I found something interesting, maybe this will give you some boost
Read this first:
This method is really cloning ID.
Next, I have schematics for Sony XM01, the same receiver the guy is talking about.
There is a chip labelled CAP which takes care of encryption, part number ST19AF08, it's secure micro similar to CAM.
If there is interest, I can post schematics, also suggest in which folder.
The next step I guess is to get actual device and start logging communications.