hola he probado con el firm de p8t4 y el duca 5 ppv.
activando el rs232 (comm1) en el deco y con el programa mediacom 2.1 (siempre a 115200b)

he conseguido estos logs

1º con el deco en el canal 1 pulsas en el mediacom el boton load psi y sale esto:
Quering Program Assotiation Table...

========= Parsing new section ==============
Section saved as: PAT_040E_00.bin
Section #1 of 1 total.
Network PID 0x0010.
Program number (Service_ID) 0x76C0, PID 0x0400.
Program number (Service_ID) 0x76C3, PID 0x0403.
Program number (Service_ID) 0x76C4, PID 0x0404.
Program number (Service_ID) 0x76C5, PID 0x0405.
Program number (Service_ID) 0x76C6, PID 0x0406.
Program number (Service_ID) 0x76C7, PID 0x0407.
Program number (Service_ID) 0x76CA, PID 0x0409.
Program number (Service_ID) 0x76CB, PID 0x040A.
Program number (Service_ID) 0x76CC, PID 0x040B.
Quering Service Description Table...

========= Parsing new section ==============
Section saved as: SDT_040E_00.bin
Section #1 of 1 total.
Service ID: 76C0
Service Type: digital television service
Service Provider: CanalSatélite
Service Name: CANAL+
Service ID: 76C3
Service Type: digital television service
Service Provider: CanalSatélite
Service Name: DISNEY CHANNEL
Service ID: 76C4
Service Type: digital television service
Service Provider: CanalSatélite
Service Name: SPORTMANÍA
Service ID: 76C5
Service Type: digital television service
Service Provider: CanalSatélite
Service Name: 40 TV
Service ID: 76C6
Service Type: digital television service
Service Provider: CanalSatélite
Service Name: DISCOVERY
Service ID: 76C7
Service Type: digital television service
Service Provider: CanalSatélite
Service Name: OP. TRIUNFO
Service ID: 76CA
Service Type: digital television service
Service Provider: CanalSatélite
Service Name: CANAL+ 2
Service ID: 76CB
Service Type: digital television service
Service Provider: CanalSatélite
Service Name: C+ DEPORTE 3
Service ID: 76CC
Service Type: digital television service
Service Provider: CanalSatélite
Service Name: TELEDEPORTE
Quering Conditional Access Table...

========= Parsing new section ==============
Section saved as: CAT_FFFF_00.bin
Section #1 of 1 total.
CA System ID: 0x0100
EMM PID: 0x00C1
Service Operator ID: 0x0064, EMM PID: 0x00C4
Quering Program Map Table...


