Back door 0 on rom 10 issue

Hi John when you say you kept persisting with Mrom where you having any errors on the strings?
Did you use method 1 or 2?
I have Mrommed both cards loads of times on both methods with no errors at all reported on either method.
The provider id has successfuly been changed to 40 this happened after mromming the first time.
I cant see what Mrom can now do if it doesnt report any errors?
I have an imfinity usb and also a infinity phoenix both give no error results although the setting up of the infinity usb took some time to get good delay settings.
 
Last edited:
@ carwash
Done some playing around in commands with xncs
and now have this in caton on card2

Caton i sent this : 21000DA0CA00000721050103FFFF012046
A1: Resp. a comando 21 (Petición de UN ITEM de un TIPO de DATOS)

126020A11E690100010000C35808000E06688200000000000000000000000000000000F5

12 CAM->IRD
60 01100000, Bloque de instrucción, sec.1, necesita al menos un paquete más
20 Longitud del envío
A1 Respuesta a comando 21
1E Longitud de datos respuesta
-------------------01: INFORMACIÓN IRD y DUEÑO TARJETA
6901 Tipo Sistema
00 EstIRD: 00000000
01 Grupo acceso libre
0000C358 Código postal: 50008
08 Zona horaria = 2:00 (GMT)
00 Byte de desviación DVB
0E066882 Número IRD: -2107111922
0000000000000000 Revisión bootstrap: ........
0000000000000000 Revisión firmware: ........
Boxkey
--------------------------------
0000 SW ?????????????????
F5 Control Redund. Lineal.: CRL Ok


Okay maybe getting somewhere now ,i did the same commands in xncs again on card 1and it allowed the ghost provider to be installed here is what caton says for card 1 now

Caton i sent 21000DA0CA00000721050103FFFF012046

A1: Resp. a comando 21 (Petición de UN ITEM de un TIPO de DATOS)

122020A11E69010001000000000000CC8E463E00000000000000000000000000000000FE

12 CAM->IRD
20 00100000, Bloque de instrucción, sec.0, necesita al menos un paquete más
20 Longitud del envío
A1 Respuesta a comando 21
1E Longitud de datos respuesta
-------------------01: INFORMACIÓN IRD y DUEÑO TARJETA
6901 Tipo Sistema
00 EstIRD: 00000000
01 Grupo acceso libre
00000000 Código postal: 0
00 Zona horaria = 0:00 (GMT)
00 Byte de desviación DVB
CC8E463E Número IRD: 1044811468
0000000000000000 Revisión bootstrap: ........
0000000000000000 Revisión firmware: ........
Boxkey
--------------------------------
0000 SW ?????????????????
FE Control Redund. Lineal.: CRL Ok

On sending this emm to both cards i get this response from caton
sent
210053A0CA00004D004B6901029D250A8525B2D7B20E3E518A AF8FF5DBEECA7E5985978F15E5625A8837E58A8751EEF70430 9C44039DF20D59BDBA1A87B1C8D9B5179082226F383EE24FD4
Respuesta corrupta:

210053A0CA00004D004B6901029D250A8525B2D7B20E3E518AAF8FF5DBEECA7E5985978F15E5625A8837CA8A8751EEF704309C44039DF20D59BDBA1A87B1C81292ECED179082226F719200E3383EE24FD42414528F2C506D034E52059783920011
In xncs on card 1 i get this with the above emm

TX: 210054A0CA00004D004B6901029D250A8525B2D7B20E3E518AAF8FF5DBEECA7E5985978F15E5625A8837E58A8751EEF704309C44039DF20D59BDBA1A87B1C8D9B5179082226F383EE24FD42414528F2C506D034E52059707
RX: 1240078003B1010A9000FC ;|CrcOk!CmdOk|

on card 2
this
TX: 210054A0CA00004D004B6901029D250A8525B2D7B20E3E518AAF8FF5DBEECA7E5985978F15E5625A8837E58A8751EEF704309C44039DF20D59BDBA1A87B1C8D9B5179082226F383EE24FD42414528F2C506D034E52059707
RX: 1240078003B101069000F0 ;|CrcOk!CmdOk|
Any more suggestions??
 
Last edited:
Can you dump card with XNCS yet?

