_MODE_FIELD&amp;lt;/code&amp;gt; set to 1 — discovered via a [https://www.spinics.net/lists/linux-media/msg45597.html 2012 linux-media mailing list post] documenting exactly this on a TBS6925. One register bit is all it takes.&lt;br /&gt;
&lt;br /&gt;
The plan was to apply a similar patch to a &#039;&#039;&#039;SkyStar 2 eXpress HD&#039;&#039;&#039; (SAA716x + STV090x). This ran into a separate problem: newer AMD motherboards have removed the 3.3V rail from PCIe slots. DVB cards use 3.3V for logic; GPUs do not. The SkyStar and other PCIe satellite tuners simply failed to enumerate, while a GPU in the same slot worked fine. Testing on an older motherboard has not yet been attempted.&lt;br /&gt;
&lt;br /&gt;
=== MiniTiouner / Longmynd ===&lt;br /&gt;
&lt;br /&gt;
The &#039;&#039;&#039;MiniTiouner&#039;&#039;&#039; is a USB DVB-S2 receiver designed by the British Amateur Television Club (BATC) for amateur TV reception, primarily targeting the QO-100 geostationary amateur transponder. Unlike the TBS cards, it uses the &#039;&#039;&#039;STV0910&#039;&#039;&#039; demodulator which outputs raw BBframes natively — no kernel patching required.&lt;br /&gt;
&lt;br /&gt;
The &#039;&#039;&#039;Longmynd&#039;&#039;&#039; software (also by BATC) drives the MiniTiouner and outputs BBframes directly over UDP, making it straightforwardly compatible with dontlookup.&lt;br /&gt;
&lt;br /&gt;
The catch is availability: purchasing the kit requires a BATC membership, and the hardware is not sold elsewhere.&lt;br /&gt;
&lt;br /&gt;
=== Professional IRD: Adtec RD-60 ===&lt;br /&gt;
&lt;br /&gt;
An [[ Adtec RD-60 ]] professional broadcast IRD is also available. This is the kind of kit used by actual broadcasters to receive satellite feeds.&lt;br /&gt;
&lt;br /&gt;
=== GNU Radio / gr-dvbs2rx ===&lt;br /&gt;
&lt;br /&gt;
An SDR-based approach using [https://github.com/igorauad/gr-dvbs2rx gr-dvbs2rx] (a GNU Radio out-of-tree module for DVB-S2 demodulation) was also explored. This would allow a HackRF or similar SDR to demodulate DVB-S2 and potentially extract BBframes entirely in software, without any dedicated DVB receiver hardware.&lt;br /&gt;
&lt;br /&gt;
The main constraint is bandwidth. Typical Ku-band transponders run at 27–45 Msym/s, requiring roughly that much RF bandwidth — well beyond the HackRF&#039;s 20 MHz maximum. However, some data-only transponders run significantly narrower symbol rates and could fit within an SDR&#039;s bandwidth.&lt;br /&gt;
&lt;br /&gt;
Combining two HackRFs in a phase-coherent configuration (the HackRF has explicit support for clock synchronisation between units) could double the available bandwidth and is cheaper than a LimeSDR.&lt;br /&gt;
&lt;br /&gt;
== Links ==&lt;br /&gt;
&lt;br /&gt;
* [https://github.com/ucsdsysnet/dontlookup GitHub — ucsdsysnet/dontlookup]&lt;br /&gt;
* [https://satcom.sysnet.ucsd.edu/docs/dontlookup_ccs25_fullpaper.pdf CCS 2025 paper (PDF)]&lt;br /&gt;
* [https://forums.radioreference.com/threads/dont-look-up-research-paper-on-satcom-interception.493532/]&lt;br /&gt;
* [https://youtu.be/VE7S1nk4F04 saveitforparts — Intercepting Sensitive Satellite Data Is (Scarily) Easier Than I Thought!]&lt;br /&gt;
* [https://www.spinics.net/lists/linux-media/msg45597.html linux-media 2012: STV090x BBframe patch]&lt;br /&gt;
* [https://www-cdn.eumetsat.int/files/2020-07/TBS%205925%20DVB-S2%20Receiver%20EUMETCast%20Windows%20Setup%20Guide.pdf TBS5925 EUMETCast setup guide]&lt;br /&gt;
* [https://www.satsignal.eu/wxsat/atovs/index.html SatSignal — EUMETCast receiver hardware notes]&lt;br /&gt;
* [[Intellian_i4_Satellite_dish]]&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=Adtec_RD-60&amp;diff=15911</id>
		<title>Adtec RD-60</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=Adtec_RD-60&amp;diff=15911"/>
		<updated>2026-04-11T23:35:19Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=Adtec RD-60&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Sdr&lt;br /&gt;
|Tool=No&lt;br /&gt;
|Location=the roof&lt;br /&gt;
}}&lt;br /&gt;
== Adtec RD-60 IRD ==&lt;br /&gt;
The &#039;&#039;&#039;Adtec RD-60&#039;&#039;&#039; is a 1RU integrated receiver/decoder (IRD).&lt;br /&gt;
&lt;br /&gt;
It seems the Adtec RD-60 might expose &#039;&#039;&#039;DVB-S2 baseband frames (BBFrames)&#039;&#039;&#039; below the TS layer, this might be very useful as part of the &#039;&#039;&#039;dontlookup&#039;&#039;&#039; satellite interception paper replication project. See [[dontlookup]]&lt;br /&gt;
&lt;br /&gt;
= Reverse Engineering Notes =&lt;br /&gt;
&lt;br /&gt;
== Hardware ==&lt;br /&gt;
[[File:Adtec_rd60_internals_overview.jpg|thumb|center]]&lt;br /&gt;
=== Main Unit ===&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;Model:&#039;&#039;&#039; Adtec RD-60 MultiCODEC Receiver/Decoder (IRD)&lt;br /&gt;
* &#039;&#039;&#039;Hostname:&#039;&#039;&#039; &amp;lt;code&amp;gt;GOFFERT&amp;lt;/code&amp;gt;&lt;br /&gt;
* &#039;&#039;&#039;IP:&#039;&#039;&#039; 10.1.2.172 (DHCP)&lt;br /&gt;
* &#039;&#039;&#039;CPU:&#039;&#039;&#039; IBM PowerPC PPC405GPr @ 399 MHz (GemPPC Iolite platform)&lt;br /&gt;
* &#039;&#039;&#039;PLB bus:&#039;&#039;&#039; 133 MHz | &#039;&#039;&#039;PCI bus:&#039;&#039;&#039; 33 MHz&lt;br /&gt;
* &#039;&#039;&#039;Kernel:&#039;&#039;&#039; Linux 2.6.14-gemppc-iolite&lt;br /&gt;
* &#039;&#039;&#039;Front panel:&#039;&#039;&#039; Character LCD/VFD — text only, ~40 chars wide.&lt;br /&gt;
* &#039;&#039;&#039;Storage:&#039;&#039;&#039; CompactFlash card (8 partitions, 4 used)&lt;br /&gt;
&lt;br /&gt;
It seems that the hardware doesn&#039;t do blind scan, but scripted sequential tuning might be a workaround?&lt;br /&gt;
&lt;br /&gt;
=== Demodulator Board ===&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;Slot 2:&#039;&#039;&#039; &amp;lt;code&amp;gt;BA14&amp;lt;/code&amp;gt; — PC87 ver 1.4 (main decoder board)&lt;br /&gt;
* &#039;&#039;&#039;Slot 99:&#039;&#039;&#039; &amp;lt;code&amp;gt;7044BB&amp;lt;/code&amp;gt; — &#039;&#039;&#039;Newtec NTC/7044/BB DVB Demodulator&#039;&#039;&#039;&lt;br /&gt;
** PRM firmware: &#039;&#039;&#039;v2.34&#039;&#039;&#039; (20/03/13)&lt;br /&gt;
** FPGA bitfile: v1.01 (09/01/12)&lt;br /&gt;
** Hardware: v3.0&lt;br /&gt;
** Serial: &#039;&#039;&#039;30091216&#039;&#039;&#039;&lt;br /&gt;
** Software ID: NTC/6381 DVB Demodulator&lt;br /&gt;
** Product ID: NTC/7044/BB.BCDCBCAA.x.B&lt;br /&gt;
** License: &#039;&#039;&#039;165&#039;&#039;&#039; (includes Baseband Frames — see below)&lt;br /&gt;
** Communicates via I2C (&amp;lt;code&amp;gt;rmcp_i2c&amp;lt;/code&amp;gt; kernel module)&lt;br /&gt;
** &amp;lt;code&amp;gt;BB&amp;lt;/code&amp;gt; suffix = BaseBand licensed and capable&lt;br /&gt;
&lt;br /&gt;
According to the official Newtec datasheet, the NTC/7044/BB supports explicit &#039;&#039;&#039;output mode switching&#039;&#039;&#039; between:&lt;br /&gt;
* Single transport stream&lt;br /&gt;
* Generic stream  &lt;br /&gt;
* &#039;&#039;&#039;Base Band Frames&#039;&#039;&#039; (BBFrames)&lt;br /&gt;
&lt;br /&gt;
The control interface is &#039;&#039;&#039;RMCPv2 protocol&#039;&#039;&#039; over async serial TTL or I2C — implemented by the &amp;lt;code&amp;gt;rmcp_i2c&amp;lt;/code&amp;gt; kernel module. &lt;br /&gt;
This is the mechanism to switch output to BBFrame mode.&lt;br /&gt;
&lt;br /&gt;
See also this PDF: https://www.melcom.co.uk/uploads/newdvbdemodntc7044_01.pdf&lt;br /&gt;
&lt;br /&gt;
RMCP protocol docs: https://newerasystems.net/wp-content/uploads/2017/02/RMCP-Manual-1_8.pdf&lt;br /&gt;
&lt;br /&gt;
[[File:20250429 153804.jpg|thumb|center]]&lt;br /&gt;
&lt;br /&gt;
=== Inputs/Outputs ===&lt;br /&gt;
&lt;br /&gt;
* 2x RF/satellite inputs (RF1, RF2) — 950–2150 MHz, 256 kSym/s – 45 MSym/s&lt;br /&gt;
* DVB-ASI input/output (currently set to RECEIVE mode)&lt;br /&gt;
* 2x SDI outputs (SD scaling)&lt;br /&gt;
* CVBS output&lt;br /&gt;
* 3x Ethernet (eth0, eth1, eth2)&lt;br /&gt;
* Serial: ttyS0 @ 115200, ttyBA&lt;br /&gt;
* L-Band Modulator option slot — &#039;&#039;&#039;not populated&#039;&#039;&#039; (&amp;lt;code&amp;gt;/dev/ntmod&amp;lt;/code&amp;gt; = &amp;quot;No such device&amp;quot;)&lt;br /&gt;
&lt;br /&gt;
== Firmware / Software ==&lt;br /&gt;
&lt;br /&gt;
=== CF Card Partition Layout ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Partition !! Size !! Contents&lt;br /&gt;
|-&lt;br /&gt;
| p5 || 137M || GNU sysroot — gcc-3.4.4 / glibc-2.3.5, PPC cross toolchain&lt;br /&gt;
|-&lt;br /&gt;
| p6 || 1.1M || &#039;&#039;&#039;Firmware&#039;&#039;&#039; — adtec/RD-60/1.12.08 and 1.12.12&lt;br /&gt;
|-&lt;br /&gt;
| p7 || 3.4M || Minimal initrd (busybox, bash, minimal libs)&lt;br /&gt;
|-&lt;br /&gt;
| p8 || 24M || Runtime/data (logs, DVC profiles, media)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
* Current firmware: &#039;&#039;&#039;1.12.12&#039;&#039;&#039; (symlinked at &amp;lt;code&amp;gt;/opt/pkg/oem&amp;lt;/code&amp;gt;)&lt;br /&gt;
* Previous firmware: &#039;&#039;&#039;1.12.08&#039;&#039;&#039; (symlinked at &amp;lt;code&amp;gt;/opt/pkg/oem_prev&amp;lt;/code&amp;gt;)&lt;br /&gt;
&lt;br /&gt;
=== p8 Runtime Directories ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Dir !! Purpose&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;dvc/&amp;lt;/code&amp;gt; || Tuner device profile files (.DVC)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;keys/&amp;lt;/code&amp;gt; || Empty — key material generated at runtime&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;log/&amp;lt;/code&amp;gt; || Rotated system logs&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;media/&amp;lt;/code&amp;gt; || Media files&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;.meta/&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;freg.db&amp;lt;/code&amp;gt; — feature registry SQLite DB&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;mvl/&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;osd/&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;rdy/&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;schmi/&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;shd/&amp;lt;/code&amp;gt; || Runtime state dirs (mostly empty)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Key Binaries (&amp;lt;code&amp;gt;/usr/local/sbin/&amp;lt;/code&amp;gt;) ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Binary !! Purpose&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;sysd&amp;lt;/code&amp;gt; || Main system daemon — tuner/demodulator config via XML&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;cmdld&amp;lt;/code&amp;gt; || Telnet API daemon (3 processes)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;menud&amp;lt;/code&amp;gt; || Front panel menu daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;fregd&amp;lt;/code&amp;gt; || Feature/license registry daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;dtrans&amp;lt;/code&amp;gt; || TS transport handler (&amp;lt;code&amp;gt;--slot=2 --id=BA14&amp;lt;/code&amp;gt;)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;dcmd&amp;lt;/code&amp;gt; || Device command interface for BA14&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;myles&amp;lt;/code&amp;gt; || Web API backend (SQLite)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;requestHandler&amp;lt;/code&amp;gt; || Apache CGI/FastCGI handler&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;snmpd&amp;lt;/code&amp;gt; || SNMP daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;snmpl&amp;lt;/code&amp;gt; || Internal SNMP poller — continuously queries Newtec MIB&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;vtosfifo&amp;lt;/code&amp;gt; || TS-to-FIFO bridge to &amp;lt;code&amp;gt;/dev/vtosfifo4&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;xcpServerd&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;xcpClientd&amp;lt;/code&amp;gt; || XCP protocol daemons (3 each)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;pard&amp;lt;/code&amp;gt; || Parallel interface daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;pnpd&amp;lt;/code&amp;gt; || PnP device daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;mirror&amp;lt;/code&amp;gt; || Mirror/redundancy daemon (runs as adtec)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Kernel Modules ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Module !! Purpose&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;newtec&amp;lt;/code&amp;gt; || Newtec 7044 demodulator driver — core BBFrame driver&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;newtec_dummy&amp;lt;/code&amp;gt; || Stub for absent optional demodulator hardware&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;dvblite&amp;lt;/code&amp;gt; || DVB lite core (depends on newtec) — exposes &amp;lt;code&amp;gt;dvblite_ioctl&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;rmcp_i2c&amp;lt;/code&amp;gt; || I2C transport for Newtec RMCP protocol&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;vtosfifo&amp;lt;/code&amp;gt; || TS FIFO device driver&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;rddma_ip&amp;lt;/code&amp;gt; || &#039;&#039;&#039;IP-over-satellite receive DMA engine (FPGA-backed)&#039;&#039;&#039;&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;ip_ingress_main&amp;lt;/code&amp;gt; || IP ingress pipeline (GSE/MPE over satellite)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;frpanel&amp;lt;/code&amp;gt; || Front panel driver&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;fanctrl&amp;lt;/code&amp;gt; / &amp;lt;code&amp;gt;pc96&amp;lt;/code&amp;gt; || Fan controller&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;proxyimg&amp;lt;/code&amp;gt; || Image proxy&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;epb&amp;lt;/code&amp;gt; || EPB bus driver&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;pnp&amp;lt;/code&amp;gt; || PnP device manager&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;fec&amp;lt;/code&amp;gt; / &amp;lt;code&amp;gt;ethfrm&amp;lt;/code&amp;gt; || Ethernet/FEC&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;pc73a&amp;lt;/code&amp;gt; / &amp;lt;code&amp;gt;pc93&amp;lt;/code&amp;gt; || Front panel dependencies&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Failed to load (hardware absent): &amp;lt;code&amp;gt;teamcast&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;nim&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;lnb_pwr&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;pc72&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Device Nodes ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Device !! Purpose&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/dvblite0-2&amp;lt;/code&amp;gt; || DVB lite interfaces&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/vtosfifo0-5&amp;lt;/code&amp;gt; || TS FIFO char devices (major 240)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/tuner0-3&amp;lt;/code&amp;gt; || Tuner interfaces (major 123)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/tuner_ledgr0-3&amp;lt;/code&amp;gt; || Tuner lock (green) LEDs&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/tuner_ledrd0-3&amp;lt;/code&amp;gt; || Tuner read LEDs&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/tuner_rst0-3&amp;lt;/code&amp;gt; || Tuner resets&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/ntmod&amp;lt;/code&amp;gt; || Newtec modulator — &#039;&#039;&#039;not populated&#039;&#039;&#039;&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== /proc Driver Interfaces ==&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;/proc/driver/dvblite/fe0/info&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
NAME=NTC/7044/BB DVB Demodulator&lt;br /&gt;
FREQ_MIN=950000 / FREQ_MAX=2150000&lt;br /&gt;
SYMRATE_MIN=256000 / SYMRATE_MAX=45000000&lt;br /&gt;
S_QPSK=1/2, 2/3, 3/4, 5/6, 6/7, 7/8, AUTO&lt;br /&gt;
S_8PSK=2/3, 5/6, 8/9, AUTO&lt;br /&gt;
S2_QPSK=1/4, 1/3, 1/2, 2/5, 2/3, 3/5, 3/4, 4/5, 5/6, 8/9, 9/10&lt;br /&gt;
S2_8PSK=2/3, 3/5, 3/4, 5/6, 8/9, 9/10&lt;br /&gt;
S2_16QAM=3/4, 7/8, AUTO&lt;br /&gt;
S2_16APSK=2/3, 3/4, 4/5, 5/6, 8/9, 9/10&lt;br /&gt;
S2_32APSK=3/4, 4/5, 5/6, 8/9, 9/10&lt;br /&gt;
SOFTWARE_LICENSE=165&lt;br /&gt;
SOFTWARE_VERSION=v2.34   20/03/13&lt;br /&gt;
FPGA_BITFILE_VERSION=v1.01 09/01/12&lt;br /&gt;
HARDWARE_VERSION=v3.0&lt;br /&gt;
SERIAL_NUM=30091216&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;/proc/driver/dvblite/fe0/stats&amp;lt;/code&amp;gt; (no signal) ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
LOCK=UNLOCKED&lt;br /&gt;
RECV_LEVEL=-70.00&lt;br /&gt;
INTRATE=41470588&lt;br /&gt;
MOD_FEC=QPSK_3/4&lt;br /&gt;
BB_CRC_ERRORS=N/A        &amp;lt;- populates with live signal&lt;br /&gt;
DUMMY_PL_RATIO=N/A       &amp;lt;- populates with live signal&lt;br /&gt;
ISI_FILTER_BYTE=N/A      &amp;lt;- populates with live signal&lt;br /&gt;
BASEBAND_LEN=N/A         &amp;lt;- populates with live signal&lt;br /&gt;
FRAMES_SEC=N/A           &amp;lt;- populates with live signal&lt;br /&gt;
ALARMS=0000110001011000&lt;br /&gt;
STATE=READY&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
fe1 has same structure but &amp;lt;code&amp;gt;NAME=NTC7044&amp;lt;/code&amp;gt; (no BB suffix, no license).&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;/proc/driver/vtosfifo/chn&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
Channel 0 processed 16620 TS frames during session. Channel 4 processed 1619.&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;/proc/driver/rddma/&amp;lt;/code&amp;gt; — FPGA DMA engine ===&lt;br /&gt;
&lt;br /&gt;
* Channel 3 active: Control=&amp;lt;code&amp;gt;49C003C0&amp;lt;/code&amp;gt;, Src=&amp;lt;code&amp;gt;03F01C00&amp;lt;/code&amp;gt; (FPGA mapped)&lt;br /&gt;
* 3.98M timer IRQs, 3.98M &amp;quot;No Data&amp;quot; — idle, no satellite IP stream&lt;br /&gt;
* PID &amp;lt;code&amp;gt;0x01E1&amp;lt;/code&amp;gt; (481) being tracked&lt;br /&gt;
&lt;br /&gt;
== Kernel Module Internals (&amp;lt;code&amp;gt;strings&amp;lt;/code&amp;gt; analysis) ==&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;newtec.ko&amp;lt;/code&amp;gt; — BBFrame symbols ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
BB_CRC_ERRORS / BB_CRC_ERRORS_CURRENT / BB_CRC_ERRORS_NEXT&lt;br /&gt;
BB_DATA_FIELD_LEN / BB_DATA_FIELD_LEN_CURRENT / BB_DATA_FIELD_LEN_NEXT&lt;br /&gt;
BB_FRAMES&lt;br /&gt;
BB_GAIN / BB_GAIN_CURRENT / BB_GAIN_NEXT&lt;br /&gt;
BASEBAND_LEN&lt;br /&gt;
ISI / ISI_CTRL / ISI_CTRL_STRUCT / ISI_CTRL_STRUCT_FIELDS&lt;br /&gt;
ISI_FILTER_BYTE / ISI_MASK&lt;br /&gt;
SAT_BB_GAIN&lt;br /&gt;
ntc_debug  (module param, uint)&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;BB_DATA_FIELD_LEN&amp;lt;/code&amp;gt; and &amp;lt;code&amp;gt;BB_FRAMES&amp;lt;/code&amp;gt; suggest the driver tracks individual baseband frames, not just statistics. Very promising for BBFrame capture.&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;dvblite.ko&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
Contains &amp;lt;code&amp;gt;dvblite_ioctl&amp;lt;/code&amp;gt; — a kernel ioctl interface on &amp;lt;code&amp;gt;/dev/dvblite0&amp;lt;/code&amp;gt;. Commands unknown — to be investigated with a live signal.&lt;br /&gt;
&lt;br /&gt;
== Network Services ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Service !! Port !! Notes&lt;br /&gt;
|-&lt;br /&gt;
| SSH || 22 || Legacy KEX only (diffie-hellman-group1-sha1)&lt;br /&gt;
|-&lt;br /&gt;
| Telnet API || 23 || &amp;lt;code&amp;gt;cmdld&amp;lt;/code&amp;gt; via xinetd&lt;br /&gt;
|-&lt;br /&gt;
| FTP || 21 || pure-ftpd&lt;br /&gt;
|-&lt;br /&gt;
| HTTP || 80 || Apache + myles + requestHandler&lt;br /&gt;
|-&lt;br /&gt;
| SNMP || 161 || Community &amp;lt;code&amp;gt;public&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| mDNS || 5353 || &amp;lt;code&amp;gt;GOFFERT.local&amp;lt;/code&amp;gt;&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
# SSH/SCP&lt;br /&gt;
ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa root@&amp;lt;ip&amp;gt;&lt;br /&gt;
scp -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa root@&amp;lt;ip&amp;gt;:/path /local&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Credentials (Default/Hardcoded — ZSL-2020-5603 / ExploitDB 48954) ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! User !! Password !! Notes&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;root&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;1root!&amp;lt;/code&amp;gt; || Full root SSH&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;admin&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;1admin!&amp;lt;/code&amp;gt; || Also root via sudoers&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;adtec&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;none&amp;lt;/code&amp;gt; || Telnet API / web UI&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;adtecftp&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;adtecftp2231&amp;lt;/code&amp;gt; || FTP only&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
* Password hashes: DES crypt — crackable in seconds with &amp;lt;code&amp;gt;john&amp;lt;/code&amp;gt;&lt;br /&gt;
* &amp;lt;code&amp;gt;apache ALL=(ALL) NOPASSWD: ALL&amp;lt;/code&amp;gt; in sudoers&lt;br /&gt;
* Diagnostic package passphrase: &#039;&#039;&#039;&amp;lt;code&amp;gt;iMoo3jio&amp;lt;/code&amp;gt;&#039;&#039;&#039; (hardcoded, leaks in &amp;lt;code&amp;gt;ps aux&amp;lt;/code&amp;gt;)&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
gpg --passphrase &amp;quot;iMoo3jio&amp;quot; --batch --ignore-mdc-error --decrypt RD-60_*.tar.gpg | tar xf -&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== APIs ==&lt;br /&gt;
&lt;br /&gt;
=== Telnet API ===&lt;br /&gt;
&lt;br /&gt;
Connect: &amp;lt;code&amp;gt;telnet &amp;lt;ip&amp;gt;&amp;lt;/code&amp;gt;, login &amp;lt;code&amp;gt;adtec&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;none&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
*.SYSD SHELLCMD &amp;lt;cmd&amp;gt;          # arbitrary root shell execution!&lt;br /&gt;
*.SNMP ADTEC-NT-DEMOD-MIB::satFeedType.0 = dvbs2   # configure tuner&lt;br /&gt;
*.SNMP ADTEC-NT-DEMOD-MIB::satFeedDownlink.0 = 10960000&lt;br /&gt;
*.SNMP .1.3.6.1.4.1.19587.6000.3.999.0 i 0         # commit/apply&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== SNMP — Newtec Demodulator MIB ===&lt;br /&gt;
&lt;br /&gt;
OID base: &amp;lt;code&amp;gt;.1.3.6.1.4.1.19587&amp;lt;/code&amp;gt;, MIB: &amp;lt;code&amp;gt;ADTEC-NT-DEMOD-MIB&amp;lt;/code&amp;gt;, community: &amp;lt;code&amp;gt;public&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
snmpwalk -v2c -c public &amp;lt;ip&amp;gt; .1.3.6.1.4.1.19587&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Key OIDs: &amp;lt;code&amp;gt;tunerLock&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;recvLevel&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;esNo&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;linkMargin&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;modFec&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;rolloff&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;pilot&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;fecFrameType&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;unCorrFs&amp;lt;/code&amp;gt;, &#039;&#039;&#039;&amp;lt;code&amp;gt;bbCrcerrors&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &#039;&#039;&#039;&amp;lt;code&amp;gt;basebandLen&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &#039;&#039;&#039;&amp;lt;code&amp;gt;dummyPlRatio&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &#039;&#039;&#039;&amp;lt;code&amp;gt;isiFilterByte&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &#039;&#039;&#039;&amp;lt;code&amp;gt;framesSec&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &amp;lt;code&amp;gt;satFeedType&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;satFeedDownlink&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;satFeedSymRate&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;satFeedModulation&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;lnbEnable&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;lnbPolarity&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;lnbTone&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== DVC Profile Format ===&lt;br /&gt;
&lt;br /&gt;
SNMP SET commands as tuner presets, applied via Telnet API or web UI.&lt;br /&gt;
&lt;br /&gt;
== Saved Tuner Profiles ==&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;prfturktest.DVC&amp;lt;/code&amp;gt; (2018-04-28) ===&lt;br /&gt;
&lt;br /&gt;
* DVB-S, &#039;&#039;&#039;10762 MHz&#039;&#039;&#039;, KU 9750 LO → &#039;&#039;&#039;1012 MHz&#039;&#039;&#039; L-band&lt;br /&gt;
* &#039;&#039;&#039;30 MSym/s&#039;&#039;&#039;, QPSK 3/4, roll-off 35%&lt;br /&gt;
* Was &#039;&#039;&#039;LOCKED&#039;&#039;&#039; at -32 dBm when saved&lt;br /&gt;
* &amp;lt;code&amp;gt;bbCrcerrors = 1&amp;lt;/code&amp;gt; — &#039;&#039;&#039;BBFrame counter was active and non-zero!&#039;&#039;&#039;&lt;br /&gt;
* Likely &#039;&#039;&#039;Türksat 42°E&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;prfMUX.DVC&amp;lt;/code&amp;gt; (2018-04-28) ===&lt;br /&gt;
&lt;br /&gt;
* DVB-S2, &#039;&#039;&#039;10960 MHz&#039;&#039;&#039;, KU 9750 LO → &#039;&#039;&#039;1210 MHz&#039;&#039;&#039; L-band&lt;br /&gt;
* &#039;&#039;&#039;8.352 MSym/s&#039;&#039;&#039;, 16APSK 2/3, roll-off 20%, pilot ON, normal frames, CCM&lt;br /&gt;
* Was unlocked when saved&lt;br /&gt;
&lt;br /&gt;
== Licensed Features (Key ID 165) ==&lt;br /&gt;
&lt;br /&gt;
DVB-DSNG + DVB-S2 + QPSK + 8-PSK + 16-QAM/16APSK + 32APSK + Symbol Rate &amp;lt;= 33 MBaud + ACM + &#039;&#039;&#039;Single TS/GS or Multiple Streams&#039;&#039;&#039; + &#039;&#039;&#039;(Baseband Frames)&#039;&#039;&#039; + no ACM client + no AES&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;BBFrame access is explicitly licensed and enabled.&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
== Encryption / CA ==&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;BISS-1 key&#039;&#039;&#039; in &amp;lt;code&amp;gt;dtrans.xml&amp;lt;/code&amp;gt;: &amp;lt;code&amp;gt;69A969BBECA0&amp;lt;/code&amp;gt;&lt;br /&gt;
* &#039;&#039;&#039;Viaccess&#039;&#039;&#039; (CA ID 0x0005) feed seen in logs — no card present, could not decrypt&lt;br /&gt;
&lt;br /&gt;
== IP-over-Satellite ==&lt;br /&gt;
&lt;br /&gt;
The unit has a full satellite IP receive stack beyond TS decoding:&lt;br /&gt;
&lt;br /&gt;
* &amp;lt;code&amp;gt;rddma_ip&amp;lt;/code&amp;gt; — FPGA-backed DMA for IP-from-satellite&lt;br /&gt;
* &amp;lt;code&amp;gt;ip_ingress_main&amp;lt;/code&amp;gt; — GSE/MPE ingress pipeline&lt;br /&gt;
* FPGA Channel 3 active at &amp;lt;code&amp;gt;03F01C00&amp;lt;/code&amp;gt;&lt;br /&gt;
* Currently idle — no GSE/MPE stream configured&lt;br /&gt;
&lt;br /&gt;
== Security Summary ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Issue !! Detail&lt;br /&gt;
|-&lt;br /&gt;
| Default root creds || &amp;lt;code&amp;gt;root&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;1root!&amp;lt;/code&amp;gt; over SSH&lt;br /&gt;
|-&lt;br /&gt;
| Telnet RCE || &amp;lt;code&amp;gt;*.SYSD SHELLCMD&amp;lt;/code&amp;gt; = root shell with &amp;lt;code&amp;gt;adtec&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;none&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Sudoers || &amp;lt;code&amp;gt;apache ALL=(ALL) NOPASSWD: ALL&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Shared SSH host keys || Same across all units (stored on CF card)&lt;br /&gt;
|-&lt;br /&gt;
| Weak password hashes || DES crypt, trivially crackable&lt;br /&gt;
|-&lt;br /&gt;
| GPG passphrase leak || &amp;lt;code&amp;gt;iMoo3jio&amp;lt;/code&amp;gt; visible in &amp;lt;code&amp;gt;ps aux&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Public exploit || ZSL-2020-5603 / ExploitDB 48954&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Other ==&lt;br /&gt;
== Front Panel ==&lt;br /&gt;
&lt;br /&gt;
* Driver: &amp;lt;code&amp;gt;frpanel.ko&amp;lt;/code&amp;gt; (depends on &amp;lt;code&amp;gt;pc93&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;pc73a&amp;lt;/code&amp;gt;)&lt;br /&gt;
* Device nodes: &amp;lt;code&amp;gt;/dev/frpanel0&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;/dev/frpanel1&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;/dev/frpanel2&amp;lt;/code&amp;gt;&lt;br /&gt;
* Display: 2 rows × 40 columns character LCD (PC93 I2C MCU)&lt;br /&gt;
* LCD API in &amp;lt;code&amp;gt;libsolib.so&amp;lt;/code&amp;gt;: &amp;lt;code&amp;gt;FpLcdKpInit()&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;LcdClear()&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;LcdWriteStr(char*, pos, len)&amp;lt;/code&amp;gt;&lt;br /&gt;
* Writing to &amp;lt;code&amp;gt;/dev/frpanel2&amp;lt;/code&amp;gt; activates the backlight&lt;br /&gt;
* &amp;lt;code&amp;gt;menud&amp;lt;/code&amp;gt; daemon owns the display — must be stopped before direct writes&lt;br /&gt;
* Proc interface: &amp;lt;code&amp;gt;/proc/driver/frpanel/&amp;lt;/code&amp;gt; (rows, cols, screen, type, version, access)&lt;br /&gt;
&lt;br /&gt;
== Images ==&lt;br /&gt;
&amp;lt;gallery&amp;gt;&lt;br /&gt;
Adtec_rd60_internals_overview.jpg&lt;br /&gt;
Adtec_rd60_internals1.jpg&lt;br /&gt;
Adtec_rd60_internals2.jpg&lt;br /&gt;
Adtec_rd60_internals3.jpg&lt;br /&gt;
Adtec_rd60_internals4.jpg&lt;br /&gt;
Adtec_rd60_internals5.jpg&lt;br /&gt;
&amp;lt;/gallery&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== TODO (requires dish connected) ==&lt;br /&gt;
&lt;br /&gt;
* [ ] Read &amp;lt;code&amp;gt;/proc/driver/dvblite/fe0/stats&amp;lt;/code&amp;gt; with live signal — observe all BB* fields&lt;br /&gt;
* [ ] SNMP walk full &amp;lt;code&amp;gt;.1.3.6.1.4.1.19587&amp;lt;/code&amp;gt; with live signal&lt;br /&gt;
* [ ] Investigate &amp;lt;code&amp;gt;dvblite_ioctl&amp;lt;/code&amp;gt; on &amp;lt;code&amp;gt;/dev/dvblite0&amp;lt;/code&amp;gt;&lt;br /&gt;
* [ ] Enable &amp;lt;code&amp;gt;ntc_debug&amp;lt;/code&amp;gt; module param and watch dmesg&lt;br /&gt;
* [ ] Try ISI multistream filtering via SNMP SET&lt;br /&gt;
* [ ] Investigate &amp;lt;code&amp;gt;rddma_ip&amp;lt;/code&amp;gt; with GSE/MPE satellite signal&lt;br /&gt;
* [ ] Lock on Türksat 42°E: 10762 MHz / 30 MSym/s / QPSK 3/4 (known working)&lt;br /&gt;
* [ ] Identify prfMUX transponder on Lyngsat (10960 MHz / 8.352 MSym/s / 16APSK 2/3)&lt;br /&gt;
* [ ] Explore Telnet API &amp;lt;code&amp;gt;*.NTC&amp;lt;/code&amp;gt; command namespace&lt;br /&gt;
* [ ] Investigate &amp;lt;code&amp;gt;xcpServerd&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;xcpClientd&amp;lt;/code&amp;gt; — XCP protocol capabilities&lt;br /&gt;
* [ ] Check if &amp;lt;code&amp;gt;schnv.DVC&amp;lt;/code&amp;gt; populates after a lock (empty offline)&lt;br /&gt;
* [ ] Read &amp;lt;code&amp;gt;freg.db&amp;lt;/code&amp;gt; contents — full feature registry dump&lt;br /&gt;
* [ ] Write to LCD display — cross-compile against glibc 2.3.5 and call &amp;lt;code&amp;gt;LcdWriteStr()&amp;lt;/code&amp;gt; from &amp;lt;code&amp;gt;libsolib.so&amp;lt;/code&amp;gt;&lt;br /&gt;
* [ ] Send RMCP command via &amp;lt;code&amp;gt;rmcp_i2c&amp;lt;/code&amp;gt; to switch NTC/7044/BB output to BBFrame mode&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=Adtec_RD-60&amp;diff=15910</id>
		<title>Adtec RD-60</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=Adtec_RD-60&amp;diff=15910"/>
		<updated>2026-04-11T23:32:10Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=Adtec RD-60&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Sdr&lt;br /&gt;
|Tool=No&lt;br /&gt;
|Location=the roof&lt;br /&gt;
}}&lt;br /&gt;
== Adtec RD-60 IRD ==&lt;br /&gt;
The &#039;&#039;&#039;Adtec RD-60&#039;&#039;&#039; is a 1RU integrated receiver/decoder (IRD).&lt;br /&gt;
&lt;br /&gt;
It seems the Adtec RD-60 might expose &#039;&#039;&#039;DVB-S2 baseband frames (BBFrames)&#039;&#039;&#039; below the TS layer, this might be very useful as part of the &#039;&#039;&#039;dontlookup&#039;&#039;&#039; satellite interception paper replication project. See [[dontlookup]]&lt;br /&gt;
&lt;br /&gt;
= Reverse Engineering Notes =&lt;br /&gt;
== Hardware ==&lt;br /&gt;
[[File:Adtec_rd60_internals_overview.jpg|thumb|center]]&lt;br /&gt;
=== Main Unit ===&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;Model:&#039;&#039;&#039; Adtec RD-60 MultiCODEC Receiver/Decoder (IRD)&lt;br /&gt;
* &#039;&#039;&#039;Hostname:&#039;&#039;&#039; &amp;lt;code&amp;gt;GOFFERT&amp;lt;/code&amp;gt;&lt;br /&gt;
* &#039;&#039;&#039;IP:&#039;&#039;&#039; 10.1.2.172 (DHCP)&lt;br /&gt;
* &#039;&#039;&#039;CPU:&#039;&#039;&#039; IBM PowerPC PPC405GPr @ 399 MHz (GemPPC Iolite platform)&lt;br /&gt;
* &#039;&#039;&#039;PLB bus:&#039;&#039;&#039; 133 MHz | &#039;&#039;&#039;PCI bus:&#039;&#039;&#039; 33 MHz&lt;br /&gt;
* &#039;&#039;&#039;Kernel:&#039;&#039;&#039; Linux 2.6.14-gemppc-iolite&lt;br /&gt;
* &#039;&#039;&#039;Front panel:&#039;&#039;&#039; Character LCD/VFD — text only, ~40 chars wide.&lt;br /&gt;
* &#039;&#039;&#039;Storage:&#039;&#039;&#039; CompactFlash card (8 partitions, 4 used)&lt;br /&gt;
&lt;br /&gt;
=== Demodulator Board ===&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;Slot 2:&#039;&#039;&#039; &amp;lt;code&amp;gt;BA14&amp;lt;/code&amp;gt; — PC87 ver 1.4 (main decoder board)&lt;br /&gt;
* &#039;&#039;&#039;Slot 99:&#039;&#039;&#039; &amp;lt;code&amp;gt;7044BB&amp;lt;/code&amp;gt; — &#039;&#039;&#039;Newtec NTC/7044/BB DVB Demodulator&#039;&#039;&#039;&lt;br /&gt;
** PRM firmware: &#039;&#039;&#039;v2.34&#039;&#039;&#039; (20/03/13)&lt;br /&gt;
** FPGA bitfile: v1.01 (09/01/12)&lt;br /&gt;
** Hardware: v3.0&lt;br /&gt;
** Serial: &#039;&#039;&#039;30091216&#039;&#039;&#039;&lt;br /&gt;
** Software ID: NTC/6381 DVB Demodulator&lt;br /&gt;
** Product ID: NTC/7044/BB.BCDCBCAA.x.B&lt;br /&gt;
** License: &#039;&#039;&#039;165&#039;&#039;&#039; (includes Baseband Frames — see below)&lt;br /&gt;
** Communicates via I2C (&amp;lt;code&amp;gt;rmcp_i2c&amp;lt;/code&amp;gt; kernel module)&lt;br /&gt;
** &amp;lt;code&amp;gt;BB&amp;lt;/code&amp;gt; suffix = BaseBand licensed and capable&lt;br /&gt;
&lt;br /&gt;
According to the official Newtec datasheet, the NTC/7044/BB supports explicit &#039;&#039;&#039;output mode switching&#039;&#039;&#039; between:&lt;br /&gt;
* Single transport stream&lt;br /&gt;
* Generic stream  &lt;br /&gt;
* &#039;&#039;&#039;Base Band Frames&#039;&#039;&#039; (BBFrames)&lt;br /&gt;
&lt;br /&gt;
