modded t911 black board gets error when running test glitch.

[Crazy1_79]

Hey guys, I modded a black board t911, got it to work on test glitch, I get the mixture of AAAAAFFFFFFAAAAAAFFFFFF but after running a few lines in the script it times out with the "2 bytes requested, 0 bytes read" nag, then if I try to run it again right away it doesn't times out at the start of the script, If I wait about 10 seconds then run it again, it works but then it runs a little bit and times out, If I run the rom 3 unlocker I get the 06f06f06f but I let it run for 4 hours and it never popped the card, Any ideas on what I did wrong? Am going to recheck my connections when I get off of work, but I believe they are all ok. Also played with variables within the script, but to no avail.

[JT]

Glad to see you finally got a loader to mod. Way to take the inititive. You can turn the trimmer pot while the testglitchfind.xvb is running. Do this before you mess with the VCC start and limit in the software. First, try reflashing your unlocker using the xpatmel settings 60/50/1. Don't forget to write the testglitch .bin to your rom. I did all my tuning with rom3 but don't change anything for rom10's. You need to get the timing tuned for your unlocker before you go trying to unlock anything. Triple check your loader2 settings as well.

[LuckLarry]

I agree with JT...I had the best succsess with vcc start/limit variables. I had good luck with my A81's, but it took me a long time to do a 383(over a week of screwing with it). I still have 2 of the 4 I started with that won't pop.Is your t911 a nexus or another rev?There's no point in posting the vccs that workes for me, because EVERY setup is different. The cards are fussy to the point that wire length, power supply, and puter speed have great influence on them. Do a search at CC's for Pengas and Killbillians.They both have excellent help info.

[Crazy1_79]

thanks guys, JT, I got this mod working, I thought I would mess with it untill I got the 383 test glitch to work, I used the 60/50/1. You and I had a conversation about that awhile ago, luckylarry, perhaps I will flash with other flash and give A23 a try. Thought I would start with rom 3's because I only have one, and work my way up to a23's. thanks for the info guys, I will report back with results.

[Crazy1_79]

JT, I am making progress, I have successfully got the glitch analyzer to give me the floor and ceiling vcc on a rev A23 card, I believe I have the ohms at 4.89K with a 1F for ceiling and a 19 for floor, I am letting the script run as I type this, I know I am suppose to leave my computer run just that program but what bothers me is I get that dreaded 03 00 as a answer to reset when I start the script I am not seeing the regualr 25 byter (or whatever it is) answer to reset, I am getting a very good combo of 6fffff6f6fffff's in the script with the ocasional reset. Looking good on that end. I do not have a rom 3 to run test glitch on because I sold it and had to mail it out today. so I am working on the rom 10's with newdd 9 as the flash, It has run only a few minutes so I will be patient and let it go for a hour or two, but I am wondering if you have any tips for me, the lack of atr I hope will not affect the glitching process and I guess that is my major concer, when I ran glitch ananylizer I got a ATR the way I should have. I didn't touch anything after that, went right into a23 open script and am awaiting success. BTW, I relfashed the atmel again with your timing settings, I may of had the 60/50 reversed the first time, and it cured my timing out problem, thanks for all of the help and any more you can give me.

[anthony101]

JT, I am making progress, I have successfully got the glitch analyzer to give me the floor and ceiling vcc on a rev A23 card, I believe I have the ohms at 4.89K with a 1F for ceiling and a 19 for floor, I am letting the script run as I type this, I know I am suppose to leave my computer run just that program but what bothers me is I get that dreaded 03 00 as a answer to reset when I start the script I am not seeing the regualr 25 byter (or whatever it is) answer to reset, I am getting a very good combo of 6fffff6f6fffff's in the script with the ocasional reset. Looking good on that end. I do not have a rom 3 to run test glitch on because I sold it and had to mail it out today. so I am working on the rom 10's with newdd 9 as the flash, It has run only a few minutes so I will be patient and let it go for a hour or two, but I am wondering if you have any tips for me, the lack of atr I hope will not affect the glitching process and I guess that is my major concer, when I ran glitch ananylizer I got a ATR the way I should have. I didn't touch anything after that, went right into a23 open script and am awaiting success. BTW, I relfashed the atmel again with your timing settings, I may of had the 60/50 reversed the first time, and it cured my timing out problem, thanks for all of the help and any more you can give me.


I wish you would hurry up I need some cards unlocked...lol keep it up maybe I will mail you my mikobu to do...lol....Hope you get going but I am counting on you

[Crazy1_79]

You can't rush perfection brother!! well you know what killed me, I had to mail off my last open rom 3 today, I am running all of this from glitch analyzer and unlock scripts, I know a guy that has a rom 3 I am going to have to borrow it I suppose! I'm trying anthony, I'm trying, I know now that overflow is working, and glitch is working so the mod is correct, I am down to the fine tuning of the script which if you read around takes awhile. A little at a time! I will let you know when I breathe success believe me!

