Romcode won't unlock card

[RockyM]

Tried cleaning card in Romcode so I can reprogram, but it says it's dealer or stream locked. The card's in my ISO programmer - does it have to be in the Nexus unlocker instead?

[Ohms]

No. It needs to be in the ISO for romcode to do anything with it.
Was it programed with romcode before? If not, then you need to unlock it first. The romcode software thinks you have a blocker installed. If you do, go into n2edit and unlock with your password first. Then clean with romcode. If it's stream locked, you will have to glitch it with the unlocker.

If it was last written with romcode, you may need their help to unlock it.

[RockyM]

Definately programmed in Romcode first (last week). Then I had problems with flashing my IRD. Finally revived the ird, changed ird / boxkeys, inserted card and got the "card not valid for this receiver". (which is strange, because the IRD # / boxkeys are directly from Romcode). So I figure I'll start from scratch, reprogram card, change ird #, etc. The Romcode says it's dealer or stream locked. But it's Romcode's own blocker on there. Will unlocking it with nagramaster and nexus get the ball rolling again?

[aposton]

thats been the problem all along Rocky,that card needs to be opened before you can program it

[Ohms]

What may have happened is that the romcode blocker didn't install correctly last time, and the card got stream locked when you had it in the IRD. Run N2Edit with the card in your ISO and do a reset. Tell us what rev it is at. If it's 105, then that's what the romcode blocker spoofs to. If it's higher, it's probably stream locked and will need to be glitched.
Report back please

[RockyM]

It's at Rev 105. I'm letting it sit for a bit, maybe it needs to register in the stream? It was definately unlocked when it first got programmed in Romcode. Lemme go see how it looks now.....

[Ohms]

Then it's not stream locked and you will probably need help from romcode to get it going.
Sorry man.

[Rockytoad]

go into romcode , in settings next to backdoor unlock code click and paste first set of numbers, save,go back to clean card , reset atr, and you should be good to go Rocky,if not try the next line of numbers.first set of numbers worked for me.

A9CFD2E6ADD62FF1
250BF0D6F39DF24A
799EE56954B04AA9
C8C8894041EE0411

[Ohms]

Then it's not stream locked and you will probably need help from romcode to get it going.
Sorry man.


Mili told me it was ok to refer you to satjunction.com. This is where the romcode coders hang. They can help with strange issues like this. there is a sticky in the romcode section of the forum that has some unlock codes to try. if they don't work, post in the forum for help. You will get it.

[Ohms]

AH HA! Rockytoad beat me to it. :) I sent him there too.
Excellent!!!!

[RockyM]

Love you guys. I'll try the backdoor password in the morning.

[RockyM]

Perfect, the first unlock code unlocked the card. So I reprogrammed the card in Romcode, re-jtaged the ird, now I'm getting the "card inserted is not authorized error. My boxkeys and ird # are correct. Now what do I do?

[Ohms]

What IRD are you using?

[RockyM]

a 2800.

[dabarg]

OK I'm in the same boat sort of... All working fine for weeks until the key change.
Go to RomCode to clean and get the locked message. thank to Ohms Rocky for pointing out the codes to get back in, BUT..... the last three do nothing for me but the first one is the password that comes up as the "default unlock code" on my RomeCode program and when I enter it in my settings it trys to unlock for awhile then I get this error (attached image) and if I continue it does nothing else and if I quit it exits. What next?

[benleo]

I looked at your image. There was a thread with some other guy having the same problem about a month ago over at satjunction dot com. It's "Arithmetic error resulted in overflow." I'm pretty sure he had to edit something in net frameworks or his registry. One of the Mods there figured it out. I can't remember the thread, but search over there . You are not the first person to run into this.

[rasimaga]

OK I'm in the same boat sort of... All working fine for weeks until the key change.
Go to RomCode to clean and get the locked message. thank to Ohms Rocky for pointing out the codes to get back in, BUT..... the last three do nothing for me but the first one is the password that comes up as the "default unlock code" on my RomeCode program and when I enter it in my settings it trys to unlock for awhile then I get this error (attached image) and if I continue it does nothing else and if I quit it exits. What next?





PENGA PASWORD IS


B000B1E5B000B1E5


Iwas have 3 and i open it with tdat pass

[lonestar23]

Is there anyway I can open my card locked be a dealer?

the dealer got busted, and they are not talking to there customers at this time

and we just got this Yellow card 2 weeks ago.

any Help I can get is much appreciated , my kids are going crazy ..

thanks in advance ,

[jimmyhat]

try this script. it opens the romcode dealer locked so it may open yours too.






