Question on Rom 3 Unlocker Schematics

[Loopey1]

Hi all I found a file in the files section that I want to try it is the T-911 Loader Mod for Rom-3 Cards. the only problem I am having is that the diagrams are a little fuzzy and I am having a hard time trying to read them. Particularily the solder points on the top of the switch bank it looks like the 3 top right connections are bridged is this correct? or is it just the center one soldered to?

Thanks All

[Loopey1]

Crap Never mind all I just realized that they are all conected anyways.
Sorry for the Stupid Post.

[ME123]

HEY BUD when you get your working let us know how it runs and if you could take some pics thanks. i HAVE A HU LOADER but it doesnt have a atmeel chip how would i by pass this

[The Punisher!]

u can't bypass it ..it's needed.

[CYCO]

Can you mod other loader like mikibou and wildthing with the daughter board? also the absolute usb loader? Thanks

[Loopey1]

The Schematics and Pictures are in the files section under
rom3 Unlocker Glitcher2 by Penga.
I did try and build this mod on mine but it is acting like there is no power to the Card or something.
Executing Script: C:\Documents and Settings\Darren\Desktop\Dish\rom3unlocker-glitcher2 rev383 penga69 unlocker\3-TESTFILES\TESTglitchFIND.XVB
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data :

Script Error on Line 70
Sc.Read: Timeout Reading Data From Card - 2 Bytes Requested, 0 Bytes Read
This is the error I get all the time even when there is no Power Applied to the loader.

As you all can see there is no RX Data comming from the card.
I also did find that I made an error in my wiring the pics are not the best quality so I made the mistake of putting one of the wires on the wrong pin of the Atmel.

As the pic looks it is on the 3rd wire on bottem row BUT as it turns out it is the 4th pin. What if anything Might have I baked?

If someone else has this mod done and working could you please post pics of your work?
Thanks Again

[Loopey1]

IN HERE IS THE ASM AND THE HEX THAT NEED TO BE PUT ON TO THE LOADER 2313 CHIP

Question is How do I load the ASM file to the Atmel Chip? I am using XPAtmel.exe Ver 2.0 to load the Hex but How do I load the ASM file?? and what does this do?

[dbDan]

Loopey you only load the .hex. The .asm is the assembly source.

[Loopey1]

That is exactly what I thought but in the directions it stated that Both files were to be loaded to the chip. I was confused by this so I thought I would ask.
Thanks for the reply.

P.S. Still no luck on getting the modifyed HU T-911 Loader to work as a rom3 Unlocker yet Still Looking at the diagrams VS the Pics. still doesn't make sense to me why the diagrams say one thing and the pics show something completly different.

[debauche]

Pretty lousy pics....
The T911 is based on the Kypro-Tucker design.. one of the very first original designs, which is why it won't break any speed records. Anyone buying some of the more unknown glitchers, or un-cased glitchers will probably be able to follow along as many followed that design with usually only very small tweaks or useless ad-ons.

To anyone that has done this, what was used for the switch by the max232? Does anyone know why a pot, and not a 2.2K resistor used?

[smokeyman]

as the read me says, it may need adjusting if it doesnt glitch proper ,turning up or down

[JOE SNUFFY]

I am running win 98 and keep getting an error message when trying to use xpatmel.exe it says advapi32.dll does anyone know how to get that to stop. I tried putting the file into the rom11 pkg file but no luck. Will it work using win 98? Does someone have the file I need?
Thanks
Joe :cool:

[JOE SNUFFY]

I forgot to mention I :) am trying this loader upgrade so any help would be appreciated.
Joe

[lightning0009]

Has anyone done this mod to a kickass clone? I am thinking about trying it. Are these instuctions correct for this old H unlooper?

The easiest way to handle the 74HC4053 mod is to use a loader that all chips are in sockets. Remove both 74HC4053 form their sockets and on the 4053 that also handles clock (U6 of the Tuker schematic) bend to 90 degrees pins 1 and 13 and on the other 4053 (U7 of the Tuker schematic) bend to 90 degrees pin 1, 3 and 13. Now reinsert both 4053s noting to correctly insert U6 and U7 in their original place.

Get a piece of thin wire-wrapping wire, about 8 inch, and pre-tin all pins you bent to 90 degrees of the now reinserted 4053s and daisy-chain connect all pins. That is, connect pins 1 and 13 of U6 together with pins 1, 3, 13 of U7. Finally, connect all that to pin 1 of the LM358.

The purpose of this mod is to allow you to power the card from the op-amp and really is a dual purpose mod. First it will allow you to vary the working voltage to the card and secondly it servers to limit the current to the card. The recommended setting is somewhere around 3.7 volts DC (experiment but going under 3.4 VDC is not recommended). You can measure the voltage with any multimeter from pin 1 of the LM358 to ground. Pin 1 of the LM358 is positive and pin 4 of the LM358 is ground or use any accessible ground reference point you wish.

Please note that not all loaders are originally wired (routed) the same and damage to you :-) or your loader may occur if you don't know what you're doing or the loader you are attempting to modify is routed differently than the tucker schematic.

Before attempting any modification verify your loader conforms to the tucker schematic. If it doesn't or you are unsure PLEASE ASK in the forums for help. Ask politely and you should get all the help you need. If you need to ask for help be patient, have the make (name brand) of your loader handy and be prepared to answer questions about your hardware. Get familiar with both your hardware and the Tuker schematic before you start asking questions.

PS. The code compiles with Atmel AVR Studio and a compiled version (newd.hex) is also included. Flash any AT90S2313-10 with newd.hex, modify your loader, apply the card test code to a good functioning Rom3 card and run the script, to test the validity of this code and loader modification.

Good luck all!
no1b4me

[Loopey1]

Mr. Snuffy XPatmel is designed to be used with WinXP I think. Correct me if I am wrong but there is DOS/Win9X software in the files section also.

[JOE SNUFFY]

If their is a file that will allow you to flash your loader with the current hex file for this mod using win 98 please let me know what it is.
Thanks
Joe

[jimmyhat]

i can'y even figure out how to get xp flash to flash the file into the loader. it keeps telling me i need .exe files to do it, and i don't know how to get the files. can anyone help me please?

[Loopey1]

Exactly What file of files is it asking for. What Loader are you trying to flash?
What OS are you using?

I have XP Pro and XPFlasher 2.0 works everytime no problems.
Win9X users need a differenf Flasher Program I think. I might Have one arround let me look for it and if I find it I will post it here OK.

[Loopey1]

Now for the BIG Question Has anyone got this mod to work?
I tried it going off the pic and I failed at it thinking that I fraged my loader I Un-Modded it and tested it on a HU card Works fine so there must be some other problem.

HELP!!!

[chep]

I know several(3) peeps on another forum that have modified the t911 clone and have unlocked over 20 ROM3s so far. It does work but I have not tried it yet as my t911 is an original and the layout is different from the one pictured! :(

[JOE SNUFFY]

Exactly What file of files is it asking for. What Loader are you trying to flash?
What OS are you using?

I have XP Pro and XPFlasher 2.0 works everytime no problems.
Win9X users need a differenf Flasher Program I think. I might Have one arround let me look for it and if I find it I will post it here OK.


I am using windows 98 if you have a program that would work I would be greatful.
Thanks
Joe

[jimmyhat]

i finally figured out how to get the .exe flashes. i flashed the loader and it actually does glitch the cards. i now just need an open rom 3 to test with. ibeen trying to test with a dssrev, but it will not work. the red led lights up and the loader goes into glitch mode, but the led's on the dss rev card don't come on so the loader faults out. i think when i find an open rom 3 to tune it with, and set it up the way penga says to, it will work. but, remember one thing. penga and noneb4me are very smart peeps. fact is they know their shit. i have to trust anything that comes by way of them. panga and crew from card coders rule!!!!!!! my hat is off to you guys.

[dell1234]

When someone gets the mod complete, and has it actually working, please make some good clear-cut pics and post. Thank you in advance. I just cant see how to modify it clearly from the pics in there, and not gonna risk messing my T911 up when it can be used on rom11. I sure hope this mod will unlock A23 r10's soon.

[Compucents]

Penga69 says it will unlock streamed ROM 10's with the same mods. We only need to flash the Atmel with newd7.hex. I can't seem to find it anywhere, not even at CC where he makes these statments. Seems like it should be out soon though.

I got 3 of 3 streamed ROM 3's unlocked so if it does this well for ROM 10's we're in luck.

[indal_98]

Penga69 says it will unlock streamed ROM 10's with the same mods. We only need to flash the Atmel with newd7.hex. I can't seem to find it anywhere, not even at CC where he makes these statments. Seems like it should be out soon though.

I got 3 of 3 streamed ROM 3's unlocked so if it does this well for ROM 10's we're in luck.

Yeah that's what I'm waiting for too ...

Got a couple of A23 here to unlock....383's is no problem now....

At least Penga/No1 got us the hardware....let's hope they'll keep on working on firmware..

[moparman]

I think someone needs to modify some of the T911 loaders and sell them to the ones like me that can't really see good enough to modify one. Thanks moparman

[jimmyhat]

i don't know if i am supposed to post this, but, i'll mod t911's for peeps if they wanna send em to me. i will not charge either. i only ask that the peeps that send em send enough quid to return them through usps.

[Loopey1]

I remade this Mod Last night and I am getting the same error that I got the first time. So as it sits now I am thinking that maybe I flashed it wrong. I am using XPFlasher 2.0 and it seems to flash correctly but I am still not getting it to work.

The people that Have this working Please Please show me what I might have done wrong. I have the T-911 Clone as in the pic followed the pictures Exactly
Flashed with the NewD6.hex in XPFlasher. Said programed OK
Start WinExp try runnig script and I get this error

rev383 penga69 unlocker\3-TESTFILES\TESTglitchFIND.XVB
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data :

Script Error on Line 70
Sc.Read: Timeout Reading Data From Card - 2 Bytes Requested, 0 Bytes Read

I followed the directions to the T
Switch set to 2 and 5 on rest off
5K pot set to 2.2k
Com 1
Loader2 settings in WinExp 5.0
the added Flash programing switch is open while trying script
closed to Flash only
Green LED is removed
Power is at 12 Volts incomming
I am stuck. I also tried moving the pot small moves both directions trying to get glitch Nothing same error all the time no change.