If so"! then your BD0 will be in line C040
 
Last edited:
Neither of them dump unfortunately with xncs but i am definately getting feedback from commands sent in xncs
 
ByteMaster said:
@ carwash
Done some playing around in commands with xncs
and now have this in caton on card2

Caton i sent this : 21000DA0CA00000721050103FFFF012046
A1: Resp. a comando 21 (Petición de UN ITEM de un TIPO de DATOS)

126020A11E690100010000C35808000E06688200000000000000000000000000000000F5

12 CAM->IRD
60 01100000, Bloque de instrucción, sec.1, necesita al menos un paquete más
20 Longitud del envío
A1 Respuesta a comando 21
1E Longitud de datos respuesta
-------------------01: INFORMACIÓN IRD y DUEÑO TARJETA
6901 Tipo Sistema
00 EstIRD: 00000000
01 Grupo acceso libre
0000C358 Código postal: 50008
08 Zona horaria = 2:00 (GMT)
00 Byte de desviación DVB
0E066882 Número IRD: -2107111922
0000000000000000 Revisión bootstrap: ........
0000000000000000 Revisión firmware: ........
Boxkey
--------------------------------
0000 SW ?????????????????
F5 Control Redund. Lineal.: CRL Ok


Okay maybe getting somewhere now ,i did the same commands in xncs again on card 1and it allowed the ghost provider to be installed here is what caton says for card 1 now

Caton i sent 21000DA0CA00000721050103FFFF012046

A1: Resp. a comando 21 (Petición de UN ITEM de un TIPO de DATOS)

122020A11E69010001000000000000CC8E463E00000000000000000000000000000000FE

12 CAM->IRD
20 00100000, Bloque de instrucción, sec.0, necesita al menos un paquete más
20 Longitud del envío
A1 Respuesta a comando 21
1E Longitud de datos respuesta
-------------------01: INFORMACIÓN IRD y DUEÑO TARJETA
6901 Tipo Sistema
00 EstIRD: 00000000
01 Grupo acceso libre
00000000 Código postal: 0
00 Zona horaria = 0:00 (GMT)
00 Byte de desviación DVB
CC8E463E Número IRD: 1044811468
0000000000000000 Revisión bootstrap: ........
0000000000000000 Revisión firmware: ........
Boxkey
--------------------------------
0000 SW ?????????????????
FE Control Redund. Lineal.: CRL Ok

On sending this emm to both cards i get this response from caton
sent
210053A0CA00004D004B6901029D250A8525B2D7B20E3E518A AF8FF5DBEECA7E5985978F15E5625A8837E58A8751EEF70430 9C44039DF20D59BDBA1A87B1C8D9B5179082226F383EE24FD4
Respuesta corrupta:

210053A0CA00004D004B6901029D250A8525B2D7B20E3E518AAF8FF5DBEECA7E5985978F15E5625A8837CA8A8751EEF704309C44039DF20D59BDBA1A87B1C81292ECED179082226F719200E3383EE24FD42414528F2C506D034E52059783920011
In xncs on card 1 i get this with the above emm

TX: 210054A0CA00004D004B6901029D250A8525B2D7B20E3E518AAF8FF5DBEECA7E5985978F15E5625A8837E58A8751EEF704309C44039DF20D59BDBA1A87B1C8D9B5179082226F383EE24FD42414528F2C506D034E52059707
RX: 1240078003B1010A9000FC ;|CrcOk!CmdOk|

on card 2
this
TX: 210054A0CA00004D004B6901029D250A8525B2D7B20E3E518AAF8FF5DBEECA7E5985978F15E5625A8837E58A8751EEF704309C44039DF20D59BDBA1A87B1C8D9B5179082226F383EE24FD42414528F2C506D034E52059707
RX: 1240078003B101069000F0 ;|CrcOk!CmdOk|
Any more suggestions??
Click to expand...

Loking at the EMM that you are sending you will allways get a corrupted response, its close to 8 bytes missing
send this one m8"!

210053A0CA00004D004B6901029D250A8525B2D7B20E3E518AAF8FF5DBEECA7E5985978F15E5625A8837E58A8751EEF704309C44039DF20D59BDBA1A87B1C8D9B5179082226F383EE24FD42414528F2C506D034E520597
 
Same error on both cards

210053A0CA00004D004B6901029D250A8525B2D7B20E3E518A AF8FF5DBEECA7E5985978F15E5625A8837E58A8751EEF70430 9C44039DF20D59BDBA1A87B1C8D9B5179082226F383EE24FD4 2414528F2C506D034E520597

Respuesta corrupta:

210053A0CA00004D004B6901029D250A8525B2D7B20E3E518AAF8FF5DBEECA7E5985978F15E5625A881282009037E58A8751EEF704309C44039D738200F1F20D59BDBA1A87B1C8D9B5179082226F383E2F8200ADE24FD42414528F2C506D034E5205972E8200AC
 
for to be able to install a ghost with XNCS it would have to Dump image"!

