Help Needed Rom11,edcase script 2100C

[stantheman]

Hi All
Coud someone pls help me with the following,I have a samsung SMT 2100C
The card needs a new image on it,as the guy who modified box,put an expiry/rights date.There are no numbers on card or box,so i ran edcase
b09 d2c file.

I have opened nagra edit 4.1
and ran the script,i can now read from card if i want to,

Apparently i can get my BK & IRD by recording the responce
to B1 Packet.
it says in nagra edit save this information if you need it

Can someone kindly help me with this,
Many Thanks
stantheman

 

[havelln]

you have wiped the numbers off the card now you will need to jtag box
you should have used boxgetpc2 to get your boxkey
and mrom to get your ird
before you ran the edcase script

 

[stantheman]

HI
I should have mentioned that i used getboxpc2
but it didnt work,i think there is a blocker on the image thats currently on the card
and if i mrom,d it.i would have lost my BK & IRD.
Thanks
stantheman

PS does the sammy 2100c need to be in stream to jtag it,or in engineers page?

 

[edcase]

If you have the response from the FIRST time the script was ran you can decrypt it in XNCS. There is a post on here explaining how. I will find it and add a link later.



edit:

Couldnt find the post on here so I copied and pasted from a post by Tesla on another forum:

Take the first B1 packet

120042 ----STRIP THIS OUT and remove all spaces from the data field
FCB1BB7848FCD9450453F5DDDDDDDDDDB76FA99C0B4EBB8D6E 217CD9FB42FAC183E50DDDDDDDDDDDDDDDDDDDD89377D902A
D3625E78531F60AC0E0A04CF55E12
90009D ---STRIP THIS OUT

Open XNCS click on 'Tools' 'Extras' 'Backdoor Enc/Dec'

Copy and paste your 64 byte encrypted data into the data field
FCB1BB7848FCD9450453F5DDDDDDDDDDB76FA99C0B4EBB8D6E 217CD9FB42FAC183E50DDDDDDDDDDDDDDDDDDDD89377D902A
D3625E78531F60AC0E0A04CF55E12

Enter the keys depending on which card it is -
rom10
login: 02030000002EFF7F7FE300FFFFFF0000 romkey: D5F340639D811C8F

rom11
login: 02030000002EFF1FBCEF1F1733070000 romkey: 2CA67B24F21DE418

Select Decypt radio button then press 'DoIT!' hopefully you will end up with something like this!!!

res=072701XX010001000000000000XXXXXXXX000000000000 0000000000000000000033333333333333330738065C0000278476F4FFFFFFFFFFFFFFFFFFFF00FFFF

The red portion should be your Boxkey

Hope this helps big thanks to edcase/deceased/TheCoder

 

[stantheman]

Hi
OK thanks for that information
its beeen a great help
Does the box need to be in engineers page.or instream?

What are the samsung bytes for pure do you know if they are correct
here they are:0x00895934
many thanks fellas
stantheman