rom11 b09

packer

Inactive User
Joined
Mar 13, 2005
Messages
408
Reaction score
1
hi all just wandering if anyone has had any luck unlocking above card cheers all
 
Should unlock with any of the normal tools for B0C or earlier and also using a T911 with the B0D script.
 
nozzer thanks for reply m8 will try what you said cheers m8
 
nozzer m8 have tried variuos scripts left run for hours no joy i am using the orange nexus any other ideas would be gratefuly recieved cheers
 
nozzer m8 have tried variuos scripts left run for hours no joy i am using the orange nexus any other ideas would be gratefuly recieved cheers


when u read it in nagra is it looking for bd password? if so this is the blockered image which you can reset using mrom with delay settings

Tx_Delay = 180
Rx_delay = 180
Loop_delay = 80

cheers
 
neathdrew m8 thanks for reply but canot read card in nagra as it is locked thats why im looking for help on the best script to use to unlock thanks for replying m8
 
If it is a true B09 the B0D script wil open it no problem. If it is the "blockered" B09 image that has been posted on many of the forums this method will not work - however there are many other ways to open them

edcase
 
edcase thanks for reply m8 what other methods do you mean m8 cheers
 
edcase thanks for reply m8 what other methods do you mean m8 cheers

Well, if it is the blockered B09 that has been knocking about on the forums I disasmed it on another forum a while back, I have never used it so I can only comment on the code I saw and I have never tried it for real.
If you know BDK0 you should be able to login with nagra and overwrite the image.
Also it has a command hooked in that will move the write protection from codespace - Im not sure if the card is then writable but at this point the B0D script would be able to unlock the card. The command is class D8 with the BK as the password. If you dont know the BK you could edit the B0D script to write numbugs to 30, then use the original B0D script to set it from 30 to zero.
Another alternative is to use MROM to repair the card, but this will overwrite dataspace and the IRD and BK info will be lost.

edcase

PS: Did you try the b0d script? Did it not work? What does nagra say when you try to read the card, if you paste up the comms log I might be able to help more!
 
Last edited:
Thanks for your help m8 this is what it says in nagra when i press reset

Opening of COM1 was successful
ATR String: 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50
30 31 31 20 52 65 76 42 30 39 41
ROM Revision: 011
EEPROM Revision: RevB09
CAM Date: 1D97
Closing of COM1 was successful



and this is what it says in nagra when i tried to read

Opening of COM1 was successful
ATR String: 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50
30 31 31 20 52 65 76 42 30 39 41
ROM Revision: 011
EEPROM Revision: RevB09
ProviderID: 40
CamID: CC CC CC CC
Using BD3 Key: 4E 69 70 50 45 72 20 49 73 20 61 20 62 75 54 74
Attempting to login to BD3
BD3 login failed
Reading ROM11 failed
Closing of COM1 was successful

CHEERS M8 COMM LOG ATTACHED BELOW
 
Last edited:
OK I am going to assume its the blockered image we are dealing with.
Looks like it might have a bit of a screwed up dataspace and thats why it is giving the 9001 response to the cmd03 login. I take it you have tried to run MROM (because its provider 40) on it so I am assuming that the block that contained the BK has now been overwritten.
We need to find out what MROM sets the BK to - then we can try the password. Im not at home at the moment so I cant find out what MROM sets it to. Maybe someone else will know, if not i will run mrom on an open card later and find out for you.

edcase
 
edcase thanks alot m8 for all your great advice i managed to get them open i done what you said i played with delays in mrom i changed to 180,180,80 and that done the trick thanks again m8 and to all who replied
 
So can I just ask packer .... im about to buy a glitcher you see ..... this rom11 unlocked fine for you and IRD and BK were intact?

Im slowly trying to progress from semi-noob
 
Back
Top