if some one now what are this please pm me thanx

i have read this from card
14.11.2012
0B - Tier (PPV)
Header 07EC0B 07EC0B
System Type 5853 5853
Ird Status Byte 8C 8C
PPV Event ID 2C54 2C54
PPV ID 6A 106
Event Price DDC9 $56777.127
Purchase Date 3F 05/16/2036
Expiration Date AD73 07/28/2113
Service ID 50 80
Min Channel CF3 5304
Max Channel 0177 375
Component 49C5 18885
PPV Low ID 4E592 51346
PPV High ID DCDAE9 -5896331
ECM Odometer 5AEA 09/21/2055
Event Start Date A2B5 01/16/2106
Event Start Time 0B5E 01:37:00
Data Block 1 159C72F71BE2A2 159C72F71BE2A2
Data Block 2 96A69A8597F8FB 96A69A8597F8FB

1.Introduction:

The c@rd is always asked by the ICAM to receive or send information. The c@rd never asks the ICAM to do anything!
To do this the ICAM always se$$$ a 5 byte long command packet header to the c@rd.

Standard 5 byte ISO-7816 header : "CLASS INSTRUCTION PARAM1 PARAM2 PARAM3"

With the introduction of the new c@rd 2 new classes were introduced:

Class Meaning
D0/D1 Replaces 48 of the old c@rd
D2 appe$$$ a 16 byte signature on the instruction reply
D3 Use an additional stream cipher to secure transmission between c@rd and box (NOT using internal HashCircuit)

(Class 48 is no longer supportet and causes the c@rd to rerun part of the initialisation including the ATR output.)

PARAM1 and PARAM2 are used differently and are often ignored. PARAM3 is the length of the packet to be send or expected
to receive. The cards first reply is the instruction number which is a vital value for the ICAM.
These instruction numbers are possibly contained in a jumptable in the ICAMs source leading to a specific offset where
processing continues.

2.The Answer To Reset (ATR):

Former ATR: 3F 7F 13 25 03 40 B0 0B 69 4C 4A 50 C0 00 00 53 59 00 00 00
New ATR : 3F 7F 13 25 03 33 B0 06 69 FF 4A 50 D0 00 00 53 59 00 00 00

3F TS - "3F" indicates inverse convention ("3B" would be direct convention)
7F T0 - "7" (0111...) indicates TA1,TB1,TC1 will be sent "F" (...1111) indicated that 15 historical bytes will be send.
13 TA1 \
25 TB1 - used for baudrate calculation
03 TC1 /
33 B0 06 69 - version Info. Has been "40 B0 0B 69"
FF - Has been ASIC reply. Now FF because he is no longer used due to multiple reasons
4A 50 C0 00 00 53 59 00 00 00 - the 15 historical bytes (system ID)

3. The Zero Knowledge Test (c@rd verification)

These three Instructions are sent to verify that the c@rd in the decoder is a true ndx c@rd

Variables used:
r - 512 bit random number
n  - 512 bit number which is the product of two large prime numbers;is  constant;can be found in the ROM of the c@rd and in the IRD firmware
s - based on a complex function of n

3.1 generate a random number r
>D1 4A 10 01 01
<4A - acknowledgement
>01 - selects one of two seeds that is to be used for a random number r
<90 20 - OK (90 00 not OK)

3.2 send 96-bit hash of r? MOD n to IRD

>D1 5A 10 01 10
<5A - acknowledgement
<90 20 - OK (90 00 not OK)

3.3 send either r*s MOD n or r to IRD

3.3.1 IRD asks for r
>48 5A 10 02 40
<5A
<33 f5 99 a1 63 cb aa cf 41 c9 b0 78 d4 c4 42 f1
<1f d8 93 b9 bb 3b 6f 6f 62 2f c7 2f 06 d3 c4 1d
<48 84 d7 b2 c1 64 6e 7c 05 56 f1 29 61 bc c7 00
<90 20 - OK (90 00 not OK)


