How To read Box Keys off this receiver?

[mili]

Since this sucker does not have a JTAG port I assume I will need a Sombrero. Can you guys look at this picture and tell me which chip is the TSOP or if there is a way to solder a JTAG on? It is a GlobeCast T105 Receiver. The card is a DNASP011 RevB08

mili

[dssdude]

Since this sucker does not have a JTAG port I assume I will need a Sombrero. Can you guys look at this picture and tell me which chip is the TSOP or if there is a way to solder a JTAG on? It is a GlobeCast T105 Receiver. The card is a DNASP011 RevB08

mili
Desolder the MX29F8100 chip and put in universal programmer... then read the chip. It's a 1 MB flash. I dont know enough about this system to offer any further info... I recognize the chip though. What's under that WHITE label on the chip to the left of this one on pic?

[mili]

Which one? Please edit the pic and circle what you are referring at then post it here.

mili

[dssdude]

Which one? Please edit the pic and circle what you are referring at then post it here.

mili
I've uploaded datasheet for this chip... please see pic.

[dssdude]

It looks as though this board is designed to use either a 44 pin SOP or 48 pin TSOP(thin small outline package), the flash memory installed is a 44 pin SOP (small outline package) very standard common chip. Would be easy to read.
The possible slot to install TSOP package would be right next to the chip with label on it.
Don't bother with JTAG... use chip programmer instead (in case of locked sectors) it will read it without problems.
Depending on whats under this label it could be a dual chip memory circuit i.e. 2MB Flash..

[mili]

Another damned TSOP. Also please let me know where to and what to get as far as programmer and software to read it.

mili

[dssdude]

Just grab a needhams emp-30
http://www.needhams.com/e30.html
You should be able to find one of these on ebay.. there's several other programmers that will work - this one is priced about right. You may need an adapter for the plastic SOP to DIP interface.. (or you can make your own using the wiring diagram in data sheet.

Read both chips... memory addressing will probably be byteswapped with 2 chips... will have to experiment to find if 8,16,32,64 swapped. Use a text string to find out.
Then search for keys...

[mili]

Man the discontinued this reader and will a Sombrero not work? I'd hate to remove the chips to read.

mili

[dssdude]

Man the discontinued this reader and will a Sombrero not work? I'd hate to remove the chips to read.

mili

Try this one...
http://www.xeltek.com/product/programmer/sp680.html
Chip removal is easy and gives you a lot more control over programming. You can reinstall chips with clamshell sockets for easy insertion/removal during testing. I don't know anything about the sombrero, so I couldn't tell you if it will work or not.. =o( what is it?

[mili]

It is a clip on reader, used with DishNet 7200 receivers. http://www.dssftp.com/filedownload/download/sombreroschematics.zip
I surely wont pay $900 for a reader

mili

[dssdude]

It is a clip on reader, used with DishNet 7200 receivers. http://www.dssftp.com/filedownload/download/sombreroschematics.zip
I surely wont pay $900 for a reader

mili
Aaaahhh... ok, I've looked at the schematics...
I don't think this will work on the globecast receiver the way it is now. The wiring between chips is completely different not to mention the chip addressing & timing is completely different than the TSOP in the 7200.

If you were to rewire it with the appropriate pin labels it may work. The sombrero is designed for a 48 pin TSOP. You're working with the 44 pin SOP version. The datasheet provides correct wiring. Once you do that, you'll need the correct timing and interface software (device programming driver) for that specific device in order to read/write to appropriate addresses. It gets very complicated and is beyond my skill level. I think it would save you about 400 hours of work to just buy a programmer... this price is pretty low when you consider all the things that can be done with it.

[mili]

Thanks man, I just had news that the Magic Card will also support GlobeCast soon so screw the Box Key I will wait a few weeks.

mili

[dssdude]

Thanks man, I just had news that the Magic Card will also support GlobeCast soon so screw the Box Key I will wait a few weeks.

mili
Good, why not do it anyways for the sake of discovery? make a globecast files section and share with others... I'd love to take a look at the firmware... have never seen a globecast system before.
Maybe someone out there has some files they can upload?

[pioca]

The sombrero won't work for sure. I have one and that is square shaped and only would work for those square chips....

What about the rs232 connector at the back of the receiver?
That is how you can upload firm updates isn't it?

[prsat]

What is a Globecast reciever, first time I heard of it.I'm new in this, can anyone explain about it? Thanks

[pioca]

http://www.globecastwtv.com


What is a Globecast reciever, first time I heard of it.I'm new in this, can anyone explain about it? Thanks

[jovic]

Hello evry 1,

I have Globecast rec.

it is working fine, but I did pay 100 CND$ for the box key.

and 100 cnd $ for the card (R10) programing and the funy things is he is my friend and he did not wanna tell me any things about it because it is a busniss. he said.
SO, I'll be wiling to shar any info IF I can.

[mili]

It will be available by the end of this week.

mili

[crazydude]

That sounds great, Im definitly getting a magic card now :)

[mili]

I got strong promise from the developer to have the code soon. I can't wait for it myself.

mili

[cartof]

yes i pull the chip on globecast receiver i read it the problem is i cant find keys bcose they write the codes diferit inverse like this

rpgoarem = programe...
1234567890 = 2143658709
please anyone can help me to find the boxkeys i tri many combination no go

ie for my keys 05-36801717
thanks

[cartof]

|BeastLoard| thanks for help the xor works

[cartof]

Vieira read up my last 2 postes after u read the chip the file must xor for keys

[mili]

Please read the Sticky post, there is no more need for extracting Box Keys, the Magic Card will work in Married Sub mode.

mili

[cartof]

mili globecast receiver has no ci so we need bk for plastic or avr

[mili]

Please stop this verbal diarrhea. Please try throwing a few more abbreviations in the above sentence replacing words like receiver with IRD and globecast with GC. THe correct format of your post should be like:

"mili CG IRD has no ci so we need bk for plastic or avr"

Now for the mentally challenged like me could you please decrypt your post?

mili

[cartof]

mili where are you from?

[mili]

Why? Just cause I am an idiot does not mean everyone is where I am from :)

mili

[jovic]

Pansat2300 dose not rol keys, GC with cam dose,

[RavesRus]

How many more people r going to ask how to extract box keys on this thread..........lol
Stick with the magic cam

[cartof]

This GC service provides wonderful ethnic programming for many people.
They are currently barely breaking even due to a drop in subscribing and it would be a shame for them to stop uplinking. if you cant aford to pay subscription hacked those providers need help

[satellitedream]

by the looks of it, apparently globecast is trying to protect themselves. The new se 830 looks reletively similar to the de 997 from the outside yet inside it is totally different, the only thing almost the same is the power supply. First off the biggest problem with this receiver would have to be what appears to be white epoxy covering the tsop and mcu. looks like it is not going to be possible to remove tsop in this unit because there is no way to remove this glue, if you try you will cause damage to the receiver. If anyone has any info on the receiver, like what mcu they are using, if its still the LSI 64108 and if tsop is still 29lv320, that would help since maybe then we can use a jtag to communicate through the lsi. so if anyone has one of these irds, and maybe for some reason there is no epoxy on covering the board, then please post what chips are on there.

[cartof]

vieira do the swaping bites to find ird and bk
if u can aford to pay for programing pay for

This service provides wonderful ethnic programming for many people.
They are currently barely breaking even due to a drop in subscribing and it would be a shame for them to stop uplinking.

[cartof]

keys are at 00001c10 but you have to swap bites to see the keys

[cartof]

i tall you 99 % how to do but becose this i cant tall you the rest:
This service GC provides wonderful ethnic programming for many people.
They are currently barely breaking even due to a drop in subscribing and it would be a shame for them to stop uplinking
if u can pay pay for it if not lern how to swap bites
sorry

[cartof]

globecast is big but they take mony from providers and they charge providers $2 for do the bills and the providers dont make enough
ie. romanien provider pay to globecast $100 000 us a month for 3 uplynks on 2 satellites and there are only 3000 subscribers so sune romanien tv on t5 will quit if they will not get more subs

[cartof]

im tri to defend only romanienn chanels i geave you the address where ird and bk are 00001c10 loock here and you can see all your ird # in dif order u have to swap them to put in real order convert in hex only first 10# of your ird is easy to hack gc dvb matrix jocker avr fortec strong pansat astrovox dreambox all dont need any card or bk

[argetim]

Hi all, I am new to this forum so bare with me. I have read that Magic Card suports GlobCast. Is this true, or is there still a waiting line for this...

[cartof]

idr=05 36 90 64 73 on back of receiver or in info screen

[cartof]

i geave you only ird # no bk
check out your receiver next 16 # are bk
ird# in hex=20 00 8a e9
is this # on back of receiver 05 36 90 64 73 ?

