A24 Unlock VXB

[BirdieMod]

I do not have any streamlocked A24's to try this on, But the mods to the script looked good to me from what I could tell.
Post back if it works so if it is good I can add it to public files.
Thanks

[VirgoVixen]

I have one @24, will check it out and post my findings.

.

[VirgoVixen]

I started at 2.2 ohms and readjusted, it ended up at .21 when it said "we hit our bug"
Used d9 flash

Executing Script: C:\A24UNLOCKER\A24-StreamORchecksumlocked fast .XVB
TX Data : A0
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 07 1B
RX Data : 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50
30 31 30 20 52 65 76 41 32
TX Data : 12 15 AB 21 00 08 A0 CA 00 00 02 12 00 06 55 0E
03 85 00
RX Data : 12 06
RX Data : 12 00 08 92 04 00

Now we will try 0C20 delay
6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F
now we will try 0C21 delay
6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F
now we will try 0C22 delay
6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6FFFFFFFFFFFFFFFFFFFFFFFFF FFFFFFFFFF6FFF6F6F6F6F6F6F6F6F6F6F6FFFFF6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6FFF6F6F6F6F6F6F6F6F6F6F6F6F6F 6FFF6FFF6F6F6F6F6F6F6F6F6FFFFFFF6FFFFFFFFF6F6FFF6F FFFF6FFFFFFF6F6F6F6FFFFF6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6FFFFFFF6F6F6F6F6F6F6F6F6F6FFFFFFFFF6F6FFF6F6F6F 6F6F6F6F6F6F6F6F6F6F6FFF6FFF6F6F6F6F6F6F6F6F6F6F6F 6F6FFFFFFFFF6F6F6F6F6F6F6F6F6FFF6F6F6F6FFF6F6F6F6F 6F6F6F6F6F6F6F6F6F6FFFFFFFFFFF6F6F6F6F6F6F6F6F6F6F 6F6F6F6FFFFFFF6F6F6F6F6F6F6F6F6F6F6F6F6F6FFFFFFF6F 6F
now we will try 0C23 delay
6F6F6F6F6F6F6F6F6F6FFF6F6FFFFF6F6F6F6F6F6F6F6F6F6F 6FFF6F6F6FFF6F6F6F6F6F6F6F6F6F6F6F6FFF6FFF6FFFFF6F 6F6F6F6F6F6F6F6F6F6F6F6FFFFF6FFF6F6F6F6F6F6F6F6F6F 6FFF6F6F6FFF6F6F6F6F6F6F6F6F6F6F6F6F6F6F6FFFFF6FFF 6F6F6F6F6F6F6F6F6F6F6F6FFFFFFFFFFF6F6F6F6F6F6F6F6F 6F6F6FFFFF6F6F6FFF6F6F6F6F6F6F6F6F6F6F6FFF6F6FFFFF FF6F6F6F6F6F6F6F6F6F6F6FFF6F6FFFFF6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6FFFFF6F6F6F6F6F6F6F6F6F6F6F6F6F6FFF FF6F6F6F6F6F6F6F6F6F6F6F6FFF6F6F6FFFFF6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6FFF6F6F6F6F6F6F6F6F6F6F6FFFFFFF 6F6FFF6F6F6F6F6F6F6F6F6F6F6F6F6FFF6FFFFF6F6F6F6F6F 6F6F6F6F6F6F6FFFFFFFFFFF6F6F6F6F6F6F6F6F6F6F6FFF6F 6F
now we will try 0C24 delay
FFFFFF6F6F6F6F6F6F6F6F6F6F6FFF6FFFFFFF6F6F6F6F6F6F 6F6F6F6F6F6F6FFF6FFFFFFF6F6F6F6F6F6F6F6F6F6F6F6F6F FF6F6FFF6F6F6F6F6F6F6F6F6F6F6F6F6F6F6FFFFF6F6F6F6F 6F6F6F6F6F6F6FFF6F6F6F6FFF6F6F6F6F6F6F6F6F6F6F6FFF 6F6FFFFF6F6F6F6F6F6F6F6F6F6F6F6F6F6F6FFFFFFF6F6F6F 6F6F6F6FFF6F6F6F6F6F6F6FFF6F6F6F6F6F6F6F6F6F6F6FFF 6F6F6F6FFFFF6F6F6F6F6F6F6F6F6FFF6F6F6F6FFF6FFF6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6FFF6F6F6F6F6F6F6F6F6F6F6F 6F6FFFFFFF6FFF6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6FFFFF6F6F6F6F6F6F6F6F6F 6F6F6F6FFFFFFFFF6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6FFF6FFFFF6F6F6F6F6F6F6F6F 6F
now we will try 0C25 delay
6F6FFFFF6FFF6F6F6F6F6F6F6F6F6F6F6F6F6F6F6FFF6FFFFF 6F6F6F6F6F6F6F6F6F6F6FFF6F6F6FFFFF6F6F6F6F6F6F6F6F 6F6F6F6FFFFF6F6FFF6F6F6F6F6F6F6F6F6F6F6F6FFFFFFFFF FF6F6F6F6F6F6F6F6FFF6F6F6F6F6FFFFFFF6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6FFFFF6F6F6F6F6F6F6F6F6F6F6F6F6FFF6F 6FFF6F6F6F6F6F6F6F6F6F6F6F6FFF6F6F6FFF6F6F6F6F6F6F 6F6F6F6F6F6FFFFFFFFFFF6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6FFF6F6F6F6F6F6F6F6F6F6F6F6F6F6F6FFF6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6FFFFFFF6F6F6F6F6F6F6F6F6F6F6F6FFF 6F6FFFFF6F6F6F6F6F6F6F6F6F6F6F6F6F6FFF6F6F6F6F6F6F 6F6F6F6FFFFFFFFFFFFFFFFFFF6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6FFFFF6F6F6F6F6FFF6F6FFF6F6F6F6FFFFFFFFF6F6F6F 6F
now we will try 0C26 delay
6F6F6F6F6FFF6FFF6F6FFFFFFF6F6F6F6F6F6F6F6F6F6F6FFF FFFFFFFFFF6F6F6F6F6F6F6F6FFF6F6FFFFFFF6FFFFF6F6F6F 6F6F6F6F6F6F6F6F6FFFFFFFFFFF6F6F6F6F6F6F6F6F6F6F6F 6F6FFFFFFFFF6F6F6F6F6F6F6F6F6F6FFF6FFFFF6F6FFF6F6F 6F6F6F6F6F6F6F6F6FFFFFFFFFFFFF6FFF6F6F6F6F6F6FFF6F 6F6F6FFFFFFFFF6F6F6F6F6F6F6F6F6F6F6FFF6F6F6F6FFF6F 6F6F6F6F6F6F83