3.3.2 IRD asks for r*s mod n
>48 5A 11 02 40
<5A
<71 94 69 64 7F 84 B2 EA 1D E2 16 E9 AE 79 F2 49
<6E 6A 82 D9 B5 7B 1C EE 21 1C 55 0B BF DE 51 B4
<90 20 - OK (90 00 not OK)

4.The communication Protocol:

4.1 Instruction Overview

Instruction Meaning
02 BSkyB identifier "SYAV" and ROM version 02.00
04 receives one byte and writes it to 8022h
06 se$$$ the byte at 8022h
0E se$$$ one byte (09) - unknown
12 se$$$ encrypted chip information
1E se$$$ 9 bytes - unkown
28
2A se$$$ detailed c@rd information (mostly from EEPROM)
40 makes it possible to process comma$$$
42
4C

4.2 Command Overview

The values in brackets indicate the fixed length byte for this command. The remaining comma$$$ have all a variable length.

Red - comma$$$ are processed in realtime (no matter if signature is correct or not)
Fuchsia - comma$$$ are buffered and executed via the deferred command buffer only if the signature is correct
Lime - command is processed in real time but don't change anything. Only important for ASIC.
Blue -
Teal -
Black - handled seperatly

Basic command set:

00 [00] - No Operation
01 [04] - Sets Date/Time
02 [01] - Sets rating byte, marks message as ECM
03 [03] - checks channel entitlements
04 [00] - set bit 2Ah.0
05 [00] - clear bit 2Ah.0
06 [0B] - compares Postal code, opens c@rd filter if they match
07 LE - set bit 2Ch.6
08 LE - Bogus!
09 [03] - initialise ASIC with specified key, flushes the command buffer (nanos which need no signature stay)
0A [05] - Bogus!
0B LE - write 14 bytes to 9E36h
0C [00] -
0D [00] - Bogus!
0E [00] - Bogus!
0F [04] - Bogus!
10 [02] - Bogus!
11 [04] - Bogus!
12 [12] - set Blackout bits
13 [02] - Bogus!
14 [01] - clear Blackout bits
15 LE - Bogus!
16 [07] - Bogus!
17 LE - Bogus!
18 [03] -
19 [01] - stores the Time Zone in EEPROM (9CC9h)
1A [04] - Bogus!
1B [03] - Bogus!
1C [00] - Bogus!
1D LE - stores the Zip Code in EEPROM (9CA8h)
1E [08] - set the PostCode
1F LE -
20 [00] - Bogus!
21 [00] - Bogus!
22 [00] - Bogus!
23 [00] - Bogus!
24 [00] - Close Filter
25 [00] - Flip filter, from open to closed or vice versa
26 [01] -
27 [0D] - c@rd Swap! (write cardswap key to 9FF5h/Date stamp to 9CA0h/update fuse)
28 [07] - Bogus!
29 [08] - something to do with PPV (add entry to purchase list?)
2A [01] - Bogus!
2B [02] - UnSwap c@rd! (write cardswap send key to 9FF5h/Date stamp to 9CA0h/update fuse)
2C [04] - Bogus!
2D [04] - sets Activation Date/Time
2E [08] - Bogus!
2F LE - Bogus!
30 [00] -
31 [03] - checks Serial Number
32 [03] - checks Shared Address (whole c@rd group)
33 LE - checks Shared Address, processes bitmap
34 LE - Bogus!
35 [00] - Bogus!
36 [00] - Bogus!
37 LE - Bogus!
38 [00] - checks Postal Code
39 [00] - Bogus!
3A [00] - Bogus!
3B LE - Bogus!
3C LE - Bogus!
3D [02] - activates c@rd and write PPV spending limit
3E [00] - deacivate c@rd
3F [02] - Bogus!
40 [00] -
41 [05] - add/update channel entitlements (tier)
42 [02] - drop channel entitlement (tier)
43 [02] - Bogus!
44 [04] -
45 [05] - Bogus!
46 LE - Bogus!
47 [01] - Bogus!
48 [00] -
49 [02] - Bogus!
4A [05] - Bogus!
4B [04] - Bogus!
4C LE - Bogus!
4D [00] - sets some data, PPV related, both in PPV ECM and EMM
4E [04] - writes four bytes
4F [14] - Bogus!
50 LE - Bogus!
51 LE - Bogus!
52 LE - Bogus!
53 LE -
54 LE - same as cmd53
55 LE - Bogus!
56 LE - Bogus!
57 LE -
58 [00] -
59 LE -
5A LE - Bogus!
5B LE -
5C LE - Bogus!
5D LE -
5E LE - Bogus!
5F LE -
60 LE - Bogus!
61 LE - Bogus!
62 LE - Bogus!
63 LE - Bogus!
64 LE - Bogus!
65 LE - Bogus!
66 LE - Bogus!
67 LE - contains signature to authorise packet
68 LE -
69 LE - Bogus!
6A LE - Bogus!
6B LE - Bogus!
6C LE - Bogus!
6D LE - sets some data, unknown, values can be read with INS78
6E LE - same as cmd6D
6F LE - Bogus!
70 LE - Bogus!
71 LE - Bogus!
72 LE - sets some data, unknown
73 LE -
74 LE -
75 LE - writes some data including Local Region Code. Values can be read with INS58
76 LE - Bogus!
77 LE - Bogus!