The "TEST" card is an open rom 3 at rev 381 with the testglitch bin loaded.

[indal_98]

rev383 penga69 unlocker\3-TESTFILES\TESTglitchFIND.XVB
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data :



Sounds to me the Atmel wasn't flashed ....

XPflasher takes TWO files to flash something...
--an initialize file ...usually 1K.
--actual flash image....usually 6K.

Penga's flash is 4K....and it does not come with an initialize file.

I believe there is another XPflasher program out there that would let you flash a single flash file. If not then you have to use something like fpr16 or something like that ...forgot the name.

In the mean time try this.....
--Copy the flash file to XPflasher folder.
--Open up XPflasher.
--Choose/Load the flash.
--Right click in the MIDDLE bar of XPflasher, a hidden menu will come up.
--Choose 60/50/1 (forgot the name of the boxes but you'll see them).
--Click on Program.

Watch the scrolling screen carefully...if there's any error....XP will continue anyway.
I believe you'll see an error like "........expected xxx but not found...."

g'l

[Loopey1]

You are EXACTLY Correct I just for giggles tried to flash again and it went SO FAST
so I thought I would try the ecoboot flash and nice and slow then I ran the Script and it is trying to glitch so YES the Flash file for the loader is messing me UP. Thanks for the reply

Now does anyone know how to MOD the flash file to work with XPFlasher?
I am also going to build the Programmer for fbprg16 so I hope it works now.

[indal_98]

You are EXACTLY Correct I just for giggles tried to flash again and it went SO FAST
so I thought I would try the ecoboot flash and nice and slow then I ran the Script and it is trying to glitch so YES the Flash file for the loader is messing me UP. Thanks for the reply

Now does anyone know how to MOD the flash file to work with XPFlasher?
I am also going to build the Programmer for fbprg16 so I hope it works now.

Glad I could help you....

Eventually you'll get it to work to unlock 383 and hopefully by that time Penga came out with flash to unlock A23 ....

In the mean time when you get it to work you'll be asking yourself the same question as the rest of us succeeded with the mod ..." run the card with or without blocker? .." ...

Charlie's ECM does use blocker as a stool to get to the next command to loop card...So to run the card without blocker may help...but what if he rev's up to 385?

So far I run one cam without blocker and I had unlocked it many times just to try the mod'ed T911..

Who knows.......right..?

G'L

[tweed]

hey guys i cant get test file beyond line 152 and been tring to get in to rev383 with no luck yet it keeps cycling and says try to hit bug at 10a2 to 10a7 and has 0f6 after that ??????any help would be helpfull??????

[Compucents]

Are you using an open ROM 3 with testglitch.bin on it and running testglitchfind.xvb? The 06f data returned is what you get when trying to unlock a closed card. You need to dial in your loader before attempting to unlock anything.

Also try posting the start of your log. It helps to see what is displayed for
TX Data: xx xx
TX Data: xx xx xx xx xx xx xx

[Compucents]

You are EXACTLY Correct I just for giggles tried to flash again and it went SO FAST
so I thought I would try the ecoboot flash and nice and slow then I ran the Script and it is trying to glitch so YES the Flash file for the loader is messing me UP. Thanks for the reply

Now does anyone know how to MOD the flash file to work with XPFlasher?
I am also going to build the Programmer for fbprg16 so I hope it works now.


I had the same problem. Using UFP16 I was able to flash the thing correctly. Don't build the Atmel programmer... flash it while in the loader. Try this out. I couldn't seem to get the file to upload in the files section so I will leave it here for a day or so. I will try again to get it into the Dish ROM Files section to keep the thread clean.

[Loopey1]

Is it supposed to look like this???
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 07 1B
RX Data : 0C FF 95 00 FF 91 81 71 64 47 00 44 4E 41 53 50
30 30 33 20 52 65 76 33 37
OVERFLOW WAS SENT TO 00 E050, READ CAM LATER WITH NAGRA EDIT TO SEE E050
CHANGED FROM FF TO 00. IF IT DID WE KNOW OVERFLOW IS WORKING.
AAAAAAAAFFFFFFAAAAAAAAAAAAFFAAAAAAAAAAAAFFAAFFAAAA AAAAFFAAFF--- try to hit 0C bug at 10A5
FFAAAAAAAAAAFFFFFFAAAAAAAAAAFFAAFFAAAAAAAAAAFFAAAA AAAAAAAAAAFF--- try to hit 0C bug at 10A6
AAFFAAAAAAFFAAFFFFFFAAAAAAAAAAFFAAFFAAAAAAAAFFFFAA FFAAAAAAAAAA--- try to hit 0C bug at 10A7
FFFFFFAAAAAAAAFFAAFFFFAAAAAAAAAAAAFFFFAAAAAAAAFFFF FFFFAAAAAAFF--- try to hit 0C bug at 10A8
FFFFFFAAAAAAAAAAFFAAFFFFAAAAAAAAAAAAFFFFAAAAAAAAAA FFFFFFAAAAAA--- try to hit 0C bug at 10A9
AAAAFFFFFFAAAAAAAAAAFFFFAAAAAAAAAAFFFFFFFFAAAAAAAA AAFFFFAAAAAA--- try to hit 0C bug at 10AA
AAAAAAFFFFFFAAAAAAAAAAFFAAFFAAAAAAFFFFFFFFFFAAAAAA AAAAFFFFAAAA--- try to hit 0C bug at 10AB
AAAAAAAAFFFFAAAAAAAAAAAAFFFFFFAAAAAAAAAAFFAAFFAAAA AAAAFFFFFFFF--- try to hit 0C bug at 10AC
AAAAAAAAAAAAAAAAAAAAAAAAAAFFFFFFAAAAAAAAAAFFFFFFAA AAAAAAAAFFAA--- try to hit 0C bug at 10AD
FFAAAAAAAAFFAAFFFFAAAAAAAAAAFFFFAAAAAAAAAAAAAAFFFF AAAAAAAAAAFF--- try to hit 0C bug at 10AE
FFAAAAAAAAAAAAFFFFFFAAAAAAAAAAAAFFFFAAAAAAAAFFFFFF FFAAAAAAAAAA--- try to hit 0C bug at 10AF
FFFFAAAAAAAAAAAAAAFFFFAAAAAAAAAAFFFFAAAAAAAAAAAAFF FFFFAAAAAAAA--- try to hit 0C bug at 10B0
FFFFFFAAAAAAAAFFAAFFFFAAAAAAAAFFAAFFFFFFAAAAAAAAAA FFFFFFAAAAAA--- try to hit 0C bug at 10B1
AAAAAAFFFFAAAAAAAAAAAAFFFFAAAAAAAAFFFFFFFFAAAAAAAA AAFFAAFFAAAA--- try to hit 0C bug at 10B2
AAAAAAFFAAFFAAAAAAAAFFFFFFFFAAAAAAAAAAFFFFFFAAAAAA AAAAFFFFFFAA--- try to hit 0C bug at 10B3
AAAAAAFFFFFFFFAAAAAAAAAAFFFFAAAAAAAAAAAAFFFFFFAAAA AAAAFFFFFFAA--- try to hit 0C bug at 10B4
AAAAAAAAFFFFFFFFAAAAAAAAFFAAFFAAAAAAAAAAAAFFFFFFAA AAAAAAAAAAAA--- try to hit 0C bug at 10B5
FFAAAAAAAAAAFFFFFFAAAAAAAAFFFFFFFFAAAAAAAAAAAAFFFF AAAAAAAAAAFF--- try to hit 0C bug at 10A2
FFAAAAAAAAAAFFAAFFFFAAAAAAAAAAFFAAFFAAAAAAAAAAAAFF FFAAAAAAAAAA--- try to hit 0C bug at 10A3
FFFFAAAAAAAAAAAAAAFFFFAAAAAAAAFFFFFFFFAAAAAAAAFFFF FFFFAAAAAAAA--- try to hit 0C bug at 10A4
AAFFFFFFAAAAAAAAAAFFFFFFAAAAAAAAAAFFFFFFAAAAAAFFAA FFFFFFAAAAAA--- try to hit 0C bug at 10A5
AAAAFFFFFFAAAAAAAAAAFFFFAAAAAAAAAAAAAAFFFFAAAAAAAA FFFFFFFFAAAA--- try to hit 0C bug at 10A6
AAAAAAFFFFFFAAAAAAAAFFAAAAAAAAAAAAAAAAFFFFFFAAAAAA AAAAAAFFFFAA--- try to hit 0C bug at 10A7
AAAAFFAAFFFFFFAAAAAAAAAAAAFFFFAAAAAAAAFFFFFFAAAAAA AAAAAAFFAAAA--- try to hit 0C bug at 10A8
AAAAAAAAAAFFFFFFAAAAAAAAAAAAFFAAAAAAAAAAAAFFFFFFAA AAAAAAAAFFFF--- try to hit 0C bug at 10A9
FFAAAAAAAAFFAAFFFFAAAAAAAAAAFFFFFFAAAAAAAAAAFFFFFF

Script Error on Line 142
Sc.Read: Timeout Reading Data From Card - 2 Bytes Requested, 0 Bytes Read

[tweed]

hey guys how long does it tate to glich into card?

[tweed]

got test card to run tring lock card how long should i let it run?

[jimmyhat]

oh hell, just use these files to flash your loader with. they worked in mine.

[debauche]

I would suggest flashing Atmels prior to mod, although it shouldn't make a dif.

No-one has answered, even the successful ones who modded, is what is the switch by the 232 in the schematics? The rest is straightforward, but it looks on the schematic to be a toggle and that makes no sense.

[Loopey1]

The Switch is for entering ATMEL flashing only Closed to Flash Open to glitch.

[chep]

Here is some pics for you guys from another site that I belong to. The guys there was nice enough to make some clearer pics..Hope it helps you out.

chep

[Loopey1]

HOLY SHIT IT WORKS!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!11
I just opened a rom 3 rev 383 that was used in a 7200 and I was able to read all the info Box Keys and everything THANK GOD for you penga69 and No1B4me
Thank God for you!