*********** we hit our bug *************
1200078303
===========================================
83 was hit at 0C26 delay ----VCC WAS 1F
TX Data : 0A 15 A3 21 92 00 B3 0E 03 85 00
RX Data : 0A 06
RX Data : 12 92 00 80 21
***************************
* A24 CAM should be OPEN *
* test in Nagra to see. *
* if not, try again. *
***************************

Script C:\A24UNLOCKER\A24-StreamORchecksumlocked fast .XVB Transmission Completed


Timeout from 2A command
The Update Status Word is at 0 (Decimal)

The Fuse Byte is at 0 (Decimal)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~

Ok I went to nagra 4.0 did a one step clean and got ATR bad, so I restarted computer and redid, got same thing. Then I tried nagra 3.0 did one step clean and got this below

ATR String: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXX
ROM Revision: 010
EEPROM Revision: RevA24
ProviderID: 00
CamID: 00 XX XX XX
Using BD3 Key: 4E 69 70 50 45 72 20 49 73 20 XX XX XX XX XX
Attempting to login to BD3
BackDoor login verified
Dumping Dataspace
Using BD0 Key: 21 DC 75 D6 01 82 33 22 66 XX XX XX XX XX XX
Attempting to login to BD3
Attempting to login to BD0
BackDoor login verified
Dumping CodeSpace
Reading ROM10 successful
Card read successfully
Efficiency: 100.0%, Packets: 141, Retries: 0, Time: 16.83s
Closing of COM1 was successful
Card image cleaned successfully
Opening of COM1 was successful
ATR String: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXX
ROM Revision: 010
EEPROM Revision: RevA24
ProviderID: 00
CamID: 00 XX XX XX
Using BD3 Key: 4E 69 70 50 45 72 20 49 73 20 XX XX XX XX XX XX
Attempting to login to BD3
BackDoor login verified
Dumping Dataspace
Using BD0 Key: 21 DC 75 D6 01 82 33 22 66 XX XX XX XX XX XX
Attempting to login to BD3
Attempting to login to BD0
BackDoor login verified
Attempting to login to BD0
Disabling card
Writing ROM10 failed
Closing of COM1 was successful
Error detected, One Step Clean incomplete

.

[VirgoVixen]

I went back and did a read on the card and got this

Opening of COM1 was successful
ATR String: XX XX XX XX XX XX XX XX XX
ROM Revision: 010
EEPROM Revision: RevA16
ProviderID: 00
CamID: 00 XX XX XX XX
Using BD3 Key: 4E 69 70 50 45 72 20 49 73 20 61 XX XX XX XX XX
Attempting to login to BD3
BackDoor login verified
Dumping Dataspace
Error changing decrypt keys
Write error encountered, attempting to restore original decrypt keys
ProviderID: 00
CamID: 00 XX XX XX
Attempting to login to BD3
Error, unabled to restore decrypt keys
Decrypt keys: 10 E6 78 2B E2 7A 02 E1 90 D9 CD DA 12 21 C4 56
BF 16 B8 44 85 04 CF 33 1E F8 FE CE 2E 96 43 89
7B 36 83 40 19 51 8C 8A 7A B7 91 D7 AF C5 DE 7F
77 52 55 FD 1D 4E 9C FE 26 79 13 C8 D3 8D 8F CF
4D 0E C6 49 B6 02 F8 74 7B E3 BA E3 11 F6 E3 01
DE 29 1B E4 86 A3 C3
Reading ROM10 failed
Closing of COM1 was successful

I don't know what decrypt keys are so I don't know what to do from here.

[HDTV MAN]

I bet it's marked. let us know.

Use Powersync2b, it works and does not mark the card!!!

[VirgoVixen]

I redid another one step clean in nagra 3 got same as above. Then restarted computer and did a one step clean in nagra 4, success, all looks good, card is now open and cleaned. Able to now read.

How do I know if it is marked, where do I check for that?

[VirgoVixen]

found where 10's are marked at=C008. If there is FF at C008 it is marked. This one has 26 at C008 so my guess it is not marked.

C000: D7 7C E0 19 30 0F 51 00 26 00 00 00 00 00 00 FF
C010: FF FF FF FF FF FF FF FF FF FF FF FF 0A 01 F5 00

I have not programed yet to see how it works in receiver yet. But so far so good and this looks to be a kickass rom 10 @24 unlocker :). Thanks Birdie for sharing.

.

[blue_grass_tv]

I went back and did a read on the card and got this

Opening of COM1 was successful
ATR String: XX XX XX XX XX XX XX XX XX
ROM Revision: 010
EEPROM Revision: RevA16
ProviderID: 00
CamID: 00 XX XX XX XX
Using BD3 Key: 4E 69 70 50 45 72 20 49 73 20 61 XX XX XX XX XX
Attempting to login to BD3
BackDoor login verified
Dumping Dataspace
Error changing decrypt keys
Write error encountered, attempting to restore original decrypt keys
ProviderID: 00
CamID: 00 XX XX XX
Attempting to login to BD3
Error, unabled to restore decrypt keys
Decrypt keys: 10 E6 78 2B E2 7A 02 E1 90 D9 CD DA 12 21 C4 56
BF 16 B8 44 85 04 CF 33 1E F8 FE CE 2E 96 43 89
7B 36 83 40 19 51 8C 8A 7A B7 91 D7 AF C5 DE 7F
77 52 55 FD 1D 4E 9C FE 26 79 13 C8 D3 8D 8F CF
4D 0E C6 49 B6 02 F8 74 7B E3 BA E3 11 F6 E3 01
DE 29 1B E4 86 A3 C3
Reading ROM10 failed
Closing of COM1 was successful

I don't know what decrypt keys are so I don't know what to do from here.


I have had this happen on 2 different cards. The only thing different I did is pull the card from the modded loader before closing winexplorer. Never had one read this way when I closed it first. Maybe just coincidence?

I was able to clean and read them both on a different computer, but with Restarts, and a less than 100% effeciency. In each case I just wrote a bin to the card and restreamed it and let it get updated to Rev A24, then unlocked each successfully with powersync3. Then they both read and cleaned like all other cards I have unlocked.

