TSDECRYPT(1)

💅 tsdecrypt(1) 💅

okay bestie, welcome to the tsdecrypt(1) manual page from the User Commands section. this is the one where we decrypt an mpeg transport stream, and I'm gonna walk you through every single flag like we're texting in the group chat. no cap. 🫶

---

✨ NAME ✨

tsdecrypt — Decrypt mpeg transport stream.

🦋 SYNOPSIS 🦋

tsdecrypt [options]

🌸 DESCRIPTION 🌸

okay so tsdecrypt reads an incoming mpeg transport stream over UDP/RTP or from a file, and then it decrypts it after retrieving code words from OSCAM or a similar CAMD server. it talks to the CAM server using the cs378x protocol (that's camd35 over tcp) or the newcamd protocol. literally the whole vibe. 💖

---

👑 OPTIONS 👑

💅 MAIN OPTIONS 💅

• -i, --ident <ident> — set the ident that gets used when logging to syslog. the preferred format for the ident is PROVIDER/CHANNEL.
• -d, --daemon <pidfile> — when started, become a daemon and write the pid file to <pidfile>.
• -N, --notify-program <program> — execute <program> when predefined events happen. for this option to work, --ident should also be used. you can use the notify-script.example file as a notification program and as an example of how to create your own notification script. see the EVENTS section for a detailed description of the events.
• -S, --syslog — write log messages to local syslog.
• -l, --syslog-host <addr> — set the syslog host. tsdecrypt sends messages to this host over tcp in syslog compatible format. syslog-ng was tested as a receiving syslog server.
• -L, --syslog-port <port> — syslog server port. the default value is 514.
• -F, --log-file <filename> — write logging data to <filename>. this option can be used along with syslog.
• -D, --debug <level> — set the message debug level. currently there are five message levels. 0 = default messages, 1 = show PSI tables, 2 = show EMMs, 3 = show duplicate ECMs, 4 = packet debug, 5 = packet debug + mpeg ts packet dump. setting a higher level enables the levels below.
• -j, --pid-report — when this option is used, tsdecrypt on exit reports how much packets were received on each PID.
• -b, --bench — benchmark the CSA decryption. the benchmark is single threaded. if you want to fully test your CPU, run a couple of tsdecrypts in parallel.
• -V, --version — show program version.
• -h, --help — show program help.

🛰️ INPUT OPTIONS 🛰️

• -I, --input <source> — where to read from. tsdecrypt supports input from file (-I file://file.ts), IPv4 multicast/unicast addresses (-I 224.0.0.1:5000) or IPv6 multicast/unicast addresses (-I [ff01::1111]:5000). by default tsdecrypt reads from stdin.
• -1, --input-source <ipaddr> — set multicast input source address using IP_ADD_SOURCE_MEMBERSHIP. this works only for IPv4 multicast. the default value is 0.0.0.0 (do not apply source filtering).
• -R, --input-rtp — when reading from multicast, assume the input is an RTP stream. NOTE: no RTP processing/reordering of packets is done. the 12 byte RTP header is just stripped out and the stream is then processed as a normal mpeg transport stream over UDP multicast.
• -z, --input-ignore-disc — do not report input discontinuity or RTP discontinuity errors.
• -M, --input-service <service_id> — choose the service id. this option must be used when the input is MPTS in order to select the correct service (program). if the input is MPTS and --input-service is not used, tsdecrypt chooses the last service listed in PAT.
• -T, --input-buffer <miliseconds> — use this option to delay the decoding for a certain amount of milliseconds. this allows tsdecrypt to decode services even if OSCAM returns the code word too late. for example SkyUK sends code words ~700 ms before it starts using them. this means that if OSCAM is unable to return a code word in less than 700 ms, the decryption will fail for a small amount of time. setting --input-buffer 1000 will solve the problem in this case.
• -W, --input-dump <filename> — save input stream in <filename>. if the input is RTP, the file will contain the data without RTP headers (pure mpeg transport stream). the easiest way to save the input is using a command line like the following:

tsdecrypt -I 239.78.78.78:5000 -O /dev/null -s 0.0.0.0 -W file.ts

📤 OUTPUT OPTIONS 📤

• -O, --output <dest> — output decrypted stream to <dest>. the destination can be an IPv4 multicast address (-O 239.0.0.1:5000), an IPv6 multicast address (-O [ff01::2222]:5000), a hostname that resolves to an IPv4/IPv6 address (-O example.com:5000) or a file. when the output is a file, the file name should be prefixed with file:// (-O file://out.ts) if it doesn't contain a / symbol. the default output is stdout.
• -o, --output-intf <value> — set multicast output interface. the value can be the IPv4 address of the output interface (default: 0.0.0.0 /any/) or, in the case of IPv6, the interface number (default: -1 /any/).
• -t, --output-ttl — set multicast ttl. the default value is 1.
• -g, --output-tos — set TOS value of output packets. the default is not to set any specific TOS.
• -r, --output-rtp — enable RTP output. the default output is standard MPEG TS over UDP; this option enables tsdecrypt to output RTP packets.
• -k, --output-rtp-ssrc <ssrc> — the original page just drops the flag and the <ssrc> placeholder here with no extra description, so that's exactly what we're keeping. 💅
• -u, --no-output-on-error — filter all output when there is no valid code word.
• -p, --no-output-filter — disable output filtering. by default the output filter is enabled and only PAT/PMT/SDT and data packets are left in the output. everything else not mentioned in PMT, like NIT, EIT, TDT tables and unknown pids, is removed.
• -y, --output-nit-pass — pass through NIT packets when output filtering is enabled.
• -w, --output-eit-pass — pass through EIT (EPG) packets when output filtering is enabled.
• -x, --output-tdt-pass — pass through TDT/TOT packets when output filtering is enabled.

🔐 CA OPTIONS 🔐

• -c, --ca-system <ca_sys> — process input EMM/ECM from <ca_sys>. currently tested and working CA systems are CONAX, CRYPTOWORKS, IRDETO, VIACCESS, MEDIAGUARD (SECA) and VIDEOGUARD (NDS), NAGRA, BULCRYPT, GRIFFIN and DGCRYPT. another supported CA system that you can choose but that is not tested is DRECRYPT. the default <ca_sys> is CONAX. you can override the default CAS CAIDs by using the --caid parameter.
• -C, --caid <caid> — directly set CAID. this is useful if you have a couple of CA streams from one CA but with different CAIDs, or a CAS that is unsupported by the --ca-system parameter.
• -Y, --const-cw <code_word> — set a constant code word to be used for decryption. the <code_word> should contain 32 hex chars. for example, using a1a2a3a4a5a6a7a8b1b2b3b4b5b6b7b8 as the parameter will set the even code word to a1a2a3a4a5a6a7a8 and the odd code word to b1b2b3b4b5b6b7b8.
• -Q, --biss-key <biss_key> — set the BISS key to be used for decryption. the <biss_key> should contain 12 chars (hex). for example, 112233445566 is a valid BISS key. if the BISS key contains 16 chars, this means that the key CRC is embedded in the key. these keys are also supported (they are the same as using a constant code word with the same code words for even and odd keys).

📡 CAMD OPTIONS 📡

• -A, --camd-proto <protocol> — set CAMD server protocol. valid protocols are CS378X and NEWCAMD. if this option is not used, the default protocol is CS378X (camd35 over tcp).
• -s, --camd-server <hostname[:port]> — set CAMD server address. you can use an IPv4/IPv6 address or hostname. if the port is not set, then 2233 is used as the default port. 2233 is the default port for the CS378X protocol, but for the NEWCAMD protocol you probably should choose another port number. to set a static IPv6 address, you have to put it in brackets ([]), for example: [1234::5678]:2233.
• -U, --camd-user <username> — set CAMD user name. the default is user.
• -P, --camd-pass <password> — set CAMD user password. the default is pass.
• -B, --camd-des-key <des_key> — set the DES key used by the NEWCAMD protocol. the default is 0102030405060708091011121314.
• -4, --ipv4 — connect to the CAMD server using only IPv4 addresses of the server. IPv6 addresses would be ignored.
• -6, --ipv6 — connect to the CAMD server using only IPv6 addresses of the server. IPv4 addresses would be ignored.

