help geting bk/t911/libby

S

scatterp

Guest
#1
ok i have tryed everything :(

ok lately i have been trying to downgrade 2 boxs to cr1 since they have
rs232 and i need the schematics for rs232 <> scart

ive tryed all night followed the instructions read every post mentioning wembley i get a load of writing come up freq [hex] comb agcs [hex]
eventualy freezes one time it didnt and i got a WHITE ntl screen

the reason i want to downgrade is so i can use libby to get a box key

i have 4 4000 series boxs and a 1010 and a 1000 and some others
basicly i got almost everything except i only have one 1000 box

my irc is not in the database (none of them)

so heres about the t911

ok well i have spoken with stacey curtis over the phone while trying to unloop so i am guessing i am doing everything right but its not working tryed replaceing the hardware tryed adjusting the pots tryed diffrent scripts tryed diffrent cards nothings working i was told to ask her for simon kirk or wonko
dunno if this is over kill but were out of ideas here
if you guys have got some kinda messanger we can install it

forgot to mention useing winexplorer of course ini setings d11 atmel

t911 = the white one and blue one i have both
script =
rom 10 multi provider script A82jons
multprovider multirom release ver 1

cards =
titanium 2 os 2.1 revA3E rom 10
titanium 1 os ? ????
telewest broadband x2 revA82 rom 10 / revBOC rom11
ntl dsc (old one) revA39 rom 10
telewest communications revA82 rom 10
(few more now too)
atmel =newD11


with the unlooping

i get all kinds of stuff for example

TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 07 1B
RX Data : 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50
30 31 30 20 52 65 76 41 33
TX Data : 12 15 AB 21 00 08 A0 CA 00 00 02 12 00 06 55 0E
03 85 00
RX Data : 12 06
RX Data :

Now we will try 12FF delay
TX Data : 17 15 B0 21 00 0D A0 CA 00 00 07 21 05 01 03 FF
FF 00 28 4F 0E 03 88 00
RX Data : 17 09
RX Data : 12 60 20 A1 26 5A 01 00 01
TX Data : B0 99
TX Data : 47 15 E0
TX Data : 21 00 3D A0 CA 00 00 37 03 35 5A 01 10 31 05 4E
69 70 50 45 72 20 49 E3 40 7C AD FD B9 64 29 F4
F6 77 C2 35 6D 74 74
TX Data : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 05 C0
TX Data : 0E 05 8A 00
RX Data : 47 0B
RX Data : 12 00 07 83 03 B1 01 01 90 00 B4
TX Data : 6A 15 FF 21 00
TX Data : 5C A0 CA 00 00 56 03 54 5A 5B 10 81 05 FA CD 7A
TX Data : B7 C0 A1 A6 00 96 5D C2 69 CB A2 C6 99 73 D6 CD
TX Data : 87 66 A2 CF EB 84 A1 8F BF F8 E2 6F CF 88 07 B7
TX Data : 10 98 3A 07 DD 92 B7 57 5B 55 8D BF 6B E4 F0 CA
TX Data : 62 2B CC 01 F8 EE 44 13 51 E7 B4 78 4E 4C 23 2F
TX Data : 36 98 87 1E 3A 0C CD 32 0C 5A EA 2D 2D 10 20 12
FF 09 0E 05 85 00
RX Data : 6A 06
RX Data : 12 40 07 83 03 B1


*********** we hit our bug *************
1240078303
===========================================
83 was hit at 12FF delay ----VCC WAS 99 , our GlitchType was 09

TX Data : 12 15 AB 21 00 08 A0 CA 00 00 02 C0 00 06 87 0E
03 85 00
RX Data : 11 00
TX Data : 0A 15 A3 21 98 00 B9 0E 03 85 00
RX Data : 03 00
TX Data : 0A 15 A3 21 92 00 B3 0E 04 85 00
RX Data : 03 00
***************************
* A82 CAM should be OPEN *
* test in Nagra to see. *
* if not, try again. *
***************************

then i go to nagra and get

Opening of COM2 was successful
ATR String: 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50
30 31 30 20 52 65 76 41 33 39 40
ROM Revision: 010
EEPROM Revision: RevA39
SetIFS failed
Using BD3 Key: 4E 69 70 50 45 72 20 49 73 20 61 20 62 75 54 74
Reading ROM10 failed
Closing of COM2 was successful

any help would be appriciated thanks

that example was with the ntl dsc card

for the telewest broadband
revA82 rom 10

i get the following

john script\rom 10 multi provider script A82jons.xvb
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 07 1B
RX Data : 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50
30 31 30 20 52 65 76 41 38
TX Data : 12 15 AB 21 00 08 A0 CA 00 00 02 12 00 06 55 0E
03 85 00
RX Data : 12 06
RX Data :

