Back door 0 on rom 10 issue

[ByteMaster]

Thanks Capcomind !!!!!!!!
Awesome folder mate all the stuff in one place.....
:Clap: :Clap: Top Marks :banana: :banana:

 

[ByteMaster]

Sadly nagra 4.0 nope open da card either bdo striketh again :FRIGHT:

 

[john!]

u could trry writing this image to card noting the bd keys b4 hand

 

[ByteMaster]

will give ot a try using rom studio

 

[ByteMaster]

Still no joy writing

Xncs
"""Info=DNASP010 RevA82
Retrieving card info...
Card info retrieved
0.Checking Image integrity...
1.Disabling Card Bugs.
Card didnt disable the bugcatchers exiting....""""

 

[john!]

Still no joy writing

Xncs
"""Info=DNASP010 RevA82
Retrieving card info...
Card info retrieved
0.Checking Image integrity...
1.Disabling Card Bugs.
Card didnt disable the bugcatchers exiting....""""

i would keep trying mrom while your stuck ?

 

[ByteMaster]

cant hurt i suppose
thanks for everything
cheers

 

[wayneeboy19117]

hi mate in xncs goto file then settings and make sure
there is a tick in all the boxes this works for me on
stubburn cards but not all cards

 

[ByteMaster]

Tried that M8 but
Thanx for the info

 

[ByteMaster]

caton
ATR: 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50 30 31 30 20 52 65 76 41 38 32 40

3F Tipo de notación inversa
FF Datos que siguen
95 Período de bit
00 Vpp
FF Tiempo de guardia (en número de bits)
91 Siguen Ta2 y Td2
81 No se admite cambio de modo
71 Siguen Ta3, Tb3 y Tc2
A0 Tamaño de bloque de recepción
47 Tiempo de espera de carácter
00 Comprobación de errores a usar

44 4E 41 53 50 30 31 30 20 52 65 76 41 38 32
DNASP010 RevA82

 

[ByteMaster]

Ok . all ,
I have changed the delays on M rom and now both cards go through the string cycle ok on method 1 and 2 without errors but still no further on than that. :CRYBABY: :SHYTE

 

[john!]

Ok . all ,
I have changed the delays on M rom and now both cards go through the string cycle ok on method 1 and 2 without errors but still no further on than that. :CRYBABY: :SHYTE

have u tryed xncs since

 

[ByteMaster]

Shiney new Avvy Eh....
Yes M8 I Xnsc wont dump either of them.
I think caton is now the only answer but without some help I am going no further!
I dont want to destoy the atr or something like that!!!: bat :

 

[john!]

him8 , just noticed ,u started this post b,cause your card was BDO, but your card is now rom 10 rev a 82 that means your card is locked have u tried glitching your card again

 

[ByteMaster]

Yes mate
they are both glitched ok .
MultiRom script for Rom 10, Rom 11 (both normal and 6300) and Rom 7 cards
Rom 7 support is experimental, is currently unproven and has no cardopen check atm - and only providers 54 & 5C
Script version 1.4c - experimental prototype - not for general release

Work still to be done before release
------------------------------------
1. Add BD key correction or display

Do NOT remove card while script is running!!!

Card is a Rom 10 RevA82 (5401)

Checking card status..........

This card is already open

Script has finished - it is now safe to remove your card

When i mrom the cards i change the provider to 40
but thats all both cards the same!!!!!!!

 

[ByteMaster]

Thinking of closing this thread now.If anyone has any further suggestions I would greatly appreciate giving them a go.
If not thanks to all that have given there input to this thread and I will shelve them for the moment.
Thanks againroud: roud: roud:

 

[carwash]

Ok”! Let’s try and put an end to this problem.
You will need to do 2 things so we can see what alien you have inside that card

1) Read card with Nagraedit and copy paste result
2) Open Caton and send this command to see if corresponds with Nagra readings
21000DA0CA00000721050103FFFF002047
Again”! Copy and paste so we can see the response (The Blue writing) bottom box

Then we will go from here

BTW: Don't let this little plastic defeat you"!

 

[ByteMaster]

Hi Carwash thanks for this I was hoping you might have a look
Ok CARD 1
Opening of COM2 was successful
ATR String: 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50
30 31 30 20 52 65 76 41 38 32 40
ROM Revision: 010
EEPROM Revision: RevA82
ProviderID: 54
CamID: 85 85 85 85
Using BD3 Key: 4E 69 70 50 45 72 20 49 73 20 61 20 62 75 54 74
Attempting to login to BD3
BackDoor login verified
Dumping Dataspace
Backdoor retrieval has been blocked
Attempting to login to BD3
Attempting to login to BD0
Unable to login, bad password detected
Attempting to login to BD0
Unable to login, bad password detected
Login attempt aborted
Reading ROM10 failed
Closing of COM2 was successful

CARD 2 IDENTICLE MESSAGE
Caton card 1
A1: Resp. a comando 21 (Petición de UN ITEM de un TIPO de DATOS)

122020A11E54010001000000000000124B22C60000000000000000000000000000000044

12 CAM->IRD
20 00100000, Bloque de instrucción, sec.0, necesita al menos un paquete más
20 Longitud del envío
A1 Respuesta a comando 21
1E Longitud de datos respuesta
-------------------01: INFORMACIÓN IRD y DUEÑO TARJETA
5401 Tipo Sistema
00 EstIRD: 00000000
01 Grupo acceso libre
00000000 Código postal: 0
00 Zona horaria = 0:00 (GMT)
00 Byte de desviación DVB
124B22C6 Número IRD: -970831086
0000000000000000 Revisión bootstrap: ........
0000000000000000 Revisión firmware: ........
Boxkey
--------------------------------
0000 SW ?????????????????
44 Control Redund. Lineal.: CRL Ok

Caton card2
A1: Resp. a comando 21 (Petición de UN ITEM de un TIPO de DATOS)

122020A11E54010001000000000000124B22C60000000000000000000000000000000044

12 CAM->IRD
20 00100000, Bloque de instrucción, sec.0, necesita al menos un paquete más
20 Longitud del envío
A1 Respuesta a comando 21
1E Longitud de datos respuesta
-------------------01: INFORMACIÓN IRD y DUEÑO TARJETA
5401 Tipo Sistema
00 EstIRD: 00000000
01 Grupo acceso libre
00000000 Código postal: 0
00 Zona horaria = 0:00 (GMT)
00 Byte de desviación DVB
124B22C6 Número IRD: -970831086
0000000000000000 Revisión bootstrap: ........
0000000000000000 Revisión firmware: ........
Boxkey
--------------------------------
0000 SW ?????????????????
44 Control Redund. Lineal.: CRL Ok

 

[simonkirk]

imo - the card is blockered.

id forget all emm attacks as these will undoubtedley be blocked if it is a blocker.

step 1 would be - use rom studio and read the data space with the backdoor command.

alter the provider bytes in each tier for 54 or 5c or alternatively load in a good image of the dataspace.

write out the image again using romstudio's back door login command that uread the card with.

step2 - use one of the original scripts for rom10. the script should hit the bug immediateley and report open.

step 3 - read the card in nagra edit.

 

[ByteMaster]

Will try that now Simon with 1 card back in a mo with results...
Thanks and great to have you and Carwash aboard !!!!!!!!!!!!:banana: :banana: