Stuck... smart card at 0000000000-00

[wasup]

I programmed my Rom 3 successfully and put it in my 3700, everything checks out except smart card 0000000000-00. using scammer for cam id. I double checked the box keys and ird # and wrote the tiers and used 007 blocker. Software version is 797 location id is ok. Dont know. Help?

[fubr]

Cam ID where?
on sys info screen or on Nagra dump?
\
If sys info screen then pull the cam and wait for nag to reinsert then reinsert it.
if that dont do it put cam in unplug then reboot ird (plug it back up)
if that dont work then do a factory reset menu 63 info right left.
next make sure the ird is getting signal, try tricking it into reading the card

but I think maybe this is the problem>

ARe you putting ID in three places in nagra befroe writing image?
the id you got from scammer
let me know we'll think on it some more

[wasup]

Cam ID where?
on sys info screen or on Nagra dump?
\
If sys info screen then pull the cam and wait for nag to reinsert then reinsert it.
if that dont do it put cam in unplug then reboot ird (plug it back up)
if that dont work then do a factory reset menu 63 info right left.
next make sure the ird is getting signal, try tricking it into reading the card

but I think maybe this is the problem>

ARe you putting ID in three places in nagra befroe writing image?
the id you got from scammer
let me know we'll think on it some more


Thnx for the reply
I did what you suggested, no go. I got a memory dump when I menu 63 info right left. Signal checked out.
Second, I put the card Id in the yatm tier maker, once along with the box keys, ird, zip, time zone, and selected no ppv and rom3. I used NE4 to patch this tier list and patch the blocker wd45. Reset atr and the rev is spoofed correctly, no errors. 3700 system info says location ok, ird # correct, software good, but no smart card number, just 0000000000-00. I will play with the signal tomorrow, and try to improve on it. check switched a couple of times and its locked in. strange.

[wasup]

I improved my signal strength and still no bananza. I guess the only thing I can think of is to reflash the ird cause i've done everything to the card I can. Anyone? :cry:

[sukh77]

do you do full one step clean on the rom in nagra?
re-enter all the info in yatm just select the top50 package. click generate.
Apply patch in nagra.
Apply blocker. Are u changing anything else between these steps.
Make sure nothing else is selected in the Yatm tabs.
For Cam #'s do this S00 XXXX XXXX replace the X's with numbers and delete all spaces after it and press the TAB button it will automatically generate the last 2 digits for Camid.
Also are u using the latest YATM09k.

[wasup]

do you do full one step clean on the rom in nagra?
re-enter all the info in yatm just select the top50 package. click generate.
Apply patch in nagra.
Apply blocker. Are u changing anything else between these steps.
Make sure nothing else is selected in the Yatm tabs.
For Cam #'s do this S00 XXXX XXXX replace the X's with numbers and delete all spaces after it and press the TAB button it will automatically generate the last 2 digits for Camid.
Also are u using the latest YATM09k.

I get a data pointing error, so I have to use NE3 to change FF FF to E4 00 and then write, then clean. Then go to NE4 with no errors, one step clean (this finishes in a full clean. Im using yatm09i which i believe is the latest version. When you enter the cam id and click off the field, it totally changes the format of the cam id with spaces, it does this with the ird number too. I used top 50 and a few movie channels no ppvs and apply this tier list to NE4, blocker, then organize, defrag, organize, write, succesfull with the rev382, no problems or errors.
Do you have a buffered jtag or recommend one, mine is falling apart everywhere, ive resoldered 3 places already and now i get no reading. I may have to open the pogo pins to make sure the connections are not loose. Any recommendations on a good jtag, solder or pogo's, buffered or plain? Thanks

[sukh77]

Is that a common practice for you to use NE3 first and then go to NE4.
Why don't you just use NE3 if you are having problems with NE4.
YATM09k is the latest. K comes after i making YATM09k latest.
It's common when you enter the number like I said and press TAB it is suppose to fix it in the correct format. One more thing you are not putting hex numbers in the YATM info are u. It should be the numbers from the back of the CAM. redo the steps that i posted earlier to enter camid in YATM.