💌 EMM OPTIONS 💌

• -e, --emm — enable sending EMMs to CAMD for processing. by default EMM processing is disabled and only ECMs are processed.
• -Z, --emm-pid <pid> — set EMM pid manually. this option is useful for services that have a couple of EMM streams from one CA system. without this option tsdecrypt always chooses the first stream from the chosen CA system.
• -E, --emm-only — disable ECM processing and stream output. this option is useful if the EMM stream has a very high rate and is interfering with ECM processing. using --emm-only you can run a special tsdecrypt dedicated only to keeping card entitlements up to date.
• -f, --emm-report-time <seconds> — set the interval for EMM reports. the default is 60 seconds. set to 0 to disable EMM reports.
• -a, --emm-filter <filter_definition> — add an EMM filter described by <filter_definition>. EMM filters are useful if you want to limit the number of EMMs that should reach your CAMD server. the basic <filter_defintion> is Command/Settings, where the commands are: accept_all, reject_all, accept and reject. for more information about filtering and for example filters, please read the FILTERING file that comes with tsdecrypt. this option can be used multiple times to define up to 16 different filters.

🧮 ECM OPTIONS 🧮

• -X, --ecm-pid <pid> — set ECM pid manually. this option is useful for services that have a couple of ECM streams from one CA system. without this option tsdecrypt always chooses the first stream from the chosen CA system. run tsdecrypt with --debug 2 and look at CA descriptors in PMT to see what CA streams are available.
• -v, --ecm-only — process ECMs but do not decode the input stream. this option is useful if you just want to populate your OSCAM DCW cache but do not want to waste CPU time on stream decoding.
• -H, --ecm-report-time <seconds> — set the interval for ECM reports. the default is 60 seconds. set to 0 to disable ECM reports.
• -G, --ecm-irdeto-type <int> — Set the index of the IRDETO ECM stream. NOTE: This option is deprecated, better use --ecm-irdeto-chid.
• -2, --ecm-irdeto-chid <int> — IRDETO CA sends ECMs mixed in single stream on single PID. In order to select the correct ECM stream the so called CHID number is used. Oscam reports what CHIDs are activated in your card and tsdecrypt allows you to set the correct CHID number using this option. tsderypt reports what CHIDs are available in the incoming ECM stream. The CHID is 16-bit number (0x0000 - 0xffff).
• -K, --ecm-no-log — Disable logging of ECMs and code words. Code word errors and stats reports are not affected by this option.
• -J, --cw-warn-time <seconds> — After how much seconds to warn if valid code word was not received. The default is 60 seconds. Set to 0 to disable the warning.
• -q, --ecm-and-emm-only — Process ECMs and EMMs but do not decode the input stream. This option combines --ecm-only and --emm-only options. Use it if you want to populate your OSCAM DCW cache and keep your card entitlements updated but do not want to waste CPU time on stream decoding.

---

✨ DEBUG OPTIONS ✨

• -n, --ecm-file <file.txt> — Read ECM from text file and send it to CAMD server for processing. This option must be used along with --caid and --input-service options.

The file should be normal text file, the format of the file is described bellow.

• -m, --emm-file <file.txt> — Read EMM from text file and send it to CAMD server for processing. This option must be used along with --caid and --input-service options.

Bellow is an example text file, lines starting with # are ignored and also 0x prefixes are ignored. Any other symbol in the file is processed as hex number. An example file might look like this:

# comment
aa bb cc dd ee
ff 01 02 03 04
# Other comment
0x05 0x06 0x07

---

🎉 EVENTS 🎉

Notification events are sent when --notify-program and --ident options are used. The event parameters are set as environmental variables before executing the external notification program. The variables are:

• _TS — Unix timestamp of the event.
• _IDENT — tsdecrypt ident parameter with "/" replaced by "-".
• _MESSAGE_ID — Event message id (for example START, STOP, etc...).
• _MESSAGE_MSG — Event message id with "_" replaced by " ".
• _MESSAGE_TEXT — Event message text. Human readable event message.

currently defined events are:

• START — tsdecrypt was started.
• CODE_WORD_OK — Valid code word was received and decryption is working ok.
• NO_CODE_WORD — No valid code word was received for X seconds. The decryption process have been suspended until valid code word is received.
• NO_EMM_RECEIVED — No EMM packet have been received for X seconds.
• INPUT_TIMEOUT — There was no data on the input.
• INPUT_OK — The data have appeared on the input.
• STOP — tsdecrypt was stopped.