Thanks for the file Birdie, never can have too many tools in the arsenal. I will try it out on my next Rev A24, and post results.

[Crazy1_79]

we are going to lock one and try it folks, I have about 4 extra rom 10's so I can afford one of them

[Crazy1_79]

BTW, I was reading over at card coders and it seems these A24's were suppose to be glitch proof with a single glitch attempt, all the code to accomplish this is in the update, but somehow it didnt' work, be prepared for dish to correct this mistake and lock us out of them for good in the near future. Just a FYI warning.

[harbor]

i'm using mod T911 loader on MY rom10 A24 i use a24unlocker.zip.
but all i get it this can someone help me out??? i don't know what i did..





:mad: :(


Executing Script: C:\Documents and Settings\tom\Local Settings\Temp\A24-StreamORchecksumlocked fast .XVB
TX Data : A0
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 07 1B
RX Data : 3F 00 3F 00 3F 00 3F 00 3F 3C 30 00 00 3F 00 3C
38 00 3F 20 3F 00 3F 00 00
TX Data : 12 15 AB 21 00 08 A0 CA 00 00 02 12 00 06 55 0E
03 85 00
RX Data : 12 06
RX Data : 00 FF FF FF FF FF

Now we will try 0C20 delay
RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET

Script Error on Line 193
Script Aborted By User

[playme1979]

check ur flash

[mongoose123]

is this for a 3.68 reader / writer or a flashed modded unlooper

what flash do u use if its for only a loader?

[harbor]

New VB Script File - Created 12/5/04
' FOR Dish rom 10 A23 rev STREAMLOCKED And Dealerlocked!
' Thanks to No1be4me,Penga! DELAYS CHANGED BY RICKYWASHERE PICS AND MUSIC BY DEVILDSS
'************************************************* *************************************

'Instruction Table
'01 Reset Card (Leaves card clock off)
'02 4.608 MHz Card Clock Off -FREEZE CAM
'03 4.608 MHz Card Clock On - FREE RUNNING CAM
'04 XX XX Delay $XXXX card clocks and glitch VCC on high phase with 1.152 MHz Card clock
'05 XX XX Delay $XXXX card clocks and glitch VCC on high phase with 1.536 MHz Card clock
'07 XX XX Delay $XXXX card clocks and glitch VCC on low phase with 1.152 MHz Card clock
'06 XX XX Delay $XXXX card clocks and glitch VCC on low phase with 1.536 MHz Card clock
'09 rom 10 glitch DELAY -- 2*CARD CLOCKS -- ex. 2x xx xx 09 for timing
'0E XX SET WD TIMER
'0F POWER DOWN CAM
'1X TX RX SPEED

'2X XX XX Delay $2X XX XX Atmel clock cycles

'8X-9X Rx from card, instruction anded with $1f plus 1 bytes Ex. $9F = rx $20 bytes
'aX-FX Tx to card, instruction anded with $5f plus 1 bytes Ex. $FF = Tx $60 bytes
'************************************************* *************************************
'Commands
'80 Check Card Presence - Sends 1 byte
'90 Get chip ID - Sends 4 Bytes (DISH)
'AX Set Bi-color Led - X = 0 off, X = 1 Red, X = 2 Green
'B0 XX Set Glitch VCC - VCC = (5/255) * XX

Option Explicit
Dim ResetCounter
Dim Bytes
dim bytes2
Dim BR2(5)
Dim VCCStart
Dim VCCLimit
Dim VCC
Dim DelayEnd
Dim DelayStart
Dim GlitchType
Dim TryCnt
DIM TryLimit
DIM TRYCNT2
DIM RT
DIM TestMode
Dim logo
TRYCNT2=1
Sc.Playsound("spookwelcome.wav")
logo= "logo.jpg"
Sc.Picturebox "logo.jpg",3
Sub Main()

Sc.Reset

' These are the variables you can change for rom 10 dish A23


VCCStart = &h26 'Enter your VCC Ceiling Here from VCCAnalyzerV2!
VCCLimit = VCCStart - &h10 'This subtracts &h09 from the start value
DelayStart=&h0c20 'Try &h123E for Streamlocked. Try &h1100 or &h0C20 for checksumlocked.
DelayEnd = &h0c40 'Try &h127A for Streamlocked. Try &h1108 or &h0C40 for checksumlocked.
TryCnt = 300 'Number of tries per delay FROM 5-50000
TestMode = 0 'TestMode, 1 = ON, 0 = OFF

'TestMode is used to find a glitch point on A23 cam. once you find the
'delay and vcc settings on cam then set TestMode = 0, and open the cam.

' end of variables

GlitchType=&h09
VCC = VCCStart
RT = DelayStart









Executing Script: C:\Documents and Settings\tom\Local Settings\Temp\A24-StreamORchecksumlocked fast .XVB
TX Data : A0
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 06 01
TX Data : 12 15 AB 21 00 08 A0 CA 00 00 02 12 00 06 55 0E
03 85 00
RX Data : 03 00

Now we will try 0C20 delay
RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET

Script Error on Line 193
Script Aborted By User


i have a24 but i can't get any luck on it .. all i get it RESET not like 6F6F6F6F6F6F6F6F like you... what are yor setting for the VCCSTART and VCCLimit ??? can you help me out?? i have try for 2 days now and still get same thing...i 'm using my moded T911 and i set at 2.2 let you say and flash with newd9 flash....

[mongoose123]

I ran this script about 7 times

it said it found the bug and was should be open 7 separate times

THE TRUTH IS THIS DOESNT WORK!








Executing Script: D:\My Documents\Explorer\A24-StreamORchecksumlocked fast .XVB

Trying to reset card...
Reset Successful

RX ATR : 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50 30 31 30 20 52 65 76 41 32 34 4C
TX Data : A0
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 1A 82
RX Data : 00 98 07 70 82 00 F2 0E E0 82 00 62 03 30 82 00
B2 10 01 82 00 83 01 10 82
TX Data : 12 15 AB 21 00 08 A0 CA 00 00 02 12 00 06 55 0E
03 85 00
RX Data : 82 00

Now we will try 0C20 delay
94 RESET 2000E0 RESET RESET D19C RESET RESET 00E2AB RESET CC80 RESET 0E00D253 RESET RESET 74 RESET 8800514E RESET EA001242 RESET 1B RESET RESET 0C0008 RESET 004C42 RESET 0000C499 RESET 4B004FD2 RESET 00D6 RESET RESET 002346 RESET E0 RESET RESET F40030DE RESET E2AB RESET 0000A512 RESET EA001E83