How did you install ghost?
 
went firsr to rom studio logged in aperndiz dump did not install ghost on card 1
then deleted the other no 1 provider info then loaded a new working image wrote that with write apperndiz
then mrommed
then tried to read in xncs
it said no ghost installed and i clicked yes to install ghost
.
sorry 4 delay find the attached and load it into rom studio just dumped with login apperndiz again
without installing ghost
rom studio now longers says no ghost installed on both cards but here is the usual guff its saying
ATR = 3FFF9500FF918171A04700444E4153503031302052657641383240
Eeprom revision: DNASP010 RevA82

Card ID: 2767D536
1. Dumping Card (Ghost Method)...
>>> Trying with signature exchange emm....
>>> retry Nº. 1
>>> Trying with signature exchange emm....
>>> retry Nº. 2
>>> Trying with signature exchange emm....
>>> retry Nº. 3
>>> Trying with signature exchange emm....
>>> retry Nº. 4
Could'nt dump card!
 
Last edited:
ByteMaster said:
went firsr to rom studio logged in aperndiz dump did not install ghost on card 1
then deleted the other no 1 provider info then loaded a new working image wrote that with write apperndiz
then mrommed
then tried to read in xncs
it said no ghost installed and i clicked yes to install ghost
.
sorry 4 delay find the attached and load it into rom studio just dumped with login apperndiz again
without installing ghost
rom studio now longers says no ghost installed on both cards but here is the usual guff its saying
ATR = 3FFF9500FF918171A04700444E4153503031302052657641383240
Eeprom revision: DNASP010 RevA82

Card ID: 2767D536
1. Dumping Card (Ghost Method)...
>>> Trying with signature exchange emm....
>>> retry Nº. 1
>>> Trying with signature exchange emm....
>>> retry Nº. 2
>>> Trying with signature exchange emm....
>>> retry Nº. 3
>>> Trying with signature exchange emm....
>>> retry Nº. 4
Could'nt dump card!
Click to expand...

Go back to Romstudio and dump card, Login Aprendiz, but make sure that ghost is installed in the end, as soon has it dumped press write login Aprendiz
then read card with XNCS
 
That attachment will only let you see the eeprom in nagra


did all that M8 now have 3 providers on card
4001
6901
now also 9901

tried to dump with xncs 6 times just for good measure

ATR=3FFF9500FF918171A04700444E4153503031302052657641383240
Info=DNASP010 RevA82
Retrieving card info...
Card info retrieved :)
Dumping card,try #0.
Dumping card,try #1.
Dumping card,try #2.
Dumping card,try #3.
Couldnt Dump Card...
got this in under development
ATR=3FFF9500FF918171A04700444E4153503031302052657641383240
Info=DNASP010 RevA82
Retrieving card info...
Card info retrieved :)
--------------------------------------------------------------------
BugKey=3E7E9D7816F79327
BugTableBuild: Building Bug Tables 0..$7FFF...
BugTableBuild: Ok
SendTwkEmm: Tweak emm accepted...
Ecm Being Sent:21005DA0CA000057035540011088059D9D9D9D9D9D9D9D0CCD320C5AEA2D2D0CCD320C5AEA2D2D0CCD320C5AEA2D2D0CCD320C5AEA2D2D0CCD320C5AEA2D2D0CCD320C5AEA2D2D9078CA8E5FF3897676A35D3FE4FEF4C42C3EB13468EF913805
--------------------------------------------------------------------
Remeber You Can Press ESC at anytime to Halt the process...
ChkBC: C=14 from card should be C=AC.
Exiting due to iso_error...
 