[wasup]

Is that a common practice for you to use NE3 first and then go to NE4.
Why don't you just use NE3 if you are having problems with NE4.
YATM09k is the latest. K comes after i making YATM09k latest.
It's common when you enter the number like I said and press TAB it is suppose to fix it in the correct format. One more thing you are not putting hex numbers in the YATM info are u. It should be the numbers from the back of the CAM. redo the steps that i posted earlier to enter camid in YATM.

I went ahead and used NE3 only. I also did a full erase and restored the flash and eeprom, as well as wrote a new bin using excel, switch test(of coarse) and no ppv's everything i can think of. OH, I also tried the rom3 in a 301 010 and got the same error 015. it hangs on signal screen. weird huh. Im using yatm09k now and no hex numbers, justs the way i read them. :cry:

[sukh77]

Dude again just stick with NE3 why are u writing the bin in xcel.
In YATM just select Top60 and input all sys info. generate
apply the tier patch in NE3. DO everything in NE3.

PS. In previous post I said unselect everything else in YATM tabs, actually you need to have the sats that you have selected in the Satellite tab.

[wasup]

Ok my problem is narrowing. The final image doesn't write successfully cause the DataSpace changes to FF FF from E4 00. I read in a post to write an original image to my Rom3 but I dont have one. Where could I get an original Rom3 Rev372 image to use or is this the same as a virgin image. If so, how do I make a Virgin Rom3 image? This sounds like a ToTaLLy NeWb QuEStioN.

[sukh77]

there is a clean rom image in the files section. Do a search for clean rom image in the forums you migh find it that way too.

[wasup]

Dude again just stick with NE3 why are u writing the bin in xcel.
In YATM just select Top60 and input all sys info. generate
apply the tier patch in NE3. DO everything in NE3.

sorry I thought I was clear that I am in NE3 the whole time.
HERE ARE MY STEPS:

1. Atr reset on Rom3 in NE3:
RETURNS:

Opening of COM1 was successful
ATR String: 3F FF 95 00 FF 91 81 71 64 47 00 44 4E 41 53 50
30 30 33 20 52 65 76 33 38 32 F4
ROM Revision: 003
EEPROM Revision: Rev382
Closing of COM1 was successful

2. One step clean:
RETURNS

Opening of COM1 was successful
ATR String: 3F FF 95 00 FF 91 81 71 64 47 00 44 4E 41 53 50
30 30 33 20 52 65 76 33 38 32 F4
ROM Revision: 003
EEPROM Revision: Rev382
Closing of COM1 was successful

AFTER WHICH I GET AN "error retrieving backdoor password"!

3. I click on Data Editor, then Code Space, notice the DataSpace Start Address says: FF FF so I change it to E4 00 and Write to Card
RETURN:

Opening of COM1 was successful
ATR String: 3F FF 95 00 FF 91 81 71 64 47 00 44 4E 41 53 50
30 30 33 20 52 65 76 33 38 32 F4
ROM Revision: 003
EEPROM Revision: Rev382
Logging into card
Checking for BackDoor
BackDoor appears to be open, continuing...
Retrieving BackDoor password
Password: 8F AB C2 64 44 9A FE 70 1D E7 62 FA B1 4C 31 06
Login successful
Disabling Bug Catchers
Disabling Data Space
Writing image to card
Enabling Data Space
Enabling Bug Catchers
Card image written successfully with 0 retries
Card written successfully
Efficiency: 100.0%, Packets: 261, Retries: 0, Time: 6.28s
Closing of COM1 was successful

NO ERRORS!

4. One Step Clean again now, It takes me to the Full Clean dialogue, I select OK. I get a error "Retrieving Backdoor Password".
RETURNS:

Login successful
Reading image from card
Card read successfully with 0 retries
Card read successfully
Efficiency: 100.0%, Packets: 260, Retries: 0, Time: 6.72s
Closing of COM1 was successful
Card image cleaned successfully
Opening of COM1 was successful
ATR String: 3F FF 95 00 FF 91 81 71 64 47 00 44 4E 41 53 50
30 30 33 20 52 65 76 33 38 32 F4
ROM Revision: 003
EEPROM Revision: Rev382
Logging into card
Checking for BackDoor
BackDoor appears to be open, continuing...
Retrieving BackDoor password
Password: 8F AB C2 64 44 9A FE 70 1D E7 62 FA B1 4C 31 06
Login successful
Disabling Bug Catchers
Disabling Data Space
Writing image to card
Error writing image to card
Error writing to card
Closing of COM1 was successful
Error detected, One Step Clean incomplete