'************************************************* *************************************
'* New VB SCRIPT CREATED BY RebelSerf - 1/31/06 *
'* *
'* FOR STREAM LOCKED, PASSWORD LOCKED or SOFT LOOPED ROM 102s. *
'* AUTOMATIC VCC, SEMI-AUTO DELAY RANGE *
'* USES ONLY NEWD13.HEX WITH LOADER *
'* THANKS TO A CERTAIN SLAVE DRIVER ;-) *
'* *
'* HAPPY UNLOCKING AND GOOD LUCK!! *
'* *
'************************************************* *************************************
Option Explicit
Dim StartDate
Dim BuffFlg
Dim bytes2
Dim IntTim
Dim RngFlg
Dim RngHi
Dim RngLo
Dim SlFlg
Dim RdLen
Dim DtPnt
Dim bytes
Dim Uflg
Dim Acnt
Dim Mix
Dim VS1
Dim VT1
Dim DS1
Dim LP1
Dim LP2
Dim RT2
Dim RT3
Dim RT7
Dim VG
Dim DD
Dim TL
Dim RT
Dim T1
Dim T2
Dim T3
Dim T4
Dim T5
Dim T6
Dim GT
RT7 = 0
LP1 = 1
BuffFlg = 0
RngFlg = 0
SlFlg = 0
Uflg = 0
VT1 = 1
DS1 = 960
DD = DS1 + 96
GT= 6
RngLo = DS1
RngHi = DD
RT = RngLo
RT3 = RT 'Do not change any values above this line
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^