*********** we hit our bug *************
0182008301
===========================================
83 was hit at 0C20 delay ----VCC WAS 26
TX Data : 0A 15 A3 21 92 00 B3 0E 03 85 00
RX Data : 82 00
***************************
* A24 CAM should be OPEN *
* test in Nagra to see. *
* if not, try again. *
***************************

Script D:\My Documents\Explorer\A24-StreamORchecksumlocked fast .XVB Transmission Completed


Executing Script: D:\My Documents\Explorer\A24-StreamORchecksumlocked fast .XVB

Trying to reset card...
Reset Successful

RX ATR : 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50 30 31 30 20 52 65 76 41 32 34 4C
TX Data : A0
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 1A 82
RX Data : 00 98 07 70 82 00 F2 0E E0 82 00 62 03 30 82 00
B2 10 01 82 00 83 01 10 82
TX Data : 12 15 AB 21 00 08 A0 CA 00 00 02 12 00 06 55 0E
03 85 00
RX Data : 82 00

Now we will try 0C20 delay
94 RESET 2000E0 RESET RESET D19C RESET RESET 00E2AB RESET CC80 RESET 0E00D253 RESET RESET 74 RESET 8800514E RESET EA001242 RESET 1B RESET RESET 0C0008 RESET 004C42 RESET 0000C499 RESET 4B004FD2 RESET 00D6 RESET RESET 002346 RESET E0 RESET RESET F40030DE RESET E2AB RESET 0000A512 RESET EA001E83

*********** we hit our bug *************
0182008301
===========================================
83 was hit at 0C20 delay ----VCC WAS 26
TX Data : 0A 15 A3 21 92 00 B3 0E 03 85 00
RX Data : 82 00
***************************
* A24 CAM should be OPEN *
* test in Nagra to see. *
* if not, try again. *
***************************

Script D:\My Documents\Explorer\A24-StreamORchecksumlocked fast .XVB Transmission Completed


Executing Script: D:\My Documents\Explorer\A24-StreamORchecksumlocked fast .XVB

Trying to reset card...
Reset Successful

RX ATR : 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50 30 31 30 20 52 65 76 41 32 34 4C
TX Data : A0
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 1A 82
RX Data : 00 98 07 70 82 00 F2 0E E0 82 00 62 03 30 82 00
B2 10 01 82 00 83 01 10 82
TX Data : 12 15 AB 21 00 08 A0 CA 00 00 02 12 00 06 55 0E
03 85 00
RX Data : 82 00

Now we will try 0C20 delay
94 RESET 2000E0 RESET RESET D19C RESET RESET 00E2AB RESET CC80 RESET 0E00D253 RESET RESET 74 RESET 8800514E RESET EA001242 RESET 1B RESET RESET 0C0008 RESET 004C42 RESET 0000C499 RESET 4B004FD2 RESET 00D6 RESET RESET 002346 RESET E0 RESET RESET F40030DE RESET E2AB RESET 0000A512 RESET EA001E83

*********** we hit our bug *************
0182008301
===========================================
83 was hit at 0C20 delay ----VCC WAS 26
TX Data : 0A 15 A3 21 92 00 B3 0E 03 85 00
RX Data : 82 00
***************************
* A24 CAM should be OPEN *
* test in Nagra to see. *
* if not, try again. *
***************************

Script D:\My Documents\Explorer\A24-StreamORchecksumlocked fast .XVB Transmission Completed


Executing Script: D:\My Documents\Explorer\A24-StreamORchecksumlocked fast .XVB

Trying to reset card...
Reset Successful

RX ATR : 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50 30 31 30 20 52 65 76 41 32 34 4C
TX Data : A0
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 1A 82
RX Data : 00 98 07 70 82 00 F2 0E E0 82 00 62 03 30 82 00
B2 10 01 82 00 83 01 10 82
TX Data : 12 15 AB 21 00 08 A0 CA 00 00 02 12 00 06 55 0E
03 85 00
RX Data : 82 00

Now we will try 0C20 delay
94 RESET 2000E0 RESET RESET D19C RESET RESET 00E2AB RESET CC80 RESET 0E00D253 RESET RESET 74 RESET 8800514E RESET EA001242 RESET 1B RESET RESET 0C0008 RESET 004C42 RESET 0000C499 RESET 4B004FD2 RESET 00D6 RESET RESET 002346 RESET E0 RESET RESET F40030DE RESET E2AB RESET 0000A512 RESET EA001E83

*********** we hit our bug *************
0182008301
===========================================
83 was hit at 0C20 delay ----VCC WAS 26
TX Data : 0A 15 A3 21 92 00 B3 0E 03 85 00
RX Data : 82 00
***************************
* A24 CAM should be OPEN *
* test in Nagra to see. *
* if not, try again. *
***************************

Script D:\My Documents\Explorer\A24-StreamORchecksumlocked fast .XVB Transmission Completed


Executing Script: D:\My Documents\Explorer\A24-StreamORchecksumlocked fast .XVB

Trying to reset card...
Reset Successful

RX ATR : 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50 30 31 30 20 52 65 76 41 32 34 4C
TX Data : A0
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 1A 82
RX Data : 00 98 07 70 82 00 F2 0E E0 82 00 62 03 30 82 00
B2 10 01 82 00 83 01 10 82
TX Data : 12 15 AB 21 00 08 A0 CA 00 00 02 12 00 06 55 0E
03 85 00
RX Data : 82 00

Now we will try 0C20 delay
94 RESET 2000E0 RESET RESET D19C RESET RESET 00E2AB RESET CC80 RESET 0E00D253 RESET RESET 74 RESET 8800514E RESET EA001242 RESET 1B RESET RESET 0C0008 RESET 004C42 RESET 0000C499 RESET 4B004FD2 RESET 00D6 RESET RESET 002346 RESET E0 RESET RESET F40030DE RESET E2AB RESET 0000A512 RESET EA001E83

*********** we hit our bug *************
0182008301
===========================================
83 was hit at 0C20 delay ----VCC WAS 26
TX Data : 0A 15 A3 21 92 00 B3 0E 03 85 00
RX Data : 82 00
***************************
* A24 CAM should be OPEN *
* test in Nagra to see. *
* if not, try again. *
***************************

Script D:\My Documents\Explorer\A24-StreamORchecksumlocked fast .XVB Transmission Completed

[mongoose123]

I am using a 3.68 regular reader/writer and it seems to be running the script fast and correctly

[recog]

Greetings ...
This is a very interesting discussion ... I have an old HU glitcher (basic 2313 type) ... Is there simply a new program to load into the 2313 to make it a "mod 911" type for ROM 10 card glitching ? OR are there hardware changes (ie. voltages, resistors, etc.) needed to "mod" the glitcher ?