5. So I again edit the Code Space in the Data editor to E4 00 from FF FF. (changes back again) write to the card.
RETURNS:

Opening of COM1 was successful
ATR String: 3F FF 95 00 FF 91 81 71 64 47 00 44 4E 41 53 50
30 30 33 20 52 65 76 33 37 32 FB
ROM Revision: 003
EEPROM Revision: Rev372
Logging into card
Checking for BackDoor
BackDoor appears to be open, continuing...
Retrieving BackDoor password
Password: 8F AB C2 64 44 9A FE 70 1D E7 62 FA B1 4C 31 06
Login successful
Disabling Bug Catchers
Disabling Data Space
Writing image to card
Enabling Data Space
Enabling Bug Catchers
Card image written successfully with 0 retries
Card written successfully
Efficiency: 100.0%, Packets: 261, Retries: 0, Time: 6.25s

6. One step Clean, prompts Full Clean, with no errors. finally!
RETURNS:

Opening of COM1 was successful
ATR String: 3F FF 95 00 FF 91 81 71 64 47 00 44 4E 41 53 50
30 30 33 20 52 65 76 33 37 32 FB
ROM Revision: 003
EEPROM Revision: Rev372
Logging into card
Checking for BackDoor
BackDoor appears to be open, continuing...
Retrieving BackDoor password
Password: 8F AB C2 64 44 9A FE 70 1D E7 62 FA B1 4C 31 06
Login successful
Reading image from card
Card read successfully with 0 retries
Card read successfully
Efficiency: 100.0%, Packets: 260, Retries: 0, Time: 6.72s
Closing of COM1 was successful
Card image cleaned successfully
Opening of COM1 was successful
ATR String: 3F FF 95 00 FF 91 81 71 64 47 00 44 4E 41 53 50
30 30 33 20 52 65 76 33 37 32 FB
ROM Revision: 003
EEPROM Revision: Rev372
Logging into card
Checking for BackDoor
BackDoor appears to be open, continuing...
Retrieving BackDoor password
Password: 8F AB C2 64 44 9A FE 70 1D E7 62 FA B1 4C 31 06
Login successful
Disabling Bug Catchers
Disabling Data Space
Writing image to card
Enabling Data Space
Enabling Bug Catchers
Card image written successfully with 0 retries
Card written successfully
Efficiency: 100.0%, Packets: 261, Retries: 0, Time: 6.30s
Closing of COM1 was successful
One Step Clean completed successfully
does this mean I have a clean Rom3 image now?

7. Open Patch Editor, open patch YATMnoPPV.NE3 (tiers created top 50 no ppv), run patch, open Blocker, WD45-007.ne3, run patch. No errors, In Data Editor, click Organize, Defrag, Organize (Data space start address is still E4 00) and Write to Card. No dialog errors but....
RETURN:

Opening of COM1 was successful
ATR String: 3F FF 95 00 FF 91 81 71 64 47 00 44 4E 41 53 50
30 30 33 20 52 65 76 33 37 32 FB
ROM Revision: 003
EEPROM Revision: Rev372
Logging into card
Checking for BackDoor
BackDoor appears to be open, continuing...
Retrieving BackDoor password
Password: 8F AB C2 64 44 9A FE 70 1D E7 62 FA B1 4C 31 06
Login successful
Disabling Bug Catchers
Disabling Data Space
Writing image to card
Error writing image to card
Error writing to card
Closing of COM1 was successful

DataSpace Start Address is Back to FF FF!!!

I think this is where my problem lies.
Sorry post is so long but it is necessary.
Thanks for help.
:)

[sukh77]

Have you alway had this card or did you buy it at rev382.
In your step2 when you do the one step clean you say that you get an error retriveing back door password. This tells me that the card is locked either with a blocker or was stream locked.

After you get the back door error on step 2. Why are u going to the data editor tab. You should not have anything there because the card didn't read do to backdoor being locked. Lets start with step 2 then we will refer back to others if needed. Let me know if you get what Iam saying so far. There is a Clean rom 3 image attached but don't do anything with it yet.

