Glitching a86

[dabest57]

hi people,
i have two rom 10 A86's and im having trouble unlooping the cards,

im using win ex with a A86 script, but doesnt seem to be working so if anyone has a script they could send me, this would be great.

and also when im trying to set my VCC to '1A' on my powersync, both cards display different figures when i run the test, and cannot keep my VCC as '1A' on both cards...is this normal?

thanks

 

[mb63]

Yes m8.
Each card will give have outputs/settings.

 

[dabest57]

Yes m8.
Each card will give have outputs/settings.

well im glad i got that question cleared,

has anyone got a A86 script and how successful are the powersync's at unlooping these cards? because iv been playing around with them for a few hours and im having no look . . Gutted

 

[mb63]

well im glad i got that question cleared,

has anyone got a A86 script and how successful are the powersync's at unlooping these cards? because iv been playing around with them for a few hours and im having no look . . Gutted

a86 cards are definately "unloopable" as you put it. It is a bit hit and mis, though it depends on your set up.
If you post EXACTLY what your setup is, then i'm sure the guys on here will help you.

Like answers to these questions.....

What unlooper and what flash? and what power supply
which script are you using?
What operating system is your pc running?
Is it a DEDICATED serial port on your pc, or a USB to serial port?

try to give as much info as possible, and i'm sure youy will get help m8y.

 

[dabest57]

a86 cards are definately "unloopable" as you put it. It is a bit hit and mis, though it depends on your set up.
If you post EXACTLY what your setup is, then i'm sure the guys on here will help you.

Like answers to these questions.....

What unlooper and what flash? and what power supply
which script are you using?
What operating system is your pc running?
Is it a DEDICATED serial port on your pc, or a USB to serial port?

try to give as much info as possible, and i'm sure youy will get help m8y.

running a script called 'working A86 script.xvb' with win ex 5.42
running windows xp with serial port 1
power supply from a ntl modem with the powersync
the power sync has not changed its flash since brought from TMC
vcc is set at 1A
Switch is set as 1 down, 2 up, 3 down, 4 down

i have successfully unlocked many cards with this unlooper but cannot seem to get these two cards.

they both load up in nagra until it asks for BD3 and then says cannot read rom 10, so the card is working and functioning OK, but just needs unlocking and its driving me up the wall LOL

 

[TBC]

have you flashed them with the a86 flash and used the correct script?

 

[speedy1234]

I use a powersync and sidewinder prog pops then in no more than 5 mins never had 1 fail yet.

 

[dabest57]

I use a powersync and sidewinder prog pops then in no more than 5 mins never had 1 fail yet.

any chance you could send me the sidewinder prog 4 it? because obv win ex aint popping the cards

 

[dabest57]

have you flashed them with the a86 flash and used the correct script?

flash what? the card or powersync? and yeh im thinking its the correct script, unless someone could send me on they use??

 

[TBC]

https://www.digitalworldz.co.uk/posts/1645351/ these are the powersync a86 files.


Flash Modus3 << Glitcher flash does not work on anything other than a powersync "this replaces the previous version DoubleTBC
script included << A86 powersync script

vcc average 1A but could be less if you have too many resets per delay. Too many is more than 10-12 if more reduce vcc. DIP 1 on rest OFF

DO NOT USE THIS FLASH ON ANYTHING OTHER THAN A ROM10 A86 !!! IT WILL KILL A ROM11 CARD IN NO TIME YOU HAVE BEEN WARNED !!!

I also note you are not using the correct clocking DIP which for the TMC powersync is DIP 1 not 2 !!

 

[dabest57]

https://www.digitalworldz.co.uk/posts/1645351/ these are the powersync a86 files.


Flash Modus3 << Glitcher flash does not work on anything other than a powersync "this replaces the previous version DoubleTBC
script included << A86 powersync script

vcc average 1A but could be less if you have too many resets per delay. Too many is more than 10-12 if more reduce vcc. DIP 1 on rest OFF

DO NOT USE THIS FLASH ON ANYTHING OTHER THAN A ROM10 A86 !!! IT WILL KILL A ROM11 CARD IN NO TIME YOU HAVE BEEN WARNED !!!