The control interface is &#039;&#039;&#039;RMCPv2 protocol&#039;&#039;&#039; over async serial TTL or I2C — implemented by the &amp;lt;code&amp;gt;rmcp_i2c&amp;lt;/code&amp;gt; kernel module. &lt;br /&gt;
This is the mechanism to switch output to BBFrame mode.&lt;br /&gt;
&lt;br /&gt;
See also this PDF: https://www.melcom.co.uk/uploads/newdvbdemodntc7044_01.pdf&lt;br /&gt;
RMCP protocol docs: https://newerasystems.net/wp-content/uploads/2017/02/RMCP-Manual-1_8.pdf&lt;br /&gt;
&lt;br /&gt;
[[File:20250429 153804.jpg|thumb|center]]&lt;br /&gt;
&lt;br /&gt;
=== Inputs/Outputs ===&lt;br /&gt;
&lt;br /&gt;
* 2x RF/satellite inputs (RF1, RF2) — 950–2150 MHz, 256 kSym/s – 45 MSym/s&lt;br /&gt;
* DVB-ASI input/output (currently set to RECEIVE mode)&lt;br /&gt;
* 2x SDI outputs (SD scaling)&lt;br /&gt;
* CVBS output&lt;br /&gt;
* 3x Ethernet (eth0, eth1, eth2)&lt;br /&gt;
* Serial: ttyS0 @ 115200, ttyBA&lt;br /&gt;
* L-Band Modulator option slot — &#039;&#039;&#039;not populated&#039;&#039;&#039; (&amp;lt;code&amp;gt;/dev/ntmod&amp;lt;/code&amp;gt; = &amp;quot;No such device&amp;quot;)&lt;br /&gt;
&lt;br /&gt;
== Firmware / Software ==&lt;br /&gt;
&lt;br /&gt;
=== CF Card Partition Layout ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Partition !! Size !! Contents&lt;br /&gt;
|-&lt;br /&gt;
| p5 || 137M || GNU sysroot — gcc-3.4.4 / glibc-2.3.5, PPC cross toolchain&lt;br /&gt;
|-&lt;br /&gt;
| p6 || 1.1M || &#039;&#039;&#039;Firmware&#039;&#039;&#039; — adtec/RD-60/1.12.08 and 1.12.12&lt;br /&gt;
|-&lt;br /&gt;
| p7 || 3.4M || Minimal initrd (busybox, bash, minimal libs)&lt;br /&gt;
|-&lt;br /&gt;
| p8 || 24M || Runtime/data (logs, DVC profiles, media)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
* Current firmware: &#039;&#039;&#039;1.12.12&#039;&#039;&#039; (symlinked at &amp;lt;code&amp;gt;/opt/pkg/oem&amp;lt;/code&amp;gt;)&lt;br /&gt;
* Previous firmware: &#039;&#039;&#039;1.12.08&#039;&#039;&#039; (symlinked at &amp;lt;code&amp;gt;/opt/pkg/oem_prev&amp;lt;/code&amp;gt;)&lt;br /&gt;
&lt;br /&gt;
=== p8 Runtime Directories ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Dir !! Purpose&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;dvc/&amp;lt;/code&amp;gt; || Tuner device profile files (.DVC)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;keys/&amp;lt;/code&amp;gt; || Empty — key material generated at runtime&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;log/&amp;lt;/code&amp;gt; || Rotated system logs&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;media/&amp;lt;/code&amp;gt; || Media files&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;.meta/&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;freg.db&amp;lt;/code&amp;gt; — feature registry SQLite DB&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;mvl/&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;osd/&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;rdy/&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;schmi/&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;shd/&amp;lt;/code&amp;gt; || Runtime state dirs (mostly empty)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Key Binaries (&amp;lt;code&amp;gt;/usr/local/sbin/&amp;lt;/code&amp;gt;) ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Binary !! Purpose&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;sysd&amp;lt;/code&amp;gt; || Main system daemon — tuner/demodulator config via XML&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;cmdld&amp;lt;/code&amp;gt; || Telnet API daemon (3 processes)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;menud&amp;lt;/code&amp;gt; || Front panel menu daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;fregd&amp;lt;/code&amp;gt; || Feature/license registry daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;dtrans&amp;lt;/code&amp;gt; || TS transport handler (&amp;lt;code&amp;gt;--slot=2 --id=BA14&amp;lt;/code&amp;gt;)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;dcmd&amp;lt;/code&amp;gt; || Device command interface for BA14&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;myles&amp;lt;/code&amp;gt; || Web API backend (SQLite)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;requestHandler&amp;lt;/code&amp;gt; || Apache CGI/FastCGI handler&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;snmpd&amp;lt;/code&amp;gt; || SNMP daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;snmpl&amp;lt;/code&amp;gt; || Internal SNMP poller — continuously queries Newtec MIB&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;vtosfifo&amp;lt;/code&amp;gt; || TS-to-FIFO bridge to &amp;lt;code&amp;gt;/dev/vtosfifo4&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;xcpServerd&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;xcpClientd&amp;lt;/code&amp;gt; || XCP protocol daemons (3 each)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;pard&amp;lt;/code&amp;gt; || Parallel interface daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;pnpd&amp;lt;/code&amp;gt; || PnP device daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;mirror&amp;lt;/code&amp;gt; || Mirror/redundancy daemon (runs as adtec)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Kernel Modules ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Module !! Purpose&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;newtec&amp;lt;/code&amp;gt; || Newtec 7044 demodulator driver — core BBFrame driver&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;newtec_dummy&amp;lt;/code&amp;gt; || Stub for absent optional demodulator hardware&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;dvblite&amp;lt;/code&amp;gt; || DVB lite core (depends on newtec) — exposes &amp;lt;code&amp;gt;dvblite_ioctl&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;rmcp_i2c&amp;lt;/code&amp;gt; || I2C transport for Newtec RMCP protocol&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;vtosfifo&amp;lt;/code&amp;gt; || TS FIFO device driver&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;rddma_ip&amp;lt;/code&amp;gt; || &#039;&#039;&#039;IP-over-satellite receive DMA engine (FPGA-backed)&#039;&#039;&#039;&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;ip_ingress_main&amp;lt;/code&amp;gt; || IP ingress pipeline (GSE/MPE over satellite)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;frpanel&amp;lt;/code&amp;gt; || Front panel driver&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;fanctrl&amp;lt;/code&amp;gt; / &amp;lt;code&amp;gt;pc96&amp;lt;/code&amp;gt; || Fan controller&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;proxyimg&amp;lt;/code&amp;gt; || Image proxy&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;epb&amp;lt;/code&amp;gt; || EPB bus driver&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;pnp&amp;lt;/code&amp;gt; || PnP device manager&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;fec&amp;lt;/code&amp;gt; / &amp;lt;code&amp;gt;ethfrm&amp;lt;/code&amp;gt; || Ethernet/FEC&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;pc73a&amp;lt;/code&amp;gt; / &amp;lt;code&amp;gt;pc93&amp;lt;/code&amp;gt; || Front panel dependencies&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Failed to load (hardware absent): &amp;lt;code&amp;gt;teamcast&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;nim&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;lnb_pwr&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;pc72&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Device Nodes ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Device !! Purpose&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/dvblite0-2&amp;lt;/code&amp;gt; || DVB lite interfaces&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/vtosfifo0-5&amp;lt;/code&amp;gt; || TS FIFO char devices (major 240)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/tuner0-3&amp;lt;/code&amp;gt; || Tuner interfaces (major 123)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/tuner_ledgr0-3&amp;lt;/code&amp;gt; || Tuner lock (green) LEDs&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/tuner_ledrd0-3&amp;lt;/code&amp;gt; || Tuner read LEDs&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/tuner_rst0-3&amp;lt;/code&amp;gt; || Tuner resets&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/ntmod&amp;lt;/code&amp;gt; || Newtec modulator — &#039;&#039;&#039;not populated&#039;&#039;&#039;&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== /proc Driver Interfaces ==&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;/proc/driver/dvblite/fe0/info&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
NAME=NTC/7044/BB DVB Demodulator&lt;br /&gt;
FREQ_MIN=950000 / FREQ_MAX=2150000&lt;br /&gt;
SYMRATE_MIN=256000 / SYMRATE_MAX=45000000&lt;br /&gt;
S_QPSK=1/2, 2/3, 3/4, 5/6, 6/7, 7/8, AUTO&lt;br /&gt;
S_8PSK=2/3, 5/6, 8/9, AUTO&lt;br /&gt;
S2_QPSK=1/4, 1/3, 1/2, 2/5, 2/3, 3/5, 3/4, 4/5, 5/6, 8/9, 9/10&lt;br /&gt;
S2_8PSK=2/3, 3/5, 3/4, 5/6, 8/9, 9/10&lt;br /&gt;
S2_16QAM=3/4, 7/8, AUTO&lt;br /&gt;
S2_16APSK=2/3, 3/4, 4/5, 5/6, 8/9, 9/10&lt;br /&gt;
S2_32APSK=3/4, 4/5, 5/6, 8/9, 9/10&lt;br /&gt;
SOFTWARE_LICENSE=165&lt;br /&gt;
SOFTWARE_VERSION=v2.34   20/03/13&lt;br /&gt;
FPGA_BITFILE_VERSION=v1.01 09/01/12&lt;br /&gt;
HARDWARE_VERSION=v3.0&lt;br /&gt;
SERIAL_NUM=30091216&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;/proc/driver/dvblite/fe0/stats&amp;lt;/code&amp;gt; (no signal) ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
LOCK=UNLOCKED&lt;br /&gt;
RECV_LEVEL=-70.00&lt;br /&gt;
INTRATE=41470588&lt;br /&gt;
MOD_FEC=QPSK_3/4&lt;br /&gt;
BB_CRC_ERRORS=N/A        &amp;lt;- populates with live signal&lt;br /&gt;
DUMMY_PL_RATIO=N/A       &amp;lt;- populates with live signal&lt;br /&gt;
ISI_FILTER_BYTE=N/A      &amp;lt;- populates with live signal&lt;br /&gt;
BASEBAND_LEN=N/A         &amp;lt;- populates with live signal&lt;br /&gt;
FRAMES_SEC=N/A           &amp;lt;- populates with live signal&lt;br /&gt;
ALARMS=0000110001011000&lt;br /&gt;
STATE=READY&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
fe1 has same structure but &amp;lt;code&amp;gt;NAME=NTC7044&amp;lt;/code&amp;gt; (no BB suffix, no license).&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;/proc/driver/vtosfifo/chn&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
Channel 0 processed 16620 TS frames during session. Channel 4 processed 1619.&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;/proc/driver/rddma/&amp;lt;/code&amp;gt; — FPGA DMA engine ===&lt;br /&gt;
&lt;br /&gt;
* Channel 3 active: Control=&amp;lt;code&amp;gt;49C003C0&amp;lt;/code&amp;gt;, Src=&amp;lt;code&amp;gt;03F01C00&amp;lt;/code&amp;gt; (FPGA mapped)&lt;br /&gt;
* 3.98M timer IRQs, 3.98M &amp;quot;No Data&amp;quot; — idle, no satellite IP stream&lt;br /&gt;
* PID &amp;lt;code&amp;gt;0x01E1&amp;lt;/code&amp;gt; (481) being tracked&lt;br /&gt;
&lt;br /&gt;
== Kernel Module Internals (&amp;lt;code&amp;gt;strings&amp;lt;/code&amp;gt; analysis) ==&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;newtec.ko&amp;lt;/code&amp;gt; — BBFrame symbols ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
BB_CRC_ERRORS / BB_CRC_ERRORS_CURRENT / BB_CRC_ERRORS_NEXT&lt;br /&gt;
BB_DATA_FIELD_LEN / BB_DATA_FIELD_LEN_CURRENT / BB_DATA_FIELD_LEN_NEXT&lt;br /&gt;
BB_FRAMES&lt;br /&gt;
BB_GAIN / BB_GAIN_CURRENT / BB_GAIN_NEXT&lt;br /&gt;
BASEBAND_LEN&lt;br /&gt;
ISI / ISI_CTRL / ISI_CTRL_STRUCT / ISI_CTRL_STRUCT_FIELDS&lt;br /&gt;
ISI_FILTER_BYTE / ISI_MASK&lt;br /&gt;
SAT_BB_GAIN&lt;br /&gt;
ntc_debug  (module param, uint)&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;BB_DATA_FIELD_LEN&amp;lt;/code&amp;gt; and &amp;lt;code&amp;gt;BB_FRAMES&amp;lt;/code&amp;gt; suggest the driver tracks individual baseband frames, not just statistics. Very promising for BBFrame capture.&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;dvblite.ko&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
Contains &amp;lt;code&amp;gt;dvblite_ioctl&amp;lt;/code&amp;gt; — a kernel ioctl interface on &amp;lt;code&amp;gt;/dev/dvblite0&amp;lt;/code&amp;gt;. Commands unknown — to be investigated with a live signal.&lt;br /&gt;
&lt;br /&gt;
== Network Services ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Service !! Port !! Notes&lt;br /&gt;
|-&lt;br /&gt;
| SSH || 22 || Legacy KEX only (diffie-hellman-group1-sha1)&lt;br /&gt;
|-&lt;br /&gt;
| Telnet API || 23 || &amp;lt;code&amp;gt;cmdld&amp;lt;/code&amp;gt; via xinetd&lt;br /&gt;
|-&lt;br /&gt;
| FTP || 21 || pure-ftpd&lt;br /&gt;
|-&lt;br /&gt;
| HTTP || 80 || Apache + myles + requestHandler&lt;br /&gt;
|-&lt;br /&gt;
| SNMP || 161 || Community &amp;lt;code&amp;gt;public&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| mDNS || 5353 || &amp;lt;code&amp;gt;GOFFERT.local&amp;lt;/code&amp;gt;&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
# SSH/SCP&lt;br /&gt;
ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa root@&amp;lt;ip&amp;gt;&lt;br /&gt;
scp -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa root@&amp;lt;ip&amp;gt;:/path /local&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Credentials (Default/Hardcoded — ZSL-2020-5603 / ExploitDB 48954) ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! User !! Password !! Notes&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;root&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;1root!&amp;lt;/code&amp;gt; || Full root SSH&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;admin&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;1admin!&amp;lt;/code&amp;gt; || Also root via sudoers&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;adtec&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;none&amp;lt;/code&amp;gt; || Telnet API / web UI&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;adtecftp&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;adtecftp2231&amp;lt;/code&amp;gt; || FTP only&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
* Password hashes: DES crypt — crackable in seconds with &amp;lt;code&amp;gt;john&amp;lt;/code&amp;gt;&lt;br /&gt;
* &amp;lt;code&amp;gt;apache ALL=(ALL) NOPASSWD: ALL&amp;lt;/code&amp;gt; in sudoers&lt;br /&gt;
* Diagnostic package passphrase: &#039;&#039;&#039;&amp;lt;code&amp;gt;iMoo3jio&amp;lt;/code&amp;gt;&#039;&#039;&#039; (hardcoded, leaks in &amp;lt;code&amp;gt;ps aux&amp;lt;/code&amp;gt;)&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
gpg --passphrase &amp;quot;iMoo3jio&amp;quot; --batch --ignore-mdc-error --decrypt RD-60_*.tar.gpg | tar xf -&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== APIs ==&lt;br /&gt;
&lt;br /&gt;
=== Telnet API ===&lt;br /&gt;
&lt;br /&gt;
Connect: &amp;lt;code&amp;gt;telnet &amp;lt;ip&amp;gt;&amp;lt;/code&amp;gt;, login &amp;lt;code&amp;gt;adtec&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;none&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
*.SYSD SHELLCMD &amp;lt;cmd&amp;gt;          # arbitrary root shell execution!&lt;br /&gt;
*.SNMP ADTEC-NT-DEMOD-MIB::satFeedType.0 = dvbs2   # configure tuner&lt;br /&gt;
*.SNMP ADTEC-NT-DEMOD-MIB::satFeedDownlink.0 = 10960000&lt;br /&gt;
*.SNMP .1.3.6.1.4.1.19587.6000.3.999.0 i 0         # commit/apply&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== SNMP — Newtec Demodulator MIB ===&lt;br /&gt;
&lt;br /&gt;
OID base: &amp;lt;code&amp;gt;.1.3.6.1.4.1.19587&amp;lt;/code&amp;gt;, MIB: &amp;lt;code&amp;gt;ADTEC-NT-DEMOD-MIB&amp;lt;/code&amp;gt;, community: &amp;lt;code&amp;gt;public&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
snmpwalk -v2c -c public &amp;lt;ip&amp;gt; .1.3.6.1.4.1.19587&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Key OIDs: &amp;lt;code&amp;gt;tunerLock&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;recvLevel&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;esNo&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;linkMargin&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;modFec&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;rolloff&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;pilot&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;fecFrameType&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;unCorrFs&amp;lt;/code&amp;gt;, &#039;&#039;&#039;&amp;lt;code&amp;gt;bbCrcerrors&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &#039;&#039;&#039;&amp;lt;code&amp;gt;basebandLen&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &#039;&#039;&#039;&amp;lt;code&amp;gt;dummyPlRatio&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &#039;&#039;&#039;&amp;lt;code&amp;gt;isiFilterByte&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &#039;&#039;&#039;&amp;lt;code&amp;gt;framesSec&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &amp;lt;code&amp;gt;satFeedType&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;satFeedDownlink&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;satFeedSymRate&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;satFeedModulation&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;lnbEnable&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;lnbPolarity&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;lnbTone&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== DVC Profile Format ===&lt;br /&gt;
&lt;br /&gt;
