View Full Version : Help Badly looped 4Bcard
Iv'e let cards glitch for an hour ... Some people say you shouldn't go any longer than 2 minutes but hell , I go out and cut the front and back lawns and they are still glitching , come in the house and finally poped .. Been running theses same cards for a few years now without a problem ...
I am not to worried about it ....
With the new Starglitch though it has cut the times down consdideraly...
4x :D
In winex I bump up the Rec Timeout to 400 ..
That would be under Configure Parimiters ..
4x
kimmykat
03-06-2003, 07:01 PM
i have found that the stubborn 4b cards gets unlooped and fix faster with win46 and superpopper /semu_unlooper2.9 fixes card in 5-10 minutes select the 5b option not the 4b and then write the wiper2 to the file
Extreme Dac Settings
Dac 1 Range Max 99 Min 95
Dac 2 Value 99 Delay 11
Glitch Type Ins 4C
Attempts Per Glitch 6
These are the setting I like the best for Extreme ..
They can be found under Settings Tab ...
4x
mdeven
03-06-2003, 09:43 PM
Wille,
If you get stuck and give up, e-mail me....
Mark
Chief
03-07-2003, 08:19 PM
...I'm gonna try your ideas here and see what happens. Last night I applied the dac settings as per 4x4's post, and they gave me a "error in hex data" message and no functions would work. They work for him, I must have done something else wrong. When I clicked "default settings" it did away with the ul4s atmel flash as well. Banged my head trying to get that working- kept getting "not detected" messages in the ul4s DOS program. Finally got it repaired. Anyway, I'll try your ideas and see what happens- and write down the default settings so I don't go through all that mess again. Thanks for the useful information....Chief
Chief
03-08-2003, 05:43 AM
... and top of the evenin' to ya. Somebody's file looped the livin' crap out of one of my cards last night, and Extreme wouldn't touch it. Ul4s5c7f wouldn't either. I have starglitch 3.3, but I've been too busy, and too lazy, to open 'er up and give it a try. I used SEMU 2.8 which I've had for a year and never tried. Must be an old version, but it unlooped the card in less than 15 seconds. I appreciate your posts on the DAC's, I wrote all of that down and will apply when I get around to Starglitch. Thanks, bud. Chief
I am also having a nightmare with this 4b, I have used starglitch 3.3- which gives an error "script error on line 3448 , active x component can't create object: 'Scripting. File System Object'.
Using a AIO flashed ul4s. with winexp 5.0. Have problems with 4b only.
this occurs after choosing "dac finder" or even the other option,
Help please on this, thanks
also tried others, hxboiglitch 3.0, starglitch 3.4, starglitch 3.3, and 33a.
Please help!
I got it to pop, I used Extreme hu 3.5 with alternative 3, it took about 20 minutes to pop. I also used winexp 5.0 endlessly with no success, "starglicth v3.3 and v3.3a, and v3.4", I recieved an error (script error) using starglitch, maybe the support file sct 10 would have helped, but i don't know. Also used these scripts "dsstech unlooper v7", "super hu card popper" , "Hxboiglitch v3.0 and v3.12", "P3 superscript pub v.2b, "semu 3.8" and a few others. None worked.
I did not know about "sct 10 support file" as mentioned above until now, or where to get the file(sct 10)so I don't know if that would have made a difference. Anyone else had this problem let us know.
If someone has the support file please post for I can test it to see if that was the whole problem.
Thanks to all,
Chief
03-09-2003, 10:01 PM
I didn't check Mili's file section to see, but if you need sct 10 , PM me and give me your e-mail address- I'll get it right to you. Chief
valenti
03-09-2003, 11:42 PM
I'm with MWC on the Starglitch thing. Starglitch works great if you set it up and take the time to get some Dac settings specific to your situation, and then use those settings to get into your cards.
SEMU 3.2 works great for me also. It definitely takes longer, but it does work.