Now we will try 12FF delay
TX Data : 17 15 B0 21 00 0D A0 CA 00 00 07 21 05 01 03 FF
FF 00 28 4F 0E 03 88 00
RX Data : 17 09
RX Data : 12 60 20 A1 26 5A 01 00 01
TX Data : B0 99
TX Data : 47 15 E0
TX Data : 21 00 3D A0 CA 00 00 37 03 35 5A 01 10 31 05 4E
69 70 50 45 72 20 49 E3 40 7C AD FD B9 64 29 F4
F6 77 C2 35 6D 74 74
TX Data : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 05 C0
TX Data : 0E 05 8A 00
RX Data : 47 0B
RX Data : 12 00 07 83 03 B1 01 01 90 00 B4
TX Data : 6A 15 FF 21 00
TX Data : 5C A0 CA 00 00 56 03 54 5A 5B 10 81 05 FA CD 7A
TX Data : B7 C0 A1 A6 00 96 5D C2 69 CB A2 C6 99 73 D6 CD
TX Data : 87 66 A2 CF EB 84 A1 8F BF F8 E2 6F CF 88 07 B7
TX Data : 10 98 3A 07 DD 92 B7 57 5B 55 8D BF 6B E4 F0 CA
TX Data : 62 2B CC 01 F8 EE 44 13 51 E7 B4 78 4E 4C 23 2F
TX Data : 36 98 87 1E 3A 0C CD 32 0C 5A EA 2D 2D 10 20 12
FF 09 0E 05 85 00
RX Data : 6A 06
RX Data : 12 40 02 6F 00 3F
+
TX Data : 08 0E 03 10 01 01 03 9A 00
RX Data : 08 1B ++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++
Now we will try 1300 delay, our VCC is about FFE5 and our Glitch Type was 07
++++++++++++++++++++++++++++++++++++++

Sc.Read: Timeout Reading Data From Card - 2 Bytes Requested, 0 Bytes Read, Continuing Script

Script Error on Line 139
Sc.GetByte: Requested Byte Exceeds Last Read Request

and in nagra

Opening of COM2 was successful
ATR String: 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50
30 31 30 20 52 65 76 41 38 32 40
ROM Revision: 010
EEPROM Revision: RevA82
SetIFS failed
Using BD3 Key: 4E 69 70 50 45 72 20 49 73 20 61 20 62 75 54 74
Reading ROM10 failed
Closing of COM2 was successful

for the telewest broadband revBOC rom 11

i get

john script\rom 10 multi provider script A82jons.xvb
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data :

Sc.Read: Timeout Reading Data From Card - 2 Bytes Requested, 0 Bytes Read, Continuing Script



Script Error on Line 86
Sc.GetByte: Requested Byte Exceeds Last Read Request


Executing Script: C:\Documents and Settings\Tyrone Benjamin\Desktop\si s\john script\john script\rom 10 multi provider script A82jons.xvb
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 07 1B
RX Data : 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50
30 31 31 20 52 65 76 42 30
TX Data : 12 15 AB 21 00 08 A0 CA 00 00 02 12 00 06 55 0E
03 85 00
RX Data : 12 06
RX Data :

Now we will try 12FF delay
TX Data : 17 15 B0 21 00 0D A0 CA 00 00 07 21 05 01 03 FF
FF 00 28 4F 0E 03 88 00
RX Data : 17 09
RX Data : 12 60 20 A1 26 5A 01 00 01
TX Data : B0 99
TX Data : 47 15 E0
TX Data : 21 00 3D A0 CA 00 00 37 03 35 5A 01 10 31 05 4E
69 70 50 45 72 20 49 E3 40 7C AD FD B9 64 29 F4
F6 77 C2 35 6D 74 74
TX Data : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 05 C0
TX Data : 0E 05 8A 00
RX Data : 47 0B
RX Data : 12 00 07 83 03 B1 01 01 90 01 B5
TX Data : 6A 15 FF 21 00
TX Data : 5C A0 CA 00 00 56 03 54 5A 5B 10 81 05 FA CD 7A
TX Data : B7 C0 A1 A6 00 96 5D C2 69 CB A2 C6 99 73 D6 CD
TX Data : 87 66 A2 CF EB 84 A1 8F BF F8 E2 6F CF 88 07 B7
TX Data : 10 98 3A 07 DD 92 B7 57 5B 55 8D BF 6B E4 F0 CA
TX Data : 62 2B CC 01 F8 EE 44 13 51 E7 B4 78 4E 4C 23 2F
TX Data : 36 98 87 1E 3A 0C CD 32 0C 5A EA 2D 2D 10 20 12
FF 09 0E 05 85 00
RX Data : 6A 06
RX Data : 12 40 02 6F 00 3F
+
TX Data : 08 0E 03 10 01 01 03 9A 00
RX Data : 08 1B ++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++
Now we will try 1300 delay, our VCC is about FFE5 and our Glitch Type was 07
++++++++++++++++++++++++++++++++++++++

