If it is a true B09 the B0D script wil open it no problem. If it is the "blockered" B09 image that has been posted on many of the forums this method will not work - however there are many other ways to open them
Well, if it is the blockered B09 that has been knocking about on the forums I disasmed it on another forum a while back, I have never used it so I can only comment on the code I saw and I have never tried it for real.
If you know BDK0 you should be able to login with nagra and overwrite the image.
Also it has a command hooked in that will move the write protection from codespace - Im not sure if the card is then writable but at this point the B0D script would be able to unlock the card. The command is class D8 with the BK as the password. If you dont know the BK you could edit the B0D script to write numbugs to 30, then use the original B0D script to set it from 30 to zero.
Another alternative is to use MROM to repair the card, but this will overwrite dataspace and the IRD and BK info will be lost.
PS: Did you try the b0d script? Did it not work? What does nagra say when you try to read the card, if you paste up the comms log I might be able to help more!
OK I am going to assume its the blockered image we are dealing with.
Looks like it might have a bit of a screwed up dataspace and thats why it is giving the 9001 response to the cmd03 login. I take it you have tried to run MROM (because its provider 40) on it so I am assuming that the block that contained the BK has now been overwritten.
We need to find out what MROM sets the BK to - then we can try the password. Im not at home at the moment so I cant find out what MROM sets it to. Maybe someone else will know, if not i will run mrom on an open card later and find out for you.
edcase thanks alot m8 for all your great advice i managed to get them open i done what you said i played with delays in mrom i changed to 180,180,80 and that done the trick thanks again m8 and to all who replied