[cartof]

man pay for one chanel and use eepedit card in card avr6 and open all chanels set to maried no need bk

[cartof]

yes they are in 1c10 line in dif order 20 00 8a e9
1C10 Line-- 0301-00-20-E9-8A-4560D69F4A8267430000

[cartof]

sorry man i dont do for mony for my frends i do card in card they pay for one chanel

[cartof]

sorry i like romanien chanels and i dont wana see them out off air i geave you lots of info find sameone to help you with avr6 card in card

[cartof]

YES NOSTRADAMUS this CARTOF is a real ..... ..... I agree with you if question of money tell us b ut dont came here defend GC or else i am shore you CARTOF have a GC hacked for shore why you don't be nice first be subs. and get f.. out from the forums

Viera you rite im get off from this forum bye

[satellitedream]

the new globecast 830 receiver does not have a am29lv320 chip any more, it has one with half the size, m29w160 which is only 2 meg and keys are no longer in line 1c0, i found the ird at the end of the file and it is no longer swapped, tried xoring but no go, any one have any suggestions?

[bimmer]

Vieira, try this as your boxkey:

60 45 9F D6 82 4A 43 67

Let me know if it works.

[brownboy]

The guys in france can jtag a xsat model 310 that has a l64108 cpu, so I contend in theory it is possible, we however don't have a jtag port on the pcb, so we need datasheets so we can trace the correct cpu pins to a point on the board where we could tap in to the lines. anyone with any info on the l64108-54?? lets see some digging.

PS here's a link to the french site
http://xsat.rtfm.be/jtag.html

[brownboy]

found a tech guide for the l64108

http://xsat.rtfm.be/docs/l64108tm.rar

[hifly]

So then based on line 1C10 from up above: 45 60 D6 9F 4A 82 67 43 gets shifted to a box key of 60 45 9F D6 82 4A 43 67. Is this correct?

[lightning0009]

I removed both M29F400T tsops from my Globecast VIStar 2000 ird and read them and now I am trying to find the Box keys in there somewhere by looking for the ird number. Does anybody know where they are in this receiver? Do I need to join the two bins together to complete the flash or are the two tsops two different files. Attached is a picture of the board.

[bimmer]

lightning0009, if your receiver has a network interface at the back, look for the MAC address on the same sticker where the IRD # is. You have to OR the MAC address and that's the box keys (you may have to add leading zero's). My receiver works like that. I have a VNI Quantum® Multimedia Satellite Receiver (MSR) also known as Vistar 2000 FTA or Visionetics Vistar 2000 FTA or NATV Vistar2000 Integrated Receiver Decoder or Smallear 2000 (or 1000 I'm not sure). Good luck.

[lightning0009]

Bimmer, my vistar 2000 ird does not have the network interface. There is another sticker and number below the sticker that has the ird number on the back. How would I OR the MAC address? Part of my problem might be I put the flash chips in a 2800 and read them doing that. I might have to get the 48 pin tsop adapter for my Willem to read the chips properly.

[bimmer]

My receiver doesn't have the actual network interface anymore but it was there (somebody removed it before it got in my hands) thus the MAC address inscription at the back. The back case is having now a hole, covered by a silver tape, instead of the RJ45 connector. The NIC (network interface card) is gone, but I still have inside the IRD, the interface with the slot accepting the NIC.

The MAC address is marked on a sticker near the IRD number at the back and should be a number in hex that look like:

00 AA 11 BB 22 CC 33 DD

What I did with my MAC address was something like this:

AA 00 BB11 CC 22 DD 33

The pattern is obvious. I don't know if this is truly an OR operation but who cares. I tried with the original MAC address and I had "Smartcard not paired" error message. After switching the numbers around there was no error message anymore and it started to work.

[leet83]

hook up a dish ird to 61.5 and quit bitching

[lightning0009]

I am just trying to figure this out for fun. I don't watch much tv. I barely have time to do anything and haven't messed with this globecast box for a while since I desoldered the chips off it and read them in a 2800, but mabey I will get to it some day. I currently don't even have a satellite dish pointed at anything at the moment or even on the house, but that's a whole nutter story(bitch landlord).

[cartof]

vieira those are your bk
DD F8 22 6B 3F F7 FE D?

[anon]

My receiver doesn't have the actual network interface anymore but it was there (somebody removed it before it got in my hands) thus the MAC address inscription at the back. The back case is having now a hole, covered by a silver tape, instead of the RJ45 connector. The NIC (network interface card) is gone, but I still have inside the IRD, the interface with the slot accepting the NIC.

The MAC address is marked on a sticker near the IRD number at the back and should be a number in hex that look like:

00 AA 11 BB 22 CC 33 DD

What I did with my MAC address was something like this:

AA 00 BB11 CC 22 DD 33

The pattern is obvious. I don't know if this is truly an OR operation but who cares. I tried with the original MAC address and I had "Smartcard not paired" error message. After switching the numbers around there was no error message anymore and it started to work.

