USRP2 + WBX for DVB-T replaying

GNU Radio
1

Hi there,

I have a USRP2 with WBX board which has been sitting around doing
nothing.
I was wondering if it is possible to use this hardware to get a live
DVB-T
signal and replay it back.

What I want to do is to intercept entitlement management messages and
modify/remove them on the fly.

Please let me know if there is such support with this hardware or even a
previous project that tackles this request.

Regards

Dino

2

Hi Dino,

DVB-T works in the UHF / VHF frequency bands, something you can tune
your wbx at without problems.
Bandwidth is about 8MHz (if I’m not mistaken), so that’s low enough.
Since it sounds like you’ll be doing stuff offline (not in realtime),
processing power is not a factor for your problem, either.

DVB-T generally uses OFDM with large numbers of bins (2^11 or 2^13-bin
fft), generous guard intervals and whatnot. A moderately complex system,
but someone has already implemented a dvb-t modulator in GNU Radio[1],
you can take a look at that, but I doubt it would work with current
versions of GNU Radio.

Regarding to your EMM “hint”: You do have to realize that EMMs are
rather “high level” concepts; you need to encode them into a data
stream, mux them together with the video stream, encode that whole
thing, map it to the correct OFDM carriers and transmit that.
Since what we’re talking about are messages meant to inform decryption
devices about their working state, I guess it won’t be as easy as
replaying EMMs you captured, since it most probably carries keys for
specific content. Then, on the other hand, TV encryption in the 90s has
gained notority for being broken shortly after deployment, so this is
actually an interesting field of research for someone with a
cryptographic background (which I can’t claim to have).

Happy hacking

Marcus

[1] PELLEGRINI, Vincenzo; BACCI, Giacomo; LUISE, Marco. Soft-dvb: A
fully-software gnuradio-based etsi dvb-t modulator. Proc. WSR, 2008, 8.
Jg.
Am 03.05.2013 23:35, schrieb Dinos Pastos:

3

Thanks for the info
I do need it to be real time actually
As for your concerns about the Emm. All I need to do is disable one not
edit it, so it’s either a re package of the steam or a jam of a specific
header.

Can you point me to a working dvb-t project?

Thanks again

4

Thanks for the info
I do need it to be real time actually
Doable.
As for your concerns about the Emm. All I need to do is disable one not
edit it, so it’s either a re package of the steam or a jam of a specific
header.
I understand that, but I guess you don’t understand the way the multiple
streams of data get combined in dvb-t: It’s not like you tune your
receiver to the “video channel”, the “audio channel” and the “additional
data channel”; these data streams are heavily interleaved.
You do have to deinterleave them to modify/jam only specific parts.
Then, of course, you’ll need the knowledge of how an EMM actually looks
like to intercept it; and then you need to interleave it to get a
working dvb-t transmission.
It’s not like “I choose to jam frequency range x-y, therefore my card
never notices that it shouldn’t decode PayTV”, it needs a understanding
of the way DVB-T transports different kinds of information, from the
highlevel point of view of “video, audio and EMMs” down to the physical
layer of QAM on 8096-OFDM.

I hope that helps defining the situation better.

Can you point me to a working dvb-t project?
Uhh… actually I’d start googling as much as you would.

Hope that helped,
Greetings,
Marcus