SNMP SET commands as tuner presets, applied via Telnet API or web UI.&lt;br /&gt;
&lt;br /&gt;
== Saved Tuner Profiles ==&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;prfturktest.DVC&amp;lt;/code&amp;gt; (2018-04-28) ===&lt;br /&gt;
&lt;br /&gt;
* DVB-S, &#039;&#039;&#039;10762 MHz&#039;&#039;&#039;, KU 9750 LO → &#039;&#039;&#039;1012 MHz&#039;&#039;&#039; L-band&lt;br /&gt;
* &#039;&#039;&#039;30 MSym/s&#039;&#039;&#039;, QPSK 3/4, roll-off 35%&lt;br /&gt;
* Was &#039;&#039;&#039;LOCKED&#039;&#039;&#039; at -32 dBm when saved&lt;br /&gt;
* &amp;lt;code&amp;gt;bbCrcerrors = 1&amp;lt;/code&amp;gt; — &#039;&#039;&#039;BBFrame counter was active and non-zero!&#039;&#039;&#039;&lt;br /&gt;
* Likely &#039;&#039;&#039;Türksat 42°E&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;prfMUX.DVC&amp;lt;/code&amp;gt; (2018-04-28) ===&lt;br /&gt;
&lt;br /&gt;
* DVB-S2, &#039;&#039;&#039;10960 MHz&#039;&#039;&#039;, KU 9750 LO → &#039;&#039;&#039;1210 MHz&#039;&#039;&#039; L-band&lt;br /&gt;
* &#039;&#039;&#039;8.352 MSym/s&#039;&#039;&#039;, 16APSK 2/3, roll-off 20%, pilot ON, normal frames, CCM&lt;br /&gt;
* Was unlocked when saved&lt;br /&gt;
&lt;br /&gt;
== Licensed Features (Key ID 165) ==&lt;br /&gt;
&lt;br /&gt;
DVB-DSNG + DVB-S2 + QPSK + 8-PSK + 16-QAM/16APSK + 32APSK + Symbol Rate &amp;lt;= 33 MBaud + ACM + &#039;&#039;&#039;Single TS/GS or Multiple Streams&#039;&#039;&#039; + &#039;&#039;&#039;(Baseband Frames)&#039;&#039;&#039; + no ACM client + no AES&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;BBFrame access is explicitly licensed and enabled.&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
== Encryption / CA ==&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;BISS-1 key&#039;&#039;&#039; in &amp;lt;code&amp;gt;dtrans.xml&amp;lt;/code&amp;gt;: &amp;lt;code&amp;gt;69A969BBECA0&amp;lt;/code&amp;gt;&lt;br /&gt;
* &#039;&#039;&#039;Viaccess&#039;&#039;&#039; (CA ID 0x0005) feed seen in logs — no card present, could not decrypt&lt;br /&gt;
&lt;br /&gt;
== IP-over-Satellite ==&lt;br /&gt;
&lt;br /&gt;
The unit has a full satellite IP receive stack beyond TS decoding:&lt;br /&gt;
&lt;br /&gt;
* &amp;lt;code&amp;gt;rddma_ip&amp;lt;/code&amp;gt; — FPGA-backed DMA for IP-from-satellite&lt;br /&gt;
* &amp;lt;code&amp;gt;ip_ingress_main&amp;lt;/code&amp;gt; — GSE/MPE ingress pipeline&lt;br /&gt;
* FPGA Channel 3 active at &amp;lt;code&amp;gt;03F01C00&amp;lt;/code&amp;gt;&lt;br /&gt;
* Currently idle — no GSE/MPE stream configured&lt;br /&gt;
&lt;br /&gt;
== Security Summary ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Issue !! Detail&lt;br /&gt;
|-&lt;br /&gt;
| Default root creds || &amp;lt;code&amp;gt;root&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;1root!&amp;lt;/code&amp;gt; over SSH&lt;br /&gt;
|-&lt;br /&gt;
| Telnet RCE || &amp;lt;code&amp;gt;*.SYSD SHELLCMD&amp;lt;/code&amp;gt; = root shell with &amp;lt;code&amp;gt;adtec&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;none&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Sudoers || &amp;lt;code&amp;gt;apache ALL=(ALL) NOPASSWD: ALL&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Shared SSH host keys || Same across all units (stored on CF card)&lt;br /&gt;
|-&lt;br /&gt;
| Weak password hashes || DES crypt, trivially crackable&lt;br /&gt;
|-&lt;br /&gt;
| GPG passphrase leak || &amp;lt;code&amp;gt;iMoo3jio&amp;lt;/code&amp;gt; visible in &amp;lt;code&amp;gt;ps aux&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Public exploit || ZSL-2020-5603 / ExploitDB 48954&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Other ==&lt;br /&gt;
== Front Panel ==&lt;br /&gt;
&lt;br /&gt;
* Driver: &amp;lt;code&amp;gt;frpanel.ko&amp;lt;/code&amp;gt; (depends on &amp;lt;code&amp;gt;pc93&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;pc73a&amp;lt;/code&amp;gt;)&lt;br /&gt;
* Device nodes: &amp;lt;code&amp;gt;/dev/frpanel0&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;/dev/frpanel1&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;/dev/frpanel2&amp;lt;/code&amp;gt;&lt;br /&gt;
* Display: 2 rows × 40 columns character LCD (PC93 I2C MCU)&lt;br /&gt;
* LCD API in &amp;lt;code&amp;gt;libsolib.so&amp;lt;/code&amp;gt;: &amp;lt;code&amp;gt;FpLcdKpInit()&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;LcdClear()&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;LcdWriteStr(char*, pos, len)&amp;lt;/code&amp;gt;&lt;br /&gt;
* Writing to &amp;lt;code&amp;gt;/dev/frpanel2&amp;lt;/code&amp;gt; activates the backlight&lt;br /&gt;
* &amp;lt;code&amp;gt;menud&amp;lt;/code&amp;gt; daemon owns the display — must be stopped before direct writes&lt;br /&gt;
* Proc interface: &amp;lt;code&amp;gt;/proc/driver/frpanel/&amp;lt;/code&amp;gt; (rows, cols, screen, type, version, access)&lt;br /&gt;
&lt;br /&gt;
== Images ==&lt;br /&gt;
&amp;lt;gallery&amp;gt;&lt;br /&gt;
Adtec_rd60_internals_overview.jpg&lt;br /&gt;
Adtec_rd60_internals1.jpg&lt;br /&gt;
Adtec_rd60_internals2.jpg&lt;br /&gt;
Adtec_rd60_internals3.jpg&lt;br /&gt;
Adtec_rd60_internals4.jpg&lt;br /&gt;
Adtec_rd60_internals5.jpg&lt;br /&gt;
&amp;lt;/gallery&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== TODO (requires dish connected) ==&lt;br /&gt;
&lt;br /&gt;
* [ ] Read &amp;lt;code&amp;gt;/proc/driver/dvblite/fe0/stats&amp;lt;/code&amp;gt; with live signal — observe all BB* fields&lt;br /&gt;
* [ ] SNMP walk full &amp;lt;code&amp;gt;.1.3.6.1.4.1.19587&amp;lt;/code&amp;gt; with live signal&lt;br /&gt;
* [ ] Investigate &amp;lt;code&amp;gt;dvblite_ioctl&amp;lt;/code&amp;gt; on &amp;lt;code&amp;gt;/dev/dvblite0&amp;lt;/code&amp;gt;&lt;br /&gt;
* [ ] Enable &amp;lt;code&amp;gt;ntc_debug&amp;lt;/code&amp;gt; module param and watch dmesg&lt;br /&gt;
* [ ] Try ISI multistream filtering via SNMP SET&lt;br /&gt;
* [ ] Investigate &amp;lt;code&amp;gt;rddma_ip&amp;lt;/code&amp;gt; with GSE/MPE satellite signal&lt;br /&gt;
* [ ] Lock on Türksat 42°E: 10762 MHz / 30 MSym/s / QPSK 3/4 (known working)&lt;br /&gt;
* [ ] Identify prfMUX transponder on Lyngsat (10960 MHz / 8.352 MSym/s / 16APSK 2/3)&lt;br /&gt;
* [ ] Explore Telnet API &amp;lt;code&amp;gt;*.NTC&amp;lt;/code&amp;gt; command namespace&lt;br /&gt;
* [ ] Investigate &amp;lt;code&amp;gt;xcpServerd&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;xcpClientd&amp;lt;/code&amp;gt; — XCP protocol capabilities&lt;br /&gt;
* [ ] Check if &amp;lt;code&amp;gt;schnv.DVC&amp;lt;/code&amp;gt; populates after a lock (empty offline)&lt;br /&gt;
* [ ] Read &amp;lt;code&amp;gt;freg.db&amp;lt;/code&amp;gt; contents — full feature registry dump&lt;br /&gt;
* [ ] Write to LCD display — cross-compile against glibc 2.3.5 and call &amp;lt;code&amp;gt;LcdWriteStr()&amp;lt;/code&amp;gt; from &amp;lt;code&amp;gt;libsolib.so&amp;lt;/code&amp;gt;&lt;br /&gt;
* [ ] Send RMCP command via &amp;lt;code&amp;gt;rmcp_i2c&amp;lt;/code&amp;gt; to switch NTC/7044/BB output to BBFrame mode&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=Dontlookup&amp;diff=15909</id>
		<title>Dontlookup</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=Dontlookup&amp;diff=15909"/>
		<updated>2026-04-11T23:27:40Z</updated>

		<summary type="html">&lt;p&gt;Melan: /* Professional IRD: Adtec RD-60 */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=dontlookup&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Sdr&lt;br /&gt;
|Tool=No&lt;br /&gt;
|Location=&lt;br /&gt;
}}&lt;br /&gt;
= dontlookup =&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;dontlookup&#039;&#039;&#039; is an open-source tool by researchers at UC San Diego for parsing IP traffic encapsulated in raw DVB-S2(X) satellite captures. It was presented at CCS 2025.&lt;br /&gt;
&lt;br /&gt;
The name is a reference to the fact that satellite internet providers apparently did not expect anyone to be passively listening.&lt;br /&gt;
&lt;br /&gt;
NURDspace uses it (or plans to) in combination with the [[Intellian i4 Satellite Dish]] and a DVB-S2 receiver to capture and inspect unencrypted satellite internet traffic off the air.&lt;br /&gt;
&lt;br /&gt;
== What It Does ==&lt;br /&gt;
&lt;br /&gt;
Many satellite internet providers beam IP traffic down to large coverage areas using DVB-S2 or DVB-S2X. A significant portion of this traffic is unencrypted. By capturing the raw transport stream with a DVB-S2 receiver and running it through dontlookup, you can extract actual IP packets and open them in Wireshark.&lt;br /&gt;
&lt;br /&gt;
== Capturing ==&lt;br /&gt;
&lt;br /&gt;
=== Background: BBframes ===&lt;br /&gt;
&lt;br /&gt;
DVB-S2 transmits data in &#039;&#039;&#039;Baseband Frames (BBframes)&#039;&#039;&#039; — the lowest-level data unit after forward error correction. IP traffic is encapsulated inside these frames, either directly or via GSE or MPEG-TS wrappers. dontlookup operates on raw BBframe payloads.&lt;br /&gt;
&lt;br /&gt;
The problem is that virtually every DVB-S2 receiver card exposes only a processed &#039;&#039;&#039;MPEG-TS&#039;&#039;&#039; stream to userspace. The DVB API in Linux was designed for TV reception, so the driver demodulates the signal and hands you PIDs — the raw BBframe layer is discarded. If the satellite provider uses MPEG-TS encapsulation you get lucky and this works fine. If they use direct IP or GSE encapsulation, which does not map to MPEG-TS PIDs, you get nothing.&lt;br /&gt;
&lt;br /&gt;
=== Background: Blind Scan ===&lt;br /&gt;
&lt;br /&gt;
When tuning a satellite receiver normally, you already know what you are looking for — frequency,&lt;br /&gt;
symbol rate, polarisation, and FEC parameters. These are typically sourced from a database like&lt;br /&gt;
[[https://www.lyngsat.com/ LyngSat]] or a channel list. Blind scan is the alternative: the&lt;br /&gt;
receiver sweeps the entire band and attempts to lock onto any signal it finds, determining the&lt;br /&gt;
parameters itself.&lt;br /&gt;
&lt;br /&gt;
This matters for dontlookup because the most interesting transponders — those carrying&lt;br /&gt;
unencrypted IP backhaul — are generally not listed in any public database. They are not&lt;br /&gt;
broadcast television services; they are private data links that nobody was expected to be&lt;br /&gt;
looking at. A receiver limited to known transponders will never find them.&lt;br /&gt;
&lt;br /&gt;
Blind scan is more computationally intensive than directed tuning and takes longer to complete&lt;br /&gt;
a full sweep, but it is the only reliable method to discover unknown transponders.&lt;br /&gt;
Not all DVB-S2 receiver hardware exposes blind scan capability to the Linux DVB API, even if&lt;br /&gt;
the underlying demodulator chipset supports it — this is one of the reasons the [[#TBS Driver Patch|TBS5927]]&lt;br /&gt;
became the reference hardware for this project.&lt;br /&gt;
&lt;br /&gt;
=== TBS Driver Patch ===&lt;br /&gt;
&lt;br /&gt;
The dontlookup repo ships a kernel patch (&amp;lt;code&amp;gt;tbsdriver.patch&amp;lt;/code&amp;gt;) for TBS DVB-S2 receiver cards that exposes the raw BBframe stream to userspace, bypassing the normal DVB API. This is required to capture proprietary or non-MPEG-TS encapsulations.&lt;br /&gt;
&lt;br /&gt;
However, the researchers used a &#039;&#039;&#039;TBS5927&#039;&#039;&#039; which has become unobtainium.&lt;br /&gt;
&lt;br /&gt;
A &#039;&#039;&#039;TBS5925&#039;&#039;&#039; may work and is on its way to NURDspace for testing. [[User:20h]] also generously acquired a &#039;&#039;&#039;TBS-5580&#039;&#039;&#039;. Neither has been confirmed working yet.&lt;br /&gt;
&lt;br /&gt;
The TBS5925 is documented to work with EUMETCast: [https://www-cdn.eumetsat.int/files/2020-07/TBS%205925%20DVB-S2%20Receiver%20EUMETCast%20Windows%20Setup%20Guide.pdf TBS5925 EUMETCast setup guide].&lt;br /&gt;
&lt;br /&gt;
=== SAT&amp;gt;IP Devices ===&lt;br /&gt;
&lt;br /&gt;
The &#039;&#039;&#039;Digibit R1&#039;&#039;&#039; SAT&amp;gt;IP tuner used at NURDspace presents itself as a network-attached DVB-S2 tuner. It handles LNB power, DiSEqC, and tuning over the network, but only streams MPEG-TS over SAT&amp;gt;IP. There is no way to get raw BBframes out of it without hardware modifications.&lt;br /&gt;
&lt;br /&gt;
Further investigation revealed it runs STMicro&#039;s proprietary &#039;&#039;&#039;STAPI&#039;&#039;&#039; stack internally — &amp;lt;code&amp;gt;stpti5_core&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;stfdma_core&amp;lt;/code&amp;gt; etc. — with no &amp;lt;code&amp;gt;/dev/dvb/&amp;lt;/code&amp;gt; device exposed. minisatip talks directly to STAPI, bypassing the Linux DVB API entirely. Intercepting data at the STAPI layer to get raw BBframes would require significant reverse engineering effort.&lt;br /&gt;
&lt;br /&gt;
=== STV090x Based Chipsets ===&lt;br /&gt;
&lt;br /&gt;
The STV090x demodulator (used in many DVB-S2 cards) is capable of outputting raw BBframes at the hardware level, but the Linux driver simply never implements it. Investigation of &amp;lt;code&amp;gt;stv090x.c&amp;lt;/code&amp;gt; showed it writes an output configuration register at init:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
{ STV090x_OUTCFG, 0x00 },  /* serial TS output, hardware default */&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
The crucial register is &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt; with &amp;lt;code&amp;gt;FRAME_MODE_FIELD&amp;lt;/code&amp;gt; set to 1 — discovered via a [https://www.spinics.net/lists/linux-media/msg45597.html 2012 linux-media mailing list post] documenting exactly this on a TBS6925. One register bit is all it takes.&lt;br /&gt;
&lt;br /&gt;
The plan was to apply a similar patch to a &#039;&#039;&#039;SkyStar 2 eXpress HD&#039;&#039;&#039; (SAA716x + STV090x). This ran into a separate problem: newer AMD motherboards have removed the 3.3V rail from PCIe slots. DVB cards use 3.3V for logic; GPUs do not. The SkyStar and other PCIe satellite tuners simply failed to enumerate, while a GPU in the same slot worked fine. Testing on an older motherboard has not yet been attempted.&lt;br /&gt;
&lt;br /&gt;
=== MiniTiouner / Longmynd ===&lt;br /&gt;
&lt;br /&gt;
The &#039;&#039;&#039;MiniTiouner&#039;&#039;&#039; is a USB DVB-S2 receiver designed by the British Amateur Television Club (BATC) for amateur TV reception, primarily targeting the QO-100 geostationary amateur transponder. Unlike the TBS cards, it uses the &#039;&#039;&#039;STV0910&#039;&#039;&#039; demodulator which outputs raw BBframes natively — no kernel patching required.&lt;br /&gt;
&lt;br /&gt;
The &#039;&#039;&#039;Longmynd&#039;&#039;&#039; software (also by BATC) drives the MiniTiouner and outputs BBframes directly over UDP, making it straightforwardly compatible with dontlookup.&lt;br /&gt;
&lt;br /&gt;
The catch is availability: purchasing the kit requires a BATC membership, and the hardware is not sold elsewhere.&lt;br /&gt;
&lt;br /&gt;
=== Professional IRD: Adtec RD-60 ===&lt;br /&gt;
&lt;br /&gt;
An [[ Adtec RD-60 ]] professional broadcast IRD is also available. This is the kind of kit used by actual broadcasters to receive satellite feeds.&lt;br /&gt;
&lt;br /&gt;
=== GNU Radio / gr-dvbs2rx ===&lt;br /&gt;
&lt;br /&gt;
An SDR-based approach using [https://github.com/igorauad/gr-dvbs2rx gr-dvbs2rx] (a GNU Radio out-of-tree module for DVB-S2 demodulation) was also explored. This would allow a HackRF or similar SDR to demodulate DVB-S2 and potentially extract BBframes entirely in software, without any dedicated DVB receiver hardware.&lt;br /&gt;
&lt;br /&gt;
The main constraint is bandwidth. Typical Ku-band transponders run at 27–45 Msym/s, requiring roughly that much RF bandwidth — well beyond the HackRF&#039;s 20 MHz maximum. However, some data-only transponders run significantly narrower symbol rates and could fit within an SDR&#039;s bandwidth.&lt;br /&gt;
&lt;br /&gt;
Combining two HackRFs in a phase-coherent configuration (the HackRF has explicit support for clock synchronisation between units) could double the available bandwidth and is cheaper than a LimeSDR.&lt;br /&gt;
&lt;br /&gt;
== Links ==&lt;br /&gt;
&lt;br /&gt;
* [https://github.com/ucsdsysnet/dontlookup GitHub — ucsdsysnet/dontlookup]&lt;br /&gt;
* [https://satcom.sysnet.ucsd.edu/docs/dontlookup_ccs25_fullpaper.pdf CCS 2025 paper (PDF)]&lt;br /&gt;
* [https://forums.radioreference.com/threads/dont-look-up-research-paper-on-satcom-interception.493532/]&lt;br /&gt;
* [https://youtu.be/VE7S1nk4F04 saveitforparts — Intercepting Sensitive Satellite Data Is (Scarily) Easier Than I Thought!]&lt;br /&gt;
* [https://www.spinics.net/lists/linux-media/msg45597.html linux-media 2012: STV090x BBframe patch]&lt;br /&gt;
* [https://www-cdn.eumetsat.int/files/2020-07/TBS%205925%20DVB-S2%20Receiver%20EUMETCast%20Windows%20Setup%20Guide.pdf TBS5925 EUMETCast setup guide]&lt;br /&gt;
* [https://www.satsignal.eu/wxsat/atovs/index.html SatSignal — EUMETCast receiver hardware notes]&lt;br /&gt;
* [[Intellian i4 Satellite Dish]]&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=Dontlookup&amp;diff=15908</id>
		<title>Dontlookup</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=Dontlookup&amp;diff=15908"/>
		<updated>2026-04-11T23:25:27Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=dontlookup&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Sdr&lt;br /&gt;
