v2.0.0

TSDEC 2.0.0

Offline decrypter for recorded DVB transport streams.

Decrypts a recorded .ts file using control words logged elsewhere, with the
common scrambling algorithm. Works for any DVB crypt system because the system
only governs what happens inside the smartcard; what the CAM does with a control
word is always the same.

Downloads

platform	binary	archive
Linux x86-64	tsdec-linux-x86_64	tsdec-linux-x86_64.tar.gz
macOS arm64 (Apple Silicon)	tsdec-macos-arm64	tsdec-macos-arm64.tar.gz
Windows x86-64	tsdec-windows-x86_64.exe	tsdec-windows-x86_64.tar.gz

The binaries are plain executables: no runtime, no shared library, no install
step. The archives are the same file plus the README and the licence.

Quick start

chmod +x tsdec-linux-x86_64
./tsdec-linux-x86_64 -f control-words.cwl -i recording.ts -o clear.ts -P

On Windows, just run tsdec-windows-x86_64.exe. tsdec -h lists every
option; the README explains the control word log format and how the sync
works.

What is different from the 0.4.1 line

The CSA cipher is bitsliced. libdvbcsa already carried the FFdecsa
implementation but nothing called it, so every packet went through the scalar
table-lookup cipher alone. It now batches 128 packets into SSE2 registers:
7.6x on the cipher itself, 18.5 to 141 MiB/s.

Decryption is threaded. One scout thread decides which logged control word
applies to each packet; N workers run the batch cipher on planned blocks and
write to disjoint output offsets. On 16 cores that takes a 215 MiB recording
from 11.99s down to 0.22s, roughly 55x end to end, with byte identical output
at every thread count. -t sets the count.

Several bugs fixed. Most visibly, the control word cursor ran past the end
of the log and then reported it as too short even when it had just matched a
key, so a log with many control words failed part way through.

New options. -t threads, -p pid filter for recordings carrying several
services, -o - to write to stdout, -P progress, -r to resync a damaged
stream, -k to refuse damaged control word checksums instead of repairing
them.

If you are coming from the 1.0 build

Nothing you already scripted breaks. -f, -i, -o, -e, -d, -a, -b,
-v and -h keep their meaning.

Two output differences are worth knowing:

• A log that runs out is no longer fatal. tsdec reports the packet where it
  stopped and carries on with what it has.
• Decrypted packets now carry correct adaptation field control and continuity
  counter bits. The old code cleared the scrambling bits with a mask that also
  wiped those two, so a byte comparison against 1.0 output differs on byte 4 of
  every scrambled packet while the payload is byte identical.

Tests

make test checks the bitsliced engine against the scalar one bit for bit,
against the published DVB test vectors. tools/run_tests.sh builds synthetic
transport streams, encrypts them through tsdec's own constant control word
path so the generated log genuinely matches the data, decrypts them again and
compares packet by packet. Both run on Linux, macOS and Windows in CI, and the
full suite is what produced these binaries.

Full changelog

The complete list of changes, with the reasoning behind each fix, is in
CHANGELOG.md.

Attribution

Based on TSDEC V0.4.1 by ganymede. The CSA engine and the FFdecsa bitslice
implementation come from libdvbcsa by Alexandre Becoulet. GPL v3.