[Loopey1]

OK now I am Super impressed, I just got done with 3 rom 3 cards that I thought I had screwed they are all back from the dead YES!!! :D

[dell1234]

Does the 5k trimmer ground to the board??? Thx for the pics dude, they were great. :)

[Loopey1]

No just connect center of pot to leg 4 and eather side to leg 7 third leg is left alone.

:heads_or_

[dell1234]

Executing Script: C:\Documents and Settings\Dell1\Desktop\Rev383\unlockrom3.XVB
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : F7 EF
RX Data : FB DF FD FB DB FF

Script Error on Line 79
Sc.Read: Timeout Reading Data From Card - 25 Bytes Requested, 6 Bytes Read

I just dont know, lol

[tung718]

Where can I get the 5K trimmer at? Please help. I did mod my t911 to exact excpet needing the 5K trimmer. Do i even need to solider the 5K trimmer? Will it work with out it? Please help....I would really like to unlock 3 of my rom 383 cards.

Thank you.

[smokeyman]

Where can I get the 5K trimmer at? Please help. I did mod my t911 to exact excpet needing the 5K trimmer. Do i even need to solider the 5K trimmer? Will it work with out it? Please help....I would really like to unlock 3 of my rom 383 cards.

Thank you.
you will need a trimmer. as adjustments will have to be made to get it to work correctly, had mine going then i believe i smoked it somehow as i cant get my test bin to work without all AAAAAAAAAAA,s

will visit my electronics store tihs morning for another one

and solder will have to be used to hold it, :o)

[jimmyhat]

Where can I get the 5K trimmer at? Please help. I did mod my t911 to exact excpet needing the 5K trimmer. Do i even need to solider the 5K trimmer? Will it work with out it? Please help....I would really like to unlock 3 of my rom 383 cards.

Thank you.
radio shit, ooops i mean radio shack. lol. they have the 5k trimmers. a small package of surface mount trimmers in various values was only 3.00.

[tung718]

Once i get the 5K trimmer will i be able to flash my loader. Right now with out the 5k Trimmer i'm unable to flash my loader is that normail?

Hopefully this will work for me.

[Loopey1]

The trimmer has nothing to do with flashing.
That is just for VCC adustments.
the flash will only work if the switch is closed. (the one that you added to the loader)
I also had luck just adding a 2.2k resistor to the loader in place of the trimmer.
then I used the VCC settings in the script to get the glitch working.
(Works in a pinch)

[kipper5k]

Hi,
i have what appears to be a newer revision T911. the schematics are not the same as the one posted with the 383 fix. Does anyone have the schematics for the newer board who is willing to share. (I can post the pics of my version if anyone interested)

thanks in advance

kipper

[jasperwiggins]

how do you guys get the aaaaaaaaafffff stuff? all mine does is try to hit oc bug at 10b2,10b3,and so on but no fffaa stuff.plz help and thanks.

[Loopey1]

Well let me see aaaaafffffaaaaafffff?????
I am going to say that this is with your voltage adjustments...... just a hunch here now for shure what that could be.

If you open the folder containing the scripts there is a discription on what it is supposed to do.

it is the .wpd file (wordpad)
read in there might give you some clues. Sorry I am not nuch help.
I can tell you this the unlocker script looks WAY different that the testglitch one when it is running.....

[Fro66er]

Is it supposed to look like this???
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 07 1B
RX Data : 0C FF 95 00 FF 91 81 71 64 47 00 44 4E 41 53 50
30 30 33 20 52 65 76 33 37
OVERFLOW WAS SENT TO 00 E050, READ CAM LATER WITH NAGRA EDIT TO SEE E050
CHANGED FROM FF TO 00. IF IT DID WE KNOW OVERFLOW IS WORKING.
AAAAAAAAFFFFFFAAAAAAAAAAAAFFAAAAAAAAAAAAFFAAFFAAAA AAAAFFAAFF--- try to hit 0C bug at 10A5
FFAAAAAAAAAAFFFFFFAAAAAAAAAAFFAAFFAAAAAAAAAAFFAAAA AAAAAAAAAAFF--- try to hit 0C bug at 10A6
AAFFAAAAAAFFAAFFFFFFAAAAAAAAAAFFAAFFAAAAAAAAFFFFAA FFAAAAAAAAAA--- try to hit 0C bug at 10A7
FFFFFFAAAAAAAAFFAAFFFFAAAAAAAAAAAAFFFFAAAAAAAAFFFF FFFFAAAAAAFF--- try to hit 0C bug at 10A8
FFFFFFAAAAAAAAAAFFAAFFFFAAAAAAAAAAAAFFFFAAAAAAAAAA FFFFFFAAAAAA--- try to hit 0C bug at 10A9
AAAAFFFFFFAAAAAAAAAAFFFFAAAAAAAAAAFFFFFFFFAAAAAAAA AAFFFFAAAAAA--- try to hit 0C bug at 10AA
AAAAAAFFFFFFAAAAAAAAAAFFAAFFAAAAAAFFFFFFFFFFAAAAAA AAAAFFFFAAAA--- try to hit 0C bug at 10AB
AAAAAAAAFFFFAAAAAAAAAAAAFFFFFFAAAAAAAAAAFFAAFFAAAA AAAAFFFFFFFF--- try to hit 0C bug at 10AC
AAAAAAAAAAAAAAAAAAAAAAAAAAFFFFFFAAAAAAAAAAFFFFFFAA AAAAAAAAFFAA--- try to hit 0C bug at 10AD
FFAAAAAAAAFFAAFFFFAAAAAAAAAAFFFFAAAAAAAAAAAAAAFFFF AAAAAAAAAAFF--- try to hit 0C bug at 10AE
FFAAAAAAAAAAAAFFFFFFAAAAAAAAAAAAFFFFAAAAAAAAFFFFFF FFAAAAAAAAAA--- try to hit 0C bug at 10AF
FFFFAAAAAAAAAAAAAAFFFFAAAAAAAAAAFFFFAAAAAAAAAAAAFF FFFFAAAAAAAA--- try to hit 0C bug at 10B0
FFFFFFAAAAAAAAFFAAFFFFAAAAAAAAFFAAFFFFFFAAAAAAAAAA FFFFFFAAAAAA--- try to hit 0C bug at 10B1
AAAAAAFFFFAAAAAAAAAAAAFFFFAAAAAAAAFFFFFFFFAAAAAAAA AAFFAAFFAAAA--- try to hit 0C bug at 10B2
AAAAAAFFAAFFAAAAAAAAFFFFFFFFAAAAAAAAAAFFFFFFAAAAAA AAAAFFFFFFAA--- try to hit 0C bug at 10B3
AAAAAAFFFFFFFFAAAAAAAAAAFFFFAAAAAAAAAAAAFFFFFFAAAA AAAAFFFFFFAA--- try to hit 0C bug at 10B4
AAAAAAAAFFFFFFFFAAAAAAAAFFAAFFAAAAAAAAAAAAFFFFFFAA AAAAAAAAAAAA--- try to hit 0C bug at 10B5
FFAAAAAAAAAAFFFFFFAAAAAAAAFFFFFFFFAAAAAAAAAAAAFFFF AAAAAAAAAAFF--- try to hit 0C bug at 10A2
FFAAAAAAAAAAFFAAFFFFAAAAAAAAAAFFAAFFAAAAAAAAAAAAFF FFAAAAAAAAAA--- try to hit 0C bug at 10A3
FFFFAAAAAAAAAAAAAAFFFFAAAAAAAAFFFFFFFFAAAAAAAAFFFF FFFFAAAAAAAA--- try to hit 0C bug at 10A4
AAFFFFFFAAAAAAAAAAFFFFFFAAAAAAAAAAFFFFFFAAAAAAFFAA FFFFFFAAAAAA--- try to hit 0C bug at 10A5
AAAAFFFFFFAAAAAAAAAAFFFFAAAAAAAAAAAAAAFFFFAAAAAAAA FFFFFFFFAAAA--- try to hit 0C bug at 10A6
AAAAAAFFFFFFAAAAAAAAFFAAAAAAAAAAAAAAAAFFFFFFAAAAAA AAAAAAFFFFAA--- try to hit 0C bug at 10A7
AAAAFFAAFFFFFFAAAAAAAAAAAAFFFFAAAAAAAAFFFFFFAAAAAA AAAAAAFFAAAA--- try to hit 0C bug at 10A8
AAAAAAAAAAFFFFFFAAAAAAAAAAAAFFAAAAAAAAAAAAFFFFFFAA AAAAAAAAFFFF--- try to hit 0C bug at 10A9
FFAAAAAAAAFFAAFFFFAAAAAAAAAAFFFFFFAAAAAAAAAAFFFFFF

Script Error on Line 142
Sc.Read: Timeout Reading Data From Card - 2 Bytes Requested, 0 Bytes Read

If you get the Script Error on line 142, that can be a few things.

1) the pot is not adjusted correctly - try 2.2k Ohms and use a 10 turn pot is possable. sometimes even the slightest difference in resistance will correct this problem. 2.2K might not work, but 2.295K Ohms might. THats why a 10 turn pot works nicely.

2) do not do anything else with computer while unlocking - try not to even move mouse. I don't care how fast your computer is OR how much RAM is in the machine, just let the script fly by itself.

If your getting FFAAAAAAAFFAAAAAAA, then you've probably done the hardware mod correctly, and just need to adjust the 5K pot ever-so slightly from 2.2K if you keep gerring the line 142 error.

Read the script and make minor changes to it. See if that helps elivate the 142 line error.

Good luck

[debauche]

Well I have tried mods, left wires long enough to reverse 4053's and try different combinations and all I get is

Timeout from 2A command

Trying to see if it is hardware still...
No-where in the actual mod files does it talk of cutting traces... but every picture I have seen shows a few cuts. For those of us without 911's, but based on Kypro, can someone post the traces to cut as in "cut trace from pin X on xxxx to pinX on xxxx"...etc..?
thnx

[Loopey1]

Um in the mod files there is a schematic that shows all of the different lines that have to be added. and the new points to where they go. If your Loader is based on the tucker one then that should work for you. The pics are for the T-911 Clone board so the schematics and the pics are not going to match.
I have a T-911 Clone so I used the pics and it works fine Poped 3 cards in 15 min.
I guess if yours is different you will have to just trace out the pionst that corrispond to your loader and go from there.