Is someone here suggesting you do NOT need a glitcher ? And one can simply use a simple "phoenix" style programmer (3.68 MHZ xtal) and winexplorer to open the A24 on the ROM 10 card ?

Keep up the testing .... :)

[VirgoVixen]

You must have a modded loader. Without a modded loader you will not be able to unlock any card. An iso programmer with a 3.68 crystal will not work on unlocking. A modded loader is an HU unlooper that has been modified by soldiering to make it into an unlocker.

If you do have a modded loader below is what i did.
I started at 2.2 ohms and readjusted, it ended up at .21 when I got a good mix of 6F's. I
Used d9 flash, I also did not mess with the settings, I left them as they are setup on the script.

VCCStart = &h26
VCCLimit = VCCStart - &h10
DelayStart=&h0c20
DelayEnd = &h0c40

after it said "we hit our bug", I closed the program and then used my iso programmer with the 3.68 crystal in it and I had to restart my computer and use nagraedit 3 to do a one step clean, restart again and was able to read and program card in nagraedit 4.

.

[harbor]

HI VIRGOVIXEN.....

I do have modded loader T911 and i do what you say set at 2.2 and readjusted it ended up at .21 but i still get this RESET all the way.......

VCCStart = &h26 'Enter your VCC Ceiling Here from VCCAnalyzerV2!
VCCLimit = VCCStart - &h10 'This subtracts &h09 from the start value
DelayStart=&h0c20 'Try &h123E for Streamlocked. Try &h1100 or &h0C20 for checksumlocked.
DelayEnd = &h0c40 'Try &h127A for Streamlocked. Try &h1108 or &h0C40 for checksumlocked.
TryCnt = 300 'Number of tries per delay FROM 5-50000
TestMode = 0 'TestMode, 1 = ON, 0 = OFF





Executing Script: C:\Documents and Settings\tom\Local Settings\Temp\A24-StreamORchecksumlocked fast .XVB
TX Data : A0
TX Data : A0
TX Data : A1
TX Data : 07 0E 03 10 01 03 9A 00
RX Data : 07 1B
RX Data : 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50
30 31 30 20 52 65 76 41 32
TX Data : 12 15 AB 21 00 08 A0 CA 00 00 02 12 00 06 55 0E
03 85 00
RX Data : 11 00

Now we will try 0C20 delay
RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET RESET

Script Error on Line 132
Script Aborted By User

[VirgoVixen]

I am not sure what else to tell you to do, as I am fairly new to unlocking myself, but getting RESET means the loader is not detecting the card I think. Have you been successfull at unlocking other cards with your loader? If so then you should have as much or more knowledge as myself on unlocking. I can only tell you what I did to get my card unlocked. I flashed my loader to d9, I didn't mess with the settings and just ran the A24unlock script, and while the script was running I adjusted my trim pot or trimmer or ohm thingy up and down untill I got a good mix of 6F's. As you see above my results. I wished I could be of more help as I know it gets frustrating, but I don't know what else to tell you to try. Did you restart your computer and do a one step clean with nagraedit 3? My card said it was open but couldn't clean it untill I did a restart and used nagraedit 3. If you did try this then I am not sure what else to tell you to do. Did you try flash d8? Maybe yours won't work with the d9 flash.

[mongoose123]

actually rompopper uses a 3.68 crystal and a ISO programmer
so your wrong

this script works with my reader/writer and communicates with the card
its just after it says its complete and the card is open
that is not the case
the card is still locked

[robo]

your not gonna unlock a a24 without a modded loader

[harbor]

HI VIRGOVIXEN.....

i findly got it to unlock my a24 ..

because one of my wire came off so i fix that and get it pop rigth way.

thanks for the reply

[VirgoVixen]

mongoose if you get your iso programmer to unlock a stream or dealer locked rom 3 @383, or a rom 10 @23 or 24 please post your success. I am sure alot of people who do not have a modded loader would be more than happy for the good news. I have been successful at unlocking some cards with my iso programmer, but they were not stream or dealer locked at the current rev's. So maybe you were referring to that about me being wrong. Yes an iso programmer can unlock cards, depending on the rev, so I stand corrected about an unmodded iso programmer not being able to unlock *any* cards.

Harbor- GREAT, glad you got it unlocked and found the problem. :)

Vixen

[Crazy1_79]

mongoose if you get your iso programmer to unlock a stream or dealer locked rom 3 @383, or a rom 10 @23 or 24 please post your success. I am sure alot of people who do not have a modded loader would be more than happy for the good news. I have been successful at unlocking some cards with my iso programmer, but they were not stream or dealer locked at the current rev's. So maybe you were referring to that about me being wrong. Yes an iso programmer can unlock cards, depending on the rev, so I stand corrected about an unmodded iso programmer not being able to unlock *any* cards.

Harbor- GREAT, glad you got it unlocked and found the problem. :)

Vixen
I have created a virgovixen unlocking guru! LOL

[Crazy1_79]

Finally got my hands on a A24 card, got the script, ran vcc analyzer got my vcc range of 6 for the ceiling and it sets the floor, I tried the OC20 and OC40 range a few times, no poppy, I tried the standard 123E to 127A andno poppy, I even ran it in my usual range of 1300 all the way to 1420 and no poppy. Finally seen where everyone has had success, in the oc20 range to oc40 range and my loader has never been one to follow suit so I started it at OC40 and this is what I got.

*********** we hit our bug *************
1200078303
===========================================
83 was hit at 0C48 delay ----VCC WAS 06
TX Data : 0A 15 A3 21 92 00 B3 0E 03 85 00
RX Data : 0A 06
RX Data : 12 92 00 80 21
***************************
* A24 CAM should be OPEN *
* test in Nagra to see. *
* if not, try again. *
***************************

Should of started there to start with. LOL.

[BirdieMod]

Tried it out myself with a card just pulled from the stream a week ago. Modded MIK 3 flash D8. Edited the settings to where my loader worked good with A23 cards and it popped the A24 just fine. Programmed rom 10 and been watching it the last few days.
Didn't have any problems with one step clean.