CM valenti
mdeven
03-14-2003, 05:03 PM
MWS,
I agree with you on the Starglitch.... It works as well as my "private" unlooper.... Better for me than the one in Mili's script.... I believe I saw a way to pick your DAC file.... A few others have expressed interest, so I guess I'll make that my next project....
Mark
Parity
03-15-2003, 04:09 AM
ok ive got three 5b's loops to hell. Ive tried star, snakebite, extreme Hu, Bioglitch, and mili. Occasionally i do get some responce from the card with a locked ATR (Usually with starglitch). I have dacs logged for each card and use those dacs on the cards. I have tried dip switch settings, power changes, and different ranges on every card.
I am using an AIO, is one of those fancy looking unloopers better?
At this point I am willing to buy something to make unlooping easy.
Going to go back and sit on them some more, I let them run about 5 to 10 minutes each and look for activity, if none i just try something else. Everyone else talks about doing it in under one minute. Please tell me what equipment you are using and where i can find some. I have never unlooped in less than 3 with an average of 7 minutes per unloop in the past.
Parity
Chief
03-15-2003, 05:26 AM
Hey, MWC, I can think of several things I'd like to "ffff the shit out of". :D Good idea, hope it works, Parity.
mdeven
03-15-2003, 05:09 PM
Parity,
If you give up, e-mail me....
Mark
Parity
03-16-2003, 12:12 AM
Ok guys, Thanks for the info, I managed to get two of them to unloop Yesterday using snakebite to find the dacs and starglitch to do the popping. I then spent about three hours trying different programs to get the third card cleaned. I just came home from work and started again and actually got the bootstrap loaded in about two minutes and I immedietly got an error saying eeprom couldn't be written. All I get from this card is 000 atr or FFF atr. When I run snakebite I get very few responses and no dac settings for it.
I wonder if I have a dead one here.
Parity
Chief
03-16-2003, 01:48 AM
Parity, don't know about your third card, but e-mail Mark- he is an unlooping specialist, if he can't do it, you can throw the SOB away....
Budreaux
03-16-2003, 02:25 AM
Guys, i can pop a 4B open in under a minute and read and write to it everytime without trouble, anyone interested?
Budreaux
03-16-2003, 02:43 AM
Ok guys, i have used these settings with a number of loaders, and they have worked everytime, without fail. The bigest factor for the 4B is the INS setting.
In ExtremeHU go to SETTINGS and hit DEFAULT SETTINGS.
Next go to your DAC 1 seetings and set to B9 - A0 (number 0)
Then set your INS to 4C
Hit SAVE SATTINGS AND EXIT
now you are all set to work with the 4B card.
Remember that this is for the 4B card only, you have to change them back for the other cards. I have these settings taped to the side of my moniter because they work so damn good.
Budreaux
03-16-2003, 07:26 PM
If that didn't work then here is a little insight that might help you out.
HU Card differences 4b, 5b, 6b, 7b..
Differences in the cards; 4b, 5b, 6b , 7b and 8b
Use Extreme HU to open your bin and look at the simulated ATR. The 4th last byte is 55. The next byte is a:
54 for a 4b
55 for a 5b
56 for a 6b/7b/8b
Another way to check is to see what is at address 201D: address @ 201D is as follows:
75 for 4b
74 for 5b
77 for 6b
76 for 7b
79 for 8B
different identification bytes exist for the different cards:
There are two places in EEPROM here the identification byte is stored. One is 201Dh, where the identification byte is stored, XORed with #21h. The other is 24D2h, where the identification byte is stored XORed with the appropriate byte of the EEPROM key.
The other major difference between bins is what is posted above. The 5B bin has a routine from 237Dh-23CDh, and a vector to 237Dh at 3157h-3158h. The 6B bin has a different routine from 237Dh-23CDh, and the vector at 3157-3158h points to 238Ah. There is also a difference in bytes at 393Ah-393Ch, but I do not have a 6B bin to see what is there and compare to a 5B bin.