Extended command set:

7E LE - sets signature and key adjustment bytes
7F LE - sets signature and key adjustment bytes (bridges gap between 1.X and 2.0 cards)
CB 02 - sets two bytes, unknown

4.3. c@rd initialisation:

The following Instructions are issued by the box during initialisation:

1. Ins48
2. Ins4C

?

D1 48 00 00 36
D1 4C 00 00 09

D1 40 40 80 4A
D1 42 00 00 16
D1 5C 00 00 04

3. The IRD then askes to send 09 bytes with 48 4C 00 00 09

>D1 4C 00 00 09
<4C c@rd acknowledges Instruction
>IN IN IN IN IRD Serial Number
>02 00 00 D8 02 unknown
<90 20 correctly married

If the c@rd belongs to this box it replies 90 20 (OK).
If the c@rd does not belong to this box it replies 90 00 (Not OK).
If  the c@rd has the fuse byte set but is previously unmarried, this  command writes the IRD number to the c@rd, thereby completing the  marriage (sw1/2 = 90 a1). If the c@rd is deactivated and this command  arrives the IRD Serial Number is written to the cards EEPROM too (sw1/2 =  90 20).
If the IRD number is set to 00 00 00 00 it will be accepted by any box. eg an engineer's c@rd.
The c@rd must receive the correct IRD number before it will give valid responses to ECMs and EMMs.

4. The c@rd is then asked for 09 bytes with 48 2C 00 00 09.

>48 2C 00 00 09
<2C c@rd acknowledges Instruction
<00 00 convert to HEX and add then 8000h - this is your PIN
<00 Parental Control Byte (PCB) - see below
<00 00 unknown
<90 20 sw1/sw2

We can change the PIN using command 48 2e 80 00 09.

5.  Next we have an often repeated cmd 48 5C 00 00 04. It's a bogus  instruction. Nothing is done although the box knows the c@rd is still  present and working.

>48 5C 00 00 04
<5C c@rd acknowledges Instruction
<00 00 00 00 allways zero
<90 20

The  command flushes a buffer containing the 7E nano. So don't issue INS5C  if you haven't allready asked for the key (issued INS54) after sending  an ECM to the c@rd. You would get a totally wrong key.