Sorry I am not much help.

[moses]

What does switch 5 do. I see on the schematic that there are only 4 legs on the switch. For non 911 loaders where does the lead come from for switch 5.

[HDTV MAN]

Here is some pics for you guys from another site that I belong to. The guys there was nice enough to make some clearer pics..Hope it helps you out.

chep


Nice PIC's.

Mili,

Can this be done with the "AIO"

thanx

[lousydog]

i have a new t911 does someone know how to nod this one thank you

[mk14er]

i just have two questions please help

1. switch to programmer : is this just on off switch?

2> whatdoes this switch do or when should i use it?

[Compucents]

The switch is a SPST (single pole single throw) toggle. Closed is for programming the Atmel part (called flashing the Atmel) and open is for normal glitch mode to unlock your card.

[mk14er]

exactly what i needed to here

and thakns for pics posted earlier my

glitcher working perfect

[Fro66er]

If you mod your unlooper for ROM03, it will also work for ROM10's now.

[Fro66er]

i have a new t911 does someone know how to nod this one thank you

After viewing your photos, I don't see two 74HC4053's. For the conversion to work, you need two 74HC4053's on the board.

Check for two 74HC4053's on your T911

Good luck

[tulsaemt]

those chips are under the card holder. try holding at an angle and look under the card holder

[gatesy]

TX Data : A0
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data :

Script Error on Line 78
Sc.Read: Timeout Reading Data From Card - 2 Bytes Requested, 0 Bytes Read
can anyone help me with this?please

[gatesy]

TX Data : A0
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : EF FF
RX Data : FF BA AA FE FE FF FF FF BE AA FF FE AE FF FE FE
AA FF FE BE FF FF FE FF FF
TX Data : 12 15 AB 21 00 08 A0 CA 00 00 02 12 00 06 55 0E
03 85 00
RX Data : FF FF
RX Data : FF FF FF FF FF FF

Now we will try 123E delay
FFBEFAFFFEFFFFFFFFFEFEFFFFFFFFABFFFFFFFEFFFFFFFFFE FFFFFFFFFFFFFFFFFFFFFFFEFEFFFFFFBEFFFFFEFEFFFFFFFF FFFFFFFFFFFFFFFFFFFEFFFFFFFEFF

Script Error on Line 124
Sc.Read: Timeout Reading Data From Card - 2 Bytes Requested, 0 Bytes Read
after restarting computer this is what i got now,anyhints on what is wrong?

[Loopey1]

That Looks like your voltage is off some Remember Verry Small Adjustments to the pot. Use Ohm meter and try going by 1/2 Ohm incriments.
Looks like tour getting there though.

Keek on trying. Took me like 2 days to get it set right.
Oh and this worked for me When doing adjustments close and restart WinExp between adjustments.

Seemed to get better results on test file if it was a first time run every time.

[rooferman]

HELP !! Did mod to t-911 loader, same as the one in pics. but now i can't flash the loader. keeps telling me "can't find active atmel" can anyone help me. checked and rechecked mod but everything is the same as the mod pics. that are shown. Ran the unlock file to see if it would glitch and seems like it is workin properly i think except i got the HU flash on atmel.

[kipper5k]

Hi,
I have a diferent t911 than one modded here. I have the after mod schematic that was included in the zip but i need the before mod schematic so i can see paths that need to be cut and to check for comparisons etc. If you have it can you post it please. :)

Thanks

[mk14er]

i did the mode exactly as showed

i flashed no prob the flipped switch

i then applied bin to good rom 3 card

went to run test scripts but just get all ffffffffffffffffffffffffffffffffffffffffffffffffff fffffffff`s

no a`s

any ideas what im doing wrong


only thing they i may have done wrong is on the three trace cuts on the 74hc chip
i donot have the one in the middle on my board i only have two traces

can you help

[lightning0009]

Here is the original tucker schematic.

[CYCO]

I thiught i modded loader right but when i run the test glitch file in winex
this is as far as it goes. and what are the dip switches susposed to be set at? It is a T911 but it is different than the one in the mod pic.
This is what test glitch reads.any suggestion?

Executing Script: C:\Documents and Settings\Owner\Desktop\383\3-TESTFILES\TESTglitchFIND.XVB
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 07 1B
RX Data : 3F FF 95 00 FF 91 81 71 64 47 00 44 4E 41 53 50
30 30 33 20 52 65 76 33 38
OVERFLOW WAS SENT TO 00 E050, READ CAM LATER WITH NAGRA EDIT TO SEE E050
CHANGED FROM FF TO 00. IF IT DID WE KNOW OVERFLOW IS WORKING.

===========================================
VCC = 22-0710A4 GLITCHED past 0C BUG
3FFF9500
===========================================
0033FF

[JOE SNUFFY]

Hello,
In the directions it says to load the asm and the hex also. I can get the hex to load to the 2313 chip but what do I do with the asm?
Thanks
Joe

[lightning0009]

Joe, if you read this whole thread, your answer is up on post number eight.

[CYCO]

i did the mode exactly as showed

i flashed no prob the flipped switch

i then applied bin to good rom 3 card

went to run test scripts but just get all ffffffffffffffffffffffffffffffffffffffffffffffffff fffffffff`s

no a`s

any ideas what im doing wrong


only thing they i may have done wrong is on the three trace cuts on the 74hc chip
i donot have the one in the middle on my board i only have two traces

can you help That trace in the middle on my board is real real real hard to see but it is there. Or you might need to adjust the pot put more resistance on. hope that helps. i am kind of stuck myself right now

[CYCO]

If you get the Script Error on line 142, that can be a few things.

1) the pot is not adjusted correctly - try 2.2k Ohms and use a 10 turn pot is possable. sometimes even the slightest difference in resistance will correct this problem. 2.2K might not work, but 2.295K Ohms might. THats why a 10 turn pot works nicely.

2) do not do anything else with computer while unlocking - try not to even move mouse. I don't care how fast your computer is OR how much RAM is in the machine, just let the script fly by itself.

If your getting FFAAAAAAAFFAAAAAAA, then you've probably done the hardware mod correctly, and just need to adjust the 5K pot ever-so slightly from 2.2K if you keep gerring the line 142 error.

Read the script and make minor changes to it. See if that helps elivate the 142 line error.


Good luck

I get exactly that when i run the test script. also i only have number 2 dip on in the 6 dip switch. when i put 5 on it wont glitch at all. I thought 2 and 5 were susposed to be on. Any ideas here peeps? Thanks

[apayrits]

i don't know if i am supposed to post this, but, i'll mod t911's for peeps if they wanna send em to me. i will not charge either. i only ask that the peeps that send em send enough quid to return them through usps.

I will send you one if you send me your address & about how much postage will be.. Can you also flash it for me? Thanks in advance..Alex

[jimmyhat]

ok guys here's one for ya'll. i got one of the original t911's done, and it rox. a buddy of mine just brought me a newer t911. one with no dip switches. anyone done any of those? or anyone know what schematic to use for that? i sure would like to be able to do the mod with it.

[lightning0009]

Here is how I modded my Kickass Clone H card unlooper so it would be able to unloop dish rom 10 rev a23's. Pull out the max232 chip and bend leg 10 up. Solder the bent up leg to one side of a switch. Solder from underneath the board on leg 10 to the other side of the switch. With the switch closed you can program your atmel, with it open, you can unlock cards. Now take out the 74HC00N chip. Bend legs 4 and 9 up. Solder a wire to leg 4 and run it to leg 18 of the amtel 2313. Now solder a wire to pin 9 of the 74HC00N and run it to pin 9 of the 74HC74AN. Now you can hook one of the outer legs of your 5k pot to pin 7 of the 74HC4053 chip(not the other 74HC4053) that is closest to the atmel 2313 chip. Hook the middle leg of the 5k pot to pin 4 of the same 74HC4053. Ok, you are now done with the mods to the top side of the kickass clone unlooper. On the bottom side, solder a wire from pin 14 of the 2313 atmel to pin 13 of the 74HC00N. Now solder a real short one from pin 9 to pin 12 of the 74HC00N. Now solder a wire from pin 11 of the 74HC00N to pin 11 of the same 74HC4053 chip that you hooked your 5k pot to. I was able to unlock a stream locked rom 10 a23 with switch 4 on.



Executing Script: C:\winexplorer5\Rom10-A23 OPENworks.XVB
TX Data : A0
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 06 00
TX Data : 12 15 AB 21 00 08 A0 CA 00 00 02 12 00 06 55 0E
03 85 00
RX Data : 11 00