Sub Main()
Setupunlocker()
If CheckChipVer <> 1 then
Sc.MsgBox("Flash Version ND13 needed to run this script" & VbCr & "Flash your Loader with NewD13.hex")
Exit Sub
End if
' These, AND ONLY THESE :), are the variables you can change for rom 102 any revision up to 105/241
LP1 = 40 'Number of tries per delay FROM 20-100 in multiples of 20
VS1 = 40 'YOU CAN CHANGE THIS FROM 02-255 = semi-automatic VCC range - Loader dependent
Mix = 0.5 'Glitch VCC resolution - attempts per VCC = 1/mix
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^
VG = VS1
sc.verbose = 0
Sc.Write("A0") ' turn led off
Clearoutputwindow
If ChkCard() = 0 then
Sc.MsgBox(" Unsupported Rom Version: Rom " & T1 & ", Rev " & T4 & " found." & VbCr & "This Script is for use with Rom 102, Revs up to 105/241")
Exit Sub
End if
If RT7 <> 0 then
Sc.MsgBox(" Invalid or no atr. Card may be looped or an unsupported rom." & vbcr & " Unable to continue.")
exit sub
end if
Clearoutputwindow
StartDate = Now()
Print "Initial Parameters = Delay:" & HexString(RT, 4) & " VCC:" & HexString(VG, 2) & " Glitch Type:" & HexString(GT, 2)& vbcr & vbcr
Do
If BuffFlg = 0 then
Acnt = 0
Do
sc.delay(10)
Sc.Write("07 0E 03 10 01 03 9A 00") 'reset card
Sc.Read(02)
Bytes = Sc.Getbyte(1)
If Bytes > 25 then
Sc.Read(27)
Exit Do
End if
Acnt = Acnt + 1
If Acnt > 5 then
Exit Do
End If
Loop
If Acnt > 5 then
Sc.MsgBox(" Check Loader Settings. Invalid or no atr. Card may be looped." & vbcr & " Unable to continue.")
exit sub
End If
Sc.Write("B0" & HexString(VG, 2))
Sc.Delay(10)
'sc.verbose = 1 'debug the packets
Sc.write("15 03 15 600C 2100098D00EE3100A7559D9D88 0E" & HexString(IntTim, 2) & "85 00")
Sc.Read(2)
bytes = sc.getbyte(1)
sc.read(bytes)
If bytes > 5 then
bytes = sc.getbyte(3)
If bytes = 111 then
BuffFlg = 1
sc.delay(10)
Sc.write("64 03 15 60 5B 2100588ECA9D9D9D9D559D9D9D9D9D9D9D9D9D9D9D9D9D9D9D 9D9D9D9D9D9D9D71801864A64BB76BCD7C1630C0B5021864CD 7C168219B7071864CD7C163176BE08CC7A95" & HexString(DtPnt, 2) & "BFA1FF270187BC88011E050060DB82199D9DE49D9D9D88 0E01 83 00")
Sc.Read(02)
bytes = sc.getbyte(1)
Sc.read(bytes)
End If
End If
End If
If BuffFlg = 1 then
Sc.Write("A0")
Sc.Delay(20)
Sc.write("0D 03 15 6004 F4C101BC88 0E01 83 00")
Sc.Read(2)
bytes = sc.getbyte(1)
sc.read(bytes)
Sc.Write("12 03 15 6003 48C00088 0E01 83 20" & HexString(RT,4) & HexString(GT, 2) & "0E10 00")
sc.read(2)
Bytes = Sc.Getbyte(1)
Sc.Read(Bytes)
End If
Sc.write("0D 03 15 6004 F4C101BC88 0E01 83 00")
Sc.Read(2)
bytes = sc.getbyte(1)
If bytes > 3 then
sc.read(bytes)
bytes = sc.getbyte(0)
bytes2 = sc.getbyte(3)
If bytes2 = 144 then
BuffFlg = 0
UFlg = 1
End If
If bytes = 79 then
print "-"
VG = VG - mix
Else
If bytes =< 72 and RngFlg = 0 then
If bytes >= 64 then
If RngFlg < 3 then
RngFlg = RngFlg + 1
End If
RngLo = RT - 3
If RngLo < DS1 then
RngLo = DS1
End If
RngHi = RngLo + 5
RT = RngLo
End If
End If
BuffFlg = 0
Print "+" & HexString(bytes,2)
VG = VG + mix
End If
Else
PRINT " Rst" & HexString(VG, 2)
BuffFlg = 0
VG = VG + mix
sc.write("02 03 00")
sc.write("02 02 00")
End if
If BuffFlg = 0 then
Sc.Write("08 0E 03 10 01 01 03 9A 00") 'reset card
sc.read(02)
bytes = sc.getbyte(1)
sc.read(bytes)
sc.delay(16)
If SlFlg = 1 then
Sc.write("2C 03 15 6023 210020A0CA00001A041801018600AA9D9D9D9D9D9D9D9D9DAE 69CC7A9BBE000000000088 0E06" & HexString(RdLen, 2) & "00")
Sc.Read(2)
bytes = sc.getbyte(1)
If bytes > 5 then
sc.read(bytes)
bytes = sc.getbyte(0)
bytes2 = sc.getbyte(3)
If bytes = 18 and bytes2 = 132 then
sc.write("13 03 15 600A 210007A0FF0000024800330E02 85 00")
Sc.Read(2)
bytes = sc.getbyte(1)
If bytes > 5 then
sc.read(bytes)
bytes = sc.getbyte(0)
bytes2 = sc.getbyte(3)
If bytes = 18 and bytes2 = 105 then
UFlg = 1
End If
End If
End If
End if
End If