12. Occasionally we get a 48 5e 00 0b 01. Reads one status byte from c@rd.
48 5e 00 0b 01
5e c@rd acknowledges Instruction
03 03=valid?, 00=invalid?
90 20 sw1/sw2

[See also additional INS 48 5e 00 0e 62]

This cmd always seems to be followed by the next one:-

13. Another occasional cmd. 48_78. This seems to follow the 48_5e. Are they related?

48 78 03 00 14
78 c@rd acknowledges Instruction
08 00 73 17 92 9F FF FF 01 08 00 73 17 92 9F FF FF 01 8F 00 pink string was written with the 6D_09 nano
90 20 OK

48 78 08 00 14
78 c@rd acknowledges Instruction
08 00 73 17 92 9F FF FF 01 08 00 73 17 92 9F FF FF 01 20 00 pink string was written with the 6D_09 nano
90 20 OK

=
The Switch-On Comma$$$
This is a log of the activation of a BBC c@rd. They use the private key 14 and address the c@rd by its unique address using nano 31.
These comma$$$ follow the activation EMMs for the c@rd's postcode area. This is why you have to wait for the comma$$$ to be sent. Three of the EMMs are repeated a number of times, at about 20 minute intervals, over a period (24 hours?).

This is the first activation command:
>48 42 00 00 16
<42 c@rd acknowledges Instruction
>09 14 00 00 initialise ASIC with private key 14
>31 checks Serial Number nano
>00 SN SN SN Serial Number
>3D 03 ec sets PPV spending limit and activates c@rd (fuse byte now 05)
>67_08 signature nano
>01 02 03 04 05 06 07 08 signature
<91 81 successfully written

The greater the values set with the 3D the greater the fuse value?

The IRD then se$$$ this request:
>48 58 00 00 35
<58 c@rd acknowledges Instruction
>05 Fuse byte
>01 09 60 always the same
>SN SN SN SN c@rd SN (unique address)
>ff ff ff ff unknown
>SN SN SN three bytes of c@rd number (shared address)
>00 ff ff ff 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 unknown
>00 00 00 00 will be written with the 4e nano on activation (still zero)
>47 42 52 "GBR" on British cards only
>00 01 00 00 0X 0X 00 00 00 00 unknown
<91 80 OK

Note the sw1/2 has changed from 90 00 on a virgin c@rd to 91 80 now that the fuse byte has been set and the region code is intact.

Next comes the IRD number.
>48 4C 00 00 09
<4C c@rd acknowledges Instruction
>IN IN IN IN IRD Serial Number
>02 00 00 58 02 unknown
<90 A1 IRD number saved successfully/correctly married

It would seem that when the fuse byte has been set, the first time the c@rd receives this IRD number test command, the IRD number is written to the c@rd. The sw1/2 is 90 a1.

Next, request the PIN and Parental control rating byte (3F).
>48 2c 00 00 09
<2C c@rd acknowledges Instruction
<84 d2 convert to HEX and add then 8000h - this is your PIN
<3F Parental Control Byte (3F - unrestricted)
<00 00 unknown
<90 a0 sw1/sw2


Request region code. Note at this stage the specific region byte is still zero.
>48 1C 00 00 20
<1C c@rd acknowledges Instruction
<47 42 52 "GBR" on British cards.
<00 Region code is still not set!
<00 00 00 00 00 00 00 00 00 00 00 00 00 00 unknown
<00 00 00 00 00 00 00 00 00 00 00 00 01 00 will be written with the 75 0F nano on intital activation, zero on virgin cards
<90 20 OK


The next command seems to have six functions:
>48 42 00 00 32
<42 c@rd acknowledges Instruction
>09 14 00 00 initialise ASIC with private key 14
>31 checks Serial Number nano
>SN SN SN SN Serial Number
>3d 03 EC sets PPV spending limit and activates c@rd (fuse byte now 05)
>2d 3A xx xx xx Set activation date and time
>1e PC PC PC PC PC PC PC PC Set the PostCode
>4e 00 6c 4d 58 writes the four bytes " IMX" to before the region code in the 48_58 string (can vary)
>2b 03 EB writes "03 eb" to the 48_36 string. Some form of counter?
>41 B7 65 3A 1F c0 Add channel entitlement b7 65 (expiry date 3A 1F)
>67 08 signature nano
>01 02 03 04 05 06 07 08 example signature
<91 a1 Write cmd accepted