[Crazy1_79]

You ain't going to believe this, I had the switch on for program and not glitch, I am starting over with the switch in the glitch positon!

[JT]

Try Newd7 for rom10. 4.89k ohms is about double what you should start with when tuning the mod. You should be a lot closer to 2.2k. Don't worry so much about changing your vcc start and limit in the software or establishing what the floor and ceiling are for your rom. I think the whole trick here is to get everything timed properly using testglitchfind.xvb before you try and do anything else with the mod. I haven't heard of anyone who could get testglitchfind.xvb to work that had any difficulties with unlocking either rom3 or rom10. I have yet to use any flash other than newd6 or 7. I assume you know this is only an unlocker, not an unlooper at this point anyway. This mod won't work to recover invalid ATR. Hopefully someday some unlooping software will be written for this mod.

[Crazy1_79]

I am aware that we can't unloop with these yet, these are valid streamlocked cards, I may have to wait untill tomorrow untill I can round up a rom 3 to testglitch with, I made a mistake when I said it was 4.89K, I measured with power still supplied to the loader, dumb rookie mistake I know, but I measured after removing power to the t911 and you are not going to believe this, I only get alternating 6fff6fff around the 80 ohm to 73 ohm mark, That is on the verge of running without resistance at all, I seen where some people were saying that the t911 was running around 300 or so, but this is much lower than that, what do you think I could have done wrong? I am getting ceiling and floor glitches here, when I had my rom 3 e050 changed from ff to 00 so overflow is working, I don't know where I could have gone wrong in the mod since it seems to be working fine. but the ohms is what bothers me, The trim pot I have is getting warm at this resistance but not hot, the chip that the trimpot runs off of does not even seem to be warm to the touch, I would say room temperature, so I am do not seem to be working it to the point of shorting, If i zero it out, it will get warm, I tried momentarily just to check. I didn't leave it there long enough to see if it gets hot.

[Sean77]

HI guys,

I'm done with hardware mod & willing to start with software challenges, So i just have some questions:
1- The loader T911 im using has a 6 volt dc power, is it ok?
2- I tested UFP16 for flashing my loader, it fails alway, but why it's successfull with xpatmel program? (im running winxp pro)
3- i dont know where to begin for software mod? after i flashed my loader what script should i run? what's that glichtest, i wanna do it for rom10 reva23.
4- there is one script file (Rom10_Reva23_opener) that i have, when i run it i just get RESETs? what's that for.
5- how do i know my card is streamlocked? when i read it in the nagraedit, it says backdoor disabled & card may contaion updates, is it the right one?

Can some one give me the right orientation to defeat it.

thanx in advance.

[JCK7]

YES IF says backdoor disabled & card may contaion updates, is it the right one?

IT stream lock .JCK7

[JT]

HI guys,

I'm done with hardware mod & willing to start with software challenges, So i just have some questions:
1- The loader T911 im using has a 6 volt dc power, is it ok?
2- I tested UFP16 for flashing my loader, it fails alway, but why it's successfull with xpatmel program? (im running winxp pro)
3- i dont know where to begin for software mod? after i flashed my loader what script should i run? what's that glichtest, i wanna do it for rom10 reva23.
4- there is one script file (Rom10_Reva23_opener) that i have, when i run it i just get RESETs? what's that for.
5- how do i know my card is streamlocked? when i read it in the nagraedit, it says backdoor disabled & card may contaion updates, is it the right one?

Can some one give me the right orientation to defeat it.

thanx in advance.

1- A 6V power supply may work, but I think you should go with a 9V 300mA or better. That's what the spec sheets say most of these unloopers are designed to work with....even though I think internally the voltage is staged down to about 4.5V.
2- I couldn't get UFP16 to run on my winxp machine either, but xpatmel works great if you change the timing settings to 60/50/1
3- I'm gonna tell you the same thing I told Crazy and that is I think your gonna want to have an open rom3 to put the testglitch .bin on and run the testglitchfind.xvb. This is how you fine tune your modded loader. Once 'tuned', then you can run the unlocker .xvb's. .xvb's are winexplorer programs and you'll be using winexplorer5.0 to run them. You will need to set up a new profile in the parameters of winexplorer called Loader2. (I guess you don't have to call it that, but I would just so were all doing it just how it says to in the read me's)
4- Your loader isn't 'tuned' right yet, so your getting errors
5- Backdoor disabled in Nagra means your streamlocked or have a blocker/rev spoofer on the card.

