stbemu_lookup

Device authentication, not credentials

Stalker middleware authenticates hardware, not users. The portal keeps a list of registered MAC addresses, each mapped to a subscriber profile, and presenting a registered MAC is the entire authentication step. This is why a portal URL alone is worthless, and why the MAC is the field that needs protecting.

MAC values here keep the 00:1A:79 prefix, the OUI assigned to the original MAG hardware. Portals frequently validate it, since anything outside that range is unlikely to be a genuine set-top box.

The handshake

A client requests a handshake and receives a token, then sends a profile request carrying that token along with the MAC, a serial and a device identifier. The portal returns the profile, and later calls for the channel list and stream links carry the token. The MAC travels in a header rather than a query string, which is marginally less exposed than Xtream — though equally unencrypted over plain HTTP.

Telling the failures apart

An immediate error means the portal is reachable and rejecting the MAC: not registered, or cleared. A loading screen that never resolves usually means the handshake succeeded and the profile request failed, which is a portal-side fault. No connection at all means the portal is down or the URL is wrong. All three look similar in the client and none of them is fixable from your side.

Emulator and hardware are interchangeable

MAG 322, 420 and 524, Formuler Z8, Z10 and Z Alpha, and Kodi through the Stalker Client add-on all speak the same protocol. A portal that authenticates in STB Emulator on a phone will generally authenticate on the box, which makes the emulator the cheaper place to test.