Sc.Read: Timeout Reading Data From Card - 2 Bytes Requested, 0 Bytes Read, Continuing Script

Script Error on Line 139
Sc.GetByte: Requested Byte Exceeds Last Read Request

and in nagra i get

Opening of COM2 was successful
ATR String: 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50
30 31 31 20 52 65 76 42 30 43 3B
ROM Revision: 011
EEPROM Revision: RevB0C
SetIFS failed
Using BD3 Key: 4E 69 70 50 45 72 20 49 73 20 61 20 62 75 54 74
Reading ROM11 failed
Closing of COM2 was successful

and with the telewest communications i get

Multiprovider MultiRom script for Rom 10 and Rom 11 cards (both normal and 6300)
Now with experimental support for Rom 11 provider 40,55,5B and 5D cards - dunno if it will work tho

Do NOT remove card while script is running!!!

Card is a Rom 10 RevA82 (5A01)
Card logged in successfully

Please wait while we do our stuff....(this could take a while)
Now we will try Packet 1, 1350 delay, our VCC is about 40 and our Glitch Type was 06
++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++!++!+++!+
Now we will try Packet 1, 134E delay, our VCC is about FFFFFFC0 and our Glitch Type was 09
+!+++!++!+++!++!+++!++!+++!++!+++!++!+++!++!+++!++ !+++!++!+++!++!+++!++!+++!++!+++!++!+++!++!+++!++! +++!++!+++!++!+++!++!+++!++!+++!++!+++!++!+++!++!+ ++!++!+++!++!+++!++!+++!++!+++!++!+++!++!+++!++!++ +!++!+++!++!+++!++!+++!++!+++!++!+++!++!+++!++!+++ !++!+++!++!+++!++!+++!

Script Error on Line 244
Script Aborted By User

goes on for hours and errors eventualy im told there should be - symbols involved

and with the other script i get

rom 10 multi provider script A82jons.xvb
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 07 1B
RX Data : 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50
30 31 30 20 52 65 76 41 38
TX Data : 12 15 AB 21 00 08 A0 CA 00 00 02 12 00 06 55 0E
03 85 00
RX Data : 12 06
RX Data :

Now we will try 12FF delay
TX Data : 17 15 B0 21 00 0D A0 CA 00 00 07 21 05 01 03 FF
FF 00 28 4F 0E 03 88 00
RX Data : 17 09
RX Data : 12 60 20 A1 26 5A 01 00 01
TX Data : B0 99
TX Data : 47 15 E0
TX Data : 21 00 3D A0 CA 00 00 37 03 35 5A 01 10 31 05 4E
69 70 50 45 72 20 49 E3 40 7C AD FD B9 64 29 F4
F6 77 C2 35 6D 74 74
TX Data : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 05 C0
TX Data : 0E 05 8A 00
RX Data : 47 0B
RX Data : 12 00 07 83 03 B1 01 01 90 00 B4
TX Data : 6A 15 FF 21 00
TX Data : 5C A0 CA 00 00 56 03 54 5A 5B 10 81 05 FA CD 7A
TX Data : B7 C0 A1 A6 00 96 5D C2 69 CB A2 C6 99 73 D6 CD
TX Data : 87 66 A2 CF EB 84 A1 8F BF F8 E2 6F CF 88 07 B7
TX Data : 10 98 3A 07 DD 92 B7 57 5B 55 8D BF 6B E4 F0 CA
TX Data : 62 2B CC 01 F8 EE 44 13 51 E7 B4 78 4E 4C 23 2F
TX Data : 36 98 87 1E 3A 0C CD 32 0C 5A EA 2D 2D 10 20 12
FF 09 0E 05 85 00
RX Data : 6A 06
RX Data : 12 40 02 6F 00 3F
+
TX Data : 08 0E 03 10 01 01 03 9A 00
RX Data : 08 1B ++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++
Now we will try 1300 delay, our VCC is about FFE5 and our Glitch Type was 07
++++++++++++++++++++++++++++++++++++++

Sc.Read: Timeout Reading Data From Card - 2 Bytes Requested, 0 Bytes Read, Continuing Script