[mongoose123]

when i find the instructions on how to modify my green t911 i will try a modded loader with this stuff

[MR_MEPHISTO]

I use this file just yesterday.... is good stuff.... this is my results
now we will try 0C11 delay
Thanks a lot....

6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6FFF6FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFFFFFFFFFF6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6FFF6F6F6F6F6F FFFF6FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF FFFFFFFFFFFFFF6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6FFFFFFFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF FFFF6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6FFFFF6FFFFFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F
now we will try 0C12 delay
6F6F6FFF6F6F6F6FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6FFF6F6FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFFFFFFFF6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6FFF6F6F6F6F6F6FFF 6FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF FFFFFFFFFFFF6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6FFFFFFFFFFFFFFF FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF FF6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6F6F6F6F6F6F6FFF6FFF6F6FFFFFFF6FFFFFFFFFFFFFFFFFFF FF
now we will try 0C13 delay
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF6F6F6F6F6F 6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F6F 6FFF6F6F6F6FFF83

*********** we hit our bug *************
1200078303
===========================================
83 was hit at 0C13 delay ----VCC WAS 2B
TX Data : 0A 15 A3 21 92 00 B3 0E 03 85 00
RX Data : 0A 06
RX Data : 12 92 00 80 21
***************************
* A24 CAM should be OPEN *
* test in Nagra to see. *
* if not, try again. *
***************************

[thehasher]

everytime I start the A 24 unlocker script this message pops up,I am using a Powersync unlocker flashed w/ D9,any suggestions would be welcomed. Thanks



Script Error on Line 48
Wrong number of arguments or invalid property assignment: 'Sc.Playsound'

[mongoose123]

pshhh that file is awesome your doing something wrong or you need a moded t911 loader from dishmonkey.com

[thehasher]

Any idea what could be wrong ??,I am able to unlock rom 3's and 10's with no problem,the Powersync unlocker is an unlocker designed for unlocking cards,it is not made for one thing then gets modified to tackle another job so I dought if it is the Powersync.

[mongoose123]

what did you use to unlock the rom3 and what rev was it at?

[thehasher]

I used Penga's unlocker,I have unlocked at least ten rom 3's ,all were at rev 383, I have also unlocked about twelve rom 10 rev a23 ,never had any troubles till this A24 card.

[methos]

thehasher, open the script in notepad. then scroll down to this

Option Explicit
Dim ResetCounter
Dim Bytes
dim bytes2
Dim BR2(5)
Dim VCCStart
Dim VCCLimit
Dim VCC
Dim DelayEnd
Dim DelayStart
Dim GlitchType
Dim TryCnt
DIM TryLimit
DIM TRYCNT2
DIM RT
DIM TestMode
Dim logo
TRYCNT2=1
Sc.Playsound("spookwelcome.wav")<<<<<<<<<<<<<remove this line
logo= "logo.jpg"
Sc.Picturebox "logo.jpg",3
Sub Main()

that should take care of that error.

[mongoose123]

where is the Penga's unlocker script at?????? what was your start and ending points and low and high vcc

[skinerd]

Used the above script on a fresh stream locked A24, popped in under 5 minutes....actually closer to 3 mins......
Modded T911 loader, 2k pot at about 50%.

[mongoose123]

i need something for a rom3 at rev383 badly where is the penga unlocker script

[gold]

ROM Revision: 010
EEPROM Revision: RevA24
ProviderID: 00

Attempting to login to BD3
BackDoor login verified
Dumping Dataspace
Backdoor retrieval has been blocked
Attempting to login to BD3
Attempting to login to BD0
Unable to login, bad password detected
Attempting to login to BD0
Unable to login, bad password detected
Attempting to login to BD0
Unable to login, bad password detected
Login attempt aborted
Reading ROM10 failed
Closing of COM1 was successful


I OPENED THE CAM NOW IT GIVES ME THIS..ANY HELP..THANKS

[methos]

try this to find the BD0 login....

use a 3.68 iso.

settings....Echostar with 3.68 crystle

[HILLBILLY]

did any of u guys use an orange nexus? been trying this a24 for a week now. all proggies, flashes, trim pots. got the card on ebay, so no history. any suggestions for the unglitchable a24?
hillbilly

[HILLBILLY]

Hillbilly--- I just cracked TWO of them!!!! Try loading D11 into your atmel and run
A24-Rom10-autoOPEN.xvb. YOu might just like what you get!!!

Treelover
i can't seen to find d11. i have newd 11, will that be ok?
also, is it an orange u have? did u change any of the settings(delay, vcc) or the trim pot? what did did u use ? 3 works for everything for me. i am asking because i've been running all kinds os scripts and settings on this vastard for more than 6 days! the funny thing is, in those 6 days, i've popped 3 rev a23 and a 383 no issues.
thanks
hillbilly

[HILLBILLY]

thanks for the offer. i'll let u know. are u in the states or canada?
hillbilly

[plydo]

Just a quick question....When you program the modded t911, do you put 1and5 on? When you run scripts, do you put 2and5 on?

When you flash the atmel, do you run the program in dos or windows?

Just some dumb questions from an old newbie :)

Thanks

[mongoose123]

i have a locked rom 3 rev383 i will swap any1 for a locked rom10 also

hahaha

or if any1 knows a good program that is new and recent that works let me know

[Nagra1]

Just unlocked 5 Rom10 cards at A24 took from 30 secs to 2 mins on each card.....

Mod T911 Newd11
A24unlocker


These setting in WinExp
data baud=115200
reset baud=115200
parity =none
rec timout=1000
byte delay=100
reset delay=100
stopbits =1
byte convention= direct
flush echo bytes= no check
flush receive buffer= check

===========================
advanced tab

check device reset(no atr)
no check ignore receive timout
dtr= low
rts= high
toggle line =rts

[JCK7]

USE newd 11 flash leave on auto open
less 2 min
with rom 10 back this best try

end of variables you should change
VCCStart = &h99 'YOU CAN CHANGE THIS FROM 21-99 = this is automatic now
VCCLimit = &h00 'YOU CAN CHANGE THIS FROM 00-20 = this is automatic now
DelayEnd = &h125C 'DISH A23 IS 125A- could be as high as 127A = this is automatic now
GlitchType= &h09
DelayEnd = DelayStart + &h50 'adds 20 to Delaystart to auto set Delayend
VCC = VCCStart
++++++++++++++++++++++++++++++++++++++++++++