Add channel entitlements 00 1d, b7 66, b7 72 and b7 73 using 41 nano:
>48 42 00 00 2f
<42 c@rd replys command for ICAM
>09 14 00 00 initialise ASIC with private key 14
>31 checks Serial Number nano
>SN SN SN SN Serial Number
>41 00 1d 3A 1F C0 Add channel entitlement 00 1D (expiry date 3A 1F)
>41 b7 66 3A 1F C0 Add channel entitlement B7 66 (expiry date 3A 1F)
>41 b7 72 3A 1F C0 Add channel entitlement B7 72 (expiry date 3A 1F)
>41 b7 73 3A 1F C0 Add channel entitlement B7 73 (expiry date 3A 1F)
>72_02 00 01 unknown propose
>67_08 signature nano
>01 02 03 04 05 06 07 08 example signature
<91 A1 Write cmd accepted

Next EMM:
48 42 00 00 24
<42 c@rd replys command for ICAM
>09 14 00 00 initialise ASIC with private key 14
>31 checks Serial Number nano
>SN SN SN SN Serial Number
75 0F 75_0F nano
12 01 06 02 00 00 00 00 00 00 00 08 00 03 0D is being written to the Region code string
>67_08 signature nano
>01 02 03 04 05 06 07 08 example signature
<91 A1 Write cmd accepted


IRD requests again:
>48 58 00 00 35
<58 c@rd replys command for ICAM
<05 fuse byte
<01 09 60 always the same
<00 FF FF FF 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 unknown
<00 6c 4d 58 was written with the 4e nano on activation
<47 42 52 "GBR" on British cards only
<00 01 00 00 03 0D 00 00 00 00 unknown
<91 A0 sw1/sw2

The sw1/2 has changed again to 91 A0.

Test IRD number again. This time the sw1/sw2 is 90 A0.
>48 4C 00 00 09
<4C c@rd replys command for ICAM
>IN IN IN IN IRD Serial Number
>02 00 00 58 02 unknown
<90 A0 IRD number saved successfully/correctly married

Request PIN/Parental control byte again.
>48 2c 00 00 09
<2C c@rd replys command for ICAM
<84 D2 convert to HEX and add then 8000h - this is your PIN
<3F Parental Control Byte (3F - unrestricted)
<00 00 unknown
<90 A0 sw1/sw2

Request region code again.
>48 1C 00 00 20
<1C c@rd replys command for ICAM
<47 42 52 "GBR" on British cards.
<00 Region code is still not set!
<00 00 00 00 00 00 00 00 00 00 00 00 00 00 unknown
<01 06 02 00 00 00 00 00 00 00 08 00 03 0d was written with the 75 0F nano on intital activation, zero on virgin cards
<90 20 OK

At this stage the c@rd is married to the box and will open the FTV channels except BBC1 as the specific region code byte (00)has not been set.

A few hours later the c@rd received this PostCode addressed cmd which sets the Region Code byte using the 75_13 nano.
Note the first time this is received the region specifc byte is set and the sw1/2 is 91 a1. If we send this cmd again the sw1/2 is 90 80.

>48 42 00 00 31
<42 c@rd replys command for ICAM
>09 10 00 00 initialise ASIC with public key 10 (all cards)
>24 Flag, Close Filter
>38_09 postal code address nano
>06 Opens c@rd filter if this is the post code.....
>PC PC PC 20 20 20 20 20 post code
>19 00 sets time zone (00=GMT)
>75_13 75_13 nano
>00 47 42 52 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 GBR Region byte
>67_08 signature nano
>01 02 03 04 05 06 07 08 sample signature
<91 a1 Write cmd accepted

The c@rd will then open on BBC1.
This seems to complete the sequence of switch-on comma$$$.
Sending these cmds again to the c@rd results in different sw1/sw2 (eg 90 a0 instead of 90 a1)which suggests re-write protection flags are set.

8. The signature Scheme




9. Codes

9.1 The Fuse Byte

The fuse byte is set during the intitial activation possibly with Cmd3D.