Those two different routines are two different versions of Cmd85. On the 6B, the routine appears to do a complex calculation on the bytes included with the packet, some bytes in a table in ROM, and some of the bytes at 237Dh. If the calculation doesn't result in the correct value, the card will trap-9.
On the 5B, the Cmd85 routine appears to be an EEPROM hash routine similar to the 60/B5 nano from the H card. It adds EEPROM bytes to the packet hash statically, based on range information given in the Cmd85.
Because these EEPROM bytes are different, these EEPROM ranges are excluded from the EEPROM hash implemented by USW0600/DSW0006 (see EEPROM hash range table at 2D4Ch).
Hardware Differences
4B (P3.0D) - Original HU card, meant to be included with IRDs for sale. Virgin 4Bs do not have the proper 12-byte video keys in EEPROM at 24F4h and 2AE4h. Those keys must be set during activation. (This prevents cards stolen from boxed in-store IRDs to be used for video). This card has difficulties in Hughes B2 IRDs.
5B (P3.1D) - Modified from original HU card, also meant to be included with IRDs for sale, virgins are also missing the 12-byte video keys like the 4B. Has a hardware fix (also applied to 6B/7B/8B) that allows the card to work properly in Hughes B2 IRDs. (This is why 5B-8B are far easier to glitch than 4B - 4B is the only card that doesn't have this hardware fix).
6B (P3.1M) - Same hardware as 5B card. Meant to be mail-out replacement card for swapping P2s. Already has proper 12-byte video keys in EEPROM at 24F4h and 2AE4h so that the card will work properly in the IRD after it card swaps a P2.
7B (P3.2M) - Meant as mail-out card to replace cards (P2 or previous P3) used by owners of Hughes A1 IRDs. Hughes A1 had problems with previous P3 cards during short power failures because the IRD doesn't hold the reset line high properly, causing previous cards to IVAC. 7B has hardware fix that works around improper reset signal.
8B (P3.1/Dealer) - Same hardware as 5B card. Half-length card for dealer showrooms to prevent in-store theft
Budreaux
03-16-2003, 08:08 PM
you could always try it and let us know. I'd be interested to know how it turned out. I don't see how it could damage anything, but that's just my opinion.
Budreaux
03-16-2003, 08:15 PM
it could happen, stick with the traditional means, one will work,just have to test them to see which is best for you.
Budreaux
03-16-2003, 08:23 PM
try the DAC1 and INS settings i gave you earlier, they work great for me.
ExtremeHU
DAC 1 = B9 - A0(the number 0)
INS = 4C
good luck, let me know if it works for you.
Budreaux
03-16-2003, 08:45 PM
after you load those settings, hit SAVE AND EXIT, then just hit the medical bag to unloop and hit "start unlooping", those settings will be your standard settings until you cahnge them again.
Budreaux
03-16-2003, 09:06 PM
DOOOOH
lmao, yeah, just hit LOAD DEFAULTS to go back to original. I have had great luck with Mili's unlooper in Defiant, use glithe 2, if no luck use glitche 1.
Good Luck
Budreaux
03-16-2003, 09:13 PM
if all else fails, send it my way, I'll put it back good for ya..
Funny, I've offered that before and noone wants to send it.
Budreaux
03-20-2003, 06:50 AM
For 5B AND 6B try these settings.
INS48
DAC1 = 85 70
DAC2 = 80 DELAY 11
Heres a few other settings to use TO BOOT 4B's.
For 4B with 4B bin....
INS4C
DAC1 = 9B 8D
DAC2 = 84 DELAY 12
For 4B with 5B bin
INS48
DAC1 = 95 - 70
DAC2 = 93 DELAY 12
ALL glitch attempts are 5
(Tip: Do not try the 4b settings on anything else. 6b etc..)
Maybe that can help somebody out here.....
Dark Knight
03-21-2003, 01:53 AM
WildwinExtremeHuV2a ....this has not failed me yet, and works quiker than others I have tried. It's in the download section
vBulletin® v3.8.4, Copyright ©2000-2009, Jelsoft Enterprises Ltd.