|Tool=No&lt;br /&gt;
|Location=&lt;br /&gt;
}}&lt;br /&gt;
= dontlookup =&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;dontlookup&#039;&#039;&#039; is an open-source tool by researchers at UC San Diego for parsing IP traffic encapsulated in raw DVB-S2(X) satellite captures. It was presented at CCS 2025.&lt;br /&gt;
&lt;br /&gt;
The name is a reference to the fact that satellite internet providers apparently did not expect anyone to be passively listening.&lt;br /&gt;
&lt;br /&gt;
NURDspace uses it (or plans to) in combination with the [[Intellian i4 Satellite Dish]] and a DVB-S2 receiver to capture and inspect unencrypted satellite internet traffic off the air.&lt;br /&gt;
&lt;br /&gt;
== What It Does ==&lt;br /&gt;
&lt;br /&gt;
Many satellite internet providers beam IP traffic down to large coverage areas using DVB-S2 or DVB-S2X. A significant portion of this traffic is unencrypted. By capturing the raw transport stream with a DVB-S2 receiver and running it through dontlookup, you can extract actual IP packets and open them in Wireshark.&lt;br /&gt;
&lt;br /&gt;
== Capturing ==&lt;br /&gt;
&lt;br /&gt;
=== Background: BBframes ===&lt;br /&gt;
&lt;br /&gt;
DVB-S2 transmits data in &#039;&#039;&#039;Baseband Frames (BBframes)&#039;&#039;&#039; — the lowest-level data unit after forward error correction. IP traffic is encapsulated inside these frames, either directly or via GSE or MPEG-TS wrappers. dontlookup operates on raw BBframe payloads.&lt;br /&gt;
&lt;br /&gt;
The problem is that virtually every DVB-S2 receiver card exposes only a processed &#039;&#039;&#039;MPEG-TS&#039;&#039;&#039; stream to userspace. The DVB API in Linux was designed for TV reception, so the driver demodulates the signal and hands you PIDs — the raw BBframe layer is discarded. If the satellite provider uses MPEG-TS encapsulation you get lucky and this works fine. If they use direct IP or GSE encapsulation, which does not map to MPEG-TS PIDs, you get nothing.&lt;br /&gt;
&lt;br /&gt;
=== Background: Blind Scan ===&lt;br /&gt;
&lt;br /&gt;
When tuning a satellite receiver normally, you already know what you are looking for — frequency,&lt;br /&gt;
symbol rate, polarisation, and FEC parameters. These are typically sourced from a database like&lt;br /&gt;
[[https://www.lyngsat.com/ LyngSat]] or a channel list. Blind scan is the alternative: the&lt;br /&gt;
receiver sweeps the entire band and attempts to lock onto any signal it finds, determining the&lt;br /&gt;
parameters itself.&lt;br /&gt;
&lt;br /&gt;
This matters for dontlookup because the most interesting transponders — those carrying&lt;br /&gt;
unencrypted IP backhaul — are generally not listed in any public database. They are not&lt;br /&gt;
broadcast television services; they are private data links that nobody was expected to be&lt;br /&gt;
looking at. A receiver limited to known transponders will never find them.&lt;br /&gt;
&lt;br /&gt;
Blind scan is more computationally intensive than directed tuning and takes longer to complete&lt;br /&gt;
a full sweep, but it is the only reliable method to discover unknown transponders.&lt;br /&gt;
Not all DVB-S2 receiver hardware exposes blind scan capability to the Linux DVB API, even if&lt;br /&gt;
the underlying demodulator chipset supports it — this is one of the reasons the [[#TBS Driver Patch|TBS5927]]&lt;br /&gt;
became the reference hardware for this project.&lt;br /&gt;
&lt;br /&gt;
=== TBS Driver Patch ===&lt;br /&gt;
&lt;br /&gt;
The dontlookup repo ships a kernel patch (&amp;lt;code&amp;gt;tbsdriver.patch&amp;lt;/code&amp;gt;) for TBS DVB-S2 receiver cards that exposes the raw BBframe stream to userspace, bypassing the normal DVB API. This is required to capture proprietary or non-MPEG-TS encapsulations.&lt;br /&gt;
&lt;br /&gt;
However, the researchers used a &#039;&#039;&#039;TBS5927&#039;&#039;&#039; which has become unobtainium.&lt;br /&gt;
&lt;br /&gt;
A &#039;&#039;&#039;TBS5925&#039;&#039;&#039; may work and is on its way to NURDspace for testing. [[User:20h]] also generously acquired a &#039;&#039;&#039;TBS-5580&#039;&#039;&#039;. Neither has been confirmed working yet.&lt;br /&gt;
&lt;br /&gt;
The TBS5925 is documented to work with EUMETCast: [https://www-cdn.eumetsat.int/files/2020-07/TBS%205925%20DVB-S2%20Receiver%20EUMETCast%20Windows%20Setup%20Guide.pdf TBS5925 EUMETCast setup guide].&lt;br /&gt;
&lt;br /&gt;
=== SAT&amp;gt;IP Devices ===&lt;br /&gt;
&lt;br /&gt;
The &#039;&#039;&#039;Digibit R1&#039;&#039;&#039; SAT&amp;gt;IP tuner used at NURDspace presents itself as a network-attached DVB-S2 tuner. It handles LNB power, DiSEqC, and tuning over the network, but only streams MPEG-TS over SAT&amp;gt;IP. There is no way to get raw BBframes out of it without hardware modifications.&lt;br /&gt;
&lt;br /&gt;
Further investigation revealed it runs STMicro&#039;s proprietary &#039;&#039;&#039;STAPI&#039;&#039;&#039; stack internally — &amp;lt;code&amp;gt;stpti5_core&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;stfdma_core&amp;lt;/code&amp;gt; etc. — with no &amp;lt;code&amp;gt;/dev/dvb/&amp;lt;/code&amp;gt; device exposed. minisatip talks directly to STAPI, bypassing the Linux DVB API entirely. Intercepting data at the STAPI layer to get raw BBframes would require significant reverse engineering effort.&lt;br /&gt;
&lt;br /&gt;
=== STV090x Based Chipsets ===&lt;br /&gt;
&lt;br /&gt;
The STV090x demodulator (used in many DVB-S2 cards) is capable of outputting raw BBframes at the hardware level, but the Linux driver simply never implements it. Investigation of &amp;lt;code&amp;gt;stv090x.c&amp;lt;/code&amp;gt; showed it writes an output configuration register at init:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
{ STV090x_OUTCFG, 0x00 },  /* serial TS output, hardware default */&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
The crucial register is &amp;lt;code&amp;gt;PDELCTRL2&amp;lt;/code&amp;gt; with &amp;lt;code&amp;gt;FRAME_MODE_FIELD&amp;lt;/code&amp;gt; set to 1 — discovered via a [https://www.spinics.net/lists/linux-media/msg45597.html 2012 linux-media mailing list post] documenting exactly this on a TBS6925. One register bit is all it takes.&lt;br /&gt;
&lt;br /&gt;
The plan was to apply a similar patch to a &#039;&#039;&#039;SkyStar 2 eXpress HD&#039;&#039;&#039; (SAA716x + STV090x). This ran into a separate problem: newer AMD motherboards have removed the 3.3V rail from PCIe slots. DVB cards use 3.3V for logic; GPUs do not. The SkyStar and other PCIe satellite tuners simply failed to enumerate, while a GPU in the same slot worked fine. Testing on an older motherboard has not yet been attempted.&lt;br /&gt;
&lt;br /&gt;
=== MiniTiouner / Longmynd ===&lt;br /&gt;
&lt;br /&gt;
The &#039;&#039;&#039;MiniTiouner&#039;&#039;&#039; is a USB DVB-S2 receiver designed by the British Amateur Television Club (BATC) for amateur TV reception, primarily targeting the QO-100 geostationary amateur transponder. Unlike the TBS cards, it uses the &#039;&#039;&#039;STV0910&#039;&#039;&#039; demodulator which outputs raw BBframes natively — no kernel patching required.&lt;br /&gt;
&lt;br /&gt;
The &#039;&#039;&#039;Longmynd&#039;&#039;&#039; software (also by BATC) drives the MiniTiouner and outputs BBframes directly over UDP, making it straightforwardly compatible with dontlookup.&lt;br /&gt;
&lt;br /&gt;
The catch is availability: purchasing the kit requires a BATC membership, and the hardware is not sold elsewhere.&lt;br /&gt;
&lt;br /&gt;
=== Professional IRD: Adtec RD-60 ===&lt;br /&gt;
&lt;br /&gt;
An [[ Adtec RD-60 ]] professional broadcast IRD is also available. This is the kind of kit used by actual broadcasters to receive satellite feeds.&lt;br /&gt;
&lt;br /&gt;
Relevant outputs and interfaces:&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;DVB-ASI output&#039;&#039;&#039; carries raw MPEG-TS bitstream over the professional broadcast standard ASI interface. Feeding this into a PCIe ASI capture card gives a clean TS stream, but it is still just TS — not BBframes.&lt;br /&gt;
* &#039;&#039;&#039;Web API and serial command interface&#039;&#039;&#039; — professional IRDs sometimes have diagnostic modes that surface baseband data below the normal TS output. This has not been explored yet.&lt;br /&gt;
&lt;br /&gt;
Internally, the RD-60 runs Linux on a PowerPC CPU. The receiver and ASI sections communicate with the PowerPC over PCI, which means in principle the full data path is accessible from software — including potentially below the TS layer. This makes it a more interesting target for BBframe extraction than it first appears.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-TODO: investigate PCI-attached receiver section from Linux userspace on the PowerPC --&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== GNU Radio / gr-dvbs2rx ===&lt;br /&gt;
&lt;br /&gt;
An SDR-based approach using [https://github.com/igorauad/gr-dvbs2rx gr-dvbs2rx] (a GNU Radio out-of-tree module for DVB-S2 demodulation) was also explored. This would allow a HackRF or similar SDR to demodulate DVB-S2 and potentially extract BBframes entirely in software, without any dedicated DVB receiver hardware.&lt;br /&gt;
&lt;br /&gt;
The main constraint is bandwidth. Typical Ku-band transponders run at 27–45 Msym/s, requiring roughly that much RF bandwidth — well beyond the HackRF&#039;s 20 MHz maximum. However, some data-only transponders run significantly narrower symbol rates and could fit within an SDR&#039;s bandwidth.&lt;br /&gt;
&lt;br /&gt;
Combining two HackRFs in a phase-coherent configuration (the HackRF has explicit support for clock synchronisation between units) could double the available bandwidth and is cheaper than a LimeSDR.&lt;br /&gt;
&lt;br /&gt;
== Links ==&lt;br /&gt;
&lt;br /&gt;
* [https://github.com/ucsdsysnet/dontlookup GitHub — ucsdsysnet/dontlookup]&lt;br /&gt;
* [https://satcom.sysnet.ucsd.edu/docs/dontlookup_ccs25_fullpaper.pdf CCS 2025 paper (PDF)]&lt;br /&gt;
* [https://forums.radioreference.com/threads/dont-look-up-research-paper-on-satcom-interception.493532/]&lt;br /&gt;
* [https://youtu.be/VE7S1nk4F04 saveitforparts — Intercepting Sensitive Satellite Data Is (Scarily) Easier Than I Thought!]&lt;br /&gt;
* [https://www.spinics.net/lists/linux-media/msg45597.html linux-media 2012: STV090x BBframe patch]&lt;br /&gt;
* [https://www-cdn.eumetsat.int/files/2020-07/TBS%205925%20DVB-S2%20Receiver%20EUMETCast%20Windows%20Setup%20Guide.pdf TBS5925 EUMETCast setup guide]&lt;br /&gt;
* [https://www.satsignal.eu/wxsat/atovs/index.html SatSignal — EUMETCast receiver hardware notes]&lt;br /&gt;
* [[Intellian i4 Satellite Dish]]&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=User:Melan&amp;diff=15907</id>
		<title>User:Melan</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=User:Melan&amp;diff=15907"/>
		<updated>2026-04-11T23:23:21Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Members&lt;br /&gt;
|picture=Melan.png&lt;br /&gt;
|Nickname=Melan&lt;br /&gt;
|Memberstatus=member&lt;br /&gt;
|URL=https://github.com/Melanpan&lt;br /&gt;
|XMPP=melan@space.nurdspace.nl&lt;br /&gt;
|Extension=1515&lt;br /&gt;
|Project=ESP_OPL, MPDTube, Sonic_Amplifier, Slabbar, DIY_Ambilight, Airplane_Tracking, nurdlights, Desk_lights, LaLamp, Nurd Plotter, Sony Vaio Ultraportable, DRIS_Display, HAIrk, Nurdtemps, Spacesound, NurdBot Lora Failover, DIY_DSP, Erratic, Open/closed_sign, Labelprinters, Meshcore, KlikoAI, Intellian_i4_Satellite_dish, Dontlookup, Adtec_RD-60&lt;br /&gt;
|nickname=Melan&lt;br /&gt;
|email=rijst@kopen.nl&lt;br /&gt;
}}&lt;br /&gt;
Will proudly present you the latest trash straight from the local Kringloop.&lt;br /&gt;
&lt;br /&gt;
== Main interests ==&lt;br /&gt;
* Programming: Python and a bit of C++&lt;br /&gt;
* Automation&lt;br /&gt;
* Anime&lt;br /&gt;
* Making Music, playing with Synths, making hark songs and remixes&lt;br /&gt;
* Audio related stuff&lt;br /&gt;
* &#039;&#039;&#039;Leds&#039;&#039;&#039;&lt;br /&gt;
* Airplanes (ADS-B) and HAMkaas radio, radio astronomy&lt;br /&gt;
* Microcontrollers (esp8266, esp32, rp2040)&lt;br /&gt;
* Machine Learning&lt;br /&gt;
* Adding pointless and annoying things to the space&lt;br /&gt;
&lt;br /&gt;
== Part of the following commissions ==&lt;br /&gt;
* RF Commission&lt;br /&gt;
* Media Commission&lt;br /&gt;
* BOFH&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=Adtec_RD-60&amp;diff=15891</id>
		<title>Adtec RD-60</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=Adtec_RD-60&amp;diff=15891"/>
		<updated>2026-04-11T23:13:56Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=Adtec RD-60&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Sdr&lt;br /&gt;
|Tool=No&lt;br /&gt;
|Location=the roof&lt;br /&gt;
}}&lt;br /&gt;
== Adtec RD-60 IRD ==&lt;br /&gt;
The &#039;&#039;&#039;Adtec RD-60&#039;&#039;&#039; is a 1RU integrated receiver/decoder (IRD).&lt;br /&gt;
&lt;br /&gt;
It seems the Adtec RD-60 might expose &#039;&#039;&#039;DVB-S2 baseband frames (BBFrames)&#039;&#039;&#039; below the TS layer, this might be very useful as part of the &#039;&#039;&#039;dontlookup&#039;&#039;&#039; satellite interception paper replication project. See [[dontlookup]]&lt;br /&gt;
&lt;br /&gt;
= Reverse Engineering Notes =&lt;br /&gt;
== Hardware ==&lt;br /&gt;
[[File:20250429 153745.jpg|thumb|center]]&lt;br /&gt;
=== Main Unit ===&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;Model:&#039;&#039;&#039; Adtec RD-60 MultiCODEC Receiver/Decoder (IRD)&lt;br /&gt;
* &#039;&#039;&#039;Hostname:&#039;&#039;&#039; &amp;lt;code&amp;gt;GOFFERT&amp;lt;/code&amp;gt;&lt;br /&gt;
* &#039;&#039;&#039;IP:&#039;&#039;&#039; 10.1.2.172 (DHCP)&lt;br /&gt;
* &#039;&#039;&#039;CPU:&#039;&#039;&#039; IBM PowerPC PPC405GPr @ 399 MHz (GemPPC Iolite platform)&lt;br /&gt;
* &#039;&#039;&#039;PLB bus:&#039;&#039;&#039; 133 MHz | &#039;&#039;&#039;PCI bus:&#039;&#039;&#039; 33 MHz&lt;br /&gt;
* &#039;&#039;&#039;Kernel:&#039;&#039;&#039; Linux 2.6.14-gemppc-iolite&lt;br /&gt;
* &#039;&#039;&#039;Front panel:&#039;&#039;&#039; Character LCD/VFD — text only, ~40 chars wide.&lt;br /&gt;
* &#039;&#039;&#039;Storage:&#039;&#039;&#039; CompactFlash card (8 partitions, 4 used)&lt;br /&gt;
&lt;br /&gt;
=== Demodulator Board ===&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;Slot 2:&#039;&#039;&#039; &amp;lt;code&amp;gt;BA14&amp;lt;/code&amp;gt; — PC87 ver 1.4 (main decoder board)&lt;br /&gt;
* &#039;&#039;&#039;Slot 99:&#039;&#039;&#039; &amp;lt;code&amp;gt;7044BB&amp;lt;/code&amp;gt; — &#039;&#039;&#039;Newtec NTC/7044/BB DVB Demodulator&#039;&#039;&#039;&lt;br /&gt;
** PRM firmware: &#039;&#039;&#039;v2.34&#039;&#039;&#039; (20/03/13)&lt;br /&gt;
** FPGA bitfile: v1.01 (09/01/12)&lt;br /&gt;
** Hardware: v3.0&lt;br /&gt;
** Serial: &#039;&#039;&#039;30091216&#039;&#039;&#039;&lt;br /&gt;
** Software ID: NTC/6381 DVB Demodulator&lt;br /&gt;
** Product ID: NTC/7044/BB.BCDCBCAA.x.B&lt;br /&gt;
** License: &#039;&#039;&#039;165&#039;&#039;&#039; (includes Baseband Frames — see below)&lt;br /&gt;
** Communicates via I2C (&amp;lt;code&amp;gt;rmcp_i2c&amp;lt;/code&amp;gt; kernel module)&lt;br /&gt;
** &amp;lt;code&amp;gt;BB&amp;lt;/code&amp;gt; suffix = BaseBand licensed and capable&lt;br /&gt;
&lt;br /&gt;
According to the official Newtec datasheet, the NTC/7044/BB supports explicit &#039;&#039;&#039;output mode switching&#039;&#039;&#039; between:&lt;br /&gt;
* Single transport stream&lt;br /&gt;
* Generic stream  &lt;br /&gt;
* &#039;&#039;&#039;Base Band Frames&#039;&#039;&#039; (BBFrames)&lt;br /&gt;
&lt;br /&gt;
The control interface is &#039;&#039;&#039;RMCPv2 protocol&#039;&#039;&#039; over async serial TTL or I2C — implemented by the &amp;lt;code&amp;gt;rmcp_i2c&amp;lt;/code&amp;gt; kernel module. &lt;br /&gt;
This is the mechanism to switch output to BBFrame mode.&lt;br /&gt;
&lt;br /&gt;
See also this PDF: https://www.melcom.co.uk/uploads/newdvbdemodntc7044_01.pdf&lt;br /&gt;
&lt;br /&gt;
[[File:20250429 153804.jpg|thumb|center]]&lt;br /&gt;
&lt;br /&gt;
=== Inputs/Outputs ===&lt;br /&gt;
&lt;br /&gt;
* 2x RF/satellite inputs (RF1, RF2) — 950–2150 MHz, 256 kSym/s – 45 MSym/s&lt;br /&gt;
* DVB-ASI input/output (currently set to RECEIVE mode)&lt;br /&gt;
* 2x SDI outputs (SD scaling)&lt;br /&gt;
* CVBS output&lt;br /&gt;
* 3x Ethernet (eth0, eth1, eth2)&lt;br /&gt;
* Serial: ttyS0 @ 115200, ttyBA&lt;br /&gt;
* L-Band Modulator option slot — &#039;&#039;&#039;not populated&#039;&#039;&#039; (&amp;lt;code&amp;gt;/dev/ntmod&amp;lt;/code&amp;gt; = &amp;quot;No such device&amp;quot;)&lt;br /&gt;
&lt;br /&gt;
== Firmware / Software ==&lt;br /&gt;
&lt;br /&gt;
=== CF Card Partition Layout ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Partition !! Size !! Contents&lt;br /&gt;
|-&lt;br /&gt;
| p5 || 137M || GNU sysroot — gcc-3.4.4 / glibc-2.3.5, PPC cross toolchain&lt;br /&gt;
|-&lt;br /&gt;
| p6 || 1.1M || &#039;&#039;&#039;Firmware&#039;&#039;&#039; — adtec/RD-60/1.12.08 and 1.12.12&lt;br /&gt;
|-&lt;br /&gt;
| p7 || 3.4M || Minimal initrd (busybox, bash, minimal libs)&lt;br /&gt;
|-&lt;br /&gt;
| p8 || 24M || Runtime/data (logs, DVC profiles, media)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