[wasup]

thnks

step 2 says rev382 because I am successful patching wd45 bocker (i assume cause the rev382 was rev372) Step 2 is me starting over again, cleaning the card and patching again. I recieved the card from a friend a year ago. (no history) It came with backdoor closed, not just error but in the NE3 window(couldn't read card) I used rompuk4 353 times to open it. Since then I can use NE3 and 4 for writing ect. It appears to open the backdoor successfully but in the end i still get an error saying "Retrieving Passord" even though the window looks successfull. See above. That brings us to the "datapointing nag"
You can see the return from a OneStepClean the the backdoor is open password appears ok, but i still get this nagging "retrieving passord" error even though the NE3 widow shows it was opened successfully> see above. redundant

basically each time i clean the card I have to edit the datapointing from ff ff to e4 00 and write this to the card. It seems to onestep clean after this but doesnt full clean until I edit this field again. And yes it goes all the way FULL CLEAN, no errors.

[sukh77]

Aw damn. I should have thought of this earlier. Increase your retry counts and error counts. The default is 3 I think, so just increase to 10 just incase even though you clean that card with 0 retries looking at the results. you might have to do step 3 again to get sucessfull clean as result. After sucessfull clean don't do one step clean again go to tiers tab in nagraedit you should not see any tiers in the bottom window. leave it at that and post results for now. Iam bout to go get some lunch So I'll be back in a bit.

[wasup]

retry counts 10 already, with the rev372 fullclean is greyed, buy I can onestepclean which leads to the fullclean, and all is well without errors. then the fullclean is no longer greyed, but it wont take me through the opening and cleaning, it just repeats "card image cleaned successfully" My only option is to onestepclean which leads to a fullclean.
Lunch myself. back at 4:30 ct

[sukh77]

When you start off with always one step clean if it has a blocker on it and do a full clean.
If its already cleaned then just do a read card. When you open nagraedit you can't do clean card because it doesn't know that you have a card in there. So always do a one step clean. After you know the card is clean put tiers and blocker and write. And I keep forgetting to attach the Clean rom image so here it finally is.

[wasup]

When you start off with always one step clean if it has a blocker on it and do a full clean.
I always do, just as it appears in the post above. When I one step clean, NE always prompts with a Full clean automatically (no choice). Then if after I one step clean, I want to do a Full clean it says "card cleaned successfully" without going through the motions, just this each time "card cleaned succesfully" Looks like Im forced to one step clean first, and forced to full clean automatically.


If its already cleaned then just do a read card.

Read? I just onestepclean the patch my tiers, blocker, and write. Never do I read.
I cleaned then opened the cleaned rom3 image you gave me then patched and wrote and still:

Opening of COM1 was successful
ATR String: 3F FF 95 00 FF 91 81 71 64 47 00 44 4E 41 53 50
30 30 33 20 52 65 76 33 38 32 F4
ROM Revision: 003
EEPROM Revision: Rev382
Logging into card
Checking for BackDoor
BackDoor appears to be open, continuing...
Retrieving BackDoor password
Password: A9 B1 56 BB AD 26 88 41 3B EF 0D 45 D9 C7 C6 97
Login successful
Reading image from card
Card read successfully with 0 retries
Card read successfully
Efficiency: 100.0%, Packets: 260, Retries: 0, Time: 6.72s
Closing of COM1 was successful
Error detected, One Step Clean incomplete

[sukh77]

In your case if its at rev372 its already cleaned. You can do a reset to tell you what rev its at and then either do a read or one step clean. You get no choice maybe because the card is cleaned already Im thinking. Ok lets continue I think we got that part straightened out. Now do the tiers for rom3 with YATM just do Top60 package
then enter sys info. for camID and IRD# you can enter it as they appear. click generate
Apply the tier patch and blocker in nagraedit on the cleaned rom and click write card.

[wasup]

Now do the tiers for rom3 with YATM just do Top60 package
then enter sys info. for camID and IRD# you can enter it as they appear. click generate
Apply the tier patch and blocker in nagraedit on the cleaned rom and click write card.

I assume you mean to add box keys as well, zip and time zone? applied the tiers with NE3 and blocker. However, what about organize, defrag, organize? Then write.

