How to get a box keys????

[weirdml]

Hi there,

I read a thread..., but I could not find it now. It said that we can read a box keys by using a remote control (memory dump). Is someone successful with it?

[j8.]

i think it depends what ird it is but im not positive

[normsbro]

you get the ird box key's by using a jtag (for those irds that can be jtagged) and the latest jkeys software, reading a unlocked rom 2,rom 3, rom 10, or rom 11 card thats marrried? with the ird with a iso programmer and nagra edit software, or there is a method for the grey box ird's where you use a voltmeter.

[j8.]

721s i got threw the remote

[j8.]

721 no jtag port u get keys threw remote i think only some newer irds this will work

[ecm_this]

You used to be able to get the boxkeys out of the IRD memory screen,but they closed that door at least 3 years ago.So unless your IRD hasn't been exposed to the stream since about January of 2001(if I remember right),you won't get it.But if it hasn't seen the stream in that long,I'll dig up the info on where it can be found.Should still have it around somewhere.

[j8.]

that could be my 721 were new in box never in stream

[ecm_this]

OK.Let me look around.I'll post it when I find it.

[ecm_this]

Aha!!
Now remember,this references a post from around 2000/01,so chances are they've fixed that loop.Needless to say,I don't take credit for this...it was posted by someone else.
The IRD memory dump method. This only works on pre-1999 new/used systems, which have not been exposed to the data stream. If your
IRD took a recent Firmware update the data that you require will be displayed with all “FF”. E* quickly closed this information hole once they found out
that us testers were benefiting from it. (You should still try this technique on your IRD regardless of its age and/or subscription status). To invoke the
memory dump screen point the remote at the IRD and press the following keys on the remote control sequentially:

MENU, 6, 3, INFO, RIGHT ARROW, LEFT ARROW.

If you can’t get to the EEPROM Dump screen to appear, turn OFF the IRD with the remote and repeat the above key sequence. Once you get the
information that you need, select “Cancel” to exit.

Use the example shown below to distinguish the location between your IRD# and the box keys. The IRD# will be at Non-Volatile Memory (NVM) location
0010. Be aware that your IRD# will be shown in hex and will be shown in reverse order such as (4D 3C 2B 1A). The IRD# should be entered in this
format (1A 2B 3C 4D). To convert your IRD# from hex to a decimal use the Windows calculator and set “View” to “Scientific” mode. Click on the “Hex”
button, enter the information you gathered from the EEPROM dump and then click on the “Dec” button to convert it. Your IRD number must be 10 digits
long, so if you are short digits just add zeros to the beginning of the number. Once you have converted your number, compare it with the number in the
rear of IRD, or the “System Info” screen on your IRD accessible with the remote control by pressing the “INFO” button.

Now again referring to the data example shown below, this time locate your box keys in the EEPROM’s data dump. Your keys will be at the end and at the
beginning of Non-Volatile Memory (NVM) sections 0010 – 0020. If you can locate the following 16 digits (8 bytes) then these will be your box keys!

Example: AAAAAAAA this is your IRD# in hex. BBBBBBBB BBBBBBBB these are your Box Keys.

NVM 0010: 00000000 00000000 AAAAAAAA BBBBBBBB

NVM 0020: BBBBBBBB 00000000 00000000 00000000

REMEMBER if your IRD took a recent firmware update, the data shown in the “A and B” fields above will be all “F’s”. E* quickly closed this information
hole once they found out that us testers were benefiting from it.

[j8.]

well good post i did not know this but it does say if ird was not in stream like mine were u can get them i got mine in a simular way but not eactly the same but close