* Current firmware: &#039;&#039;&#039;1.12.12&#039;&#039;&#039; (symlinked at &amp;lt;code&amp;gt;/opt/pkg/oem&amp;lt;/code&amp;gt;)&lt;br /&gt;
* Previous firmware: &#039;&#039;&#039;1.12.08&#039;&#039;&#039; (symlinked at &amp;lt;code&amp;gt;/opt/pkg/oem_prev&amp;lt;/code&amp;gt;)&lt;br /&gt;
&lt;br /&gt;
=== p8 Runtime Directories ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Dir !! Purpose&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;dvc/&amp;lt;/code&amp;gt; || Tuner device profile files (.DVC)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;keys/&amp;lt;/code&amp;gt; || Empty — key material generated at runtime&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;log/&amp;lt;/code&amp;gt; || Rotated system logs&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;media/&amp;lt;/code&amp;gt; || Media files&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;.meta/&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;freg.db&amp;lt;/code&amp;gt; — feature registry SQLite DB&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;mvl/&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;osd/&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;rdy/&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;schmi/&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;shd/&amp;lt;/code&amp;gt; || Runtime state dirs (mostly empty)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Key Binaries (&amp;lt;code&amp;gt;/usr/local/sbin/&amp;lt;/code&amp;gt;) ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Binary !! Purpose&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;sysd&amp;lt;/code&amp;gt; || Main system daemon — tuner/demodulator config via XML&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;cmdld&amp;lt;/code&amp;gt; || Telnet API daemon (3 processes)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;menud&amp;lt;/code&amp;gt; || Front panel menu daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;fregd&amp;lt;/code&amp;gt; || Feature/license registry daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;dtrans&amp;lt;/code&amp;gt; || TS transport handler (&amp;lt;code&amp;gt;--slot=2 --id=BA14&amp;lt;/code&amp;gt;)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;dcmd&amp;lt;/code&amp;gt; || Device command interface for BA14&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;myles&amp;lt;/code&amp;gt; || Web API backend (SQLite)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;requestHandler&amp;lt;/code&amp;gt; || Apache CGI/FastCGI handler&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;snmpd&amp;lt;/code&amp;gt; || SNMP daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;snmpl&amp;lt;/code&amp;gt; || Internal SNMP poller — continuously queries Newtec MIB&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;vtosfifo&amp;lt;/code&amp;gt; || TS-to-FIFO bridge to &amp;lt;code&amp;gt;/dev/vtosfifo4&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;xcpServerd&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;xcpClientd&amp;lt;/code&amp;gt; || XCP protocol daemons (3 each)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;pard&amp;lt;/code&amp;gt; || Parallel interface daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;pnpd&amp;lt;/code&amp;gt; || PnP device daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;mirror&amp;lt;/code&amp;gt; || Mirror/redundancy daemon (runs as adtec)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Kernel Modules ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Module !! Purpose&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;newtec&amp;lt;/code&amp;gt; || Newtec 7044 demodulator driver — core BBFrame driver&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;newtec_dummy&amp;lt;/code&amp;gt; || Stub for absent optional demodulator hardware&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;dvblite&amp;lt;/code&amp;gt; || DVB lite core (depends on newtec) — exposes &amp;lt;code&amp;gt;dvblite_ioctl&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;rmcp_i2c&amp;lt;/code&amp;gt; || I2C transport for Newtec RMCP protocol&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;vtosfifo&amp;lt;/code&amp;gt; || TS FIFO device driver&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;rddma_ip&amp;lt;/code&amp;gt; || &#039;&#039;&#039;IP-over-satellite receive DMA engine (FPGA-backed)&#039;&#039;&#039;&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;ip_ingress_main&amp;lt;/code&amp;gt; || IP ingress pipeline (GSE/MPE over satellite)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;frpanel&amp;lt;/code&amp;gt; || Front panel driver&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;fanctrl&amp;lt;/code&amp;gt; / &amp;lt;code&amp;gt;pc96&amp;lt;/code&amp;gt; || Fan controller&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;proxyimg&amp;lt;/code&amp;gt; || Image proxy&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;epb&amp;lt;/code&amp;gt; || EPB bus driver&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;pnp&amp;lt;/code&amp;gt; || PnP device manager&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;fec&amp;lt;/code&amp;gt; / &amp;lt;code&amp;gt;ethfrm&amp;lt;/code&amp;gt; || Ethernet/FEC&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;pc73a&amp;lt;/code&amp;gt; / &amp;lt;code&amp;gt;pc93&amp;lt;/code&amp;gt; || Front panel dependencies&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Failed to load (hardware absent): &amp;lt;code&amp;gt;teamcast&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;nim&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;lnb_pwr&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;pc72&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Device Nodes ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Device !! Purpose&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/dvblite0-2&amp;lt;/code&amp;gt; || DVB lite interfaces&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/vtosfifo0-5&amp;lt;/code&amp;gt; || TS FIFO char devices (major 240)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/tuner0-3&amp;lt;/code&amp;gt; || Tuner interfaces (major 123)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/tuner_ledgr0-3&amp;lt;/code&amp;gt; || Tuner lock (green) LEDs&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/tuner_ledrd0-3&amp;lt;/code&amp;gt; || Tuner read LEDs&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/tuner_rst0-3&amp;lt;/code&amp;gt; || Tuner resets&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/ntmod&amp;lt;/code&amp;gt; || Newtec modulator — &#039;&#039;&#039;not populated&#039;&#039;&#039;&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== /proc Driver Interfaces ==&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;/proc/driver/dvblite/fe0/info&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
NAME=NTC/7044/BB DVB Demodulator&lt;br /&gt;
FREQ_MIN=950000 / FREQ_MAX=2150000&lt;br /&gt;
SYMRATE_MIN=256000 / SYMRATE_MAX=45000000&lt;br /&gt;
S_QPSK=1/2, 2/3, 3/4, 5/6, 6/7, 7/8, AUTO&lt;br /&gt;
S_8PSK=2/3, 5/6, 8/9, AUTO&lt;br /&gt;
S2_QPSK=1/4, 1/3, 1/2, 2/5, 2/3, 3/5, 3/4, 4/5, 5/6, 8/9, 9/10&lt;br /&gt;
S2_8PSK=2/3, 3/5, 3/4, 5/6, 8/9, 9/10&lt;br /&gt;
S2_16QAM=3/4, 7/8, AUTO&lt;br /&gt;
S2_16APSK=2/3, 3/4, 4/5, 5/6, 8/9, 9/10&lt;br /&gt;
S2_32APSK=3/4, 4/5, 5/6, 8/9, 9/10&lt;br /&gt;
SOFTWARE_LICENSE=165&lt;br /&gt;
SOFTWARE_VERSION=v2.34   20/03/13&lt;br /&gt;
FPGA_BITFILE_VERSION=v1.01 09/01/12&lt;br /&gt;
HARDWARE_VERSION=v3.0&lt;br /&gt;
SERIAL_NUM=30091216&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;/proc/driver/dvblite/fe0/stats&amp;lt;/code&amp;gt; (no signal) ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
LOCK=UNLOCKED&lt;br /&gt;
RECV_LEVEL=-70.00&lt;br /&gt;
INTRATE=41470588&lt;br /&gt;
MOD_FEC=QPSK_3/4&lt;br /&gt;
BB_CRC_ERRORS=N/A        &amp;lt;- populates with live signal&lt;br /&gt;
DUMMY_PL_RATIO=N/A       &amp;lt;- populates with live signal&lt;br /&gt;
ISI_FILTER_BYTE=N/A      &amp;lt;- populates with live signal&lt;br /&gt;
BASEBAND_LEN=N/A         &amp;lt;- populates with live signal&lt;br /&gt;
FRAMES_SEC=N/A           &amp;lt;- populates with live signal&lt;br /&gt;
ALARMS=0000110001011000&lt;br /&gt;
STATE=READY&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
fe1 has same structure but &amp;lt;code&amp;gt;NAME=NTC7044&amp;lt;/code&amp;gt; (no BB suffix, no license).&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;/proc/driver/vtosfifo/chn&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
Channel 0 processed 16620 TS frames during session. Channel 4 processed 1619.&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;/proc/driver/rddma/&amp;lt;/code&amp;gt; — FPGA DMA engine ===&lt;br /&gt;
&lt;br /&gt;
* Channel 3 active: Control=&amp;lt;code&amp;gt;49C003C0&amp;lt;/code&amp;gt;, Src=&amp;lt;code&amp;gt;03F01C00&amp;lt;/code&amp;gt; (FPGA mapped)&lt;br /&gt;
* 3.98M timer IRQs, 3.98M &amp;quot;No Data&amp;quot; — idle, no satellite IP stream&lt;br /&gt;
* PID &amp;lt;code&amp;gt;0x01E1&amp;lt;/code&amp;gt; (481) being tracked&lt;br /&gt;
&lt;br /&gt;
== Kernel Module Internals (&amp;lt;code&amp;gt;strings&amp;lt;/code&amp;gt; analysis) ==&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;newtec.ko&amp;lt;/code&amp;gt; — BBFrame symbols ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
BB_CRC_ERRORS / BB_CRC_ERRORS_CURRENT / BB_CRC_ERRORS_NEXT&lt;br /&gt;
BB_DATA_FIELD_LEN / BB_DATA_FIELD_LEN_CURRENT / BB_DATA_FIELD_LEN_NEXT&lt;br /&gt;
BB_FRAMES&lt;br /&gt;
BB_GAIN / BB_GAIN_CURRENT / BB_GAIN_NEXT&lt;br /&gt;
BASEBAND_LEN&lt;br /&gt;
ISI / ISI_CTRL / ISI_CTRL_STRUCT / ISI_CTRL_STRUCT_FIELDS&lt;br /&gt;
ISI_FILTER_BYTE / ISI_MASK&lt;br /&gt;
SAT_BB_GAIN&lt;br /&gt;
ntc_debug  (module param, uint)&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;BB_DATA_FIELD_LEN&amp;lt;/code&amp;gt; and &amp;lt;code&amp;gt;BB_FRAMES&amp;lt;/code&amp;gt; suggest the driver tracks individual baseband frames, not just statistics. Very promising for BBFrame capture.&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;dvblite.ko&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
Contains &amp;lt;code&amp;gt;dvblite_ioctl&amp;lt;/code&amp;gt; — a kernel ioctl interface on &amp;lt;code&amp;gt;/dev/dvblite0&amp;lt;/code&amp;gt;. Commands unknown — to be investigated with a live signal.&lt;br /&gt;
&lt;br /&gt;
== Network Services ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Service !! Port !! Notes&lt;br /&gt;
|-&lt;br /&gt;
| SSH || 22 || Legacy KEX only (diffie-hellman-group1-sha1)&lt;br /&gt;
|-&lt;br /&gt;
| Telnet API || 23 || &amp;lt;code&amp;gt;cmdld&amp;lt;/code&amp;gt; via xinetd&lt;br /&gt;
|-&lt;br /&gt;
| FTP || 21 || pure-ftpd&lt;br /&gt;
|-&lt;br /&gt;
| HTTP || 80 || Apache + myles + requestHandler&lt;br /&gt;
|-&lt;br /&gt;
| SNMP || 161 || Community &amp;lt;code&amp;gt;public&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| mDNS || 5353 || &amp;lt;code&amp;gt;GOFFERT.local&amp;lt;/code&amp;gt;&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
# SSH/SCP&lt;br /&gt;
ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa root@&amp;lt;ip&amp;gt;&lt;br /&gt;
scp -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa root@&amp;lt;ip&amp;gt;:/path /local&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Credentials (Default/Hardcoded — ZSL-2020-5603 / ExploitDB 48954) ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! User !! Password !! Notes&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;root&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;1root!&amp;lt;/code&amp;gt; || Full root SSH&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;admin&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;1admin!&amp;lt;/code&amp;gt; || Also root via sudoers&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;adtec&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;none&amp;lt;/code&amp;gt; || Telnet API / web UI&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;adtecftp&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;adtecftp2231&amp;lt;/code&amp;gt; || FTP only&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
* Password hashes: DES crypt — crackable in seconds with &amp;lt;code&amp;gt;john&amp;lt;/code&amp;gt;&lt;br /&gt;
* &amp;lt;code&amp;gt;apache ALL=(ALL) NOPASSWD: ALL&amp;lt;/code&amp;gt; in sudoers&lt;br /&gt;
* Diagnostic package passphrase: &#039;&#039;&#039;&amp;lt;code&amp;gt;iMoo3jio&amp;lt;/code&amp;gt;&#039;&#039;&#039; (hardcoded, leaks in &amp;lt;code&amp;gt;ps aux&amp;lt;/code&amp;gt;)&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
gpg --passphrase &amp;quot;iMoo3jio&amp;quot; --batch --ignore-mdc-error --decrypt RD-60_*.tar.gpg | tar xf -&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== APIs ==&lt;br /&gt;
&lt;br /&gt;
=== Telnet API ===&lt;br /&gt;
&lt;br /&gt;
Connect: &amp;lt;code&amp;gt;telnet &amp;lt;ip&amp;gt;&amp;lt;/code&amp;gt;, login &amp;lt;code&amp;gt;adtec&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;none&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
*.SYSD SHELLCMD &amp;lt;cmd&amp;gt;          # arbitrary root shell execution!&lt;br /&gt;
*.SNMP ADTEC-NT-DEMOD-MIB::satFeedType.0 = dvbs2   # configure tuner&lt;br /&gt;
*.SNMP ADTEC-NT-DEMOD-MIB::satFeedDownlink.0 = 10960000&lt;br /&gt;
*.SNMP .1.3.6.1.4.1.19587.6000.3.999.0 i 0         # commit/apply&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== SNMP — Newtec Demodulator MIB ===&lt;br /&gt;
&lt;br /&gt;
OID base: &amp;lt;code&amp;gt;.1.3.6.1.4.1.19587&amp;lt;/code&amp;gt;, MIB: &amp;lt;code&amp;gt;ADTEC-NT-DEMOD-MIB&amp;lt;/code&amp;gt;, community: &amp;lt;code&amp;gt;public&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
snmpwalk -v2c -c public &amp;lt;ip&amp;gt; .1.3.6.1.4.1.19587&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Key OIDs: &amp;lt;code&amp;gt;tunerLock&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;recvLevel&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;esNo&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;linkMargin&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;modFec&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;rolloff&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;pilot&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;fecFrameType&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;unCorrFs&amp;lt;/code&amp;gt;, &#039;&#039;&#039;&amp;lt;code&amp;gt;bbCrcerrors&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &#039;&#039;&#039;&amp;lt;code&amp;gt;basebandLen&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &#039;&#039;&#039;&amp;lt;code&amp;gt;dummyPlRatio&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &#039;&#039;&#039;&amp;lt;code&amp;gt;isiFilterByte&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &#039;&#039;&#039;&amp;lt;code&amp;gt;framesSec&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &amp;lt;code&amp;gt;satFeedType&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;satFeedDownlink&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;satFeedSymRate&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;satFeedModulation&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;lnbEnable&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;lnbPolarity&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;lnbTone&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== DVC Profile Format ===&lt;br /&gt;
&lt;br /&gt;
SNMP SET commands as tuner presets, applied via Telnet API or web UI.&lt;br /&gt;
&lt;br /&gt;
== Saved Tuner Profiles ==&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;prfturktest.DVC&amp;lt;/code&amp;gt; (2018-04-28) ===&lt;br /&gt;
&lt;br /&gt;
* DVB-S, &#039;&#039;&#039;10762 MHz&#039;&#039;&#039;, KU 9750 LO → &#039;&#039;&#039;1012 MHz&#039;&#039;&#039; L-band&lt;br /&gt;
* &#039;&#039;&#039;30 MSym/s&#039;&#039;&#039;, QPSK 3/4, roll-off 35%&lt;br /&gt;
* Was &#039;&#039;&#039;LOCKED&#039;&#039;&#039; at -32 dBm when saved&lt;br /&gt;
* &amp;lt;code&amp;gt;bbCrcerrors = 1&amp;lt;/code&amp;gt; — &#039;&#039;&#039;BBFrame counter was active and non-zero!&#039;&#039;&#039;&lt;br /&gt;
* Likely &#039;&#039;&#039;Türksat 42°E&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;prfMUX.DVC&amp;lt;/code&amp;gt; (2018-04-28) ===&lt;br /&gt;
&lt;br /&gt;
* DVB-S2, &#039;&#039;&#039;10960 MHz&#039;&#039;&#039;, KU 9750 LO → &#039;&#039;&#039;1210 MHz&#039;&#039;&#039; L-band&lt;br /&gt;
* &#039;&#039;&#039;8.352 MSym/s&#039;&#039;&#039;, 16APSK 2/3, roll-off 20%, pilot ON, normal frames, CCM&lt;br /&gt;
* Was unlocked when saved&lt;br /&gt;
&lt;br /&gt;
== Licensed Features (Key ID 165) ==&lt;br /&gt;
&lt;br /&gt;
DVB-DSNG + DVB-S2 + QPSK + 8-PSK + 16-QAM/16APSK + 32APSK + Symbol Rate &amp;lt;= 33 MBaud + ACM + &#039;&#039;&#039;Single TS/GS or Multiple Streams&#039;&#039;&#039; + &#039;&#039;&#039;(Baseband Frames)&#039;&#039;&#039; + no ACM client + no AES&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;BBFrame access is explicitly licensed and enabled.&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