If SlFlg = 0 then
Sc.write("14 03 15 600B 210008A0CA0000020400CD88 0E06" & HexString(RdLen, 2) & "00")
Sc.Read(2)
bytes = sc.getbyte(1)
If bytes > 5 then
sc.read(bytes)
bytes = sc.getbyte(0)
bytes2 = sc.getbyte(3)
If bytes = 18 and bytes2 = 132 then
If SlFlg <> 1 then
bytes2 = sc.getbyte(5)
Uflg =1
End If
End If
End If
End If
End If
If Uflg = 1 then
Print " !!!!!!!" & VBCr
Sc.Write("A1")
Sc.delay(500)
print
print "******* Good response received! *********"& VbCr
PRINT " " & HEXSTRING(bytes2,2) & VbCr
Sc.Print "===========================================" & VbCr
print " " & HexString(bytes2, 2) & " was hit at: Delay:" & HexString(RT3, 4) & " VCC:" & HexString(VG, 2) & " GlitchType:" & HexString(GT, 2) &VBCr
print " Elapsed: " & TimeDiff(StartDate,Now())& vbcr
Print " VCC Resolution: " & mix & vbcr
Print " Delay Range: " & HexString(RngLo, 4) & " to " & HexString(RngHi, 4) & VBCr
print
SC.DELAY(700)
If Rdlen = 135 then
PRINT "********************************" & VBCR
PRINT "* 102 CAM NOW OPEN!! *" & VBCR
PRINT "* PROCEED AS NORMAL *" & VBCR
PRINT "* GOOD LUCK! :-) *" & VBCR
PRINT "********************************" & VBCR
Else
PRINT "********************************" & VBCR
PRINT "* 102 CAM REVIVED!!! *" & VBCR
PRINT "* READ THE CARD *" & VBCR
PRINT "* CLEAN CODESPACE AND *" & VBCR
PRINT "* WRITE CLEANED BIN TO CARD *" & VBCR
PRINT "* GOOD LUCK! :-) *" & VBCR
PRINT "********************************" & VBCR
End If
exit sub
End If
If VG < VT1 then
VG = VS1
End if
If VG > VS1 then
If VG >= 254 then
VG = VS1 / 2
End If
End If
If VG + mix = 0 or VG + 1 = 0 then
VG = VS1
End if
GT = GT - 3
If GT < 6 then
GT = 9
End If
LP2 = LP2 + 1
If LP2 > LP1 / mix then
ClearOutputWindow
RT = RT + 1
RT3 = RT
BuffFlg = 0
LP2 = 0
print
print "" &vbcr
print "Buffer Intercept Installed. Trying to Open the 102.... Delay:" & HexString(RT, 4) & " VCC:" & HexString(VG, 2) & " Glitch Type:" & HexString(GT, 2) & VBCr & vbcr
sc.print "Elapsed = " & TimeDiff(StartDate,Now())& vbcr & vbcr
If RT >= RngHi and RngFlg > 0 then
RT = RngLo
RngFlg = RngFlg + 1
If RngFlg >= 3 then
RngFlg = 0
RngLo = DS1
RngHi = DD
End If
End If
If RT > 1056 then
DS1 = 864
DD = DS1 + 96
RngLo = DS1
RngHi = DD
RT = RngLo
End If
If RT = 960 then
DS1 = 960
DD = DS1 + 96
RngLo = DS1
RngHi = DD
RT = RngLo
End If
End If
Loop
End Sub
Function HexString(Number,Length)
Dim RetVal
Dim CurLen
RetVal=Hex(Number)
CurLen=Len(RetVal)
If CurLen<Length Then
RetVal=String(Length-CurLen,"0") & RetVal
End If
HexString=RetVal
End Function
Function CheckChipVer()
CheckChipVer = 1
sc.write("90")
delay(80)
If sc.read(4) <> 4 then
CheckChipVer = 0
Exit Function
End if
If getbyte(0) <> &H4E then CheckChipVer = 0
If getbyte(1) <> &H44 then CheckChipVer = 0
If getbyte(2) <> &H31 then CheckChipVer = 0
If getbyte(3) <> &H33 then CheckChipVer = 0
End Function
Function TimeDiff (StartTime, EndTime)
Dim Hours, Minutes, Seconds
Seconds = DateDiff("s", StartTime, EndTime)
If Seconds > 90000 Then Seconds = 90000
If Seconds < 0 Then Seconds = 0
Minutes = Seconds / 60
Minutes = Fix(Minutes)
Seconds = Seconds - (Minutes * 60)
Hours = Minutes / 60
Hours = Fix(Hours)
Minutes = Minutes - (Hours * 60)
Seconds = CStr(Seconds)
Minutes = CStr(Minutes)
Hours = CStr(Hours)
If Len(Seconds) = 1 Then Seconds = "0" + Seconds
If Len(Minutes) = 1 Then Minutes = "0" + Minutes
If Len(Hours) = 1 Then Hours = "0" + Hours
TimeDiff = Hours & ":" & Minutes & ":" & Seconds
End Function
Function ChkCard()
ChkCard = 1
Print ""
Print " Determining type of Unlock needed ......." & VBCr
sc.delay(2000)
ClearOutputWindow
Sc.Write("08 0E 03 10 01 01 03 9A 00") 'reset card
sc.read(02)
bytes = sc.getbyte(1)
If bytes = 0 or bytes < 27 or bytes > 27 then
RT7 = 1
ClearOutputWindow