[Sean77]

1- A 6V power supply may work, but I think you should go with a 9V 300mA or better. That's what the spec sheets say most of these unloopers are designed to work with....even though I think internally the voltage is staged down to about 4.5V.
2- I couldn't get UFP16 to run on my winxp machine either, but xpatmel works great if you change the timing settings to 60/50/1
3- I'm gonna tell you the same thing I told Crazy and that is I think your gonna want to have an open rom3 to put the testglitch .bin on and run the testglitchfind.xvb. This is how you fine tune your modded loader. Once 'tuned', then you can run the unlocker .xvb's. .xvb's are winexplorer programs and you'll be using winexplorer5.0 to run them. You will need to set up a new profile in the parameters of winexplorer called Loader2. (I guess you don't have to call it that, but I would just so were all doing it just how it says to in the read me's)
4- Your loader isn't 'tuned' right yet, so your getting errors
5- Backdoor disabled in Nagra means your streamlocked or have a blocker/rev spoofer on the card.

thanx for reply JT,

The thing is i dont have any locked rom3 now, but i have 3,4 streamlocked Rom10 REvA23. can you tell me how can i tune my loader step by step, is the tune for rom3 is different from rom10?

i really appreciate your help

[Crazy1_79]

1- A 6V power supply may work, but I think you should go with a 9V 300mA or better. That's what the spec sheets say most of these unloopers are designed to work with....even though I think internally the voltage is staged down to about 4.5V.
2- I couldn't get UFP16 to run on my winxp machine either, but xpatmel works great if you change the timing settings to 60/50/1
3- I'm gonna tell you the same thing I told Crazy and that is I think your gonna want to have an open rom3 to put the testglitch .bin on and run the testglitchfind.xvb. This is how you fine tune your modded loader. Once 'tuned', then you can run the unlocker .xvb's. .xvb's are winexplorer programs and you'll be using winexplorer5.0 to run them. You will need to set up a new profile in the parameters of winexplorer called Loader2. (I guess you don't have to call it that, but I would just so were all doing it just how it says to in the read me's)
4- Your loader isn't 'tuned' right yet, so your getting errors
5- Backdoor disabled in Nagra means your streamlocked or have a blocker/rev spoofer on the card.
ok JT, took your advice and got a rom 3 card to run glitch test with, got it running with default setting, I have glitched past OE bug, haven't seen OC or OF yet but It has only been running about 10 minutes, I am going to let it run in 20 to 30 minutes increments and then fine tune on the trim pot, leaving the setting alone like you said, Have you seen this OE bug? I thought there was only OC and OF but I can C&P my log file if you want to see it if that seems strange to you. Edited, ok the vcc was OC after viewing the log files it would appear that I glitched past the first glitch and now I need the OC glitch and I am fined tuned. That must have been the OF bug, I just seen OE and thought that that was the bug, basically, everything is looking good, I am a OC glitch away from success.

[Crazy1_79]

Just to update, first I would like to say thanks to you JT for all the info you shared with me on this one, I really do appreciate it, I must say it was a good thing I got that rom 3 for test glitch, I got a oc and a of hit at 378 ohms on my loader, I know that seems like low ohms but over at Cardcoders the black board t911 seems to run a lot lower on resistance than most other models, around 200 seems pretty common so I am in the clear there, I then put in a streamlocked 383 and it is chugging away at it, I didn't touch a thing, not ohms or anything, I only changed the values in the unlock script to match the values in the test glitch script. It has been going for almost a hour now, I am going to let it run over nite and see if it pops, will report back in the morning.

[Sean77]

1- A 6V power supply may work, but I think you should go with a 9V 300mA or better. That's what the spec sheets say most of these unloopers are designed to work with....even though I think internally the voltage is staged down to about 4.5V.
2- I couldn't get UFP16 to run on my winxp machine either, but xpatmel works great if you change the timing settings to 60/50/1
3- I'm gonna tell you the same thing I told Crazy and that is I think your gonna want to have an open rom3 to put the testglitch .bin on and run the testglitchfind.xvb. This is how you fine tune your modded loader. Once 'tuned', then you can run the unlocker .xvb's. .xvb's are winexplorer programs and you'll be using winexplorer5.0 to run them. You will need to set up a new profile in the parameters of winexplorer called Loader2. (I guess you don't have to call it that, but I would just so were all doing it just how it says to in the read me's)
4- Your loader isn't 'tuned' right yet, so your getting errors
5- Backdoor disabled in Nagra means your streamlocked or have a blocker/rev spoofer on the card.

