311 Open

[skinerd]

Got my first 311 Rom102 rev 281 popped tonight, running wide open, locals remapped......shit it was relatively EASY.......

Save your bin, save it in saveral places so you will have a good copy case you mess it up......all the info you need to get it working is in the card bin.......receiver number, boxkeys, all other keys are in there........SAVE IT.......

[ellsmako]

OK I'll bite:

How did you do it , I have one 311 collecting dust,... please enlighten me, spoon feed, use a fork , shovel, it does not matter , but please please

[SPARKY_NY]

Got my first 311 Rom102 rev 281 popped tonight, running wide open, locals remapped......shit it was relatively EASY.......

Save your bin, save it in saveral places so you will have a good copy case you mess it up......all the info you need to get it working is in the card bin.......receiver number, boxkeys, all other keys are in there........SAVE IT.......

Nice..... next is a 625 right? LOL
I have been patiently watching the Rom103 progress, but so far there is none. It sure would be nice to fire up a dual-tuner cardless ! I got a 625 that is sitting there patiently waiting for the testing to evolve to the next step.

Nice work! Any thoughts on jtagging the beast?

[skinerd]

OK I'll bite:

How did you do it , I have one 311 collecting dust,... please enlighten me, spoon feed, use a fork , shovel, it does not matter , but please please

Go to the cardless forums at rom10x, that's where i got my hookup info, the hardest part is cutting traces, and soldering, if you can solder, you can do this. I used an old Magic card, with the components cut off, wired as an interface to the unlooper and ISO loader. I had to have help on the bin to load it with, that is not my strong point, but it's WIDE open....was sent a working bin from another 311, patched the info from my chip read, GenDt08-sk was used for that.
Glitching took about 20 minutes, actually did 2, both glitched in about 20 mins each.
One of the two done is dead, chip glitched fine tho, but box won't power on, I did not check it before I started and it looks rough, (may have been under a bird cage) so prolly been dead from the start.
Get yours hooked, glitched and open, read and saved, if you need help with the bin, holler...

[ellsmako]

OK looks like I have some reading to do,.. Just happen to have a magic card hanging around doing nothing, because it stopped programming just after warrenty.

Sure Skinerd , I will try it , now that my 501 is working great with a new 80 gb drive and all my other recievers ( almost all ) are running great I have some time.

Thanks again Skinerd

[lakeboy]

Go to the cardless forums at rom10x, that's where i got my hookup info, the hardest part is cutting traces, and soldering, if you can solder, you can do this. I used an old Magic card, with the components cut off, wired as an interface to the unlooper and ISO loader. I had to have help on the bin to load it with, that is not my strong point, but it's WIDE open....was sent a working bin from another 311, patched the info from my chip read, GenDt08-sk was used for that.
Glitching took about 20 minutes, actually did 2, both glitched in about 20 mins each.
One of the two done is dead, chip glitched fine tho, but box won't power on, I did not check it before I started and it looks rough, (may have been under a bird cage) so prolly been dead from the start.
Get yours hooked, glitched and open, read and saved, if you need help with the bin, holler...

Hi skinerd,
I have an original new(never subbed) and it has never been in the data stream. I glitched in and got it to open. I read and saved card image. I can find the CAMID, but the Boxkeys are all zero's. I can't test this one now until jtag is possible for this IRD. Was your IRD an ex-subbed?
Thanks....

[skinerd]

Hi skinerd,
I have an original new(never subbed) and it has never been in the data stream. I glitched in and got it to open. I read and saved card image. I can find the CAMID, but the Boxkeys are all zero's. I can't test this one now until jtag is possible for this IRD. Was your IRD an ex-subbed?
Thanks....

You can't use a virgin 311 receiver, the chip is not married and has no useable info....yes, mine was an ex-sub.