Bit Purpose
0 Active
1 (unknown)
2 Not Virgin
3 Swapped
4 (unknown)
5 Married
6 (unknown)
7 (unknown)

9.2 The Rating Byte

The  level of parental control is selected in the services/parental control  menu. This along with the rating byte sent in the ECMs can be used by  the subscriber to block un-wanted programming.

The Rating Byte which follows the 02 nano describes the type of programming content.

00 = not-encrypted ?
40 = encrypted (Universal)
41 = encrypted/ppv (Universal)
42 = encrypted/ppv (PG)
43 = encrypted/ppv (12)
44 = encrypted/ppv (15)
45 = encrypted/ppv (18)
51 = ppv (12)
52 = ppv (15)
53 = ppv (18)
80 = Information/announcement channels

9.3 The Parental Control Byte (PCB)

The  category of blocked programming is determined bitwise. Six bits are  used. If a bit is set that category is available, if it is not set then  that category is blocked.
00 = blocks all channels.

PCB; "11 1111" LSB
|| ||||- unclassified
|| |||-- universal
|| ||--- PG
|| |---- 12
||------ 15
|------- 18

PCB:- 1F = 18 programming is blocked, 2F = 15 programming is blocked
37 = 12 programming is blocked, 3B = PG programming is blocked
3D = universal programming is blocked,
3F = unrestricted - no programming is blocked.

Other sample combinations of blocked channels:-
39 = U+PG 0F = 15+18 07 = 12+15+18 03 = PG+12+15+18 01 = U+PG+12+15+18


The  level of parental control is selected in the services/parental control  menu. This along with the rating byte sent in the ECMs can be used by  the subscriber to block un-wanted programming.
The PCB is set using the 48 2E 40 00 09 command. See later in the INS3E section

9.4 The Country Code.

Values seen 01, 02, 08, 10 and 1b. This byte is a specific country code related to the Postal Code.
01 is for all English postcodes.
02 is for Scottish postcodes AB, DD, DG, EH, FK, G, HS, IV, KY, KA, KW, ML, PA, PH, TD, ZE.
08 is for Welsh postcodes CF, CH, DY, HR, LL, LD, NP, SA, SY, WR.
10 is for Northern Ireland postcode - BT.
1b is associated with "Postal Code" "UKxx". Is this another region or class of c@rd?

9.5 The Regional code

03  RC is the Local Regional code. This is used for local BBC and ITV  regional programming. It is written with 75 0f nano on initial  activation.
03 01 is London
03 02 is Anglia
03 08 is Yorkshire
03 09 is Meridian,
03 0D is Tyne-Tees,
03 14 is Carlton Central etc.

Some postcodes that lie in marginal areas between terrestrial transmitters may get two or more local regional services.
Please supply your regional bytes and local ITV channel(s) received so we can make a complete list.

9.6 The Bitmap algorithm

The  Bitmap consits of 20 digits. Each digit consists of 8 bits. You will  see that there are 256 Bits (FFh) in this Bitmap. Each bit represents a  number to be present (1) or not present (0). If bit number 4 (04h) is  set to 1 then 04h is present. If bit number 45 (2Dh) is set to 0 then  2Dh is not present. (Start counting from the left!)

9.7 The ke@s

key 10 is the primary public key
key 11 is the seconday public key
key 12 is the primary group key
key 13 is the secondary group key
key 14 is the primary private key
key 15 is the secondary private key
key 16 is the cardswap receive key
key 17 is the cardswap send key

public key: same on every c@rd, so signature is valid for every c@rd
group key: same on a group of 256 cards, signature is valid for any c@rd in this group
private key: unique to every c@rd, signature is valid for ony one c@rd, this is mainly used for activation

Note that these are not the only ke@s used. The internal hash circuit has an extra keyset as well as initialisation data.