Script Error on Line 139
Sc.GetByte: Requested Byte Exceeds Last Read Request

Opening of COM2 was successful
ATR String: 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50
30 31 30 20 52 65 76 41 38 32 40
ROM Revision: 010
EEPROM Revision: RevA82
SetIFS failed
Using BD3 Key: 4E 69 70 50 45 72 20 49 73 20 61 20 62 75 54 74
Reading ROM10 failed
Closing of COM2 was successful

the pot setting on the box is 226 ohmz had one before same model set at 220 ohmz both are the same error but it was worse after modifiying the setings also thought i should mention tryed this on 2 diffrent computers the one im working on now is just in use for this task so its not over worked or anything
and im useing windows 98 compatibility mode

the card reva39 provider 5401 cant be read with xncs or romstudio also

all those details above are with the white t911 unlooper
ive tryed editing the pot setings to 220 also tryed editing them manualy
didnt work either


now with the blue unlooper i get slightly better results some cards
claim to be unlocked how ever they never are they cant be read
tryed moveing pot with it runing tryed seting it to 220 tryed
9 volts tryed 12 volts


i would if possible like some help from some one on msn thats got enough
experiance to get me up and runing i have a few people on msn and we have
made no real progress
 

IANB

VIP Member
VIP Member
Joined
Feb 26, 2002
Messages
13,160
Likes
748
#2
Dont think you will get the bk by downgrading m8.
Why not read up on some of the other methods of bk retrieval on here.
Ps nice first post.
 
S

scatterp

Guest
#3
well basicly out of cash to buy other devices bought a ton of stuff as it is that should in theory work ...
 
S

scatterp

Guest
#4
ps i think i have read all methods ive also tryed the volt method the board looked diffrent it really boils down to for example if i bought a scart to rs232 i would still be stuck as i am trying to downgrade also i read a post where some guy got hes bk that way and a tut
 

IANB

VIP Member
VIP Member
Joined
Feb 26, 2002
Messages
13,160
Likes
748
#5
ok m8 you are welcome to waste your time on the libby route.
 

IANB

VIP Member
VIP Member
Joined
Feb 26, 2002
Messages
13,160
Likes
748
#7
Bit confused why do you want to rs232 to scart.
It is normaly scart to rs232 that is required for 4000 ser boxes with usb
 
S

scatterp

Guest
#9
regardless if i could downgrade at least i might learn if its possible that way

as for other options the ones i am aware of are:

desolder the chip and read it (need to buy a device not sure which is the most universal for all boxs and or guarntyed to actualy do the job)
also needs a special low heat soldering iron and good soldering skills :(

i
 
S

scatterp

Guest
#11
yeah but thats another day to arive when with schematics i could make it now and still leaves the question can i downgrade to cr1 becase if i cant that method wont work
 

IANB

VIP Member
VIP Member
Joined
Feb 26, 2002
Messages
13,160
Likes
748
#12
I realy think you would be flogging a dead horse there m8
The volt meter method should work.
Have you tried it
The only other option is to lift the atmel or st chip and have it read.
 
S

scatterp

Guest
#13
voltmeter method didnt work for me the pictures didnt match the hardware i have

so were down to lift the atmel and have it read so i need reader what reader should i get ?
 
S

scatterp

Guest
#14
hmm while were on the subject of readers i have a few of them i think the issue is i dont know what they are what software how to use etc ?
 

IANB

VIP Member
VIP Member
Joined
Feb 26, 2002
Messages
13,160
Likes
748
#15
I think you need to read more m8 as if you are going into things not quite sure then thats where you problem lies.
 
S

scatterp

Guest
#16
hmm well ive tryed to identify the devices that i have i mean the ones that appear to be epprom programers but they dont have model numbers or power requirement info that i was able to find ive been reading for 3 weeks every day that hasnt really helped ...
 
S

scatterp

Guest
#18
tryed on a diffrent machine with the blue unlooper (3rd machine i tryed) and everything started working thanks to OVERRIDE who was a great help and spent a long time with me and also stacey curtis
sorry to anyone reading this looking for the answer to there problems who didnt find it here keep trying all that matters is it is possible

i ended up left with a few boxkeys missing so ordered the scart to rs232 not expecting that to work untill i can downgrade

also any one know what i can use to read write the atmels
 

SexyBitch

Inactive User
Joined
Nov 15, 2005
Messages
59
Likes
0
#19
Hi all
i am new here but i work along side scatterp i would just like to say how much help we got and if it was not for OVERRIDE help today for many hours i think we would have still been sitting here with nothing working.
he was a great help and i just want to say thankyou

SexyBitch
 
TEST
Top