[Chicoboom]

Go to the cardless forums at rom10x, that's where i got my hookup info, the hardest part is cutting traces, and soldering, ..
Sorry, where is that "Cardless" Forum ... ????
Be more explicit please... where we could find the "Knowhow" to jtag and start using a 311. 015 Receiver?????:confused:

[skinerd]

Sorry, where is that "Cardless" Forum ... ????
Be more explicit please... where we could find the "Knowhow" to jtag and start using a 311. 015 Receiver?????:confused:

I don't like to refer people to other sites, but we don't have it all here, so I recommend xxx.rom10x.com,
specifically hxxp://www.rom10x.com/forums/forumdisplay.php?f=285
is the cardless forum.
A 311 cannot be read with a jtag yet, but can still be made to work IF it is subbed or an ex-sub unit. If you are careful you won't loop the cam, it will glitch and then you can read/modify it.

[ellsmako]

Go to the cardless forums at rom10x, is where skinard said it was and guess what thats where it is , I will only have time this weekend but it looks interesting

Thanks for the projet Skinard

[skinerd]

Go to the cardless forums at rom10x, is where skinard said it was and guess what thats where it is , I will only have time this weekend but it looks interesting

Thanks for the projet Skinard
I was a bit apprensive to try this 311, but figured what the heck,,,,,downloaded pics from the 311 thread, found it relatively easy to accomplish. The traces a touch tricky to cut, the wires a little tricky to get attached to the board and an old magic card, but pay attention to detail, you'll get it. A really good feeling to see that chip reveal it's data when read with N2Edit, you know you got it hooked right. Then move to the unlocker, glitch it. Go back to N2B7 and save the image, save it in 3 places, don't mess with 2 of them save as backup only.

[Littlebear151]

Great job Skinerd..

I been waiting and following the Jtag thread.. I think the def won't be a big deal but it looks like setting the trap for DCU boot might be another thing..
we might see a break through soon.. its a little over my head.. but once these guys get an adapter to dump the chip I look for them to figure it out..I think I'll hold off till we have a way to fix the IRD in case of a ecm.

LB

[bigeee]

Hi Guy's, here is what I did to get this cardless IRD going. I used an old dead atmega board that I stripped and cut the traces.
Then I used a six conductor phone wire and socket plus two switches to toggle between run and chip load settings.
I unlocking the rom-102 chip in less than 5 min's, I reactivated the bin, added 3m, added v22 blocker and boom "TV"
The 311 must be a former sub'd IRD with a rom 102 chip to work.

[ellsmako]

I have extensive solder experience etc ( parts of the job ) willing to play with my 311 , bought it for $5.00 last year shipping was basically free because it was thrown in with a bunch of other stuff, bonus was it has a real rom 102 in the card slot. ( what Luck )

Been using the 102 for a couple of months now. Can't wait !!!!!! ;)

[time]

still can't get it going
updated bin on box card, updated keyes

not aurtherised


over and over on screan

[0zone]

With all respect to Sinknir not bragging I got abut 13 of this box going here rev 281 is the easy one if you have rev 283 that’s some thug rev to open lol but I got it going after 1hr gliching with powersync I am using MC1 for hooking up IC here is my setup

[sukh77]

I guess I'll be using my A2 card instead of magic. Soon as I get the guts to open up the 811.

[0zone]

That’s my next target as soon I gets one 811 is going down yeah!

[Chicoboom]

All I get trying unlocking this 311 w/ cam 102 R283 is ----------------------------------
But when I try a plastic 102 I got n+---n+--n+--n+---n+-n+--n+-- and I unlock in less than 2 min...Then my Blue nexus and his trim-pod is ok... I Think!!!

Somebody knows why am getting those continusly -------- and at the end "bad cmd04 response"??????
The Iso read well the cam atr and provider.

[time]

rong contacts
cold solder contacts
looped card

My advise start from scratch again

redo everything

components on board have moved while soldering

[Chicoboom]

How I know if the card is looped???
I read the card with ISO and I get the ATR , camrom type and Revision and provider.

[time]

Your not looped
need to unlock