Now we will try 1252 delay
RESET FFFFFFFFFFFF6F6F6F6FFFFFFFFFFF6FFFFFFFFFFFFF6F6FFF FF RESET FFFFFF6F6F6FFFFFFFFFFFFF6FFF6F6FFFFFFF6FFFFFFFFFFF FFFF6FFFFFFFFFFFFFFF6F6FFFFFFFFFFFFF6FFFFFFF6FFFFF FF6FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF6FFFFFFF6FFFFFFF FFFFFFFFFFFFFFFF6F6FFF6FFFFFFFFF6F6F6FFFFFFFFFFF6F FFFFFFFFFFFFFF6F6F6FFFFFFFFFFFFFFFFFFFFFFFFFFFFF6F FFFFFFFFFFFFFFFFFFFFFFFFFFFFFF6FFFFFFFFFFFFF6F6F6F FFFFFFFFFFFFFFFFFFFFFFFFFF6F6FFFFFFFFFFFFF6F6FFFFF FFFFFFFFFF6FFF6FFFFFFFFFFFFFFFFFFFFFFFFF6F6F6FFFFF FFFFFFFFFFFFFFFFFFFFFF6F6F6FFFFFFFFFFF6FFFFF6FFFFF FFFF6FFFFFFFFFFFFFFFFF6FFFFFFFFFFFFF6FFFFFFFFFFFFF FF6FFFFFFFFFFFFFFF6FFFFFFFFFFFFFFF6FFF6F RESET FFFFFFFF
now we will try 1253 delay
6FFFFFFFFF6FFFFFFF6FFFFFFFFFFFFF6FFFFFFFFFFFFFFFFF 6F6FFF RESET FFFFFF6F6FFFFF6FFFFFFFFF RESET FFFFFFFFFFFF6F6FFFFFFFFFFFFFFF6FFFFFFFFFFFFFFF6FFF FFFF6FFFFF6F6FFFFFFFFFFFFFFFFFFFFFFFFFFFFF RESET 6FFFFFFFFFFFFF6F6FFFFFFFFFFFFF6F6F6FFFFFFFFFFF6FFF FFFFFFFFFFFFFFFF6F6FFFFFFFFFFFFFFFFFFFFFFFFF6FFFFF 6FFFFFFFFF6FFFFFFFFFFFFFFF6F6FFFFFFFFFFFFF6FFF6FFF FFFFFFFFFF6FFFFFFFFFFFFF6FFFFFFFFFFFFFFFFF6FFFFF6F FFFFFFFF6FFFFFFFFFFFFF6FFFFFFFFFFFFFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF FFFFFFFFFF6FFFFFFFFFFFFFFFFFFFFFFF6FFFFFFFFFFFFFFF 6FFFFFFF6FFFFFFFFF6FFFFFFF6FFFFFFF6FFFFFFFFFFFFF6F FFFFFFFFFFFFFFFF6F6FFFFFFFFFFF
now we will try 1254 delay
6F6FFFFFFFFFFFFF6FFF RESET 6FFFFFFFFF6F6FFF6F6FFFFFFF6FFF6FFFFFFFFFFF6F6F6F6F FFFFFFFF6F6F6F6FFFFFFFFF6FFFFF6FFFFFFFFF6FFF6F6FFF FFFFFF6F6F6FFF6FFFFFFF6F6FFFFFFFFF6FFF6FFFFF6F6FFF FFFF6FFFFFFFFFFFFFFF6FFF6FFFFF6FFFFF6FFF6FFF6FFFFF FF6F6F6FFFFF6FFFFF6F6FFFFF6FFFFFFF6F6FFF6FFFFF6FFF 6F6F6F6F6FFFFFFF6F6FFFFFFF6F6FFFFFFFFFFFFFFF6FFF6F FF6FFF6FFF6FFF6F6F6FFF6FFFFFFF6F6F6F6FFFFFFFFF6F6F 6FFF RESET FFFFFF6F6FFFFF6F6FFFFF6F6FFF6FFF6FFFFF6F6FFFFF6FFF FFFF6FFF6FFF6FFFFFFF6F6F RESET FFFFFFFF6F6FFF6FFFFFFFFFFF6F6FFFFFFFFFFFFF6F6F6FFF FFFFFFFF6F6F6F6FFFFF6FFF6F6F6FFFFFFFFFFF6F6F6F6FFF FFFFFF6FFF6F6FFFFFFFFF6FFFFFFFFFFFFFFF6F6F6FFF6FFF FFFF
now we will try 1255 delay
6F6F6FFFFFFFFFFF6F6FFF6FFFFFFFFFFF6F6FFFFFFFFF6F6F FFFFFFFFFFFFFF6F6F6FFF6FFFFFFF6F6F6FFFFF6FFFFF6F6F FFFF6FFFFFFF6F6F6F6FFFFFFFFF6F6FFFFF6F6FFFFF6FFF6F 6FFF6FFFFF6F6F6F6FFF6FFFFFFF6FFF6F6FFFFFFF6F6F6F RESET FFFFFFFF6F6F6F6FFFFFFFFF6F6F6FFFFFFFFFFF6F6F6F6FFF FFFFFF6F6FFFFF6FFFFFFF6F6FFF6FFFFFFFFF6F6F RESET FF6FFFFFFF6FFFFF6FFFFFFFFF6F6F6F6F6FFFFFFF6F6FFFFF 6FFFFFFF6F6FFFFFFFFFFFFF6FFFFF6FFFFFFFFF6FFF6FFF6F FFFFFF6F6F6FFFFFFFFFFF6FFFFFFF6FFFFFFF6F6F6F6F RESET FFFFFF6F6FFF6FFFFFFFFF6FFF6FFFFFFFFFFF6F6FFFFFFF6F FFFF6F6F6FFFFFFF6FFF6F6FFF6F6FFFFFFF6FFFFFFFFFFFFF FF6F6FFF6FFFFFFFFF6F6F6FFF6FFFFFFF6F6FFF6FFFFFFFFF 6F6FFF RESET FFFFFFFF6F
now we will try 1256 delay
6F6FFFFFFFFFFF6F6FFF6FFFFFFFFF6FFFFFFFFFFFFFFF6F6F FF6F6FFFFFFF6F6FFFFF6FFFFFFF6F6F6F6F6FFFFFFF6F6FFF 6FFFFFFF6F6FFFFFFF6FFFFFFF6FFF RESET 6FFFFFFFFF6F6FFFFFFFFFFFFF6F6FFF6FFFFFFFFF6F6F6F6F 6FFFFFFF6F6F6FFFFFFFFFFF6F6F6FFFFFFFFFFF6F83

*********** we hit our bug *************
1200078303
===========================================
83 was hit at 1256 delay ----VCC WAS 19
TX Data : 0A 15 A3 21 92 00 B3 0E 03 85 00
RX Data : 0A 06
RX Data : 12 92 00 80 21
***************************
* A23 CAM should be OPEN *
* test in Nagra to see. *
* if not, try again. *
***************************

Script C:\winexplorer5\Rom10-A23 OPENworks.XVB Transmission Completed

[mike68]

Guys

Whats best for me to buy at radioshack the 5k trimmer or the 2.2k?

I have two t911's, 1 black broad and the other green broad

[CYCO]

I think the mods are right but it just keeps running and won't open the card. Has anyone modded a T911 on the back it says [unlooper&loader 200 ] Board is black. Please if anyone has did one like this with success. I need some help.

Here is what i am getting when running the unlock script in winex
Am i on the right track?

Executing Script: C:\Documents and Settings\Owner\Desktop\383\unlockrom3.XVB
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 07 1B
RX Data : 3F FF 95 00 FF 91 81 71 64 47 00 44 4E 41 53 50
30 30 33 20 52 65 76 33 38
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo

Script Error on Line 244
Script Aborted By User

Executing Script: C:\Documents and Settings\Owner\Desktop\383\unlockrom3.XVB
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 07 1B
RX Data : 3F FF 95 00 FF 91 81 71 64 47 00 44 4E 41 53 50
30 30 33 20 52 65 76 33 38
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo

Script Error on Line 232
Script Aborted By User

[mike68]

I will have Pic's tonight on the black t911 Board

Anyone with a workable MOD on a black t911 Board?

[debauche]

Well, seem to have gotten a loader working. Word of advice from my problems:

A) Use the flash posted here that is in two parts..the one included did not work for me.

B) Use schematics and make sure you know which line is the one being used from the 232 to communicate to the atmel. Mine was a different pin, and thus the error I had before.

[mike68]

Thank you debauche and kp4ask for posting your problems, I will do the same. Thank you

[teknikal]

i also have the t911 with the black board and would like to
try this mod any help on these would be nice i looked for the
t911 in the files section but didn't see it were exactly is it?

[lightning0009]

I just unlocked a rom 3 rev383 streamlocked card with my Kickass clone. I just left it set as it was after unlocking that rom10 yesterday. All I did was reflash the 2313 with the rom3 hex and then ran the rom3 unlock script and it popped.

Executing Script: C:\winexplorer5\unlockrom3.XVB
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 07 1B
RX Data : 3F FF XX XX XX XX XX XX XX XX XX XX XX XX XX
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo00o00o63
=========================
= CAM IS OPEN NOW !!!!! =
=========================

Script C:\winexplorer5\unlockrom3.XVB Transmission Completed

[kp4ask]

Here are some photos of the T911 modification that may be be helpful.

[teknikal]

I uploaded it to bellexpress.vu today. maybe they need to check it before they allow it to be downloaded.
still don't see it anywhere, is it pics of the t911 with the black board ?

[digial123]

extreme hu sureshot loader... anyone try the mods with this yet? Any success.

[mk14er]

can someone please post part number for radio shack trimmer needed

i went to radio shack but was unsure what i needed

i told them 5k trimmer but they had no idea what it was

i really need a part number so please help thankyou

[tulsaemt]

has anyone tried the mod on a t-911 ultra
the 74hc4053 chips are under the card holder
may have to remove card holder to trace

[debauche]

Lightning, my script runs, but runs forever. When you got yours to work, did you start with a locked card, or did you use an unlocked rom3 when using testglitch to get workable settings before trying the unlock script?

Is there any consensus on the resistance that works or range? Perhaps if people posted what they have working... I put a 2.2K resistor on since did not have a pot but will be getting one when I have time and that is probably part of my problem.

Also, did those that have it working run their 4053 daisy chain to pin 1 of lm358 as the posted no1b4me steps said or skip that wire? Doesn't seem to exist in the schematics.

[HCCAfan]

I know several(3) peeps on another forum that have modified the t911 clone and have unlocked over 20 ROM3s so far. It does work but I have not tried it yet as my t911 is an original and the layout is different from the one pictured! :(
your right chep, simple ish!!

[HCCAfan]

can someone please post part number for radio shack trimmer needed

i went to radio shack but was unsure what i needed

i told them 5k trimmer but they had no idea what it was

i really need a part number so please help thankyou
i use the 4.7k ohm trimmer, just because they didnt have the 5k ohm trimmer at the time. works fine for me. part number is 271-281 at rat shack.

[HCCAfan]

as for the jumper, either you can steal the jumper off the old hard drive laying around or get this rat shack piece, its a micro toggle switch, allows you to complete the circuit when you need to flash. here is the part number for that: 275-624

[chep]

Well, good to see ya here dude! :) Lots of good info here at mili's...especially on the dish stuff! :)


chep

[HCCAfan]

always been a lurker here, just to listen to the fun. had to eventually log in to start posting.

[Tnk]

These work in xpatmel flash program, just unzip them to that folder, newd6 for rom3, newd7 for rom10

[teknikal]

i don't have xp and am trying to flash my loader can anyone help with this

[lightning0009]

Lightning, my script runs, but runs forever. When you got yours to work, did you start with a locked card, or did you use an unlocked rom3 when using testglitch to get workable settings before trying the unlock script?

Is there any consensus on the resistance that works or range? Perhaps if people posted what they have working... I put a 2.2K resistor on since did not have a pot but will be getting one when I have time and that is probably part of my problem.

Also, did those that have it working run their 4053 daisy chain to pin 1 of lm358 as the posted no1b4me steps said or skip that wire? Doesn't seem to exist in the schematics.

I didn't have a good rom3 to test with so I just left the trimmer set at where it was when I unlocked a rom10 a23. It was set at .56 K. I don't know why that worked for me, but it did.

I originally did the no1b4me mod and then changed it to just the Pengra mod and that is what worked for me.

[The Punisher!]

Pretty lousy pics....
The T911 is based on the Kypro-Tucker design.. one of the very first original designs, which is why it won't break any speed records. Anyone buying some of the more unknown glitchers, or un-cased glitchers will probably be able to follow along as many followed that design with usually only very small tweaks or useless ad-ons.

To anyone that has done this, what was used for the switch by the max232? Does anyone know why a pot, and not a 2.2K resistor used?
2 wires can become switch.
A POT was used so adjustments may be made..try adjusting a Resistor...LMAO

[The Punisher!]

extreme hu sureshot loader... anyone try the mods with this yet? Any success.
Can't.

[CYCO]

I finally got my T911 black board to open a rom 3. It took a long time and would not seem to open another rom3 that i have. I went from a single turn pot to a 12 turn pot and it made a big difference. But I still don't think I have everything connected right. I beleive it good be better. Has anyone modded a black board T911?? If so what are your times on unlocking a rom3 or rom10. It took about 7 minutes to unlock the first one and i let the second 1 run about 20 minutes with no luck. Thanks for any imput

[FaCkEnBaSsTaRd]

I bought a 4.7k-Ohm Item# 271-281 at Rat Shack, it has 3 connectors on it, which ones do you hook up to?
Thanks

[mike68]

I bought a 4.7k-Ohm Item# 271-281 at Rat Shack, it has 3 connectors on it, which ones do you hook up to?
Thanks


FaCkEnBaSsTaRd

Check that file.

[mike68]

Ok,


Reports are from my TECH that all he's getting are "REST REST REST REST REST REST" he left the t911 run overnight runninga rom10.

Any ideas

[FaCkEnBaSsTaRd]

FaCkEnBaSsTaRd

Check that file.

The file doesnt work. Cant load graphics. I know what to solder to on the 911 but not sure which connectors to use on the trimmer, it has 3 of them.

[CYCO]

The file doesnt work. Cant load graphics. I know what to solder to on the 911 but not sure which connectors to use on the trimmer, it has 3 of them.
Either side and 1 in the middle

[FaCkEnBaSsTaRd]

Either side and 1 in the middle
Thank You :D

[CYCO]

My loader is working ok on rom3 cards. but when i run the test glitch for rom10 the red light will come on and all it says while glitching is reset reset reset reset reset reset reset reset reset reset reset reset reset reset reset reset reset reset

anybody know what is going on here? i have adjusted trimmer many times but still get same results. Do i need to let it run more than 1/2 hour for any results? Thanks :cry:

[CYCO]

Thank You :D



FaCkEnBaSsTaRd that is pin 7 from chip to side on trimmer and pin 4 to middle on trimmer

[mike68]

FaCkEnBaSsTaRd that is pin 7 from chip to side on trimmer and pin 4 to middle on trimmer


Are you trying to unlock a blocker Rom10 locked card?

[CYCO]

Are you trying to unlock a blocker Rom10 locked card?
no it is stream locked

[mrploof]

Executing Script: C:\Documents and Settings\Dell1\Desktop\Rev383\unlockrom3.XVB
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : F7 EF
RX Data : FB DF FD FB DB FF

Script Error on Line 79
Sc.Read: Timeout Reading Data From Card - 25 Bytes Requested, 6 Bytes Read

I just dont know, lol

I had same problems. Thought my atmel was flashed correctly. It wasn't. Used UFP16 to flash , read and verify. Solved my problems. Now am in the tuning stage. Hope this helps

[zonavedada]

I have downloaded the files and modded my loader . But I can't get the hex file to load on my loader.it says this.

Hex Files Loaded.
Failed: Unknown COM port.

ANY HELP PLEASE

[Eldune]

My loader is working ok on rom3 cards. but when i run the test glitch for rom10 the red light will come on and all it says while glitching is reset reset reset reset reset reset reset reset reset reset reset reset reset reset reset reset reset reset

anybody know what is going on here? i have adjusted trimmer many times but still get same results. Do i need to let it run more than 1/2 hour for any results? Thanks :cry:

CYCO did you reflash your loader with the Rom10 flash?

[FaCkEnBaSsTaRd]

Could someone post the file XPAtmel.exe Ver 2.0

I cant find it anywhere.
Thanks
Fack :)

[Loopey1]

Could someone post the file XPAtmel.exe Ver 2.0

I cant find it anywhere.
Thanks
Fack :)
It is in the Files Section M8 that is where I got it from. :)

[Rotnweim]

Rom10A23
I just modded my T911, blue box, blue board, looks exactly as pics posted. Double checked all connections with voltmeter to make sure traces were cut and solder joints were ok. Unfortunately, I did not flash before attempting the mod, and my flashxp would not recognize any atmel...lucky me has an extra hu loader, so I flashed the extra loader's atmel and swapped them, so I am 99% sure my flash is good on the modded t911. I got the dips set at 2 and 5, flash switch in open position...all settings in Winexp are set properly.

While trying to tweak settings, I cannot get anything out but FF's...no matter the software settings or the trim pot....I have tried for hours, both yesterday and today....to no avail.

Any ideas on FF's??? Will changing the VCC and/or Delay's have any effect on the FF's I am seeing?? Could it be the trim pot, or a problem with the mod itself?

Edit: Looking at the schematic, at the top right corner of the green shaded area (changes section) it clearly shows the output of the top gate is to be connected to "point A VCC Glitch Enable"; but if I follow the line, it is connected to "ISO VCC MUX SEL", which does not correspond to the instructions, but does match up with the pics, connected to pin 6 on the Atmel....strange, but maybe I just dont read enough schematics to know better...

Heres a copy of the log....thanks for any/all help.

Executing Script: C:\dss\charlie\rom10unlocker-glitcher\Rom10-A23 OPEN.XVB
TX Data : A0
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 07 1B
RX Data : 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50
30 31 30 20 52 65 76 41 32
TX Data : 12 15 AB 21 00 08 A0 CA 00 00 02 12 00 06 55 0E
03 85 00
RX Data : 12 06
RX Data : 12 00 08 92 04 00

Now we will try 123E delay
FFFF RESET FF RESET FFFFFFFFFF RESET FFFF RESET FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF RESET FF RESET FFFF RESET FFFFFFFFFFFFFFFFFFFFFF RESET FFFFFFFFFFFFFFFFFFFF RESET FFFFFFFFFFFFFF RESET FFFFFFFFFFFFFFFFFFFFFFFF RESET FFFFFF RESET FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

Script Error on Line 177
Script Aborted By User

[FaCkEnBaSsTaRd]

It is in the Files Section M8 that is where I got it from. :)

Still cant find it in the files section. Could somebody just post it.
Thanks

also whats is file section M8?

[starc]

I like xpatmel131 but here are both.

[Loopey1]

Rom10A23
I just modded my T911, blue box, blue board, looks exactly as pics posted. Double checked all connections with voltmeter to make sure traces were cut and solder joints were ok. Unfortunately, I did not flash before attempting the mod, and my flashxp would not recognize any atmel...lucky me has an extra hu loader, so I flashed the extra loader's atmel and swapped them, so I am 99% sure my flash is good on the modded t911. I got the dips set at 2 and 5, flash switch in open position...all settings in Winexp are set properly.

While trying to tweak settings, I cannot get anything out but FF's...no matter the software settings or the trim pot....I have tried for hours, both yesterday and today....to no avail.

Any ideas on FF's??? Will changing the VCC and/or Delay's have any effect on the FF's I am seeing?? Could it be the trim pot, or a problem with the mod itself?

Edit: Looking at the schematic, at the top right corner of the green shaded area (changes section) it clearly shows the output of the top gate is to be connected to "point A VCC Glitch Enable"; but if I follow the line, it is connected to "ISO VCC MUX SEL", which does not correspond to the instructions, but does match up with the pics, connected to pin 6 on the Atmel....strange, but maybe I just dont read enough schematics to know better...

Heres a copy of the log....thanks for any/all help.

Executing Script: C:\dss\charlie\rom10unlocker-glitcher\Rom10-A23 OPEN.XVB
TX Data : A0
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 07 1B
RX Data : 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50
30 31 30 20 52 65 76 41 32
TX Data : 12 15 AB 21 00 08 A0 CA 00 00 02 12 00 06 55 0E
03 85 00
RX Data : 12 06
RX Data : 12 00 08 92 04 00

Now we will try 123E delay
FFFF RESET FF RESET FFFFFFFFFF RESET FFFF RESET FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF RESET FF RESET FFFF RESET FFFFFFFFFFFFFFFFFFFFFF RESET FFFFFFFFFFFFFFFFFFFF RESET FFFFFFFFFFFFFF RESET FFFFFFFFFFFFFFFFFFFFFFFF RESET FFFFFF RESET FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

Script Error on Line 177
Script Aborted By User

Did you even try the glitch test file? there is a Log of test Cam .wpd file in the test files folder follow the directions. always start with the test glitch .xvb file to "tune it"
Post your results using testglitch.
Looks like your loader is comunicating with the card so I have to say voltage settings need adjusting.

[Rotnweim]

Did you even try the glitch test file? there is a Log of test Cam .wpd file in the test files folder follow the directions. always start with the test glitch .xvb file to "tune it"
Post your results using testglitch.
Looks like your loader is comunicating with the card so I have to say voltage settings need adjusting.


Strange....I dont seem to have any test glitch.xvb file....i dont have a test files folder either...only a 'changes to loader' and a 'loader files' folders, but nowhere could I find a test glitch file.....

I did read the logoftest file, and tried to follow it as best I could, but when I run the script in testmode, I only get ff's...

Do I have a different rom10unlocker-glitcher zip file??

Perhaps you could attach or PM me the test glitch file, and I'll be glad to keep trying...as of now I still cannot get anything but FF's...tried reflashing again and still no-go....

[Canuk]

I had an old H unlooper lying around from the old days and dug it out of hiding

I traced the unloopers cct board and found that it was the same as the krypto schematics.

There were a few differences that I thought I should fix.

Caps attached to either side of the crystal were 15nF and resistor beside crystal was 1M ohm. I changed these to the 27pF and 100K ohm as per the krypto scat.

also the caps and resistor setting up the glitch voltage around the LM580 (inverting amp) were very different. Both were 10nF. The krypto scat calls for .022uF and .1uF so I changed these as well.

I flashed the 90s2313 and ran the program for unlocking rom10's but I am getting only fffffffffffffffffffffffffffff's I checked the glitch voltage out of the LM380 but it is way too low according to no1b4me I should be getting 3.5 or so volts but I am getting only .45 to .8 volts. (Yes I also tried adjusting the pot)

One thing I am wondering is what is the purpose of removing the green LED on the t911's Is that the same Green led as in the krypto scats? Cause I have an orange led wired the same way as in the krypto scats. SHould I be removing this?

It makes no mention of removing this LED in the Modded scats..
Any suggestions would be helpful.

[Mackdaddy114]

Flashed my loader perfectly with XPATMEL with Newd7.hex and did the mod on a T911. And When I run my winexp script I keep getting no response from the card. Checked my work so many times I don't see what I could of done wrong.

Executing Script: C:\Documents and Settings\Administrator\Desktop\rom10unlocker-glitcher\Rom10-A23 OPEN.XVB
TX Data : A0
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data :

Script Error on Line 78
Sc.Read: Timeout Reading Data From Card - 2 Bytes Requested, 0 Bytes Read

[Rotnweim]

Flashed my loader perfectly with XPATMEL with Newd7.hex and did the mod on a T911. And When I run my winexp script I keep getting no response from the card. Checked my work so many times I don't see what I could of done wrong.

Executing Script: C:\Documents and Settings\Administrator\Desktop\rom10unlocker-glitcher\Rom10-A23 OPEN.XVB
TX Data : A0
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data :

Script Error on Line 78
Sc.Read: Timeout Reading Data From Card - 2 Bytes Requested, 0 Bytes Read


make sure you change the settings in Winexplorer to the settings listed in the "SettingsForWinexplorer" text file included with the .zip package....That wasted about 3 hours of my testing at the beginning....but I'm still stuck with FF's...

[Mackdaddy114]

Ya I did that too and still no response back. I think Loopey1 had the same problem but mine flashes fine but still doing this. I don't know what it could be.

[rooferman]

OK now I am Super impressed, I just got done with 3 rom 3 cards that I thought I had screwed they are all back from the dead YES!!! :D


Hey LOOPEY1 can you share some info with us about the mod. Like what settings did you change in the unlocker files and to what numbers did you change too. I know not everyones settings will be the same but maybe you may be able to shed some light on some of us newbies. I got the t911 mod finished and was trying to open rom 3 and rom 10. I think i may have the wrong trimmer pot. It is a 5k ohm from rad shack , gets glitches into card but not the aaaaffffff i think i should see. can you help . :cool:

[rooferman]

make sure you change the settings in Winexplorer to the settings listed in the "SettingsForWinexplorer" text file included with the .zip package....That wasted about 3 hours of my testing at the beginning....but I'm still stuck with FF's...

Had the same problem and finally figured out it was the flash was missing a file. I will try to post the flashes here that i used with atmelflash which i will also try to post. solved my problem right away.copy files to atmel flash and your ready to go. If anyone can post the vcc settings they used to get a rom 10 or rom3 open it would be much appreciated. I can't get the aaaaaaaafffffffffffff to happen i get lots of 6f 6f 6f 6f.

[Fro66er]

Had the same problem and finally figured out it was the flash was missing a file. I will try to post the flashes here that i used with atmelflash which i will also try to post. solved my problem right away.copy files to atmel flash and your ready to go. If anyone can post the vcc settings they used to get a rom 10 or rom3 open it would be much appreciated. I can't get the aaaaaaaafffffffffffff to happen i get lots of 6f 6f 6f 6f.



you will get aaaaaaffffffffff with the TESTglitch.xvb test script. if the unlocker is working you should get the aaaaaaaafffffffffffaaaaaaaaafffffffaaaaaffffffffff . You haveto load a good rom03 with the testGLITCH .BIN in order to see the aaaaaaffffffffffaaaaafffffffaaaaaaaaffffff

When your running the actual rom03 unlocker.xvb, you should see 6f 6f 6f 6f 6f 6f 6f 6f. When unlocking ROM03 all you should see is 6f 6f 6f 6f 6f 6f 6f 6f until the CAM is unlocked.

I'm finding that 4.065V going to cards VCC (other 1/2 of the op-amp modification) with a pot resistance of approx 1K ohms works. If you have not done the op-amp mod, then try turning on unlooper and using a DVM to adjust the cards voltage to around 3.9 to 4.2V. Measure this voltage on the pot - one test probe on pin 4 and other test probe on pin 7 on the 74HC4053. Anything below 3.7V is not recommended.

Even after tweeking, i've not been able to unlock some rom03's for some reason. Rom10's appear to unlock much easier -at least for me.

[mike68]

Guys, need some help here with a t911

Here what the TECH send me, trying to unlock a ROM3

Executing Script: C:\Documents and Settings\administrators\New Folder (5)\unlockrom3.XVB
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 06 00
o00o00o00o00o00o00o00o00o00o00o00o00o00o00o00o00o0 0o00o00o00o00o00o00o00o00o00o00o00o00o00--- try to hit 0C bug at 10A5
o00o00o00o00o00o00o00o00o00o00o00o00o00o00o00o00o0 0o00o00o00o00o00o00o00o00o00o00o00o00o00o00--- try to hit 0C bug at 10A6
o00o00o00o00o00o00o00o00o00o00o00o00o00o00o00o00o0 0o00o00o00o00o00o00o00o00o00o00o00o00o00o00--- try to hit 0C bug at 10A7
o00o00o00o00o00o00o00o00o00o00o00o00o00o00o00o00o0 0o00o00o00o00o00o00o00o00o00o00o00o00o00o00--- try to hit 0C bug at 10A2
o00o00o00o00o00o00o00o00o00o00o00o00o00o00o00o00o0 0o00o00o00o00o00o00o00o00o00o00o00o00o00o00--- try to hit 0C bug at 10A3
o00o00o00o00o00o00o00o00o00o00o00o00o00o00o00o00o0 0o00o00o00o00o00o00o00o00o00o00o00o00o00o00--- try to hit 0C bug at 10A4
o00o00o00o00o00o00o00o00o00o00o00o00o00o00o00o00o0 0o00o00o00o00o00o00o00o00o00o00o00o00o00o00--- try to hit 0C bug at 10A5
o00o00o00o00o00o00o00o00o00o00o00o00o00o00o00o00o0 0o00o00o00o00o00o00o00o00o00o00o00o00o00o00--- try to hit 0C bug at 10A6
o00o00o00o00o00o00o00o00o00o00o00o00o00o00o00o00o0 0o00o00o00o00o00o00o00o00o00o00o00o00o00o00--- try to hit 0C bug at 10A7


Can someone please tell me whats wrong here.


Now the rom10

Executing Script: C:\Documents and Settings\administrators\New Folder (5)\Rom10-A23 OPEN.XVB
TX Data : A0
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 06 00
TX Data : 12 15 AB 21 00 08 A0 CA 00 00 02 12 00 06 55 0E
03 85 00
RX Data : 03 00

Now we will try 123E delay
RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET

[mike68]

I guess everyone is done with their MOD's

[dishnetwork411b]

same problem here.. i get similiar results - anyone know why?

Now we will try 123E delay
RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET

on a ROM10

and ROM3 does OoOOoOOoOOoOOoOOoOOoOOoO

[Tnk]

Flashes I converted for XpAtmel, newd6 for rom3, newd7, newd8 and newd9 are for rom10 ...had best success on rom10's with newd8 and settings vccctart around 26 and end set for around 10, pot set at 2.2. Run each rom10 script in test mode, vary settings in script till you to get a nice mix of F6's and FFF's with about a 60/40 mix in favour of the FFF's. Don't forget to unplug and replug in loader in between starting and stopping the script to re-set loader. My rom3's popped in about 10-15 minutes, rom10's took longer..15 min to 45 minutes. rom10's are pickier I found, you need to play with each one, try newd8 and newd9 both, popped one A81 with newd9, 3 with newd8. I was not getting responses at first and reheated a couple of solder connections, that fixed it for me and I was off to the races. Bored now, got no more cams to pop.... :cool:

[Fro66er]

same problem here.. i get similiar results - anyone know why?

Now we will try 123E delay
RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET

on a ROM10

and ROM3 does OoOOoOOoOOoOOoOOoOOoOOoO

Your unlocker is not communicating with your computer properly. A few things: are you using the correct atmel flash for the right ROM? Is switch 5 "open"? Is your comport working properly? Did you make the approprate settings un winexplorer program? Is the unlooper modified correctly?

I get the same exact results as your having when i forget to plug in the comport cable to the unlooper as well.

Good luck

[hondalover]

So this will not unlock blockered rom10 cards right,Only stream locked.
The reason I think some people are getting the RESET is because the card is locked by blocker.
I unlocked a stream locked rom10 A23 but other cards I have at a23 will get the RESET all the time.

[weirdml]

Hi all,

I got the error when I was trying to unlock my Rom 3-383 using mod T911:

TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 07 A3
RX Data : FA 95 80 91 60 6E D6 1C 88 CA 15 35 41 30 38 26
92 55 DB CD 38 A6 FF

Script Error on Line 79
Sc.Read: Timeout Reading Data From Card - 25 Bytes Requested, 23 Bytes Read

Any suggest????

[Loopey1]

Read my posts in

http://www.dssftp.com/forum/upload/showthread.php?t=31413

thread is ***Everyone Look Penga Unlocker zip has mejor error***

Here. Rember only LOOK at MY posts. I have tried to explain the error code there Like I said voltage is the problem.

