• This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn more.

rom11 b09

packer

Inactive User
Joined
Mar 13, 2005
Messages
408
Likes
1
#1
hi all just wandering if anyone has had any luck unlocking above card cheers all
 

nozzer

VIP Member
VIP Member
Joined
Jan 25, 2005
Messages
6,662
Likes
72
#2
Should unlock with any of the normal tools for B0C or earlier and also using a T911 with the B0D script.
 

packer

Inactive User
Joined
Mar 13, 2005
Messages
408
Likes
1
#4
nozzer m8 have tried variuos scripts left run for hours no joy i am using the orange nexus any other ideas would be gratefuly recieved cheers
 

neathdrew

Inactive User
Joined
Oct 26, 2005
Messages
1,459
Likes
28
#5
nozzer m8 have tried variuos scripts left run for hours no joy i am using the orange nexus any other ideas would be gratefuly recieved cheers

when u read it in nagra is it looking for bd password? if so this is the blockered image which you can reset using mrom with delay settings

Tx_Delay = 180
Rx_delay = 180
Loop_delay = 80

cheers
 

packer

Inactive User
Joined
Mar 13, 2005
Messages
408
Likes
1
#6
neathdrew m8 thanks for reply but canot read card in nagra as it is locked thats why im looking for help on the best script to use to unlock thanks for replying m8
 

edcase

DW Member +
Joined
May 2, 2005
Messages
1,161
Likes
18
#7
If it is a true B09 the B0D script wil open it no problem. If it is the "blockered" B09 image that has been posted on many of the forums this method will not work - however there are many other ways to open them

edcase
 

edcase

DW Member +
Joined
May 2, 2005
Messages
1,161
Likes
18
#9
edcase thanks for reply m8 what other methods do you mean m8 cheers
Well, if it is the blockered B09 that has been knocking about on the forums I disasmed it on another forum a while back, I have never used it so I can only comment on the code I saw and I have never tried it for real.
If you know BDK0 you should be able to login with nagra and overwrite the image.
Also it has a command hooked in that will move the write protection from codespace - Im not sure if the card is then writable but at this point the B0D script would be able to unlock the card. The command is class D8 with the BK as the password. If you dont know the BK you could edit the B0D script to write numbugs to 30, then use the original B0D script to set it from 30 to zero.
Another alternative is to use MROM to repair the card, but this will overwrite dataspace and the IRD and BK info will be lost.

edcase

PS: Did you try the b0d script? Did it not work? What does nagra say when you try to read the card, if you paste up the comms log I might be able to help more!
 
Last edited:

packer

Inactive User
Joined
Mar 13, 2005
Messages
408
Likes
1
#10
Thanks for your help m8 this is what it says in nagra when i press reset

Opening of COM1 was successful
ATR String: 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50
30 31 31 20 52 65 76 42 30 39 41
ROM Revision: 011
EEPROM Revision: RevB09
CAM Date: 1D97
Closing of COM1 was successful



and this is what it says in nagra when i tried to read

Opening of COM1 was successful
ATR String: 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50
30 31 31 20 52 65 76 42 30 39 41
ROM Revision: 011
EEPROM Revision: RevB09
ProviderID: 40
CamID: CC CC CC CC
Using BD3 Key: 4E 69 70 50 45 72 20 49 73 20 61 20 62 75 54 74
Attempting to login to BD3
BD3 login failed
Reading ROM11 failed
Closing of COM1 was successful

CHEERS M8 COMM LOG ATTACHED BELOW
 
Last edited:

edcase

DW Member +
Joined
May 2, 2005
Messages
1,161
Likes
18
#11
OK I am going to assume its the blockered image we are dealing with.
Looks like it might have a bit of a screwed up dataspace and thats why it is giving the 9001 response to the cmd03 login. I take it you have tried to run MROM (because its provider 40) on it so I am assuming that the block that contained the BK has now been overwritten.
We need to find out what MROM sets the BK to - then we can try the password. Im not at home at the moment so I cant find out what MROM sets it to. Maybe someone else will know, if not i will run mrom on an open card later and find out for you.

edcase
 

packer

Inactive User
Joined
Mar 13, 2005
Messages
408
Likes
1
#12
edcase thanks alot m8 for all your great advice i managed to get them open i done what you said i played with delays in mrom i changed to 180,180,80 and that done the trick thanks again m8 and to all who replied
 

Al-z

New Member
Joined
Aug 16, 2005
Messages
2
Likes
2
#13
So can I just ask packer .... im about to buy a glitcher you see ..... this rom11 unlocked fine for you and IRD and BK were intact?

Im slowly trying to progress from semi-noob