[wasup]

When i do the write, this is what I get:

Opening of COM1 was successful
ATR String: 3F FF 95 00 FF 91 81 71 64 47 00 44 4E 41 53 50
30 30 33 20 52 65 76 33 37 32 FB
ROM Revision: 003
EEPROM Revision: Rev372
Logging into card
Checking for BackDoor
BackDoor appears to be open, continuing...
Retrieving BackDoor password
Password: A9 B1 56 BB AD 26 88 41 3B EF 0D 45 D9 C7 C6 97
Login successful
Disabling Bug Catchers
Disabling Data Space
Writing image to card
Error writing image to card
Error writing to card
Closing of COM1 was successful
:cry:

Dataspace Start Address goes back to FF FF after i write.

[sukh77]

Yes u assumed correctly.

One last try. Do a reset make sure it is at rev372. You might need to do the one step clean again like you been doing. After the sucessfull one step clean do a reset make sure it says rev 372 and then do a read. you should not see any tiers on the data editor tab if one step clean was done sucessfully assuming it did a full clean. Now open the clean rom image I posted above. When you one it a window will pop up select rom3 click ok. Now apply the tier patch you created earlier add blocker make sure you don't get any errors when doing both patch's then do consolidate, defrag, organize and then finally do a write card.

[wasup]

Yes u assumed correctly.
After the sucessfull one step clean do a reset make sure it says rev 372 and then do a read. you should not see any tiers on the data editor tab if one step clean was done sucessfully assuming it did a full clean. Now open the clean rom image I posted above.
What do tiers look like in the data editor?

[sukh77]

There is usually a big list of tiers they are labeled standard tiers. They are listed on the left side where you see free space, decrypt keys and some other stuff.

[wasup]

There is a tiers tab next to data tab but I don't see any label for tiers.

[wasup]

By the way, just for grins I took the Rom3 Rev372 cleaned it and wrote the tiers without the blocker, and it wrote the image successfully! Sooo, I guess its the blocker WD45 that makes the difference. Any clues or different blockers I should use (besides mili's cause Im tapped and I would rather by a MC for the money)?

[sukh77]

hmmm try check sum blocker. After you added the tiers do you see what Im talking about in the data editor tab. If you added the tiers you should see List of standard tiers.

[wasup]

:rolleyes: I tried checksum block, and birdie blocker with no success. At least Ive narrowed this thing down to blocker writting errors.

[sukh77]

are u adding anything to the blocker. A blocker should not do this.

[wasup]

here is a screenshot of the data editor after I write the cleaned rom3 image to it. Rev 372:
is this correct or should I erase something?

[wasup]

are u adding anything to the blocker. A blocker should not do this.

nope, just open patch, select the xxxxblocker.ne3 and run patch, organize, defrag, organize, and write to card. No dialogue tells me error i see the error in the NE window "error writing image to card"
thank you for your patience

[sukh77]

In the screen shot do you see the standard tiers on the left. That's correct.

Try to do consolidate, defrag and then organize. instead of organize, defrag , organize.

[wasup]

after i run checksum blocker I consolidate, defrag, organize and write to card, this is what I get:

Opening of COM1 was successful
ATR String: 3F FF 95 00 FF 91 81 71 64 47 00 44 4E 41 53 50
30 30 33 20 52 65 76 33 37 32 FB
ROM Revision: 003
EEPROM Revision: Rev372
Logging into card
Checking for BackDoor
BackDoor appears to be open, continuing...
Retrieving BackDoor password
Password: A9 B1 56 BB AD 26 88 41 3B EF 0D 45 D9 C7 C6 97
Login successful
Disabling Bug Catchers
Disabling Data Space
Writing image to card
Error writing image to card
Error writing to card
Closing of COM1 was successful

[sukh77]

well seems like the card is fucked or something. I don't know what else to tell you. Sorry.

[Dagwood]

Guys, I'm really dissapointed !!!!!!!! After all that, I was hoping for a happy ending. (And they watched tv happily ever-after)

wished I could help

[sukh77]

Yeah I was hoping for a happy ending also, I guess I'll go finish my self.

[BirdieMod]

why make it so hard, Just write your RTM or what ever to card. read card, Open Bird blocker, test patch, run patch, write to card. Done.

[BirdieMod]

Always make sure to read card before applying a patch file as patch files do not know the card type until you do this.