Last edited:
Thanks to everyone who put the time and effort in contributing to this thread.
Although no resolution has come to these two cards :-( hopefully the information here will be of help to others...
Thanks again all........:Clap:
 
ByteMaster said:
Thanks to everyone who put the time and effort in contributing to this thread.
Although no resolution has come to these two cards :-( hopefully the information here will be of help to others...
Thanks again all........:Clap:
Click to expand...


hi m8 no luck yet i c. anyway have u tryed putting card/s back in cable box and letting them take an update ,or will that lock them to .a39.
also have u tryed some of the older software .

ps
brings the subject back up for review
 
fes_786 said:
hi m8 have u tried mrom rev7? the one that carwash posted in a thread a while back

that normally sorts them out

i got a few rom 11 sorted with it because the had blocker on and it disabled them

try it and see if it works for u

here it is



:Cheers: :Cheers: :Cheers: :Cheers:
Click to expand...
cheers m8 worked a treat
 
ByteMaster said:
Thanks to everyone who put the time and effort in contributing to this thread.
Although no resolution has come to these two cards :-( hopefully the information here will be of help to others...
Thanks again all........:Clap:
Click to expand...

If card has been glitched successfully then this should give you the BD0 key you so long for

First of all get yourself a Good Rom10 Image with Valid BD Keys and Bugcatchers at 00 And call it say”! Romstudio Bin

OK”!
Open XNCS and go to settings then tick both= Dump with cmd priority bug and fix fu**ed D000-DFFF and press OK
Then where it says Card! press read Eeprom, once reading is finished go to Eeprom and in line C040 is yourBD0 (copy it to Notepad)
Close Xncs and open Romstudio 1.6
Again where it says Card press Dump card (Nagraedit Method) introduce BD0 when asked
Get your “”Romstudio Bin””” and Write Card (Nagraedit Method) and that should give you control of you card again

This method is only for cards that are open but don’t know BD0 keys or Nagraedit don’t recognise BDs
Ps: This method will not work if your BD0s are in Zeros (00)
 
Last edited:
Help needed with rom10 card

Hi everone

I am having great trouble gettinh my rom 10 card to work.
Here goes I have a pace 4010 box.i have jtagged it and got the IRD,Boxkey and cam id.

I have tried to create an atmega card . i have aninfinity usb prorammer.

I have entered the boxkey,and ird in toxic 6. save the files
flashed the card with the ntl keys.
I have put the card in the box and iget the free channels but no subscibed chaneels the is just a blank screen.
I have tried to read my original card in nara edit 4.
I get an error message saying backdoor disabled. card may contain update
reading of rom 10 failed.
Ihave tried using the different software to get in to the card but as yet unsuccesful!

Any suggestions
Please

Thanks
Laserguy0
 
laserguy said:
Hi everone

I am having great trouble gettinh my rom 10 card to work.
Here goes I have a pace 4010 box.i have jtagged it and got the IRD,Boxkey and cam id.

I have tried to create an atmega card . i have aninfinity usb prorammer.

I have entered the boxkey,and ird in toxic 6. save the files
flashed the card with the ntl keys.
I have put the card in the box and iget the free channels but no subscibed chaneels the is just a blank screen.
I have tried to read my original card in nara edit 4.
I get an error message saying backdoor disabled. card may contain update
reading of rom 10 failed.
Ihave tried using the different software to get in to the card but as yet unsuccesful!

Any suggestions
Please

Thanks
Laserguy0
Click to expand...

That card is locked m8"!

You need a unlooper to unlock it
 
Need help desperately

Hi all

I cant unlock my My mosc card rom 11 revBod
I think i have tried every trick in the book>Im a complete novice.
Ihave jtaged my pace 4010 box.it gives me the boxkey ,ird etc.
I have tried to create an atmega card entering my box key.Ird and cam id. i have flashed the card with ntl hex file etc. But cannot get any pictures on the box.
i have tried to read my mosc card with nagra edit,but it says
Attempting to logon to BD3
Reading rom11 failed>
Can some pls help me out with this one
i have spent 2 days trying to sort it,can it be fixed??

Please could someone PM me, as i dont know how to find anyresponses to my posts i made earlier regarding this topic>

PLZZZZZ help me out,

Thanks Laserguy0
 
You must log in or register to reply here.

Similar threads

joeblaze
some people in twitter now claiming to have found stuff on a way back machine that chinese knew a lot earlier and maybe released it deliberately?
Replies
14
Views
694
joeblaze
joeblaze
loady
cypress board wont connect to jtag H2
Replies
2
Views
1K
loady
loady
Grimeire
Terrestial tuner signal issue?
Replies
6
Views
1K
Grimeire
Grimeire
silverdale
    • Like
Change rules to improve Football
Replies
8
Views
1K
countryboy
countryboy
Mick
    • Like
PORN ID Checks to be introduced
Replies
8
Views
886
cactikid
cactikid
Back
Top