You are on the right path though your "Talking with the card"
So the outlook ain't so bleek.

[weirdml]

Hi Loopey1,

How many ohm between #4 & 7 of 5k trimmer on your mod T911? I know it is 2.2k..., but someone has different value!!!!

[pstalyn]

Hello,
I would like to know if there is any Schematic that shows the mod
I have to do to a Typhoon T7 in order to fix a rev383 rom3 card.

Thanks a lot

pstalyn

[anthony101]

Anything out for the mikobu 3 yet????

[Crazy1_79]

I seen a mikobu 3 scematic today on this forum, do a search and you should find it.

[Modify_inc]

Anything for the Vector Techonogies open circuit unlooper. It uses the Atmel AT90S2313-4PC, and has been good to me for many years. I have flashed it many times w/ different flashes over the years. It was made or copyrighted in 2000 if that helps.

Please tell me it can handle this mod... and that it's not all flashed out.
Mike

[moses]

On the schematic it shows pin 6 of the atmel going to pin 10 and 11 of the 74hc4053..And pin 3 of hct00 to pin 4 of the hct00. On all the mods I've seen show pin 6 of the atmel going to pin 3 of the 74hct00 whats the deal with this. Also what concects to pin 12 of the
74hct00 on the t911 loaders for people that don't have switches.

[jasperwiggins]

weirdml,thanks for help.i have a 10 turn pot between 4 and 7 and its set to 2.2 k.i set it to 2k out of circuit and then i adjust up and down but still no luck what so ever.all i get when i run script is trying to hit oc bug but no ff aa or any letters and thats in the test glitch x.v.b.when i tried a locked rom 3 in the unlock rom 3 script al i get is Oo0o00o00o0o0o0o0o0o0o0 trying to hit oc bug.but no letters what so ever in the test glitch script.the red l.e.d does not light and on the test glitch script it doesnt matter if card is in or out it still says trying to hit oc bug.im pretty sure all the circuit cutting and wiring is right cause ive had to other people to check it.thanks for any help u can give me.

[tweed]

pic of my loader can any one help with mod on this one its a t911 in a dark blue case any help would be great thanks..............

[stralink]

i have the same problem that jasperwiggins modified other t911 and had the same problem
any help

thanks for you support

[wonder]

Sorry folks my questions might sound stupid but please try to explain some things to me .
I just ordered a T911 so I am doing reading here preparing how to mod it.
Can you explain please....
When you refer to trimmer and Pot do you mean the same thing ? If not where the pot should be placed? I don't see this in the pics.
An other question .about the switch , do we have to solder an extra switch ? if yes what type of switch is it and where does it go ?
Please respond !
Thanks

[cdsupplies]

Just going right out of my mind, been trying for 5 days to get a glitch pass and all I keep getting is Success Glitch, is there an easier way of getting a Glitch Pass, see others are getting it, whats my problem, someone please help before my mind blows. Thanks :cry: :cry: :cry: :cry:

[Loopey1]

pic of my loader can any one help with mod on this one its a t911 in a dark blue case any help would be great thanks..............
That is the one to mod my friend.. Have fun and GL.

[weirdml]

Hi there,

Finally, I can unlock Rom 10@23, but I can not unlocl Rom 3@383... It is keeping....

o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4

I run it over 4 hrs... But still no luck. Any suggest.
Thanks!

[jasperwiggins]

stralink,the t911 loader i had so much trouble with wasnt cause of the flash or the mods.i had a bad t911.i bought this loader new a week or so ago and did all the mods but the trouble with the new loader was bad solider joints on the card slot.when the card slot was put in a couple of the slot pins didnt come through the bottom side of the board.all i got was trying to hit oc bug at 1045 1055 and so on.didnt make any difference it the card was in or out,,the loader wasnt talking to the card at all.i stuck a small wire in the pin hole and soilder it to the board and then started getting the ffffaaaafff then tweeked the pot just a bit and it worked on rom 3 and with the different flash rom 10..i still have some trouble with the pins ,i hope this might help you and it might be worth a look..thanks loopey1 and all u guys for the help u gave me..

[rled2004]

Has anyone converted this to the WildThing II ??

[ynot-try]

Hi there,

Finally, I can unlock Rom 10@23, but I can not unlocl Rom 3@383... It is keeping....

o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4

I run it over 4 hrs... But still no luck. Any suggest.
Thanks!
did you load the flash for the rom 3?

[Crazy1_79]

Has anyone converted this to the WildThing II ??
whooooo, hard to focus on your question with a avatar like that!!!

[rob578]

See attached files

[weirdml]

did you load the flash for the rom 3?
Yeah! I did... It is newd6.hex.

[dell1234]

Just to give my results, which after 2 weeks of going crazy, the answer seemed simple for me. I worked on this stuff for 2 weeks straight, and finally popped 3-rom3 cards, without an open rom3 with Testglitch.bin, although it took some time and patience, this setting did work for 3 cards. I dont have any streamlocked rom10's to check, which is good, . Just set everything like this if you can, and if your mod is right, your rom3 should pop, maybe 30 minutes, maybe 8 hours, just be patient and let it run. You will see an ATR at start of script and then o6Fo6Fo6F............over and over, so just let it run until it pops. This is what i set my unlocker (T911 clone)on.....

DelayStart = &h10A5
DelayLimit = &h10A4
VCCStart = &h23 'YOU CAN CHANGE THIS FROM 20 TO 50-SET TO TEST BIN
VCCLimit = &h1A 'YOU CAN CHANGE THIS FROM 1A TO 30-SET TO TEST BIN
GlitchType = &h06
TryCnt = 1
TryLimit = 2

and i set my pot to 2.22k ohms, using a 6v 300amp power supply. There are probably other people that have their mods tweaked to pop alot faster than mine, but hey, as long as they are popping, i dont care how long it takes.

[lightning0009]

Pot on my Kickass clone set about 600 ohms. I unlocked three rom 3's one after another in a row. They were all streamlocked. So far, I haven't run into a card I couldn't unlock. I never ran any testglitch. I didn't have any good rom3's to do it with at the time. I got a few now.

Sub Main()
DelayStart = &h10A3
DelayLimit = &h10A5
VCCStart = &h30 'YOU CAN CHANGE THIS FROM 20 TO 50-SET TO TEST BIN
VCCLimit = &h1A 'YOU CAN CHANGE THIS FROM 1A TO 30-SET TO TEST BIN
GlitchType = &h06
TryCnt = 1
TryLimit = 2
Delay = DelayStart
VCC = VCCStart







Executing Script: C:\winexplorer5\unlockrom3worked.XVB
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 07 1B
RX Data : 3F FF xx xx xx xx xx xx xx xx xx xx
xx xx xx xx xx xx
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3

I edited out a bunch here, but took about ten minutes for the first one.

o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo00o63
=========================
= CAM IS OPEN NOW !!!!! =
=========================

Script C:\winexplorer5\unlockrom3worked.XVB Transmission Completed


Executing Script: C:\winexplorer5\unlockrom3worked.XVB
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 07 1B
RX Data : 3F FF xx xx xx xx xx xx xx xx xx xx
xx xx xx xx xx xx
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F---


I edited out some here also.


o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo00o00o00o00o00o00o00o00o00o00o00--- try to hit 0C bug at 10A7
o00o00o00o00o00o00o00o00o00o00o00o04o63
=========================
= CAM IS OPEN NOW !!!!! =
=========================

Script C:\winexplorer5\unlockrom3worked.XVB Transmission Completed


Executing Script: C:\winexplorer5\unlockrom3worked.XVB
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 07 1B
RX Data : 3F FF xx xx xx xx xx xx xx xx xx xx
xx xx xx xx xx xx xx
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A2
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A3
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A4
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A5
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A6
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6F--- try to hit 0C bug at 10A7
o6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6Fo6 Fo6Fo00o00o04o63
=========================
= CAM IS OPEN NOW !!!!! =
=========================

Script C:\winexplorer5\unlockrom3worked.XVB Transmission Completed

[rockets97]

Would you please show me how to edit that info into the locker? How do you know which is DelayStart & DelayLimit; VCCStart and VCCLimit? I did open Rom3 streamlocked but have no success to unloop rom3. Do I have to change any thing?
Really appreciated for all the info

[JOE SNUFFY]

Hello,

I would like to thank Penga, NO1B4ME, Mili and his folks on his forum. I just did a A81 Bev card that has been up since Jan. I was new to this stuff and didn't apply a blocker back in Jan so it locked the card but everything was wide open and it took PKO updates, PPV updates, Rearanging of channels but I couldn't read it to duplicate it since it was sitting at A81. I have read it now and duplicated it back to the card and its working and if it locks back up I will post the file on this forum for folks that have a modded working loader since it will lock your card after about 4 hours in the rec. so I have read.

I also did a A1B with a non-modded loader I don't know if thats huge but I set the tranformer on the wall to 6.09 Volts DC and used the A23 Script with the Hex7 flash. I would just keep clicking on run script and about every 3rd time I would unplug the transformer from the wall and Wham it said cam open and when I checked in Nagra it was I was running 2,4,6 dips down. :)

[JOE SNUFFY]

Hello,
All you need to do to adjust the script is take your pointer and with winex open click in the big right square to the right which is the script and scroll down to that portion of the script and change the values to whatever you would like staying in the paramaters that it tells you the writing will be green I think.
Hope this helps
JOe

[indal_98]

Scroll down to this area in the script :

Sub Main()
DelayStart = &h10A3
DelayLimit = &h10A5
VCCStart = &h30 'YOU CAN CHANGE THIS FROM 20 TO 50-SET TO TEST BIN
VCCLimit = &h1A 'YOU CAN CHANGE THIS FROM 1A TO 30-SET TO TEST BIN
GlitchType = &h06
TryCnt = 1
TryLimit = 2
Delay = DelayStart
VCC = VCCStart

Change VCCStart or VCCLimit as you wish ....Best would be in the interval of 5 or 9 or 13....to avoid loops. Much faster result this way ...

Or you can use this script to "lock" the VCC best range for your loader ..

Courtesy of Penga's home site ....cardcoders.org

G'L