9.8 Structure of Date and Time

The date and time is sent to the c@rd with the EMM 48 42 00 00 16, about every 16 seco$$$.
nano 01 36 15 91 1D = 2001.07.21 time not noted
nano 01 38 1D BF 7A = 2001.09.29 time 23:59 GMT
nano 01 38 1E 00 02 = 2001.09.30 time 00:00 GMT
nano 01 38 1E 60 46 = 2001.09.30 time 12:04 GMT
nano 01 39 01 00 05 = 2001.10.01 time 00:00:08 GMT

The following lines are an example algorithm. Set for example the Date:
Date[4]={0x38,0x1D,0xBF,0x7A}; // example from above

void RevDateCalc()
{
year=(Date[0]/12)+1997;
mon=(Date[0]%12)+1;
day=Date[1];
hh=Date[2]/8;
mm=(0x100*(Date[2]-hh*+Date[3])/32;
ss=(Date[3]-mm*32)*2;
}

You  will get 29.09.2001 23:59:52. Well, now you can try that the opposit  direction. Use the algorithm below and you will get "38 1D BF 7A" which  is exactly the value we started from.

void Datecalc()
{
Date[0]=((year-1997)*12 + (mon-1));
Date[1]=day;
Date[2]=hh*8+mm/8;
Date[3]=ss/2+mm*32;
}

9.9 The Status Words

At the end of every instruction the c@rd generates two bytes known as the status words sw1/sw2.
These indicate whether or not the instruction has been accepted or not and other things about the c@rd's status.
The first byte is either 90h or 91h - depending if a certain flag byte is non-zero.

The second byte can have the following values:-
00h, 01h, 20h, 21h, 80h, 81h, A0h or A1h
again, depending upon whether certain flag bits are set or not.

If the "filters open flag" is set at the end of the instruction, then we get 8xh or Axh, otherwise it will be 0xh or 2xh.

If the "IRD match flag" is set (correct c@rd in IRD) then we will get either 2xh or Axh, otherwise 0xh or 8xh.

x is either 1 or 0 depending upon whether another flag bit is set or not.