== Encryption / CA ==&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;BISS-1 key&#039;&#039;&#039; in &amp;lt;code&amp;gt;dtrans.xml&amp;lt;/code&amp;gt;: &amp;lt;code&amp;gt;69A969BBECA0&amp;lt;/code&amp;gt;&lt;br /&gt;
* &#039;&#039;&#039;Viaccess&#039;&#039;&#039; (CA ID 0x0005) feed seen in logs — no card present, could not decrypt&lt;br /&gt;
&lt;br /&gt;
== IP-over-Satellite ==&lt;br /&gt;
&lt;br /&gt;
The unit has a full satellite IP receive stack beyond TS decoding:&lt;br /&gt;
&lt;br /&gt;
* &amp;lt;code&amp;gt;rddma_ip&amp;lt;/code&amp;gt; — FPGA-backed DMA for IP-from-satellite&lt;br /&gt;
* &amp;lt;code&amp;gt;ip_ingress_main&amp;lt;/code&amp;gt; — GSE/MPE ingress pipeline&lt;br /&gt;
* FPGA Channel 3 active at &amp;lt;code&amp;gt;03F01C00&amp;lt;/code&amp;gt;&lt;br /&gt;
* Currently idle — no GSE/MPE stream configured&lt;br /&gt;
&lt;br /&gt;
== Security Summary ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Issue !! Detail&lt;br /&gt;
|-&lt;br /&gt;
| Default root creds || &amp;lt;code&amp;gt;root&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;1root!&amp;lt;/code&amp;gt; over SSH&lt;br /&gt;
|-&lt;br /&gt;
| Telnet RCE || &amp;lt;code&amp;gt;*.SYSD SHELLCMD&amp;lt;/code&amp;gt; = root shell with &amp;lt;code&amp;gt;adtec&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;none&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Sudoers || &amp;lt;code&amp;gt;apache ALL=(ALL) NOPASSWD: ALL&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Shared SSH host keys || Same across all units (stored on CF card)&lt;br /&gt;
|-&lt;br /&gt;
| Weak password hashes || DES crypt, trivially crackable&lt;br /&gt;
|-&lt;br /&gt;
| GPG passphrase leak || &amp;lt;code&amp;gt;iMoo3jio&amp;lt;/code&amp;gt; visible in &amp;lt;code&amp;gt;ps aux&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Public exploit || ZSL-2020-5603 / ExploitDB 48954&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Other ==&lt;br /&gt;
== Front Panel ==&lt;br /&gt;
&lt;br /&gt;
* Driver: &amp;lt;code&amp;gt;frpanel.ko&amp;lt;/code&amp;gt; (depends on &amp;lt;code&amp;gt;pc93&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;pc73a&amp;lt;/code&amp;gt;)&lt;br /&gt;
* Device nodes: &amp;lt;code&amp;gt;/dev/frpanel0&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;/dev/frpanel1&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;/dev/frpanel2&amp;lt;/code&amp;gt;&lt;br /&gt;
* Display: 2 rows × 40 columns character LCD (PC93 I2C MCU)&lt;br /&gt;
* LCD API in &amp;lt;code&amp;gt;libsolib.so&amp;lt;/code&amp;gt;: &amp;lt;code&amp;gt;FpLcdKpInit()&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;LcdClear()&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;LcdWriteStr(char*, pos, len)&amp;lt;/code&amp;gt;&lt;br /&gt;
* Writing to &amp;lt;code&amp;gt;/dev/frpanel2&amp;lt;/code&amp;gt; activates the backlight&lt;br /&gt;
* &amp;lt;code&amp;gt;menud&amp;lt;/code&amp;gt; daemon owns the display — must be stopped before direct writes&lt;br /&gt;
* Proc interface: &amp;lt;code&amp;gt;/proc/driver/frpanel/&amp;lt;/code&amp;gt; (rows, cols, screen, type, version, access)&lt;br /&gt;
&lt;br /&gt;
== Images ==&lt;br /&gt;
&amp;lt;gallery&amp;gt;&lt;br /&gt;
20250429_153750.jpg&lt;br /&gt;
20250429_153759.jpg&lt;br /&gt;
20250429_153808.jpg&lt;br /&gt;
20250429_153812.jpg&lt;br /&gt;
&amp;lt;/gallery&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== TODO (requires dish connected) ==&lt;br /&gt;
&lt;br /&gt;
* [ ] Read &amp;lt;code&amp;gt;/proc/driver/dvblite/fe0/stats&amp;lt;/code&amp;gt; with live signal — observe all BB* fields&lt;br /&gt;
* [ ] SNMP walk full &amp;lt;code&amp;gt;.1.3.6.1.4.1.19587&amp;lt;/code&amp;gt; with live signal&lt;br /&gt;
* [ ] Investigate &amp;lt;code&amp;gt;dvblite_ioctl&amp;lt;/code&amp;gt; on &amp;lt;code&amp;gt;/dev/dvblite0&amp;lt;/code&amp;gt;&lt;br /&gt;
* [ ] Enable &amp;lt;code&amp;gt;ntc_debug&amp;lt;/code&amp;gt; module param and watch dmesg&lt;br /&gt;
* [ ] Try ISI multistream filtering via SNMP SET&lt;br /&gt;
* [ ] Investigate &amp;lt;code&amp;gt;rddma_ip&amp;lt;/code&amp;gt; with GSE/MPE satellite signal&lt;br /&gt;
* [ ] Lock on Türksat 42°E: 10762 MHz / 30 MSym/s / QPSK 3/4 (known working)&lt;br /&gt;
* [ ] Identify prfMUX transponder on Lyngsat (10960 MHz / 8.352 MSym/s / 16APSK 2/3)&lt;br /&gt;
* [ ] Explore Telnet API &amp;lt;code&amp;gt;*.NTC&amp;lt;/code&amp;gt; command namespace&lt;br /&gt;
* [ ] Investigate &amp;lt;code&amp;gt;xcpServerd&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;xcpClientd&amp;lt;/code&amp;gt; — XCP protocol capabilities&lt;br /&gt;
* [ ] Check if &amp;lt;code&amp;gt;schnv.DVC&amp;lt;/code&amp;gt; populates after a lock (empty offline)&lt;br /&gt;
* [ ] Read &amp;lt;code&amp;gt;freg.db&amp;lt;/code&amp;gt; contents — full feature registry dump&lt;br /&gt;
* [ ] Write to LCD display — cross-compile against glibc 2.3.5 and call &amp;lt;code&amp;gt;LcdWriteStr()&amp;lt;/code&amp;gt; from &amp;lt;code&amp;gt;libsolib.so&amp;lt;/code&amp;gt;&lt;br /&gt;
* [ ] Send RMCP command via &amp;lt;code&amp;gt;rmcp_i2c&amp;lt;/code&amp;gt; to switch NTC/7044/BB output to BBFrame mode&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=File:Adtec_rd60_internals5.jpg&amp;diff=15890</id>
		<title>File:Adtec rd60 internals5.jpg</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=File:Adtec_rd60_internals5.jpg&amp;diff=15890"/>
		<updated>2026-04-11T23:13:38Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=File:Adtec_rd60_internals4.jpg&amp;diff=15889</id>
		<title>File:Adtec rd60 internals4.jpg</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=File:Adtec_rd60_internals4.jpg&amp;diff=15889"/>
		<updated>2026-04-11T23:13:22Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=File:Adtec_rd60_internals3.jpg&amp;diff=15888</id>
		<title>File:Adtec rd60 internals3.jpg</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=File:Adtec_rd60_internals3.jpg&amp;diff=15888"/>
		<updated>2026-04-11T23:13:06Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=File:Adtec_rd60_internals2.jpg&amp;diff=15887</id>
		<title>File:Adtec rd60 internals2.jpg</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=File:Adtec_rd60_internals2.jpg&amp;diff=15887"/>
		<updated>2026-04-11T23:12:44Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=File:Adtec_rd60_internals1.jpg&amp;diff=15886</id>
		<title>File:Adtec rd60 internals1.jpg</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=File:Adtec_rd60_internals1.jpg&amp;diff=15886"/>
		<updated>2026-04-11T23:12:19Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=File:Adtec_rd60_internals_overview.jpg&amp;diff=15885</id>
		<title>File:Adtec rd60 internals overview.jpg</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=File:Adtec_rd60_internals_overview.jpg&amp;diff=15885"/>
		<updated>2026-04-11T23:12:07Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=File:Adtec_RD-60.jpg&amp;diff=15884</id>
		<title>File:Adtec RD-60.jpg</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=File:Adtec_RD-60.jpg&amp;diff=15884"/>
		<updated>2026-04-11T23:08:39Z</updated>

		<summary type="html">&lt;p&gt;Melan: Melan uploaded a new version of File:Adtec RD-60.jpg&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=Adtec_RD-60&amp;diff=15883</id>
		<title>Adtec RD-60</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=Adtec_RD-60&amp;diff=15883"/>
		<updated>2026-04-11T23:00:57Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Project&lt;br /&gt;
|Name=Adtec RD-60&lt;br /&gt;
|Status=Active&lt;br /&gt;
|Niche=Sdr&lt;br /&gt;
|Tool=No&lt;br /&gt;
|Location=the roof&lt;br /&gt;
}}&lt;br /&gt;
== Adtec RD-60 IRD ==&lt;br /&gt;
The &#039;&#039;&#039;Adtec RD-60&#039;&#039;&#039; is a 1RU integrated receiver/decoder (IRD).&lt;br /&gt;
&lt;br /&gt;
It seems the Adtec RD-60 might expose &#039;&#039;&#039;DVB-S2 baseband frames (BBFrames)&#039;&#039;&#039; below the TS layer, this might be very useful as part of the &#039;&#039;&#039;dontlookup&#039;&#039;&#039; satellite interception paper replication project. See [[dontlookup]]&lt;br /&gt;
&lt;br /&gt;
= Reverse Engineering Notes =&lt;br /&gt;
== Hardware ==&lt;br /&gt;
&lt;br /&gt;
=== Main Unit ===&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;Model:&#039;&#039;&#039; Adtec RD-60 MultiCODEC Receiver/Decoder (IRD)&lt;br /&gt;
* &#039;&#039;&#039;Hostname:&#039;&#039;&#039; &amp;lt;code&amp;gt;GOFFERT&amp;lt;/code&amp;gt;&lt;br /&gt;
* &#039;&#039;&#039;IP:&#039;&#039;&#039; 10.1.2.172 (DHCP)&lt;br /&gt;
* &#039;&#039;&#039;CPU:&#039;&#039;&#039; IBM PowerPC PPC405GPr @ 399 MHz (GemPPC Iolite platform)&lt;br /&gt;
* &#039;&#039;&#039;PLB bus:&#039;&#039;&#039; 133 MHz | &#039;&#039;&#039;PCI bus:&#039;&#039;&#039; 33 MHz&lt;br /&gt;
* &#039;&#039;&#039;Kernel:&#039;&#039;&#039; Linux 2.6.14-gemppc-iolite&lt;br /&gt;
* &#039;&#039;&#039;Front panel:&#039;&#039;&#039; Character LCD/VFD — text only, ~40 chars wide.&lt;br /&gt;
* &#039;&#039;&#039;Storage:&#039;&#039;&#039; CompactFlash card (8 partitions, 4 used)&lt;br /&gt;
&lt;br /&gt;
=== Demodulator Board ===&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;Slot 2:&#039;&#039;&#039; &amp;lt;code&amp;gt;BA14&amp;lt;/code&amp;gt; — PC87 ver 1.4 (main decoder board)&lt;br /&gt;
* &#039;&#039;&#039;Slot 99:&#039;&#039;&#039; &amp;lt;code&amp;gt;7044BB&amp;lt;/code&amp;gt; — &#039;&#039;&#039;Newtec NTC/7044/BB DVB Demodulator&#039;&#039;&#039;&lt;br /&gt;
** PRM firmware: &#039;&#039;&#039;v2.34&#039;&#039;&#039; (20/03/13)&lt;br /&gt;
** FPGA bitfile: v1.01 (09/01/12)&lt;br /&gt;
** Hardware: v3.0&lt;br /&gt;
** Serial: &#039;&#039;&#039;30091216&#039;&#039;&#039;&lt;br /&gt;
** Software ID: NTC/6381 DVB Demodulator&lt;br /&gt;
** Product ID: NTC/7044/BB.BCDCBCAA.x.B&lt;br /&gt;
** License: &#039;&#039;&#039;165&#039;&#039;&#039; (includes Baseband Frames — see below)&lt;br /&gt;
** Communicates via I2C (&amp;lt;code&amp;gt;rmcp_i2c&amp;lt;/code&amp;gt; kernel module)&lt;br /&gt;
** &amp;lt;code&amp;gt;BB&amp;lt;/code&amp;gt; suffix = BaseBand licensed and capable&lt;br /&gt;
&lt;br /&gt;
According to the official Newtec datasheet, the NTC/7044/BB supports explicit &#039;&#039;&#039;output mode switching&#039;&#039;&#039; between:&lt;br /&gt;
* Single transport stream&lt;br /&gt;
* Generic stream  &lt;br /&gt;
* &#039;&#039;&#039;Base Band Frames&#039;&#039;&#039; (BBFrames)&lt;br /&gt;
&lt;br /&gt;
The control interface is &#039;&#039;&#039;RMCPv2 protocol&#039;&#039;&#039; over async serial TTL or I2C — implemented by the &amp;lt;code&amp;gt;rmcp_i2c&amp;lt;/code&amp;gt; kernel module. &lt;br /&gt;
This is the mechanism to switch output to BBFrame mode.&lt;br /&gt;
&lt;br /&gt;
See also this PDF: https://www.melcom.co.uk/uploads/newdvbdemodntc7044_01.pdf&lt;br /&gt;
&lt;br /&gt;
=== Inputs/Outputs ===&lt;br /&gt;
&lt;br /&gt;
* 2x RF/satellite inputs (RF1, RF2) — 950–2150 MHz, 256 kSym/s – 45 MSym/s&lt;br /&gt;
* DVB-ASI input/output (currently set to RECEIVE mode)&lt;br /&gt;
* 2x SDI outputs (SD scaling)&lt;br /&gt;
* CVBS output&lt;br /&gt;
* 3x Ethernet (eth0, eth1, eth2)&lt;br /&gt;
* Serial: ttyS0 @ 115200, ttyBA&lt;br /&gt;
* L-Band Modulator option slot — &#039;&#039;&#039;not populated&#039;&#039;&#039; (&amp;lt;code&amp;gt;/dev/ntmod&amp;lt;/code&amp;gt; = &amp;quot;No such device&amp;quot;)&lt;br /&gt;
&lt;br /&gt;
== Firmware / Software ==&lt;br /&gt;
&lt;br /&gt;
=== CF Card Partition Layout ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Partition !! Size !! Contents&lt;br /&gt;
|-&lt;br /&gt;
| p5 || 137M || GNU sysroot — gcc-3.4.4 / glibc-2.3.5, PPC cross toolchain&lt;br /&gt;
|-&lt;br /&gt;
| p6 || 1.1M || &#039;&#039;&#039;Firmware&#039;&#039;&#039; — adtec/RD-60/1.12.08 and 1.12.12&lt;br /&gt;
|-&lt;br /&gt;
| p7 || 3.4M || Minimal initrd (busybox, bash, minimal libs)&lt;br /&gt;
|-&lt;br /&gt;
| p8 || 24M || Runtime/data (logs, DVC profiles, media)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
* Current firmware: &#039;&#039;&#039;1.12.12&#039;&#039;&#039; (symlinked at &amp;lt;code&amp;gt;/opt/pkg/oem&amp;lt;/code&amp;gt;)&lt;br /&gt;
* Previous firmware: &#039;&#039;&#039;1.12.08&#039;&#039;&#039; (symlinked at &amp;lt;code&amp;gt;/opt/pkg/oem_prev&amp;lt;/code&amp;gt;)&lt;br /&gt;
&lt;br /&gt;
=== p8 Runtime Directories ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Dir !! Purpose&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;dvc/&amp;lt;/code&amp;gt; || Tuner device profile files (.DVC)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;keys/&amp;lt;/code&amp;gt; || Empty — key material generated at runtime&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;log/&amp;lt;/code&amp;gt; || Rotated system logs&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;media/&amp;lt;/code&amp;gt; || Media files&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;.meta/&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;freg.db&amp;lt;/code&amp;gt; — feature registry SQLite DB&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;mvl/&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;osd/&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;rdy/&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;schmi/&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;shd/&amp;lt;/code&amp;gt; || Runtime state dirs (mostly empty)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Key Binaries (&amp;lt;code&amp;gt;/usr/local/sbin/&amp;lt;/code&amp;gt;) ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Binary !! Purpose&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;sysd&amp;lt;/code&amp;gt; || Main system daemon — tuner/demodulator config via XML&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;cmdld&amp;lt;/code&amp;gt; || Telnet API daemon (3 processes)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;menud&amp;lt;/code&amp;gt; || Front panel menu daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;fregd&amp;lt;/code&amp;gt; || Feature/license registry daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;dtrans&amp;lt;/code&amp;gt; || TS transport handler (&amp;lt;code&amp;gt;--slot=2 --id=BA14&amp;lt;/code&amp;gt;)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;dcmd&amp;lt;/code&amp;gt; || Device command interface for BA14&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;myles&amp;lt;/code&amp;gt; || Web API backend (SQLite)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;requestHandler&amp;lt;/code&amp;gt; || Apache CGI/FastCGI handler&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;snmpd&amp;lt;/code&amp;gt; || SNMP daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;snmpl&amp;lt;/code&amp;gt; || Internal SNMP poller — continuously queries Newtec MIB&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;vtosfifo&amp;lt;/code&amp;gt; || TS-to-FIFO bridge to &amp;lt;code&amp;gt;/dev/vtosfifo4&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;xcpServerd&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;xcpClientd&amp;lt;/code&amp;gt; || XCP protocol daemons (3 each)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;pard&amp;lt;/code&amp;gt; || Parallel interface daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;pnpd&amp;lt;/code&amp;gt; || PnP device daemon&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;mirror&amp;lt;/code&amp;gt; || Mirror/redundancy daemon (runs as adtec)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Kernel Modules ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Module !! Purpose&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;newtec&amp;lt;/code&amp;gt; || Newtec 7044 demodulator driver — core BBFrame driver&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;newtec_dummy&amp;lt;/code&amp;gt; || Stub for absent optional demodulator hardware&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;dvblite&amp;lt;/code&amp;gt; || DVB lite core (depends on newtec) — exposes &amp;lt;code&amp;gt;dvblite_ioctl&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;rmcp_i2c&amp;lt;/code&amp;gt; || I2C transport for Newtec RMCP protocol&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;vtosfifo&amp;lt;/code&amp;gt; || TS FIFO device driver&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;rddma_ip&amp;lt;/code&amp;gt; || &#039;&#039;&#039;IP-over-satellite receive DMA engine (FPGA-backed)&#039;&#039;&#039;&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;ip_ingress_main&amp;lt;/code&amp;gt; || IP ingress pipeline (GSE/MPE over satellite)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;frpanel&amp;lt;/code&amp;gt; || Front panel driver&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;fanctrl&amp;lt;/code&amp;gt; / &amp;lt;code&amp;gt;pc96&amp;lt;/code&amp;gt; || Fan controller&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;proxyimg&amp;lt;/code&amp;gt; || Image proxy&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;epb&amp;lt;/code&amp;gt; || EPB bus driver&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;pnp&amp;lt;/code&amp;gt; || PnP device manager&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;fec&amp;lt;/code&amp;gt; / &amp;lt;code&amp;gt;ethfrm&amp;lt;/code&amp;gt; || Ethernet/FEC&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;pc73a&amp;lt;/code&amp;gt; / &amp;lt;code&amp;gt;pc93&amp;lt;/code&amp;gt; || Front panel dependencies&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Failed to load (hardware absent): &amp;lt;code&amp;gt;teamcast&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;nim&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;lnb_pwr&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;pc72&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Device Nodes ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Device !! Purpose&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/dvblite0-2&amp;lt;/code&amp;gt; || DVB lite interfaces&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/vtosfifo0-5&amp;lt;/code&amp;gt; || TS FIFO char devices (major 240)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/tuner0-3&amp;lt;/code&amp;gt; || Tuner interfaces (major 123)&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/tuner_ledgr0-3&amp;lt;/code&amp;gt; || Tuner lock (green) LEDs&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/tuner_ledrd0-3&amp;lt;/code&amp;gt; || Tuner read LEDs&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/tuner_rst0-3&amp;lt;/code&amp;gt; || Tuner resets&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;/dev/ntmod&amp;lt;/code&amp;gt; || Newtec modulator — &#039;&#039;&#039;not populated&#039;&#039;&#039;&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== /proc Driver Interfaces ==&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;/proc/driver/dvblite/fe0/info&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