Thanx JT,

Is there anyway tune the loader without any open rom3? i just have rom10s (locked & unlocked) so how can tune my loader & there is another question, in xpatmel program there is no place to set this timing 60/50/1, do i have an old version or what?!

thanx for help

[Crazy1_79]

JT, YOU DA MAN!!! I popped a 383 last night!!! WHOO HOO< penga, No1b4me, I"M NOT WORTHY!!! JT, the test glitch is definately the way to go, I was so far off on ohms by simply going by response from card that I never would have gotten it, I was way down around the 80 ohm range, The 378 ohm is what popped the card, it took a long time for test glitch about 18 minutes to hit OF and another 7 or 8 to hit the OC so unlocking the rom 3 took a while, I was sleeping when it popped so I can't give a precise time, The log seems pretty long I would have to say 2 hours at least that but that is a shot in the dark from the lenght of the log. I am going to pop another 383 while I am at work today and then get to work on the a23's when I get home, I think if I run test glitch and fine tun some more I could shorten the lengh of time it takes to pop them but we will let it slide right now because I am happier than a puppy with two peters!! Thanks JT for all of the help

[Crazy1_79]

Thanx JT,

Is there anyway tune the loader without any open rom3? i just have rom10s (locked & unlocked) so how can tune my loader & there is another question, in xpatmel program there is no place to set this timing 60/50/1, do i have an old version or what?!

thanx for help
do a right click on the bar just below the the window where all of the flashes are located, it will ask if you want to show timing settings then you put in 60/50/1

[robo]

sean u can do it with just a rom 10 theres is no test glitch for a rom 10 so throw the streamlocked one in and start trying to pop it it might take u awhile but u can do it

[Sean77]

sean u can do it with just a rom 10 theres is no test glitch for a rom 10 so throw the streamlocked one in and start trying to pop it it might take u awhile but u can do it

i just get RESETs !!

[JT]

Glad to hear of your success Crazy. Youv'e earned it!

[Crazy1_79]

Thanks JT, now the rest of the story, popped a second 383 while I was at work, didn't take very long by the length of the log, maybe 20 minutes to a hour, so I get home and slap a a23 in there and all I get is reset reset reset reset at my glitch test ohm level, I start getting 6f6f6f6f6f6f6f6f6f6f at around 1000+ ohms, I am now running test glitch on my rom 3 at that ohmage to see if glitch success is possible, I am getting mostly aaaaaaaa with maybe a 20 percent ff on certain lines. I am going to let it roll for 20 minutes and see what happens.

[robo]

sann ive your getting all esets just up your vcc and work it back down start high reall high start like 99 and 90 then work it down

[Crazy1_79]

robo, I tried that, I get reset reset reset 6f6f reset reset rest 6f reset reset 6f6f6f6f6f6f6f6f reset and that is it.

JT, is it possible I am going to have to work in the dark here and slowly manipulate the ohm in the range that the rom 10 is going to want to work and just wait and see what works for me? I can't get a glitch in the 1000+ ohm range on the test glitch, and the rom 10 refuses to do anything but reset at that resistance. I've tried newd 7, 8, and 9

[Crazy1_79]

Hey JT, i'm sure your busy if you are getting ecm'd like I am, but did you have to change your setting in the script or on the trimpot to go from rom 3 to 10? I am having a hell of a time here, nothing with rom 3 settings for the rom 10, just reset reset reset reset

[Sean77]

Hey JT, i'm sure your busy if you are getting ecm'd like I am, but did you have to change your setting in the script or on the trimpot to go from rom 3 to 10? I am having a hell of a time here, nothing with rom 3 settings for the rom 10, just reset reset reset reset


hey man you got my problem finally, i hope you can work it out

[Crazy1_79]

I'm pretty confident I can, we know it isn't mod related because I used the loader to unlock rom 3's, it is going to be a combination of trimmer adjustment and setting adjustment, with the help of glitch anylyzer and a ton of reading at other sites among this one, I am trying to tackle it as we speak.

[Sean77]

I'm pretty confident I can, we know it isn't mod related because I used the loader to unlock rom 3's, it is going to be a combination of trimmer adjustment and setting adjustment, with the help of glitch anylyzer and a ton of reading at other sites among this one, I am trying to tackle it as we speak.


where is the "glitch anylyzer" ? can we use it for rom10?
& please let me know how could you tackle that resets, im sure you can do it, its one week im playing with that & got nothing.

thanx man

[JT]

Hey JT, i'm sure your busy if you are getting ecm'd like I am, but did you have to change your setting in the script or on the trimpot to go from rom 3 to 10? I am having a hell of a time here, nothing with rom 3 settings for the rom 10, just reset reset reset reset

I havn't offered any help with your current issue because I never had any problem like your having, and I don't know exactly what to do to fix it. I dont change anything when I switch from rom3 to rom10 EXCEPT the VCC start and limit in the software. Once I get the trimmer pot set right with rom3 and testglitchfind I don't touch the trimmer at all. The only thing I can tell you is to go over the read me that comes with the rom10 unlocker.xvb and make sure your not missing something.

[Crazy1_79]

Thanks JT, that is all the answer I need, I was wondering if you had to change anything, from reading your posts, I didn't think you did. but was just wanting to make sure, I am getting the response from the card but at different ohm value than rom 3.