[wasup]

why make it so hard, Just write your RTM or what ever to card.

My RTM is YATM and thats all good, NE3 window says successful writing to card.

read card, Open Bird blocker, test patch, run patch, write to card. Done.
Exactly as written this is what I get:

Opening of COM1 was successful
ATR String: 3F FF 95 00 FF 91 81 71 64 47 00 44 4E 41 53 50
30 30 33 20 52 65 76 33 37 32 FB
ROM Revision: 003
EEPROM Revision: Rev372
Logging into card
Checking for BackDoor
BackDoor appears to be open, continuing...
Retrieving BackDoor password
Password: A9 B1 56 BB AD 26 88 41 3B EF 0D 45 D9 C7 C6 97
Login successful
Disabling Bug Catchers
Disabling Data Space
Writing image to card
Error writing image to card
Error writing to card
Closing of COM1 was successful

Its appears that I can successfully write a tiers patch to the card cause "error writing image to card, Error writing to card, is not there. It says successful instead of error. This is odd cause I haven't seen a post on this and I've never read so much in my life. Thanks for any help. I think this card is ready for ebay, cause I can fully clean it to Rev372. Anybody wanna buy a Rom3 for fifty bucks?
:cry: :cry: :cry: :cry:

[wasup]

This is what I get when I Read card now:

Opening of COM1 was successful
ATR String: 3F FF 95 00 FF 91 81 71 64 47 00 44 4E 41 53 50
30 30 33 20 52 65 76 33 38 32 F4
ROM Revision: 003
EEPROM Revision: Rev382
Logging into card
Checking for BackDoor
BackDoor appears to be open, continuing...
Retrieving BackDoor password
Password: A9 B1 56 BB AD 26 88 41 3B EF 0D 45 D9 C7 C6 97
Login successful
Reading image from card
Card read successfully with 0 retries
Card read successfully
Efficiency: 100.0%, Packets: 260, Retries: 0, Time: 5.64s
Closing of COM1 was successful

after which a dialog box pops up stating: Warning: Data Space Invalid: check pointer to Data Space!!!

[wasup]

"Unable to clean card" is what I get when I select Full Clean. And its not greyed either.

I can one step clean, and I get this:

Opening of COM1 was successful
ATR String: 3F FF 95 00 FF 91 81 71 64 47 00 44 4E 41 53 50
30 30 33 20 52 65 76 33 38 32 F4
ROM Revision: 003
EEPROM Revision: Rev382
Logging into card
Checking for BackDoor
BackDoor appears to be open, continuing...
Retrieving BackDoor password
Password: A9 B1 56 BB AD 26 88 41 3B EF 0D 45 D9 C7 C6 97
Login successful
Reading image from card
Card read successfully with 0 retries
Card read successfully
Efficiency: 100.0%, Packets: 260, Retries: 0, Time: 5.62s
Closing of COM1 was successful
Error detected, One Step Clean incomplete

Aterwhich the aformentioned dialog saying:
Warning: Data Space Invalid, check pointer to Data Space.

[wasup]

I tried apply a clean rom3 in xcel and still no go. I was wondering, is my puter to fast. I just built it and its 2.4mghrts with 1 gig ram? I will try my old laptop tonight.

[Canuk]

You have a stubborn Rom3 card I have had one like this also.

first you have to fix the data space start address.

and from now on you have to use NE 2.0 for all your programming of this card. (NE2 should work for you)

first read the card in NE2
then click data editor tab and pick codespace on the left

change the dataspace start address to E400

write to card

this will fix the dataspace start address

now do a onestep clean in NE2

now use NE2 for all your programming needs. NE2 should write to your card ok.


Hope this helps

[sukh77]

Well wasup I wouldn't worry too much about this card anymore all rom3 just got looped.

[wasup]

Thats ok, NE2 didn't work for this stuborn card anyway. I got new errors with it trying to write tiers. I give up. you win charlie. I want another Magic card but the backorder and the rom3 looping probably wont get one for a while. Wonder where else i could get one.

[wasup]

Well guess what. A subed to Mili's priv blocker and shazaam! First try. Mili.......I think....I....luv you. :p

[sukh77]

nice. Shit man Im happy for u. That's one stubbern rom3. If I had that card I wish that was the one that got looped yesterday.