NAME=NTC/7044/BB DVB Demodulator&lt;br /&gt;
FREQ_MIN=950000 / FREQ_MAX=2150000&lt;br /&gt;
SYMRATE_MIN=256000 / SYMRATE_MAX=45000000&lt;br /&gt;
S_QPSK=1/2, 2/3, 3/4, 5/6, 6/7, 7/8, AUTO&lt;br /&gt;
S_8PSK=2/3, 5/6, 8/9, AUTO&lt;br /&gt;
S2_QPSK=1/4, 1/3, 1/2, 2/5, 2/3, 3/5, 3/4, 4/5, 5/6, 8/9, 9/10&lt;br /&gt;
S2_8PSK=2/3, 3/5, 3/4, 5/6, 8/9, 9/10&lt;br /&gt;
S2_16QAM=3/4, 7/8, AUTO&lt;br /&gt;
S2_16APSK=2/3, 3/4, 4/5, 5/6, 8/9, 9/10&lt;br /&gt;
S2_32APSK=3/4, 4/5, 5/6, 8/9, 9/10&lt;br /&gt;
SOFTWARE_LICENSE=165&lt;br /&gt;
SOFTWARE_VERSION=v2.34   20/03/13&lt;br /&gt;
FPGA_BITFILE_VERSION=v1.01 09/01/12&lt;br /&gt;
HARDWARE_VERSION=v3.0&lt;br /&gt;
SERIAL_NUM=30091216&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;/proc/driver/dvblite/fe0/stats&amp;lt;/code&amp;gt; (no signal) ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
LOCK=UNLOCKED&lt;br /&gt;
RECV_LEVEL=-70.00&lt;br /&gt;
INTRATE=41470588&lt;br /&gt;
MOD_FEC=QPSK_3/4&lt;br /&gt;
BB_CRC_ERRORS=N/A        &amp;lt;- populates with live signal&lt;br /&gt;
DUMMY_PL_RATIO=N/A       &amp;lt;- populates with live signal&lt;br /&gt;
ISI_FILTER_BYTE=N/A      &amp;lt;- populates with live signal&lt;br /&gt;
BASEBAND_LEN=N/A         &amp;lt;- populates with live signal&lt;br /&gt;
FRAMES_SEC=N/A           &amp;lt;- populates with live signal&lt;br /&gt;
ALARMS=0000110001011000&lt;br /&gt;
STATE=READY&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
fe1 has same structure but &amp;lt;code&amp;gt;NAME=NTC7044&amp;lt;/code&amp;gt; (no BB suffix, no license).&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;/proc/driver/vtosfifo/chn&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
Channel 0 processed 16620 TS frames during session. Channel 4 processed 1619.&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;/proc/driver/rddma/&amp;lt;/code&amp;gt; — FPGA DMA engine ===&lt;br /&gt;
&lt;br /&gt;
* Channel 3 active: Control=&amp;lt;code&amp;gt;49C003C0&amp;lt;/code&amp;gt;, Src=&amp;lt;code&amp;gt;03F01C00&amp;lt;/code&amp;gt; (FPGA mapped)&lt;br /&gt;
* 3.98M timer IRQs, 3.98M &amp;quot;No Data&amp;quot; — idle, no satellite IP stream&lt;br /&gt;
* PID &amp;lt;code&amp;gt;0x01E1&amp;lt;/code&amp;gt; (481) being tracked&lt;br /&gt;
&lt;br /&gt;
== Kernel Module Internals (&amp;lt;code&amp;gt;strings&amp;lt;/code&amp;gt; analysis) ==&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;newtec.ko&amp;lt;/code&amp;gt; — BBFrame symbols ===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
BB_CRC_ERRORS / BB_CRC_ERRORS_CURRENT / BB_CRC_ERRORS_NEXT&lt;br /&gt;
BB_DATA_FIELD_LEN / BB_DATA_FIELD_LEN_CURRENT / BB_DATA_FIELD_LEN_NEXT&lt;br /&gt;
BB_FRAMES&lt;br /&gt;
BB_GAIN / BB_GAIN_CURRENT / BB_GAIN_NEXT&lt;br /&gt;
BASEBAND_LEN&lt;br /&gt;
ISI / ISI_CTRL / ISI_CTRL_STRUCT / ISI_CTRL_STRUCT_FIELDS&lt;br /&gt;
ISI_FILTER_BYTE / ISI_MASK&lt;br /&gt;
SAT_BB_GAIN&lt;br /&gt;
ntc_debug  (module param, uint)&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;BB_DATA_FIELD_LEN&amp;lt;/code&amp;gt; and &amp;lt;code&amp;gt;BB_FRAMES&amp;lt;/code&amp;gt; suggest the driver tracks individual baseband frames, not just statistics. Very promising for BBFrame capture.&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;dvblite.ko&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
Contains &amp;lt;code&amp;gt;dvblite_ioctl&amp;lt;/code&amp;gt; — a kernel ioctl interface on &amp;lt;code&amp;gt;/dev/dvblite0&amp;lt;/code&amp;gt;. Commands unknown — to be investigated with a live signal.&lt;br /&gt;
&lt;br /&gt;
== Network Services ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Service !! Port !! Notes&lt;br /&gt;
|-&lt;br /&gt;
| SSH || 22 || Legacy KEX only (diffie-hellman-group1-sha1)&lt;br /&gt;
|-&lt;br /&gt;
| Telnet API || 23 || &amp;lt;code&amp;gt;cmdld&amp;lt;/code&amp;gt; via xinetd&lt;br /&gt;
|-&lt;br /&gt;
| FTP || 21 || pure-ftpd&lt;br /&gt;
|-&lt;br /&gt;
| HTTP || 80 || Apache + myles + requestHandler&lt;br /&gt;
|-&lt;br /&gt;
| SNMP || 161 || Community &amp;lt;code&amp;gt;public&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| mDNS || 5353 || &amp;lt;code&amp;gt;GOFFERT.local&amp;lt;/code&amp;gt;&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
# SSH/SCP&lt;br /&gt;
ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa root@&amp;lt;ip&amp;gt;&lt;br /&gt;
scp -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa root@&amp;lt;ip&amp;gt;:/path /local&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Credentials (Default/Hardcoded — ZSL-2020-5603 / ExploitDB 48954) ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! User !! Password !! Notes&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;root&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;1root!&amp;lt;/code&amp;gt; || Full root SSH&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;admin&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;1admin!&amp;lt;/code&amp;gt; || Also root via sudoers&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;adtec&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;none&amp;lt;/code&amp;gt; || Telnet API / web UI&lt;br /&gt;
|-&lt;br /&gt;
| &amp;lt;code&amp;gt;adtecftp&amp;lt;/code&amp;gt; || &amp;lt;code&amp;gt;adtecftp2231&amp;lt;/code&amp;gt; || FTP only&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
* Password hashes: DES crypt — crackable in seconds with &amp;lt;code&amp;gt;john&amp;lt;/code&amp;gt;&lt;br /&gt;
* &amp;lt;code&amp;gt;apache ALL=(ALL) NOPASSWD: ALL&amp;lt;/code&amp;gt; in sudoers&lt;br /&gt;
* Diagnostic package passphrase: &#039;&#039;&#039;&amp;lt;code&amp;gt;iMoo3jio&amp;lt;/code&amp;gt;&#039;&#039;&#039; (hardcoded, leaks in &amp;lt;code&amp;gt;ps aux&amp;lt;/code&amp;gt;)&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
gpg --passphrase &amp;quot;iMoo3jio&amp;quot; --batch --ignore-mdc-error --decrypt RD-60_*.tar.gpg | tar xf -&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== APIs ==&lt;br /&gt;
&lt;br /&gt;
=== Telnet API ===&lt;br /&gt;
&lt;br /&gt;
Connect: &amp;lt;code&amp;gt;telnet &amp;lt;ip&amp;gt;&amp;lt;/code&amp;gt;, login &amp;lt;code&amp;gt;adtec&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;none&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
*.SYSD SHELLCMD &amp;lt;cmd&amp;gt;          # arbitrary root shell execution!&lt;br /&gt;
*.SNMP ADTEC-NT-DEMOD-MIB::satFeedType.0 = dvbs2   # configure tuner&lt;br /&gt;
*.SNMP ADTEC-NT-DEMOD-MIB::satFeedDownlink.0 = 10960000&lt;br /&gt;
*.SNMP .1.3.6.1.4.1.19587.6000.3.999.0 i 0         # commit/apply&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== SNMP — Newtec Demodulator MIB ===&lt;br /&gt;
&lt;br /&gt;
OID base: &amp;lt;code&amp;gt;.1.3.6.1.4.1.19587&amp;lt;/code&amp;gt;, MIB: &amp;lt;code&amp;gt;ADTEC-NT-DEMOD-MIB&amp;lt;/code&amp;gt;, community: &amp;lt;code&amp;gt;public&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;bash&amp;quot;&amp;gt;&lt;br /&gt;
snmpwalk -v2c -c public &amp;lt;ip&amp;gt; .1.3.6.1.4.1.19587&lt;br /&gt;
&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Key OIDs: &amp;lt;code&amp;gt;tunerLock&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;recvLevel&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;esNo&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;linkMargin&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;modFec&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;rolloff&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;pilot&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;fecFrameType&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;unCorrFs&amp;lt;/code&amp;gt;, &#039;&#039;&#039;&amp;lt;code&amp;gt;bbCrcerrors&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &#039;&#039;&#039;&amp;lt;code&amp;gt;basebandLen&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &#039;&#039;&#039;&amp;lt;code&amp;gt;dummyPlRatio&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &#039;&#039;&#039;&amp;lt;code&amp;gt;isiFilterByte&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &#039;&#039;&#039;&amp;lt;code&amp;gt;framesSec&amp;lt;/code&amp;gt;&#039;&#039;&#039;, &amp;lt;code&amp;gt;satFeedType&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;satFeedDownlink&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;satFeedSymRate&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;satFeedModulation&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;lnbEnable&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;lnbPolarity&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;lnbTone&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== DVC Profile Format ===&lt;br /&gt;
&lt;br /&gt;
SNMP SET commands as tuner presets, applied via Telnet API or web UI.&lt;br /&gt;
&lt;br /&gt;
== Saved Tuner Profiles ==&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;prfturktest.DVC&amp;lt;/code&amp;gt; (2018-04-28) ===&lt;br /&gt;
&lt;br /&gt;
* DVB-S, &#039;&#039;&#039;10762 MHz&#039;&#039;&#039;, KU 9750 LO → &#039;&#039;&#039;1012 MHz&#039;&#039;&#039; L-band&lt;br /&gt;
* &#039;&#039;&#039;30 MSym/s&#039;&#039;&#039;, QPSK 3/4, roll-off 35%&lt;br /&gt;
* Was &#039;&#039;&#039;LOCKED&#039;&#039;&#039; at -32 dBm when saved&lt;br /&gt;
* &amp;lt;code&amp;gt;bbCrcerrors = 1&amp;lt;/code&amp;gt; — &#039;&#039;&#039;BBFrame counter was active and non-zero!&#039;&#039;&#039;&lt;br /&gt;
* Likely &#039;&#039;&#039;Türksat 42°E&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;prfMUX.DVC&amp;lt;/code&amp;gt; (2018-04-28) ===&lt;br /&gt;
&lt;br /&gt;
* DVB-S2, &#039;&#039;&#039;10960 MHz&#039;&#039;&#039;, KU 9750 LO → &#039;&#039;&#039;1210 MHz&#039;&#039;&#039; L-band&lt;br /&gt;
* &#039;&#039;&#039;8.352 MSym/s&#039;&#039;&#039;, 16APSK 2/3, roll-off 20%, pilot ON, normal frames, CCM&lt;br /&gt;
* Was unlocked when saved&lt;br /&gt;
&lt;br /&gt;
== Licensed Features (Key ID 165) ==&lt;br /&gt;
&lt;br /&gt;
DVB-DSNG + DVB-S2 + QPSK + 8-PSK + 16-QAM/16APSK + 32APSK + Symbol Rate &amp;lt;= 33 MBaud + ACM + &#039;&#039;&#039;Single TS/GS or Multiple Streams&#039;&#039;&#039; + &#039;&#039;&#039;(Baseband Frames)&#039;&#039;&#039; + no ACM client + no AES&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;BBFrame access is explicitly licensed and enabled.&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
== Encryption / CA ==&lt;br /&gt;
&lt;br /&gt;
* &#039;&#039;&#039;BISS-1 key&#039;&#039;&#039; in &amp;lt;code&amp;gt;dtrans.xml&amp;lt;/code&amp;gt;: &amp;lt;code&amp;gt;69A969BBECA0&amp;lt;/code&amp;gt;&lt;br /&gt;
* &#039;&#039;&#039;Viaccess&#039;&#039;&#039; (CA ID 0x0005) feed seen in logs — no card present, could not decrypt&lt;br /&gt;
&lt;br /&gt;
== IP-over-Satellite ==&lt;br /&gt;
&lt;br /&gt;
The unit has a full satellite IP receive stack beyond TS decoding:&lt;br /&gt;
&lt;br /&gt;
* &amp;lt;code&amp;gt;rddma_ip&amp;lt;/code&amp;gt; — FPGA-backed DMA for IP-from-satellite&lt;br /&gt;
* &amp;lt;code&amp;gt;ip_ingress_main&amp;lt;/code&amp;gt; — GSE/MPE ingress pipeline&lt;br /&gt;
* FPGA Channel 3 active at &amp;lt;code&amp;gt;03F01C00&amp;lt;/code&amp;gt;&lt;br /&gt;
* Currently idle — no GSE/MPE stream configured&lt;br /&gt;
&lt;br /&gt;
== Security Summary ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Issue !! Detail&lt;br /&gt;
|-&lt;br /&gt;
| Default root creds || &amp;lt;code&amp;gt;root&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;1root!&amp;lt;/code&amp;gt; over SSH&lt;br /&gt;
|-&lt;br /&gt;
| Telnet RCE || &amp;lt;code&amp;gt;*.SYSD SHELLCMD&amp;lt;/code&amp;gt; = root shell with &amp;lt;code&amp;gt;adtec&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;none&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Sudoers || &amp;lt;code&amp;gt;apache ALL=(ALL) NOPASSWD: ALL&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Shared SSH host keys || Same across all units (stored on CF card)&lt;br /&gt;
|-&lt;br /&gt;
| Weak password hashes || DES crypt, trivially crackable&lt;br /&gt;
|-&lt;br /&gt;
| GPG passphrase leak || &amp;lt;code&amp;gt;iMoo3jio&amp;lt;/code&amp;gt; visible in &amp;lt;code&amp;gt;ps aux&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| Public exploit || ZSL-2020-5603 / ExploitDB 48954&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Other ==&lt;br /&gt;
== Front Panel ==&lt;br /&gt;
&lt;br /&gt;
* Driver: &amp;lt;code&amp;gt;frpanel.ko&amp;lt;/code&amp;gt; (depends on &amp;lt;code&amp;gt;pc93&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;pc73a&amp;lt;/code&amp;gt;)&lt;br /&gt;
* Device nodes: &amp;lt;code&amp;gt;/dev/frpanel0&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;/dev/frpanel1&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;/dev/frpanel2&amp;lt;/code&amp;gt;&lt;br /&gt;
* Display: 2 rows × 40 columns character LCD (PC93 I2C MCU)&lt;br /&gt;
* LCD API in &amp;lt;code&amp;gt;libsolib.so&amp;lt;/code&amp;gt;: &amp;lt;code&amp;gt;FpLcdKpInit()&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;LcdClear()&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;LcdWriteStr(char*, pos, len)&amp;lt;/code&amp;gt;&lt;br /&gt;
* Writing to &amp;lt;code&amp;gt;/dev/frpanel2&amp;lt;/code&amp;gt; activates the backlight&lt;br /&gt;
* &amp;lt;code&amp;gt;menud&amp;lt;/code&amp;gt; daemon owns the display — must be stopped before direct writes&lt;br /&gt;
* Proc interface: &amp;lt;code&amp;gt;/proc/driver/frpanel/&amp;lt;/code&amp;gt; (rows, cols, screen, type, version, access)&lt;br /&gt;
&lt;br /&gt;
== TODO (requires dish connected) ==&lt;br /&gt;
&lt;br /&gt;
* [ ] Read &amp;lt;code&amp;gt;/proc/driver/dvblite/fe0/stats&amp;lt;/code&amp;gt; with live signal — observe all BB* fields&lt;br /&gt;
* [ ] SNMP walk full &amp;lt;code&amp;gt;.1.3.6.1.4.1.19587&amp;lt;/code&amp;gt; with live signal&lt;br /&gt;
* [ ] Investigate &amp;lt;code&amp;gt;dvblite_ioctl&amp;lt;/code&amp;gt; on &amp;lt;code&amp;gt;/dev/dvblite0&amp;lt;/code&amp;gt;&lt;br /&gt;
* [ ] Enable &amp;lt;code&amp;gt;ntc_debug&amp;lt;/code&amp;gt; module param and watch dmesg&lt;br /&gt;
* [ ] Try ISI multistream filtering via SNMP SET&lt;br /&gt;
* [ ] Investigate &amp;lt;code&amp;gt;rddma_ip&amp;lt;/code&amp;gt; with GSE/MPE satellite signal&lt;br /&gt;
* [ ] Lock on Türksat 42°E: 10762 MHz / 30 MSym/s / QPSK 3/4 (known working)&lt;br /&gt;
* [ ] Identify prfMUX transponder on Lyngsat (10960 MHz / 8.352 MSym/s / 16APSK 2/3)&lt;br /&gt;
* [ ] Explore Telnet API &amp;lt;code&amp;gt;*.NTC&amp;lt;/code&amp;gt; command namespace&lt;br /&gt;
* [ ] Investigate &amp;lt;code&amp;gt;xcpServerd&amp;lt;/code&amp;gt;/&amp;lt;code&amp;gt;xcpClientd&amp;lt;/code&amp;gt; — XCP protocol capabilities&lt;br /&gt;
* [ ] Check if &amp;lt;code&amp;gt;schnv.DVC&amp;lt;/code&amp;gt; populates after a lock (empty offline)&lt;br /&gt;
* [ ] Read &amp;lt;code&amp;gt;freg.db&amp;lt;/code&amp;gt; contents — full feature registry dump&lt;br /&gt;
* [ ] Write to LCD display — cross-compile against glibc 2.3.5 and call &amp;lt;code&amp;gt;LcdWriteStr()&amp;lt;/code&amp;gt; from &amp;lt;code&amp;gt;libsolib.so&amp;lt;/code&amp;gt;&lt;br /&gt;
* [ ] Send RMCP command via &amp;lt;code&amp;gt;rmcp_i2c&amp;lt;/code&amp;gt; to switch NTC/7044/BB output to BBFrame mode&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
	<entry>
		<id>https://nurdspace.nl/index.php?title=File:Adtec_RD-60.jpg&amp;diff=15882</id>
		<title>File:Adtec RD-60.jpg</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=File:Adtec_RD-60.jpg&amp;diff=15882"/>
		<updated>2026-04-11T22:55:33Z</updated>

		<summary type="html">&lt;p&gt;Melan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;/div&gt;</summary>
		<author><name>Melan</name></author>
	</entry>
</feed>