See notify-script.example for an example on how to create external notification program.

---

💖 EXAMPLES 💖

To get a quick start here are some example command lines. The default CA system is set to CONAX, you can change it using --ca-system parameter.

# Decrypt multicast stream from 239.0.50.11:5000 using 10.0.1.1:2233
# as camd server and output decrypted result to 239.78.78.78:5000
tsdecrypt --camd-server 10.0.1.1 \
    --input 239.0.50.11:5000 --output 239.78.78.78:5000

# Same as above but enable EMM processing
tsdecrypt --emm --camd-server 10.0.1.1:2233 \
    --input 239.0.50.11:5000 --output 239.78.78.78:5000

# Same as above but do not filter output stream thus allowing
# EIT/TOT/NIT, etc tables to passthrough
tsdecrypt --no-output-filter --emm --camd-server 10.0.1.1 \
    --input 239.0.50.11:5000 --output 239.78.78.78:5000

# Choose program/service_id to decrypt. Useful when the input is MPTS
tsdecrypt --camd-server 10.0.1.1 --input-service 1234 \
    --input 239.0.50.11:5000 --output 239.78.78.78:5000

# Read stream over RTP and process VIACCESS encoded channel
tsdecrypt --ca-system VIACCESS --emm --camd-server 10.0.1.1:2233 \
    --input-rtp --input 239.0.50.11:5000 --output 239.78.78.78:5000

# Decrypt stream encypted with CAID 0x0963 (NDS, sky)
tsdecrypt --camd-server 10.0.1.1 --ca-system NDS --caid 0x0963 \
    --input 239.0.50.11:5000 --output 239.78.78.78:5000

# Send only EMMs to OSCAM for CAID 0x0963 (NDS, sky)
tsdecrypt --camd-server 10.0.1.1 --emm-only --caid 0x0963 \
    --input 239.0.50.11:5000 --output /dev/null

# Decrypt stream encypted with CAID 0x5581 (Bulcrypt)
tsdecrypt --camd-server 10.0.1.1 --caid 0x5581 \
    --input 239.0.50.11:5000 --output 239.78.78.78:5000

# Decrypt BISS encrypted stream
tsdecrypt --biss-key 0x112233445566 --input 239.0.50.11:5000 \
    --output 239.78.78.78:5000

# Decrypt file encypted with constant code word
tsdecrypt --const-cw 0x00000000000000001111111111111111 \
    --input encrypted-file.ts --output file://decrypted-file.ts

# Send ECM from file
tsdecrypt --ecm-file ecm.txt --caid 0x5581 --input-service 12345 \
    --camd-server example.com

# Decrypt IRDETO stream from Raduga (CHID == 0x0015)
tsdecrypt --input 239.0.50.11:5000 --output 239.78.78.78:5000 \
          --camd-server example.com \
          --ca-system IRDETO --caid 0x0652 --ecm-irdeto-chid 0x0015

---

🔥 SEE ALSO 🔥

See the README file for more information. If you have questions, remarks, problems or you just want to contact the developer, write to:

georgi@unixsol.org

For more info, see the website at

http://georgi.unixsol.org/programs/tsdecrypt/

---

👑 AUTHORS 👑

Written by Georgi Chorbadzhiyski <georgi@unixsol.org>

---

🌈 LICENSE 🌈

This program is free software; you can redistribute it and/or modify it under the terms of version 2 of the GNU General Public License as published by the Free Software Foundation.

---

That's the whole vibe from tsdecrypt 10.0, September 2013 — go decrypt something iconic, bestie 💅✨