I also note you are not using the correct clocking DIP which for the TMC powersync is DIP 1 not 2 !!

thanks for responce mate, and if i flash my powersync, can i flash it back to the flash it has got on it already, because i want to flash rom 11's again etc

 

[speedy1234]

[

I also note you are not using the correct clocking DIP which for the TMC powersync is DIP 1 not 2 !!

thats weird i have dip 2 and 5 on for glitching. and use 1and 5 on for flashing the powersync. it works fine no probs ? thats got me confused now lol would be good to see what other ppl have there's set at T.B.C ya got me scratching my head now lol

 

[dabest57]

thats weird i have dip 2 and 5 on for glitching. and use 1and 5 on for flashing the powersync. it works fine no probs ? thats got me confused now lol would be good to see what other ppl have there's set at T.B.C ya got me scratching my head now lol

when i have my dip on 1, it displays all +++, LIKE SO:

WINEX\Chartman VCC Analyzer v4.xvb

TX Data : 02 03 00
TX Data : 02 02 00
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 07 1B
RX Data : 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50
30 31 30 20 52 65 76 41 38
TX Data : 12 15 AB 21 00 08 A0 CA 00 00 02 12 00 06 55 0E
03 8B 00
RX Data : 12 0C
RX Data : 12 00 08 92 04 27 67 A3 E0 90 00 1F

VCC 28: ++++++++++++ 6F = 100% FF = 0%
VCC 27: ++++++++++++ 6F = 100% FF = 0%
VCC 26: ++++++++++++ 6F = 100% FF = 0%
VCC 25: ++++++++++++ 6F = 100% FF = 0%
VCC 24: ++++++++++++ 6F = 100% FF = 0%
VCC 23: ++++++++++++ 6F = 100% FF = 0%
VCC 22: ++++++++++++ 6F = 100% FF = 0%
VCC 21: ++++++++++++ 6F = 100% FF = 0%
VCC 20: ++++++++++++ 6F = 100% FF = 0%
VCC 1F: ++++++++++++ 6F = 100% FF = 0%
VCC 1E: ++++++++++++ 6F = 100% FF = 0%
VCC 1D: ++++++++++++ 6F = 100% FF = 0%
VCC 1C: ++++++++++++ 6F = 100% FF = 0%
VCC 1B: ++++++++++++ 6F = 100% FF = 0%
VCC 1A: ++++++++++++ 6F = 100% FF = 0%
VCC 19: ++++++++++++ 6F = 100% FF = 0%
VCC 18: ++++++++++++ 6F = 100% FF = 0%
VCC 17: ++++++++++++ 6F = 100% FF = 0%
VCC 16: ++++++++++++ 6F = 100% FF = 0%
VCC 15: ++++++++++++ 6F = 100% FF = 0%
VCC 14: ++++++++++++ 6F = 100% FF = 0%
VCC 13: ++++++++++++ 6F = 100% FF = 0%
VCC 12: ++++++++++++ 6F = 100% FF = 0%
VCC 11: ++++++++++++ 6F = 100% FF = 0%
VCC 10: ++++++++++++ 6F = 100% FF = 0%
VCC 0F: ++++++++++++ 6F = 100% FF = 0%
VCC 0E: ++++++++++++ 6F = 100% FF = 0%
VCC 0D: ++++++++++++ 6F = 100% FF = 0%
VCC 0C: ++++++++++++ 6F = 100% FF = 0%
VCC 0B: ++++++++++++ 6F = 100% FF = 0%
VCC 0A: ++++++++++++ 6F = 100% FF = 0%
VCC 09: ++++++++++++ 6F = 100% FF = 0%
VCC 08: ++++++++++++ 6F = 100% FF = 0%

VCC Ceiling: 00
VCC Floor..: 00

\WINEX\Chartman VCC Analyzer v4.xvb Transmission Completed



BUT . . . .
when i have DIP switch 2, i have the following results

TX Data : 02 03 00
TX Data : 02 02 00
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 07 1B
RX Data : 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50
30 31 30 20 52 65 76 41 38
TX Data : 12 15 AB 21 00 08 A0 CA 00 00 02 12 00 06 55 0E
03 8B 00
RX Data : 12 0C
RX Data : 12 00 08 92 04 27 67 A3 E0 90 00 1F