Hi bimmer,

I am new around here. I too have a viacast quantum, and would like to know:

1. if my mac is 00-21-1a-bb-dc-43 , then bk = 00-00-21-00-bb-1a-43-dc? (added the 2 x 00s in the front)
2. what type of card did you write the bK to ?
3. when you say" it started to work", were the channels decrpted?


Thanks in advanced for your reply.

anon

[cartof]

hi Bimmer!
i have viacast quantum came with original card i can read the card and i will post the real keys here and the receiver has MAC keys too but evrithing i done swaping xor backwards i cant convert the MAC in real boxkey so i take the risk and put here real #
MAC= 00 60 aa 01 8f 30
real box key working with card are=
02 03 5f 9a b3 75 00 88
to get real ird key ih hex i convert first 10# of back of receiver and they are backwards
so what we nedd to convert those mak in bk ? thank you

[lips905]

for those globecast impaired do this (lol)

Using a dishnet receiver set it to 119 transponder 13 When you find signal for globecast you will see on the screen LOCKED WRONG SATELLITE SKYVISTA.THAT IS YOUR GLOBCAST SIGNAL.You need 30 inch dish +++ for good quality signal.

By the way you need MIGHTY LOADER to program globecast

[cartof]

for those globecast impaired do this (lol)

Using a dishnet receiver set it to 119 transponder 13 When you find signal for globecast you will see on the screen LOCKED WRONG SATELLITE SKYVISTA.THAT IS YOUR GLOBCAST SIGNAL.You need 30 inch dish +++ for good quality signal.

By the way you need MIGHTY LOADER to program globecast


realy? MIGHTY LOADER for what?

[anon]

realy? MIGHTY LOADER for what?

Hi cartof,

Sorry I do not have an answer for you, but a question.

Were you able to decrypt any channels with the card, after having the correct bk's?
I too have a quantum that I am trying to get the bk's off of. Unfortunally, unlike you, I do not have the original smartcard.

anon

[cartof]

yes Anon is wotking on t5 nagra chanels
anon i pull 2 eproms tsop from this receiver and i cant find the keys loock the keys are spred in both chips like UK receivers 4bites in one eprrom and ather 4 in dif eprrom i try evrething or xor swaping cant find the keys

[argetim]

I have a globecast ird with original card, i also have a magic card, but dont suscribe to any channels.....i was told i could use MC to "test" globecast but how???I want to get the European channels (Bulgarian, Albanian).....

[cartof]

argetim your original card gc must be acctivate one time to get the bk on it after that u can use mc bulgaria tv is gone no more on t5 trade your receiver for fta one

[mrgadget39]

didn,t he say the 16 digits after receiver would be bk?? this #=4560D69F4A826743 i think thats what he said so now what ever that swap thingie was lol


good luck im lost too

[bimmer]

Hi bimmer,

I am new around here. I too have a viacast quantum, and would like to know:

1. if my mac is 00-21-1a-bb-dc-43 , then bk = 00-00-21-00-bb-1a-43-dc? (added the 2 x 00s in the front)
2. what type of card did you write the bK to ?
3. when you say" it started to work", were the channels decrpted?


Thanks in advanced for your reply.

anon

1. right
2. dssrev original
3. yes but for almost a day only... and I think because I did not know how to work with tiers for globecast.

[DRAG)N!!#]

i read somewhere that a d^^^net 1000 could be set up on t5 and it will down load globecst firmwatre? is this still possible?

[radio11]

hey guys,i am trying to do the same thing with a pansat 500ci,were the fu--k do you get your boxkeys/ird number???no were to jtag.now i maybe wrong but for you guys that have the globecast receivers and card,that card should be married to the receiver.if so you should be able to read all your info from your card!!!boxkeys/ird number and so on.someone in a past thread said mighty loader?it might crack the card/unlock.if so you would be all set.you would then have all need info to do globecast.good luck to all.and have a good xmas!!!!!!!!!

[angeltv]

hi,
can anybody help me with what dish size i need for the globecast on the fta(fortec or pansat) ?
i have a 18" dish, will it work or i need a bigger dish, what size please?


and how do i get the right keys for globecast, in case they change?

Thanks man, I just had news that the Magic Card will also support GlobeCast soon so screw the Box Key I will wait a few weeks.

mili

[argetim]

cartof is Offline:
Registered User Join Date: Mar 2004
Last Seen: 11-17-2004 (10:57 AM)
Posts: 40

argetim your original card gc must be acctivate one time to get the bk on it after that u can use mc bulgaria tv is gone no more on t5 trade your receiver for fta one


Cartof:

My origional card is activated already, now what needs to be done now?? Atone time I did sub to the Albanian channels but have since discontinued the service so what do i need to do?