Now we will try 0C00 delay
TX Data : B0 99
TX Data : 61 15 F6 21 00
TX Data : 53 A0 CA 00 00 4D 03 4B 00 C5 10 6F 15 CC 00 CC
TX Data : 00 CC 00 CC 00 0C CD 32 0C 5A EA 2D 2D 0C CD 32
TX Data : 0C 5A EA 2D 2D B1 C4 45 F4 E1 20 14 80 8D 4C F0
TX Data : AA A6 1D 0D AA 1D F4 97 65 2E 88 4E 25 0C CD 32
TX Data : 0C 5A EA 2D 2D B1 C4 45 F4 E1 20 14 80 05 67 21
TX Data : 92 00 00 00 7D 20 0C 00 09 0E 05 85 00
RX Data : 61 06
RX Data : 12 40 02 6F 00
+
TX Data : 08 0E 03 10 01 01 03 9A 00
RX Data : 08 1B ++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++++++++++++++++++++++++-+--++-+-++-+++--++--++++--+-+-++-+++--+----+-+----+-+-+-++--+---+--+++--+---+++++++-------++++
Now we will try 0C01 delay, our VCC is about 3B and our Glitch Type is 08
+---++++-++-+-+--+++-++---+-++++++---+---+-+++---+++-+++-+-++----+++++-++------+-+++--+-++-+-+-+-+--+++---++-++----+++--+-+--+--+++-++---++-+++---+---++-----++-+---+--+++++--+++---+----++++--
Now we will try 0C02 delay, our VCC is about 3A and our Glitch Type is 08
-+--+++--+++++--+---+--+-+----+++++++++++-+++------+--+++-+-+--+++-+-+++-++-+---++-+--+----++++-+-+-+---++---++-+++---+-+++--+-++---+--+--++-++-+-++-++--+--+-++--+---++----+--+++-+-+-+++--+-+
Now we will try 0C03 delay, our VCC is about 37 and our Glitch Type is 07
+---+-+-+--+++--+---+-++---++-++-+-+-+-+-+++--+++-----++++-++---+++++-+--++++---+++---------++--++--+-++-+-+++++-+++-+-----+---++-+--+-+--+++++-+++++-+---+-+---+-+-+-+---+-+++-+---++++----+++
Now we will try 0C04 delay, our VCC is about 36 and our Glitch Type is 06
--+--+++--+-+-+---+--+--+--+-+++++--+++--+-+-+--+-+++--+--+---+---+--++-++-+++---++-++++-++-++--+---+-++-+-+--+-+++-+-+-+-++-++-++-----+-+--++---+++-++---+-+-+-++--++-++-++--+--+--+++-+++-++-
Now we will try 0C05 delay, our VCC is about 35 and our Glitch Type is 06
-++--+--+-++-+----+++-++++----++-+-+--+-+-----++++---++---+-++++++---+-+----+--+--++-+-+-+-+--+++-+-++++--++++----++-++-++--+++-+++-++--+-+-+-+--+-+---+++--++-++-----+-+-+-+-++---+-+++-++-+-+
Now we will try 0C06 delay, our VCC is about 34 and our Glitch Type is 05
----++----+--+----+++-++++++--+--++---++--+-+++++---++-+---+--++++-++---+++------+++++--+------+--+++-++++---+---++++--+-++-+--+++-+++-+-+--++-+-++-++-+--+-+++--+-++-++-+-+--+-+--+-++-++--+--
Now we will try 0C07 delay, our VCC is about 35 and our Glitch Type is 05
+-+--++-+-++-+++----+-+++----++--++---+--+----++-+++++++--+-++---+--+--+--+-+++-++---+--+-+--++----++--+-++++++--+-+--++----++---++-+--++--+-++-+-+++-+-+---+++-++++-+--+++--+-+++-+----+-++++-
Now we will try 0C08 delay, our VCC is about 34 and our Glitch Type is 09
++--+--+----+--+-+-+--+++++++-+-+-++---+---+--+++-++----+-+---+--+---++++-+++-+-+-+++++++-----++-+-+--+-+-------++-+--+++-+++----+++---+-+-+--+--++--++-+--+-++--++---++---+-+-+++-+-++++++-+-+
Now we will try 0C09 delay, our VCC is about 37 and our Glitch Type is 09
+-++--++--+--+--+++-+++++----+-+++-+-+-+--+-++--+---+++-++-+----++-+++---+--+-+-----+---+++-++-+++++++-+-+-+--+---++-----++---+++++-+-++++-+-+--+---+-++-+-+---++--+----+++-++---+---++--+++--+
Now we will try 0C0A delay, our VCC is about 3A and our Glitch Type is 08
+++-++---+----++++++-++-+--++---++++-+---+-++--+++-+++--+-----+++++---++-++-+--++-++--++-+-+-+--+-+--++-++-+-+-----+---+++++-++-+-+-+--------+---++++++++++---+-+--++-++---++--+---+-++----+-+-
Now we will try 0C0B delay, our VCC is about 3B and our Glitch Type is 07
+----+++++-+--+-++----+++--+-+--+++---+++-++-++-++-++-+++--++-++++---+++-----++--+--++-+++++----++---++++--++--+----+++-++----+--+-++-+-++--+--++-++--+----+--+++++-----++-+-+++-+-++++-++-+---
Now we will try 0C0C delay, our VCC is about 36 and our Glitch Type is 07
-+---+++------+--+++-+++---+--+++++--++-+--+++-++-------+++--++-+--++-+-+-+-+++--+-++++-++-+--++++-----+---++-+---+++-++--++---++++-+-+---+++-------++++++++--+--+----++---+++-+-+-++++-+--++--
Now we will try 0C0D delay, our VCC is about 37 and our Glitch Type is 06
---++-+-++-++-++-++++---+---+---+-++-+++-++----+--+-----+++-++-++--+-+----+-++-++--++--++++++--++++--+--+---++--+++-+++----+-+--++--+--++-+-++----++-++++-+-+++-+++--+-+-++-+---+--+++-----+--+
Now we will try 0C0E delay, our VCC is about 38 and our Glitch Type is 06
-+++--+-+-+-+-++--+--+-++-++-+-+++--+++-----+---+-+++--+-+-++++-+-----+-++---+-+--++-+--+++---+++-----++++--++---++-+++++--++-+---+++-+++-++-++-++-----+--+--+++--++-++-+-+++--+---++--++-+-+-+
Now we will try 0C0F delay, our VCC is about 35 and our Glitch Type is 05
++-+-+-++--+-+--+--+--+++++---+++-+---++---+--++-++-+-+-+++--+------+++-++--+--+++---++-+-+----+----+-++--+--+--+-++-++--+--+++-+-++-++-+++-++-++-+++++--++-+--+-++-+--+--++-++--+--+-+--+--++-
Now we will try 0C10 delay, our VCC is about 36 and our Glitch Type is 04
--+-+++-----+---+--+-+-+++-+-++--++++++-+-+----+----+++--++++-++-+-+---++--++-++--+-+-+--++---++--+++--+-+-+----+--+-+++-++-+---+-+---++++++-+---+--+--+++-+++-+--+-+-++---++-+----+-+-++-+--++
Now we will try 0C11 delay, our VCC is about 3B and our Glitch Type is 09
+-+--++++--++-++--++++++---+-++-------+++--++++-+++--+-+-+--+---++--++++++---+--++-+++---++-++--++--+-++--+--+-+-----++-+-+-++--+--+--++---++++-+--+--+--+-+-+--+-++---+++--++-+++--++--+-+-+-+
Now we will try 0C12 delay, our VCC is about 3A and our Glitch Type is 09
+++--++++--+-+++--+-++-+-++--+++--++-----++----+-+++-+-+++-+----+-+++-++-+---+-+-++-++---++---+---++++-++----+-+-++------+-++++++-++-+++---+-+-+---+-+---++-++-+--++--++---+-++---++---+-+++-+-
Now we will try 0C13 delay, our VCC is about 3B and our Glitch Type is 08
+--++--+-+-+-++---++-++-+++++-+--+--++-+--+-+-++++-++-++----++-+-++-++-++--+--++-++----+--+-++-+++-++-+--+---++--+++++-+---+--+--+--+--+++-+-++-+---+-++---+++-+---+-+-+++---++--+--+++----++--
Now we will try 0C14 delay, our VCC is about 3A and our Glitch Type is 07
++-+--+-+--+-----++++---+-+++----+-++-+-+-++++---+++--+++-++-+-+++---+-++++--+--+-++--+++-+--++-+--++-++-+--+++----+-+-----++++-+++----++++--+-+++-+---+++++-------++-++---+--++++-+--++----+++
Now we will try 0C15 delay, our VCC is about 37 and our Glitch Type is 07
-+--+--++---+--+-+-+++--++--++++---++++-----+-+-+-+---+--+++-+---++-+-++-++++++-+---+-++---++++-+-+-++++--+-+++-+-+--+----++-+---+-++--+-+++---+-+--++++--+-+-++---++-+++----+-++--+-+++-+--+-+
Now we will try 0C16 delay, our VCC is about 36 and our Glitch Type is 06
--+++--+----+-++++---++---++-+---++++-+-++--++--+-+-+--++++++--------+-+++-----++--+-++-++----++++-++-+-++-+-+++++---+-+-+++-+-++---++--+++-+-+--+-+-+-+---++-+-+--++++-+++--+-+++---+--++---++
Now we will try 0C17 delay, our VCC is about 33 and our Glitch Type is 05
+--+-+---+-+--+++--+-+---+-++-++-++-+---+----+----++-+++-++++--+-+-++-++-+--+---+--+--++---++---+--+-++-+++++-++------+-+++-++---++-++--++-++-+-+-+-++----+-+-+++++--++---++++++-+++--+-+---+--
Now we will try 0C18 delay, our VCC is about 36 and our Glitch Type is 05
++++--+-+-++-+--+-+-+--++--+----+-----++++--++--++++++-+--+-+---++--+-+---+++---+---+++-+++------++-+++-+--+--+-+++---++++-++-----++++--+--++---+-++-++-++-++-++--++++-++-+-+---+++-++--+---+-+
Now we will try 0C19 delay, our VCC is about 35 and our Glitch Type is 04
-+-+-+-++-----++--++--+-++--+-++-+++-+-+-+-++-++-++------+---+++++-+---++++--++++-+--+-+-----+-+++--+-+--+-----+-+++---+-++++++-+-++----+---++-++-++++----+--++-+--+++-----+--++-++-+-++++-++++
Now we will try 0C1A delay, our VCC is about 34 and our Glitch Type is 09
+-----++++-+++--++--++---------+-+-++++-++---++--+-+++---++-+-+++---+++----+++--++-++--+---+--+--+-++-+++++++-+-++---+-+---++-+-----+-++-+-+-++--+--++-+-+--+++-+--+--++---+-++-++++----++--+--
Now we will try 0C1B delay, our VCC is about 3B and our Glitch Type is 08
+-+++----+-+-+++---+-++--+++++++-+-++++-+-++-++--+--+-----+-++-++-+

