Rom11 Rev B0e

[gryfon99]

Has anybody heard of this revision I have tried every script I have with no look tried all software i.e. nagraedit ,xncs1.8 ,romstudio but keep getting wrong password anybody got any ideas as I have never come across this rev before

 

[edds]

Has anybody heard of this revision I have tried every script I have with no look tried all software i.e. nagraedit ,xncs1.8 ,romstudio but keep getting wrong password anybody got any ideas as I have never come across this rev before

Sounds like it may be a successor to B0D?
Was it an untouched card?

 

[gryfon99]

No it was my brothers done by some one else about 6 months ago and i got it given as he can't get in touch whith the lad who done it before

 

[edds]

Right, try reading it with BoxGetPC2, on NO account use MROM until you've retrieved the BK.

 

[gryfon99]

already used ledsims to get the bk so i don't need any info of the card just need to get into it tried mrom with loads of delays but allways errors on string 2

 

[edds]

already used ledsims to get the bk so i don't need any info of the card just need to get into it tried mrom with loads of delays but allways errors on string 2

Great, one less worry, lol. Try A3E_B09.d2c file in Nagraedit 4.1 that'll fix the backdoors. All thanks to Edcase/Deceased for that script.

 

[edcase]

Great, one less worry, lol. Try A3E_B09.d2c file in Nagraedit 4.1 that'll fix the backdoors. All thanks to Edcase/Deceased for that script.

It wont fix it if the blocker prevents backdoor writes to dataspace, might be worth a try though.

If it doesnt work, I would be interested to see a comms log from an attempted read in nagraedit.

edcase

 

[edds]

It wont fix it if the blocker prevents backdoor writes to dataspace, might be worth a try though.

If it doesnt work, I would be interested to see a comms log from an attempted read in nagraedit.

edcase

It was a case of suck it and see, nowt to lose by trying it. If your script didn't fix it, then it'd be a job for MROM, using different delays until it cracked or the user gave up, lol.

 

[gryfon99]

tride it with no look here is the comm log

R11_B09_AND_R10_A3E_BLOCKER_REPAIR
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
PLEASE_WAIT_SCREEN_MAY_FREEZE!
RX: 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50
30 31 31 20 52 65 76 42 30 45 3D
TX: 21 C1 01 C0 21
RX: 12 E1 01 C0 32
~~~~~~~~~~~~~~~~~
DECEASED/ED_NONPROVIDER_SPECIFIC_LOGIN
~~~~~~~~~~~~~~~~~
TX: 21 00 09 A0 CA 00 00 03 41 01 00 03 02
RX: 12 00 05 71 01 01 90 00
TX: 21 00 16 A0 CA 00 00 10 41 0E 00 00 2E FF 1F BC
EF 1F 17 33 07 00 00 28 03 88
RX: 12 40 05 71 01 02 90 00 B5
TX: 21 00 09 A0 CA 00 00 03 41 00 ED 03 EE
RX: 12 00 05 71 01 03 90 00 F4
TX: 21 00 0D A0 CA 00 00 07 21 05 11 03 FF FF 01 1A
6C
RX: 12 40 1C A1 18 02 0E 00 00 2E FF 1F BC EF 1F 17
33 07 00 00 28 00 00 00 00 00 00 00 00 90 00 E2
DUMPING_D000_FOR_BOXKEY
SAVE_THIS_DATA_IF_YOU_NEED_IT
TX: 21 00 07 A0 B1 10 00 02 00 40 65
RX: 12 00 02 63 00 73
DATASPACE_OVERWRITE_PACKET_1
TX: 21 00 45 A0 D7 10 00 40 8B 7E 21 98 0E FF DA 4A
EE 43 17 EF 63 14 57 82 54 DE B5 EC 7E 10 93 47
65 F4 D2 C7 6B 0D 45 FD 00 7F B7 40 AC DA C6 90
E9 B5 0E A2 F0 C8 FE 27 27 27 77 6B A4 F4 A3 01
A1 18 58 B3 DB 57 2B 6F 67
RX: 12 40 02 63 00
PACKET_DIDNT_TAKE

 

[edcase]

What is interesting is the 6300 response to the D7 packet. This indicates an incorrect backdoor password. The data that my script logs in against is virtually always the same on all cards (I have only ever seen a few exceptions).
It may be that this image is blocking the write attempt totally and spoofing a 6300 response, or it may just be that you need to find some alternative data to log in against in order to attack it by this method.

In your situation I would try to dump the card with XNCS before anything else.

edcase

 

[richie989]

Use the 5401 rom11 boc script (not bod/multi prov) to unloop the card (should unloop with first delay), repair the card with mrom with delays 190-50-100 then write a rom11 BOD image to the card with nagraedit that should sort it! - you wont be able to get the bk/ird off the card..... or and if you previously ran the BOD script card maybe scraper....

 

[gryfon99]

Tried everything that everybody has suggested with no look every script I try seems to get stuck like this

________________Setting up WinExplorer_________________

Executing Script: E:\cable\Gltiching Scripts\5401 Rom11 BOC.xvb
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 07 1B
RX Data : 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50
30 31 31 20 52 65 76 42 30
TX Data : 14 03 10 15 AB 21 00 08 A0 CA 00 00 02 12 00 06
55 0E 03 87 00
RX Data : 14 08
RX Data : 12 00 08 92 04 12 34 56

Now we will try 16FF delay
TX Data : B0 30
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 07 1B
TX Data : 47 15 E0
TX Data : 21 00 3D A0 CA 00 00 37 03 35 54 01 10 31 05 4E
69 70 50 45 72 20 49 E3 40 7C AD FD B9 64 29 F4
F6 77 C2 35 6D 74 74
TX Data : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 05 CE
TX Data : 0E 05 8A 00
RX Data : 46 00
TX Data : 53 15 E8
TX Data : 21 00 45 A0 D7 10 80 40 66 E1 24 39 14 1A CA A1
C1 D5 E9 B2 9B 68 F8 61 EF 7F 04 3C 26 55 63 F3
37 FE 29 F5 61 DB 8E
TX Data : 17 B5 E1 9B D3 83 99 50 49 EC 66 52 53 E2 81 95
DF 32 90 53 12 C9 95 CE 26 F0
TX Data : D9 26 86 05 BE FE F2 B0 20 16 FF 06 0E 05 85 00
RX Data : 03 00
! ! ! -

*********** we hit our bug *************
6300 was our loggin = not logged in, packet didnt take!!1240026300
===========================================
63 was hit at 16FF delay ----VCC WAS 34 , our GlitchType was 08



*********** we hit our bug *************
6300 was our loggin = not logged in, packet didnt take!!1240026300
===========================================
63 was hit at 16FF delay ----VCC WAS 34 , our GlitchType was 08



*********** we hit our bug *************
6300 was our loggin = not logged in, packet didnt take!!1240026300
===========================================
63 was hit at 16FF delay ----VCC WAS 34 , our GlitchType was 08



*********** we hit our bug *************
6300 was our loggin = not logged in, packet didnt take!!1240026300
===========================================
63 was hit at 16FF delay ----VCC WAS 34 , our GlitchType was 08


and then just continues i have left it for 2 days but still the same

 

[richie989]

I think you must have ran the bod script first I aways had the same result unless I ran the 5401 boc script....