terminator2k2
Inactive User
- Joined
- Sep 9, 2007
- Messages
- 352
- Reaction score
- 6
well all i can see is the original key with the wrong bytes is xor aginst 19 to give the correct value.????
keyroll emm and the fix (code it ur self)
- Thread starter fes_786
- Start date
correct in that ecm it does. It take the two highlighted red values xors with 19 and stores them back.
the next ecm pics out two more differnt bytes and xors with #41 and alters bytes b1 and bc.
so the fix is read from the emm stored in the cards memory the xor byte store this to a register
read from the emm in memory the xor`ed bytes location b1 b3 b6 etc
xor it with the a byte location
store it back emm done
the next ecm pics out two more differnt bytes and xors with #41 and alters bytes b1 and bc.
so the fix is read from the emm stored in the cards memory the xor byte store this to a register
read from the emm in memory the xor`ed bytes location b1 b3 b6 etc
xor it with the a byte location
store it back emm done
Well someone just leaked my rom 7.
Bit disappointed as I hope one of you would come up with a fix. I hope you don't just give up now that a fix is out.
I will post this. First block is a decrypted rom 7 emm with comments added.
Second block is the fix applied to the rom 7.
Bit disappointed as I hope one of you would come up with a fix. I hope you don't just give up now that a fix is out.
I will post this. First block is a decrypted rom 7 emm with comments added.
Second block is the fix applied to the rom 7.
CG121
Inactive User
- Joined
- Jun 1, 2007
- Messages
- 520
- Reaction score
- 113
1 byte in each key
Re my public opos patch, I simply made the initial branch command jump to $94 (same as the branch always below it) and replaced the lda #$02 command with clrx (clear x) and tax (transfer a to x)
sorted
1 byte in each key
Re my public opos patch, I simply made the initial branch command jump to $94 (same as the branch always below it) and replaced the lda #$02 command with clrx (clear x) and tax (transfer a to x)
sorted
Yep lots of different ways to do it. Take your pick.
Lots of your code in the above so thanks for that also.
fendale2000
Inactive User
- Joined
- Apr 9, 2008
- Messages
- 35
- Reaction score
- 0
Can you give me a hint as to what setting to use to dissassemble the nagrarom10.bin from the dbox? I have selected Motorola 6805 and then when it asks me what model it is, which I don't know. I have tried a few with different sizes of RAM but the dissassembled code is basically just a list of 'fcb' over and over again!
I am using IDA pro 5.2 which I grabbed from Pirate Bay ...
linked
Member ++
no i for one would still wanna understand and learn this so i know and can edit and fix myself which to me is more fun then just downloading a file already done...
@ danefc34 yeah i should have known but its been ages and i think i been getting lazy. so wanna get back on this all.
Just wanted to say thanx @cydine_ this thread makes for a great read it's nice to get an idea of what's going on and an op to experiment even if I don't fully understand everything! lol
Not forgetting fes for starting it all off
Not forgetting fes for starting it all off
Last edited:
fendale2000
Inactive User
- Joined
- Apr 9, 2008
- Messages
- 35
- Reaction score
- 0
Thanks for posting that. I REALLY want to patch the ROM myself with this code, or even hack around with my code to see if I can get a different version working. I am still stuck however:
1. I have IDA pro, but cannot get it to dissassemble the ROM 10 or 7 I have copied from the Dbox.
2. I don't know how to assemble my or your code to get it into the form required to edit the hex - is there a workin assembler, or will I have to just look up the hex for each OP code?
If I could get some help with these two parts, I reckon I would be well on the way to victory on this!
fendale2000
Inactive User
- Joined
- Apr 9, 2008
- Messages
- 35
- Reaction score
- 0
OK - after viewing the patched ROM 7 in the hex editor, and comparing with the dissassembled ROM 7 in the Nagra Coding Package, I think I can answer all my own questions now!
1 - there is no real need to dissassemble the existing ROM, the in the nagra_coding packge is good enough - Wouldn't mind know how to do this anyway though!
2 - I reckon I just have to look up the OP codes to do the assembling - its only a handful of instructions, so it should be simple enough.
Then all you have to do is edit the old ROM with win hex edit and sit back and watch the telly!
Thanks to all involved in this thread for helping - If I can successfully patch the April ROM7 I have with a variation of the code I posted earlier in this thread, I will try and write up a tutorial on how to do this stuff to help future noobs.