y te graba estos dos ficheros SDT_040E_00.bin,CAT_FFFF_00.bin


de pues le das a el boton load ptm y cargas poe ejemplo el canal +, y te sale esto:
========= Parsing new section ==============
Section saved as: PMT_76C0_00.bin
Section #1 of 1 total.
Service ID: 0x76C0
PCR PID: 0x00A0
Elementary stream:
ES type C6: User Private
ES PID: 0x00C7
ES info, length 0x0000
Elementary stream:
ES type 02: ITU-T Rec. H.262 | ISO/IEC 13818-2 Video
ES PID: 0x00A0
ES info, length 0x0022
09: CA descriptor, length 0x20
CA System ID: 0x0100
Service Operator ID: 0x0064, ECM PID: 0x05DD
Event ID: 2742
PBM: 73FFFFFFFFFFFFFF
Service Operator ID: 0x0064, ECM PID: 0x05DC
PBM: 0000000008010004
Seca Date: 1CF5
Elementary stream:
ES type 04: ISO/IEC 13818-3 Audio
ES PID: 0x0050
ES info, length 0x0028
0A: ISO_639_language_descriptor, length 0x04
ISO_639_language_code: spa
Audio type: Undefined
09: CA descriptor, length 0x20
CA System ID: 0x0100
Service Operator ID: 0x0064, ECM PID: 0x05DD
Event ID: 2742
PBM: 73FFFFFFFFFFFFFF
Service Operator ID: 0x0064, ECM PID: 0x05DC
PBM: 0000000008010004
Seca Date: 1CF5
Elementary stream:
ES type 04: ISO/IEC 13818-3 Audio
ES PID: 0x0051
ES info, length 0x002A
0A: ISO_639_language_descriptor, length 0x04
ISO_639_language_code: dos
Audio type: Undefined
Unknown Descriptor: C0, length 0x00
09: CA descriptor, length 0x20
CA System ID: 0x0100
Service Operator ID: 0x0064, ECM PID: 0x05DD
Event ID: 2742
PBM: 73FFFFFFFFFFFFFF
Service Operator ID: 0x0064, ECM PID: 0x05DC
PBM: 0000000008010004
Seca Date: 1CF5
Elementary stream:
ES type 06: Teletext / Subtittles
ES PID: 0x0020
ES info, length 0x000C
56: Teletext descriptor, length 0x0A
ISO_639_language_code: spa
Teletext_type: Teletext subtitle page
Teletext_magazine_number: 0
Teletext_page_number: 0x01
ISO_639_language_code: imp
Teletext_type: Teletext subtitle page for hearing impaired people
Teletext_magazine_number: 0
Teletext_page_number: 0x58
Elementary stream:
ES type C0: User Private
ES PID: 0x00D0
ES info, length 0x0051
Unknown Descriptor: C6, length 0x05
C2: 8 byte text msg descriptor, length 0x48
Text: CSE_PIL1
Text: CSE_PIL2
Text: CSE_CHAN
Text: CSE_EPG
Text: CSE_FUT1
Text: CSE_FUT2
Text: CSE_AUDI
Text: CSE_MSD1
Text: CSE_MSD2
Elementary stream:
ES type C0: User Private
ES PID: 0x00DE
ES info, length 0x000A
C2: 8 byte text msg descriptor, length 0x08
Text: CHAINE
Elementary stream:
ES type C0: User Private
ES PID: 0x0134
ES info, length 0x000A
C2: 8 byte text msg descriptor, length 0x08
Text: LANZUPGR
Elementary stream:
ES type C1: User Private
ES PID: 0x016B
ES info, length 0x000A
C2: 8 byte text msg descriptor, length 0x08
Text: BUZON16
Elementary stream:
ES type C1: User Private
ES PID: 0x016C
ES info, length 0x000A
C2: 8 byte text msg descriptor, length 0x08
Text: BUZON19
Elementary stream:
ES type C1: User Private
ES PID: 0x0165
ES info, length 0x000A
C2: 8 byte text msg descriptor, length 0x08
Text: DWV
Elementary stream:
ES type C1: User Private
ES PID: 0x0094
ES info, length 0x000A
C2: 8 byte text msg descriptor, length 0x08
Text: TICKER
Elementary stream:
ES type C1: User Private
ES PID: 0x00FD
ES info, length 0x000A
C2: 8 byte text msg descriptor, length 0x08
Text: DCOMUN
Elementary stream:
ES type C1: User Private
ES PID: 0x0164
ES info, length 0x000A
C2: 8 byte text msg descriptor, length 0x08
Text: LORD
Elementary stream:
ES type C1: User Private
ES PID: 0x00D5
ES info, length 0x000A
C2: 8 byte text msg descriptor, length 0x08
Text: PILOTE
Elementary stream:
ES type C1: User Private
ES PID: 0x0133
ES info, length 0x000A
C2: 8 byte text msg descriptor, length 0x08
Text: LANZ

y te graba esto PMT_76C0_00.bin, pues es el que habia elegido el canal 1
en teoria aqui estan los datos para poder capturar las emm y las ecm.
CA System ID: 0x0100
EMM PID: 0x00C1
Service Operator ID: 0x0064, EMM PID: 0x00C4

pero el problema esque no se puede mandar todo el trafico del deco al pc poque el puerto com no da los 27mhz (eso he leido) por eso hay que filtrarla.

y he visto que hay que mandar unos filtros de las ins que queramos al host del deko, (enteoria el mediacom lo hace) se quede en la eprom del deco y que lo desencripte y no lo mande al pc por el serie(rs232).
pero eso no se como.

haber si alguien le gusta el tema y me echa una mano.
pues los post de este hilo son mas de 40000 creo que interesa.

un saludo seguire haciendo los deberes