*********** we hit our bug *************
1200078303
===========================================
83 was hit at 0C1B delay ----VCC WAS 34 , our GlitchType was 05

TX Data : 0A 15 A3 21 92 00 B3 0E 03 85 00
RX Data : 0A 06
RX Data : 12 92 00 80 21
***************************
* A23 CAM should be OPEN *
* test in Nagra to see. *
* if not, try again. *
***************************
and open ok

[apaz1]

up to now I have not been able to unlock a true a24 stream locked. All I get is reset reset reset or FFFFFFFFFF not OF. I don't think its glitching into the rom. I've done several A23 and 383. maybe you guys are opening softlooped roms. or blocker caused a24. I dont know?????

[pwang100]

Anyone had success using this file to unlock Mili's old private blocker?

[Cimba]

Why would you use that instead of the R10 unlocker built in or the extra one that he provided ?

[bobsmith161]

BTW, I was reading over at card coders and it seems these A24's were suppose to be glitch proof with a single glitch attempt, all the code to accomplish this is in the update, but somehow it didnt' work, be prepared for dish to correct this mistake and lock us out of them for good in the near future. Just a FYI warning.
that would explain why i have not ever been able to get in to my a24:o

[pwang100]

I tried the unlocker it came with many times. It didnt work. I didnt know there was another one provided, I'll try that one next.

[pwang100]

Why would you use that instead of the R10 unlocker built in or the extra one that he provided ?

I tried the one called Dishblocker 4.0... All that does is give me an error that says, 'card still locked, set parameters to dishblocker..."

I also tried the one called Dish_Rom10_Opener, that was packaged with the Dishblocker. This one goes through 7 packets, and says "card should be unlocked, try nagraedit..." But nagraedit still reads them as A24's and cant get in.

My original question, was.. are there any other scripts that can be recommended, since these two dont seem to let me into either of 2 different cards?

[swttvro]

谢谢大家