I have to say though, expecting someone from a non computing/engineering background to figure this stuff out is asking a lot - I have an engineering degree (and hence have programmed in assembler before) and am currently a programmer by trade - if you have never written any assembly code, learning how to do this stuff is going to be tough.
A tutorial would be very well received methiinks, fendale2000, its been a really interesting thread to follow has this one. Even if I am no nearer to being able to write a fix......but I'm going to keep reading and hopefully some of this stuff will stick in my head.....................................................trouble is, its like I only have 64 megabytes of memory, and I'm trying to fit 10gigabytes of stuff into it
Thanks to all who have contributed to this thread.
ATB, Rigsby.
Thanks to all who have contributed to this thread.
ATB, Rigsby.
terminator2k2
Inactive User
- Joined
- Sep 9, 2007
- Messages
- 352
- Reaction score
- 6
yes ferndale2000 you hit the nail on the head there....you must have a bit of knowledge to begin with in coding...and like so many of us we dont have a clue.....
how about a tutorial for us noobs to understand....
i understand what is needed and why but when i like at the code its all gibberish..lol....
how about a tutorial for us noobs to understand....
i understand what is needed and why but when i like at the code its all gibberish..lol....
I am a software architect by profession, but never really done any assembly language before. I am going through the stuff cydine sent - quite slowly, but I need to understand what I am doing. Once the penny drops, I'll be fine.
Any tutorial would be very much appreciated.
Thanks for everything cydine.
abaddon
BLACKJACK1978
Inactive User
This has been doing my head in for 2 days trying to work round this coding.I think my head is about to explode.I think a tutorial will be a good thing if someone has the time and patience with us to try and learn.I want to learn so i can give somthing back to the community.
Darth Jax
Inactive User
- Joined
- Mar 6, 2005
- Messages
- 123
- Reaction score
- 0
I'm not a prolific poster as you can tell by my post count, but am always around logged on or not and must say this has been a really good thread to appear in a while. I understand the concept of what is going on but as others when you look at the code you don't know where to start....
A noob tut would be magnificent
cheers
A noob tut would be magnificent
cheers
learntofly
Inactive User
Yeah shame some tosser screwed cydine over.. I mean is your integrity worth TV?
Although most of it has been over my head Ive been stuck in assembler for about 24 hours now and loving it, I think I would of got it within a week or so to but unfortunately am back in work tomorrow.
I would still like to patch the rom10 and 11 files though.. I was looking at the feasibility of a dirty hex cut and paste job from the rom 7 but I can see some of the registers are different...
Cydine.. I understand you are pissed off at whoever leaked your work however please do not turn your back on us.. I bet the author of the next fix in the future is subscibed to this thread!
Couple of questions, hope someone can help me..
* How do you get IDA Pro to disassemble the .bin's out of the box?
* Can IDA produce a .lst file?
* if so what tool will recompile this .lst into a binary?
Does anyone have anymore literature stashed away about this?
Many Thanks!
--
Regards
Although most of it has been over my head Ive been stuck in assembler for about 24 hours now and loving it, I think I would of got it within a week or so to but unfortunately am back in work tomorrow.
I would still like to patch the rom10 and 11 files though.. I was looking at the feasibility of a dirty hex cut and paste job from the rom 7 but I can see some of the registers are different...
Cydine.. I understand you are pissed off at whoever leaked your work however please do not turn your back on us.. I bet the author of the next fix in the future is subscibed to this thread!
Couple of questions, hope someone can help me..
* How do you get IDA Pro to disassemble the .bin's out of the box?
* Can IDA produce a .lst file?
* if so what tool will recompile this .lst into a binary?
Does anyone have anymore literature stashed away about this?
Many Thanks!
--
Regards
phils_confused
Inactive User
Thanx to all who have helped out here. Shame I didn't anywhere with it. If somebody did a tut I'd love a go at modding rom 10 and 11. My only problem is I'm a bit of a retard when it comes to programming, so the simpler the better.
Once again Thanks Cydine and everybody else who helped. Shame the fix was leaked, I'm gonna try and stick with it and learn though.
Once again Thanks Cydine and everybody else who helped. Shame the fix was leaked, I'm gonna try and stick with it and learn though.