Exit function
End If
sc.read(bytes)
sc.delay(16)
T1 = chr(sc.getbyte(16))
T2 = chr(sc.getbyte(17))
T3 = chr(sc.getbyte(18))
T4 = chr(sc.getbyte(23))
T5 = chr(sc.getbyte(24))
T6 = chr(sc.getbyte(25))
T1 = T1+T2+T3
T4 = T4+T5+T6
If asc(T4) = 0 then
T4 = "000"
End If
If left(T4, 1) = "2" then
DtPnt = 156
Else
DtPnt = 167
End If
If T1 <> "102" then
ChkCard = 0
exit function
End If
If T1 = "102" and T4 = "106" or T4 = "242" then
ChkCard = 0
exit function
End If
Print " Rom " & T1 & ", Rev " & T4 & " found." & VBCR
print
Sc.delay(1500)
Sc.write("14 03 15 600B 210008A0CA0000020400CD88 0E08 86 00")
Sc.Read(2)
bytes = sc.getbyte(1)
If bytes < 6 then
RdLen = 133
IntTim = 48
print " Proceeding with Really Fooked Unlocking :-D......"
Sc.Delay(2000)
exit function
end If
if bytes > 5 then
sc.read(bytes)
bytes = sc.getbyte(0)
bytes2 = sc.getbyte(3)
If bytes = 18 and bytes2 = 132 then
RdLen = 133
IntTim = 21
SlFlg = 1
print " Proceeding with Normal Unlocking......"
Sc.Delay(2000)
exit function
Else
RdLen = 131
IntTim = 48
print " Proceeding with Fubared Unlocking :-)......"
Sc.Delay(2000)
end If
End If
End Function
Function setupunlocker()
Wx.BaudRate = 115200
Wx.ResetBaudRate = 115200
Wx.Parity = 0 ' 0 = None, 1 = Odd, 2 = Even, 3 = Mark, 4 = Space
Wx.StopBits = 0 ' 0 = 1 stop bit, 1 = 1.5 stop bits, 2 = 2 stop bits
Wx.DTRControl = 0 ' Initial state of DTR 0 = off, 1 = on
Wx.RTSControl = 1 ' Initial state of RTS 0 = off, 1 = on
Wx.ResetDelay = 100 ' In microseconds
Wx.ByteDelay = 10 ' In microseconds
Wx.RxByteTimeout = 500 ' In milliseconds
Wx.ResetMode = 2 ' 0 = No Resets, 1 = ISO Reset (Expect a ATR), 2 = Device Reset (No ATR)
Wx.ResetLine = 1 ' 0 = Toggle RTS for Reset, 1 = Toggle DTR for Reset
Wx.ByteConvention = 1 ' 0 = Inverse, 1 = Direct
Wx.FlushEchoByte = 0 ' 0 = no flush, 1 = flush - A Phoenix interface will echo each byte transmitted.
Wx.FlushBeforeWrite = 1 ' 0 = no flush, 1 = flush - Flush the receive buffer before each write to strip off Null bytes.
Wx.IgnoreTimeouts = 1 ' 0 = Abort script on a receive timeout, 1 = Ignore all receive timeouts
Wx.ResetAfterTimeout = 0 ' 0 = Don't reset after a timeout, 1 = do a reset after a timeout - Not used if "IgnoreTimeouts=0"
Wx.LogTransactions = 0 ' 0 = Don't log transactions, 1 = log transactions
Wx.DisplayUSW = 0 ' Display USW after script complete 0 = no, 1 = yes
Wx.DisplayFuse = 0 ' Display Fuse after script complete 0 = no, 1 = yes
End function

[lunar1L]

Can someone help or let me know how to contact Romcode?
I got locked out of my 311 I was using Romcode and wrote a incorrect
bin to the 311 ...Bam locked out ever since. I tried a few dealer unlock codes
from another site. Still no help. 311 102@ 283...
I tried Mili with two emails but he never answered . I know he's busy
and thatS why he cant get back to me right now. usually he's great about helping folks out.
Thanks
L

[fubr]

you can post your question here, www.satjunction.com/forum
we try to help out because Mili sells romcode and I might add we do pretty good on most issues, The problem you have will be one for them to decide if they can help you or not. thats where they read most of the time maybe one of their members will get a answer and post it for you there if you ask..

[bigstinker]

It's at Rev 105. I'm letting it sit for a bit, maybe it needs to register in the stream? It was definately unlocked when it first got programmed in Romcode. Lemme go see how it looks now.....

Does this still hold true?

I have a card the my bud F-ed up and not sure if it's romcode locked or really stream locked.

From N2edt-
CAM Type: ROM102 Rev103
Setting IFS
Provider: Unknown

If it is really strem locked what is the best script to run on it?
Thanks