9.10 The Channel Entitlements (taken from Colibri Doc: You are not allowed to view links. Register or Login)

s*yfo World
Movies
s*yfo Movies Premier 1 30E2 B74D
s*yfo Movies Premier 2 30E2 B74E
s*yfo Movies Premier 3 30E2 B74F
s*yfo Movies Premier 4 30E2 B750
s*yfo Movies Premier Wide 30E2 B754
s*yfo Movies Max 1 30E1 B749
s*yfo Movies Max 2 30E1 B74A
s*yfo Movies Max 3 30E1 B74B
s*yfo Movies Max 4 30E1 B74C
s*yfo Movies Max 5 30E1 B78A
s*yfo Movies Cinema 1 B732 B747
s*yfo Movies Cinema 2 B732 B748
Sports
s*yfo Sports 1 30E3
s*yfo Sports 2 30E4
s*yfo Sports 3 30E5
s*yfo Sports Extra 30E3 30E4
Family Pack
Sports
s*yfo Sports News 0010 B752
British Eurosport 0010 B776
attheraces 0010 1531
Entertainment
s*yfo One 0010 B758 B759 B75A B75B B757 B723
s*yfo One Mix 0010 B889
UK Gold 0010 B758 B743
UK Gold +1 0010 B87B
UK Gold 2 0010 B745
Living TV 0010 B758 B73C
Living TV +1 0010 B87F
Granada Plus 0010 B75B B727
Challenge? 0010 B75B B73D
Bravo 0010 B75B B73F
Bravo +1 0010 B890
Paramount 0010 B758 B762
Sci-Fi 0010 B75B B729
Discovery Home & Leisure 0010 B757 B758 B759 B75A B75B B753
Discovery Home & Leisure + 1 0010 B84F
Men and Motors 0010 B75B B761
UK Style 0010 B75B B740
UK Style+1 0010 B869
UK Food 0010 B85C
UK Drama 0010 B75B B742
Discovery Health 0010 B833
E4 0010 B847
CNX 0010 B884
E! 0010 5B6B
UK Bright Ideas 0010 3C4D
Ftn 0010 33C0
s*yfo Travel Shop 0010 B738
News and Documentaries
Bloomberg 0010 B757 B758 B759 B75A B75B B725
CNBC 0010 B759 B735
Fox News 0010 B867
Discovery Channel 0010 B758 B759 B733
Discovery Channel + 1hr 0010 B758 B759 B763
Discovery Travel and Adventure 0010 B75D
Discovery Civilisation 0010 B75E
Discovery Sci-Trek 0010 B75F
Discovery Wings 0010 B831
National Geographic 0010 B758 B759 B728
National Geographic Channel + 1 0010 B758 B759 B7C9
Adventure One 0010 B7CB
The History Channel 0010 B759 30DD
History + 1 hr 0010 B759 B839
Biography 0010 B759 B83A
UK Horizons 0010 B759 B741
UK Horizons + 1 0010 B759 B84D
Discovery Animal Planet 0010 B759 B734
Discovery Animal Planet + 1 0010 B84E
UK History 0010 B880
Music and Radio
MTV 0010 B75A B72E
MTV Hits 0010 B77B
VH1 0010 B75A B72F
VH1 Classic 0010 B77D
MTV 2 0010 B75A B760
MTV Base 0010 B77C
MTV Dance 0010 B84B
TMF 0010 223A
The Box 0010 B75A B730
KISS 0010 B82B
Smash Hits 0010 B84C
Magic 0010 B853
Q 0010 B82C
Kerrang! 0010 B849
The Hits 0010 255F
Music Choice (10 channels) 0010 B757 B758 B759 B75A B75B B764
Big Blue 0010 B858 B85A B85B B859
The Saint 0010 B858 B85A B85B B859
The Villan 0010 B858 B85A B85B B859
Kids
Cartoon Network 0010 B758 B75A B774
Cartoon Network + 1 0010 B758 B75A B774
Boomerang 0010 B88F
Nickelodeon 0010 B758 B75A B72C
Nick Replay 0010 B758 B75A B72C
Nick Toons TV 0010 B87D
Trouble 0010 B75A B75B B73E
Fox Kids 0010 B758 B75A B72A
Fox Kids + 1 0010 B758 B75A B72A
Nick Jr. 0010 B7CA
Non-subscription channels
Channel 4 B766
five B765
BBC ONE 001D
BBC TWO 001D
BBC THREE 001D
BBC FOUR 001D
S4C ~ Digitol B777
Various channels
Music Choice Extra B721
Bangla TV B878
Premiership Plus 0010 B757 B758 B759 B75A B75B B739
Chelsea TV 0010 B757 B758 B759 B75A B75B B739
LBC B85F
ART Europe B85F
ART Movies B85F
ART Music B85F
Al Jazeera B85F
FilmFour Night: B770 only/Day: B770 0010 B757 B758 B759 B75A B75B
FilmFour +1 Night: B770 only/Day: B770 0010 B757 B758 B759 B75A B75B
Film4 Weekly Night: B770 only/Day: B770 0010 B757 B758 B759 B75A B75B
SouthForYou B879
NASN 2590
Ekushey TV B865
PTV Prime B837
STREAM-0 0010 001D B7C8
STREAM-1 0010 001D B7C8
STREAM-2 0010 001D B7C8
STREAM-3 0010 001D B7C8
STREAM-4 0010 001D B7C8
STREAM-5 0010 001D B7C8
STREAM-6 0010 001D B7C8
Pub Channel B78B B78C B78D B78E B78F B790 B791 B792 B793 B794
ISM Test1 v5 B778
ISM Sports 1 v6 B778
ISM s*yfo One v6 B778
ISM s*yfo News v6 B778
STT B778
101-5 B778
Snr B7D9
Tantalise TV B874
STAR Plus B838
STAR News B838
Talk Sport 0010 B757 B758 B759 B75A B75B B7D3
Zee TV / Zee Music B79A
Zee Cinema B7CC
Sony TV Asia B7CC
Alpha EtcPun B7D5
ARY Digital B7D2
B4U Movies B799
TV5 0010 B86D
Artsworld B82F
MUTV B73B