VCC 28: ++++++++++++ 6F = 100% FF = 0%
VCC 27: ++++++++++++ 6F = 100% FF = 0%
VCC 26: ++++++++++++ 6F = 100% FF = 0%
VCC 25: ++++++++++++ 6F = 100% FF = 0%
VCC 24: ++++++++++++ 6F = 100% FF = 0%
VCC 23: ++++++++++++ 6F = 100% FF = 0%
VCC 22: ++++++++++++ 6F = 100% FF = 0%
VCC 21: ++++++++++++ 6F = 100% FF = 0%
VCC 20: ++++++++++++ 6F = 100% FF = 0%
VCC 1F: ++++++++++++ 6F = 100% FF = 0%
VCC 1E: ++++++++++++ 6F = 100% FF = 0%
VCC 1D: ++++++----++ 6F = 67% FF = 33%
VCC 1C: ++++--++--++ 6F = 67% FF = 33%
VCC 1B: ----++----++ 6F = 33% FF = 67%
VCC 1A: ------------ 6F = 0% FF = 100%

VCC Ceiling: 1E
VCC Floor..: 18

 

[TBC]

The Dips are for timing control, if you use a different dip then you must readjust your pot to set your vcc. The point of the pot is to adjust the vcc - not run vcc analyser and assume you have no control. The is a vaste difference in pot adjustment between dip 1 and 2 becuase of clock proximity.

A tmc powersync setting as a base line is 90ohms dip1 .. rom11 flash = newd11x Rom10 flash Dtbc or MoDus3
from this baseline you adjust your pot using a vcc analyser or just run the script and set while runing.

the fifth dip switch was abandoned early on in favour of a fixed link since it is the flash enable switch. and may as well be on al the time. (a true TMC powersync 99% of the time has only 4 dips)

I think somewhere along the way the way to use the powersync to glitch A86 seems to have been lost lol.
There are other places to buy a powersync, i think unapit sell them now BUT they are not the exact same glitcher. The most effective glitching of a86 is done with the posted files, these were developed at the same time as the TMC design. While a powersync can gltich an a86 with newd11x it is not as quick at all, it is more efficient to use the posted flash particularly with difficult roms it is a more agressive flash. The TMC powersync can glitch with dip2 but again it was not intended to do so with A86.

My sidewinder programs are not likely to be effective either unless you setup your glitcher correctly i'm afraid. they are more user friendly but not as efficient as winex.


if vcc<&h0a then
sc.print "*** turn the pot up lol ***" & VbCr
vcc=&h0a
end if
Sc.Write("B0" & HexString(VCC, 2)) 'set glitch VCC <<*** this line is in all scripts ** so add the lines above it

i am not sure wether the posted script has a vcc error trap, but above you can see an example of an installed vcc error trap, so you can add the pot help lines as above. Now when you run the script you will see it flash the instructions to adjust the pot - this trap will also stop the script crashing when the VCC value flip negative due to a poorly adjusted pot. pot adjustments should be done gradualy and slowly untl the desired result is seen.

 

[MFCGMFC]

just turn teh pot up during a glitching session?

wot should come up?

Cheers
MFCGAVMFC

 

[TBC]

you shuold be able to see the vcc being modified, with the added lines if the vcc falls below &0A then the message will flash up. you should set you vcc to a nominal 1B-1D depening on rst pattern.

clockwise rotation increases vcc
anticlockwise rotation decreases vcc

 

[MFCGMFC]

++--+=Rst8-+--Rst7Rst6--+--

that look better?

Cheers
MFCGAVMFC

 

[TBC]

now make sure you don't have more than 12 or 13 rsts per full completed delay if you do drop the vcc until you have about 8 to 12 rsts ans leave it runnig

 

[MFCGMFC]

lol i've got 12-13 per line! lol

so i tkae it i shoudl turn it down

Cheers
MFCGAVMFC

 

[TBC]

yeah reduce your vcc till you get about 12-13 per delay NOT line lol. The actual vcc you end up at is not as important as your rst pattern - this pattern is generally determining how efectively the glitches are hitting the card, if excessive then it can damage the card if none at all then the card is not likely to glitch