Fix Unknown Provider for Rom102 and camless

[mili]

Open bin in N2E
At address 30C0 change first two bytes from BF BF to as follows, to reset datapointers:
Dish plastic is A7 BF
Dish integrated (DP311 DP811) is A5BF
BEV is 9C BF
You will then have provider back and still have sub dump info.

Thanks satjunction people

mili

[Chicodog#1]

How can I open the bin if I can't read the card? I can't read the card because of the unknown provider nag

[1one]

chicodog,
I use a padded script afterwords such as Dr.Sagans(a member here). It is called Loader_Based_Rom_102_Reader_damaged. That is if , It nis not an ex subbed!

[Chicodog#1]

Where can I find the Loader_Based_Rom_102_Reader_damaged ?

[DrSagan]

For unknown provider cards that don't respond to normal commands, use reb's v3a of the omniunlocker. It sets the dataspace pointer to BFBF and "fixes" the last 255 bytes of the card if you have fubar'd the dataspace. Then to "fix" the card, write a "clean" image(good dataspace) to the card but that clean image needs to have the dataspace pointers still set to BFBF at 30C0. After that write is complete, then you should be able to write whatever you want.

[Chicodog#1]

Thanks. I will try that

[mmjokerr]

since Ican not get my to read does this mean that I will need to use the nexus again to reopen or fix it then find a good bin to write to the card? I know these are probably simple question but I am new to the plastic game again. Also I have read Millis post about not all programmers working with 102 cards. I got a programmer 400 from him a little while back does any know if this one works or if it caused my problem

[A-Team]

Once you have the card unlocked you should not have to un-lock again.Try to read a couple of times it should go if not try writing to card this has worked for me before where i could not read the card but i was able to write 3m with latest blocker- that card has been running awhile now with no problems.

[mmjokerr]

cant read it tried writing it cant do that either keeps throwing errors

[A-Team]

cant read it tried writing it cant do that either keeps throwing errorsWhat errors- what is the rev of your card -what unlocking script did you use ? Is this your 1st card - have you done other cards with the loader your using?

[mmjokerr]

card came from milli unlocked already yes it is my first card it is 102 rev 105 usind a programmer 400 from milli also. i get an atr but it shows provider unknow I cant read or write to card. I have had responses back to write a clean bin to it. Since I cant write to the card this would seem impossible but since Im a newbie in the worst sense maybe i am not understanding what everyone is telling me to do

[mmjokerr]

Here is the info I get I did not write to the card prior to getting this and like I said in previous post the card came from Millis store already unlocked
ATR: 3F FF 95 00 FF 91 81 71 FF 47 00 44 4E 41 53 50 31 30 32 20 52 65 76 31 30 35 62
CAM Type: ROM102 Rev105
Setting IFS
Provider: Unknown
Reading Card image...
Failed to read card. (Retries: 23)

Any ideas on how to fix this problem so I can get back into the card and hopefully be able to write something to it

[omare]

Here is the info I get I did not write to the card prior to getting this and like I said in previous post the card came from Millis store already unlocked
ATR: 3F FF 95 00 FF 91 81 71 FF 47 00 44 4E 41 53 50 31 30 32 20 52 65 76 31 30 35 62
CAM Type: ROM102 Rev105
Setting IFS
Provider: Unknown
Reading Card image...
Failed to read card. (Retries: 23)

Any ideas on how to fix this problem so I can get back into the card and hopefully be able to write something to it

I have exactly the same problem.... all valid ATR but fails to read card. When I try with unlocker it goes fine and I can even write an image onto it.

Does anybody know what program (other than NAGRA MASTER) that I can use to write to the card with an unlocker???? I think my ISO might be defective.

[Trapofmind]

Is jacking up your card (or acquiring it already jacked up by another) the only way to get provider unknown?

[blkstangca]

I have the same issue, i cannot password unlock the card. I get an ATR but unknown provider shows up and cant write to card. the card was working until someone programmed it for a buddy. The password the guy gave me doesnt work and i am positive it is the right one. If i go and try to use v3a glitcher it says it cant run on rev 109. the card was rev 103 but the blocker brought it up to 109. any ideas on this or do we have to wait for a fix

[2getwired]

i hope i haven't highjacked a thread here.....i was having problems changing keys on my 102 x-sub. during a write i got an error now it is unknown provider rom102 rev 000. i can reset and get this info but cant read or write to card w/o some kind of error. it doesnt want to even glitch in an unlock program. at this point i assume the card is toast. can i write my original bin file to a new card and continue as if it were an x-sub???

[haris2k7]

after doing last keep update to card I am locked out of card i used rad383 blocker on it

i know the password for it b.c i saved the password in blocker file which i have back up of I am also getting unknown provider can someone please help me i am in deep crap

plzzz

i read in forum to use this script than try reading it in n2edit

'************************************************* *************************************
'* New VB SCRIPT CREATED BY ALPHAREBEL - 1/31/06 *
'* ATTEMPTED MOD FOR NO RSP CAMS. PENGA ADDED. - MODDED 8/02/06 *
'* FOR STREAM LOCKED, PASSWORD LOCKED or SOFT LOOPED ROM 102s. *
'* OR PROVIDER UNKNOWN ROM 102s. ICAM DISH AND BEV *
'* AUTOMATIC VCC, SEMI-AUTO DELAY RANGE *
'* USES ONLY NEWD13.HEX WITH LOADER *
'* *
'* HAPPY UNLOCKING AND GOOD LUCK!! *
'* *
'************************************************* *************************************
Option Explicit
Dim StartDate
Dim BuffFlg
Dim bytes2
Dim IntTim
Dim RngFlg
Dim RngHi
Dim RngLo
Dim SlFlg
Dim RdLen
Dim DtPnt
Dim bytes
Dim Uflg
Dim Acnt
Dim Mix
Dim VS1
Dim VT1
Dim DS1
Dim LP1
Dim LP2
Dim RT2
Dim RT3
Dim RT7
Dim VG
Dim DD
Dim TL
Dim RT
Dim T1
Dim T2
Dim T3
Dim T4
Dim T5
Dim T6
Dim GT
RT7 = 0
LP1 = 1
BuffFlg = 0
RngFlg = 0
SlFlg = 0
Uflg = 0
VT1 = 1
DS1 = 960
DD = DS1 + 96
GT= 6
RngLo = DS1
RngHi = DD
RT = RngLo
RT3 = RT

Sub Main()

Setupunlocker()
If CheckChipVer <> 1 then
Sc.MsgBox("Flash Version ND13 needed to run this script" & VbCr & "Flash your Loader with NewD13.hex")
Exit Sub
End if
'Do not change any values above this line
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^
' These, AND ONLY THESE http://www.rom10x.com/forums/images/smilies/smile.gif, are the variables you can change for rom 102 any revision up to 105/241
LP1 = 40 'Number of tries per delay FROM 20-100 in multiples of 20
VS1 = 10 'YOU CAN CHANGE THIS FROM 02-255 = semi-automatic VCC range - Loader dependent
Mix = 0.5 'Glitch VCC resolution - attempts per VCC = 1/mix

'DtPnt SET TO 9C FOR BEV, A7 FOR DISH, A5 IF YOU KNOW YOUR ICAM TIERS ARE AT A500
DtPnt = &hA7

'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^
VG = VS1
sc.verbose = 0
Sc.Write("A0") ' turn led off
Clearoutputwindow
If ChkCard() = 0 then
Sc.MsgBox(" Unsupported Rom Version: Rom " & T1 & ", Rev " & T4 & " found." & VbCr & "This Script is for use with Rom 102, Revs up to 105/241")
Exit Sub
End if
If RT7 <> 0 then
Sc.MsgBox(" Invalid or no atr. Card may be looped or an unsupported rom." & vbcr & " Unable to continue.")
exit sub
end if
Clearoutputwindow
StartDate = Now()
Print "Initial Parameters = Delay:" & HexString(RT, 4) & " VCC:" & HexString(VG, 2) & " Glitch Type:" & HexString(GT, 2)& vbcr & vbcr
Do
If BuffFlg = 0 then
Acnt = 0
Do
sc.delay(10)
Sc.Write("07 0E 03 10 01 03 9A 00") 'reset card
Sc.Read(02)
Bytes = Sc.Getbyte(1)
If Bytes > 25 then
Sc.Read(27)
Exit Do
End if
Acnt = Acnt + 1
If Acnt > 5 then
Exit Do
End If
Loop
If Acnt > 5 then
Sc.MsgBox(" Check Loader Settings. Invalid or no atr. Card may be looped." & vbcr & " Unable to continue.")
exit sub
End If
Sc.Write("B0" & HexString(VG, 2))
Sc.Delay(10)
sc.verbose = 1 'debug the packets
Sc.write("15 03 15 600C 2100098D00EE3100A7559D9D88 0E" & HexString(IntTim, 2) & "85 00")
Sc.Read(2)
bytes = sc.getbyte(1)
sc.read(bytes)
If bytes > 5 then
bytes = sc.getbyte(3)
If bytes = 111 then
BuffFlg = 1
sc.delay(10)

'30C0=A7BF
'8219=A1FF270187CD5A7D0DFA8080BC80
'3177=05050060DB8219

Sc.write("64 03 15 60 5B 2100588ECA9D9D9D9D559D9D9D9D9D9D9D9D9D9D9D9D9D9D9D 9D9D9D9D9D9D9D71801864A64BB76BCD7C1630C0B5021864CD 7C168219B70E1864CD7C163177C507CC7A95" & HexString(DtPnt, 2) & "BFA1FF270187CD5A7D0DFA8080BC8005050060DB82198 8 0E01 83 00")

Sc.Read(02)
bytes = sc.getbyte(1)
Sc.read(bytes)
End If
End If
End If
If BuffFlg = 1 then
Sc.Write("A0")
Sc.Delay(20)
Sc.write("0D 03 15 6004 F4C101BC88 0E01 83 00")
Sc.Read(2)
bytes = sc.getbyte(1)
sc.read(bytes)
Sc.Write("12 03 15 6003 48C00088 0E01 83 20" & HexString(RT,4) & HexString(GT, 2) & "0E10 00")
sc.read(2)
Bytes = Sc.Getbyte(1)
Sc.Read(Bytes)
End If
Sc.write("0D 03 15 6004 F4C101BC88 0E01 83 00")
Sc.Read(2)
bytes = sc.getbyte(1)
If bytes > 3 then
sc.read(bytes)
bytes = sc.getbyte(0)
bytes2 = sc.getbyte(3)
If bytes2 = 144 then
BuffFlg = 0
UFlg = 1
End If
If bytes = 79 then
print "-"
VG = VG - mix
Else
If bytes =< 72 and RngFlg = 0 then
If bytes >= 64 then
If RngFlg < 3 then
RngFlg = RngFlg + 1
End If
RngLo = RT - 3
If RngLo < DS1 then
RngLo = DS1
End If
RngHi = RngLo + 5
RT = RngLo
End If
End If
BuffFlg = 0
Print "+" & HexString(bytes,2)
VG = VG + mix
End If
Else
PRINT " Rst" & HexString(VG, 2)
BuffFlg = 0
VG = VG + mix
sc.write("02 03 00")
sc.write("02 02 00")
End if
If BuffFlg = 0 then
Sc.Write("08 0E 03 10 01 01 03 9A 00") 'reset card
sc.read(02)
bytes = sc.getbyte(1)
sc.read(bytes)
sc.delay(16)
If SlFlg = 1 then
Sc.write("2C 03 15 6023 210020A0CA00001A041801018600AA9D9D9D9D9D9D9D9D9DAE 69CC7A9BBE000000000088 0E06" & HexString(RdLen, 2) & "00")
Sc.Read(2)
bytes = sc.getbyte(1)
If bytes > 5 then
sc.read(bytes)
bytes = sc.getbyte(0)
bytes2 = sc.getbyte(3)
If bytes = 18 and bytes2 = 105 then
UFlg = 1
End If
End If
End If
'End if
'End If
If SlFlg = 0 then
Sc.write("14 03 15 600B 210008A0CA0000020400CD88 0E06" & HexString(RdLen, 2) & "00")
Sc.Read(2)
bytes = sc.getbyte(1)
If bytes > 5 then
sc.read(bytes)
bytes = sc.getbyte(0)
bytes2 = sc.getbyte(3)
If bytes = 18 and bytes2 = 132 then
If SlFlg <> 1 then
bytes2 = sc.getbyte(5)
Uflg =1
End If
End If
End If
End If
End If
If Uflg = 1 then
Print " !!!!!!!" & VBCr
Sc.Write("A1")
Sc.delay(500)
print
print "******* Good response received! *********"& VbCr
PRINT " " & HEXSTRING(bytes2,2) & VbCr
Sc.Print "===========================================" & VbCr
print " " & HexString(bytes2, 2) & " was hit at: Delay:" & HexString(RT3, 4) & " VCC:" & HexString(VG, 2) & " GlitchType:" & HexString(GT, 2) &VBCr
print " Elapsed: " & TimeDiff(StartDate,Now())& vbcr
Print " VCC Resolution: " & mix & vbcr
Print " Delay Range: " & HexString(RngLo, 4) & " to " & HexString(RngHi, 4) & VBCr
print
SC.DELAY(700)
PRINT "********************************" & VBCR
PRINT "* 102 CAM REVIVED!!! *" & VBCR
PRINT "* READ THE CARD *" & VBCR
PRINT "* CLEAN CODESPACE OR *" & VBCR
PRINT "* WRITE CLEANED BIN TO CARD *" & VBCR
PRINT "* GOOD LUCK! :-) *" & VBCR
PRINT "********************************" & VBCR
exit sub
End If
If VG < VT1 then
VG = VS1
End if
If VG > VS1 then
If VG >= 254 then
VG = VS1 / 2
End If
End If
If VG + mix = 0 or VG + 1 = 0 then
VG = VS1
End if
GT = GT - 3
If GT < 6 then
GT = 9
End If
LP2 = LP2 + 1
If LP2 > LP1 / mix then
ClearOutputWindow
RT = RT + 1
RT3 = RT
BuffFlg = 0
LP2 = 0
print
print "" &vbcr
print "Buffer Intercept Installed. Trying to Open the 102.... Delay:" & HexString(RT, 4) & " VCC:" & HexString(VG, 2) & " Glitch Type:" & HexString(GT, 2) & VBCr & vbcr
sc.print "Elapsed = " & TimeDiff(StartDate,Now())& vbcr & vbcr
If RT >= RngHi and RngFlg > 0 then
RT = RngLo
RngFlg = RngFlg + 1
If RngFlg >= 3 then
RngFlg = 0
RngLo = DS1
RngHi = DD
End If
End If
If RT > 1056 then
DS1 = 864
DD = DS1 + 96
RngLo = DS1
RngHi = DD
RT = RngLo
End If
If RT = 960 then
DS1 = 960
DD = DS1 + 96
RngLo = DS1
RngHi = DD
RT = RngLo
End If
End If
Loop
End Sub

Function HexString(Number,Length)
Dim RetVal
Dim CurLen
RetVal=Hex(Number)
CurLen=Len(RetVal)
If CurLen<Length Then
RetVal=String(Length-CurLen,"0") & RetVal
End If
HexString=RetVal
End Function

Function CheckChipVer()
CheckChipVer = 1
sc.write("90")
delay(80)
If sc.read(4) <> 4 then
CheckChipVer = 0
Exit Function
End if
If getbyte(0) <> &H4E then CheckChipVer = 0
If getbyte(1) <> &H44 then CheckChipVer = 0
If getbyte(2) <> &H31 then CheckChipVer = 0
If getbyte(3) <> &H33 then CheckChipVer = 0

End Function

Function TimeDiff (StartTime, EndTime)
Dim Hours, Minutes, Seconds
Seconds = DateDiff("s", StartTime, EndTime)
If Seconds > 90000 Then Seconds = 90000
If Seconds < 0 Then Seconds = 0
Minutes = Seconds / 60
Minutes = Fix(Minutes)
Seconds = Seconds - (Minutes * 60)
Hours = Minutes / 60
Hours = Fix(Hours)
Minutes = Minutes - (Hours * 60)
Seconds = CStr(Seconds)
Minutes = CStr(Minutes)
Hours = CStr(Hours)
If Len(Seconds) = 1 Then Seconds = "0" + Seconds
If Len(Minutes) = 1 Then Minutes = "0" + Minutes
If Len(Hours) = 1 Then Hours = "0" + Hours
TimeDiff = Hours & ":" & Minutes & ":" & Seconds
End Function

Function ChkCard()
ChkCard = 1
Print ""
Print " Determining type of Unlock needed ......." & VBCr
sc.delay(2000)
ClearOutputWindow
Sc.Write("08 0E 03 10 01 01 03 9A 00") 'reset card
sc.read(02)
bytes = sc.getbyte(1)
If bytes = 0 or bytes < 27 or bytes > 27 then
RT7 = 1
ClearOutputWindow
Exit function
End If
sc.read(bytes)
sc.delay(16)
T1 = chr(sc.getbyte(16))
T2 = chr(sc.getbyte(17))
T3 = chr(sc.getbyte(18))
T4 = chr(sc.getbyte(23))
T5 = chr(sc.getbyte(24))
T6 = chr(sc.getbyte(25))
T1 = T1+T2+T3
T4 = T4+T5+T6
If asc(T4) = 0 then
T4 = "000"
End If
Print " Rom " & T1 & ", Rev " & T4 & " found." & VBCR
Print " GOOD LUCK." & VBCR
print
Sc.delay(1500)
Sc.write("14 03 15 600B 210008A0CA0000020400CD88 0E08 86 00")
Sc.Read(2)
bytes = sc.getbyte(1)
If bytes < 9 then
RdLen = 133
IntTim = 48
print " Proceeding with Really Fooked Unlocking :-D......"
Sc.Delay(2000)
exit function
end If
if bytes = 5 then
sc.read(bytes)
bytes = sc.getbyte(0)
bytes2 = sc.getbyte(3)
If bytes = 18 and bytes2 = 132 then
RdLen = 133
IntTim = 21
SlFlg = 1
print " Proceeding with Normal Unlocking......"
Sc.Delay(2000)
exit function
Else
RdLen = 131
IntTim = 48
print " Proceeding with Fubared Unlocking :-)......"
Sc.Delay(2000)
end If
End If
End Function

Function setupunlocker()
Wx.BaudRate = 115200
Wx.ResetBaudRate = 115200
Wx.Parity = 0 ' 0 = None, 1 = Odd, 2 = Even, 3 = Mark, 4 = Space
Wx.StopBits = 0 ' 0 = 1 stop bit, 1 = 1.5 stop bits, 2 = 2 stop bits
Wx.DTRControl = 0 ' Initial state of DTR 0 = off, 1 = on
Wx.RTSControl = 1 ' Initial state of RTS 0 = off, 1 = on
Wx.ResetDelay = 100 ' In microseconds
Wx.ByteDelay = 10 ' In microseconds
Wx.RxByteTimeout = 500 ' In milliseconds
Wx.ResetMode = 2 ' 0 = No Resets, 1 = ISO Reset (Expect a ATR), 2 = Device Reset (No ATR)
Wx.ResetLine = 1 ' 0 = Toggle RTS for Reset, 1 = Toggle DTR for Reset
Wx.ByteConvention = 1 ' 0 = Inverse, 1 = Direct
Wx.FlushEchoByte = 0 ' 0 = no flush, 1 = flush - A Phoenix interface will echo each byte transmitted.
Wx.FlushBeforeWrite = 1 ' 0 = no flush, 1 = flush - Flush the receive buffer before each write to strip off Null bytes.
Wx.IgnoreTimeouts = 1 ' 0 = Abort script on a receive timeout, 1 = Ignore all receive timeouts
Wx.ResetAfterTimeout = 0 ' 0 = Don't reset after a timeout, 1 = do a reset after a timeout - Not used if "IgnoreTimeouts=0"
Wx.LogTransactions = 0 ' 0 = Don't log transactions, 1 = log transactions
Wx.DisplayUSW = 0 ' Display USW after script complete 0 = no, 1 = yes
Wx.DisplayFuse = 0 ' Display Fuse after script complete 0 = no, 1 = yes
End function



when I run this script it gives this resposnce

******* Good response received! *********

90

===========================================

90 was hit at: Delay:03C0 VCC:04 GlitchType:06

Elapsed: 00:00:04

VCC Resolution: 0.5

Delay Range: 03C0 to 0420

********************************

* 102 CAM REVIVED!!! *

* READ THE CARD *

* CLEAN CODESPACE OR *

* WRITE CLEANED BIN TO CARD *

* GOOD LUCK! :-) *

********************************



and when I try to read the card in n2 edit beta 9 it gives this responsce





ATR: 3F FF 95 00 FF 91 81 71 FF 47 00 44 4E 41 53 50 31 30 32 20 52 65 76 31 30 42 15
CAM Type: ROM102 Rev10B
Setting IFS
Provider: Unknown
Reading Card image...
Failed to read card. (Retries: 25)


Can someone please help me

[2getwired]

been there -done that...... try writing your original bin to the card[open bin,clean code space,write to card. force write several times if necessary.] otherwise you can try using the [bug resetter] file. it has worked for many. you can always try to re-glitch. dont worry about the unknown provider issue. it will fix itself when you are able to write theoriginal bin or just edit [30C0] from BF BF to A7 BF. unfortunatly none of this worked for me so in the meen time start lookin for another card. good luck.

[dravas]

I had the same problem being locked out of a rom102 at rev10b with unknown provider.. I tried running rebelsurf omniunlocker force fubar and it came back success.. checked the atr with nagra master and it came back with a rev at 102? Then I ran a rev 103 unlocker script on it and within 5min it came back as unlocked. Checked with nagra master again and sure enough card is open again.. Hope this helps.

[krameel]

I have a rev 108 with unknown provider and i can't get it open. Any ideas?

[haris2k7]

Open bin in N2E
At address 30C0 change first two bytes from BF BF to as follows, to reset datapointers:
Dish plastic is A7 BF
Dish integrated (DP311 DP811) is A5BF
BEV is 9C BF
You will then have provider back and still have sub dump info.

Thanks satjunction people

How can I make changes when i can even open cam in n2edit beta 7
i get this
ATR: 3F FF 95 00 FF 91 81 71 FF 47 00 44 4E 41 53 50 31 30 32 20 52 65 76 31 30 33 64
CAM Type: ROM102 Rev103
Setting IFS
Provider: Unknown
Reading Card image...
Failed to read card. (Retries: 25)
Unlocking Card...
Error

[friedbrain]

i can't find reb's v3a where is it...............................????????????????? ?

[friedbrain]

And i don't see anything helpful so far in this post other than changing bf to a7.........................but u can't change anything if your locked out ...........................dtworks locked me out , i tried to change the keys that way, and then wrote it...... now iam locked out.................so what....... iam no rookie just.................but maybe i am still a rookie, who cares...........that's not the point......just need to get back into unknown provider rev 10B........... been looking all over 4 reb"s v3a can't find it nowhere.......any help would be appreciated......!!!!

[windsurf]

Help Guys...
my card was workin fine till I downloaded a bin file to it...
in the past was reading {
ROM ID: DNASP102 (ROM102)
REV ID: 10b}

now I CAN NOT read or write to it...Try to open it with nagraedit 2.58, UNLOCK FAIL, Read the card I get "ATR: 3F FF 95 00 FF 91 81 71 FF 47 00 44 4E 41 53 50 31 30 32 20 69 6E 20 61 6E 20 1F
CAM Type: ROM102 in an
Provider: Unknown
Reading Card Image...
Failed to read card."
With nagraedit 5.2 I get "
Opening COM1.
ATR String: 3F FF 95 00 FF 91 81 71 FF 47 00 44 4E 41 53 50
31 30 32 20 69 6E 20 61 6E 20 1F
ROM ID: DNASP102 (ROM102)
REV ID: in an
IFS has been set.
Could not test for backdoor.
Failure reading card.
Closing COM1."
Is there any software that can correct the problem, can read the password...unlock the card...Step by step please...
Any info ia appreciated...
Thanks

[oakley04]

Can anybody help me with Romcode in the error area it says : Error: Reading pre-response bytes from CommPort can anybody tell me what I can do to fix this.

[ekpoan]

I need help to fix dish unknow provider. I get only ISO pogrammer. Thans

[josmed]

Easiest way to fix Unknown Provider is spend $25 and send card to someone who knows what he is doing or screw up your card and how much are those cards going for at the moment?
I had 2 w/unknown provider and within a week I had them back and are working flawlessly

[0zone]

Here RebelSerf Rom102 OmniUnlocker V3A.xvb

'************************************************* *************************************
'* ORIGINAL VB SCRIPT MODDED BY REBELSERF - 3/04/06 *
'* *
'* FOR STREAM LOCKED, PASSWORD LOCKED or ROM 102s. *
'* AUTOMATIC VCC, SEMI-AUTO DELAY RANGE *
'* USES ONLY NEWD13.HEX WITH LOADER *
'* THANKS TO A CERTAIN SLAVE DRIVER ;-) *
'* *
'* HAPPY UNLOCKING AND GOOD LUCK!! *
'* *
'************************************************* *************************************
Option Explicit
Dim Shell
Set Shell = CreateObject("WScript.Shell")
Dim StartDate
Dim BuffFlg
Dim bytes2
Dim IntTim
Dim RngFlg
Dim RngHi
Dim RngLo
Dim SlFlg
Dim RdLen
Dim DtPnt
Dim bytes
Dim Uflg
Dim Acnt
Dim Mix
Dim VS1
Dim VT1
Dim DS1
Dim LP1
Dim LP2
Dim RT2
Dim RT3
Dim RT7
Dim VG
Dim DD
Dim TL
Dim RT
Dim T1
Dim T2
Dim T3
Dim T4
Dim T5
Dim T6
Dim GT
RT7 = 0
LP1 = 1
BuffFlg = 0
RngFlg = 0
SlFlg = 0
Uflg = 0
VT1 = 1
DS1 = 960
DD = DS1 + 96
GT= 6
RngLo = DS1
RngHi = DD
RT = RngLo
RT3 = RT 'Do not change any values above this line
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^


Sub Main()

Setupunlocker()
If CheckChipVer <> 1 then
Sc.MsgBox("Flash Version ND13 needed to run this script" & VbCr & "Flash your Loader with NewD13.hex")
Exit Sub
End if
' These, AND ONLY THESE :), are the variables you can change for rom 102 any revision up to 105/241
LP1 = 40 'Number of tries per delay FROM 20-100 in multiples of 20
VS1 = 40 'YOU CAN CHANGE THIS FROM 02-255 = semi-automatic VCC range - Loader dependent
Mix = 0.5 'Glitch VCC resolution - attempts per VCC = 1/mix
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^
VG = VS1
sc.verbose = 0
Sc.Write("A0") ' turn led off
Clearoutputwindow
If ChkCard() = 0 then
Sc.MsgBox(" Unsupported Rom Version: Rom " & T1 & ", Rev " & T4 & " found." & VbCr & "This Script is for use with Rom 102, Revs up to 105/241")
Exit Sub
End if
If RT7 <> 0 then
Sc.MsgBox(" Invalid or no atr. Card may be looped or an unsupported rom." & vbcr & " Unable to continue.")
exit sub
end if
Clearoutputwindow
StartDate = Now()
Print "Initial Parameters = Delay:" & HexString(RT, 4) & " VCC:" & HexString(VG, 2) & " Glitch Type:" & HexString(GT, 2)& vbcr & vbcr
Do
If BuffFlg = 0 then
Acnt = 0
Do
sc.delay(10)
Sc.Write("07 0E 03 10 01 03 9A 00") 'reset card
Sc.Read(02)
Bytes = Sc.Getbyte(1)
If Bytes > 25 then
Sc.Read(27)
Exit Do
End if
Acnt = Acnt + 1
If Acnt > 5 then
Exit Do
End If
Loop
If Acnt > 5 then
Sc.MsgBox(" Check Loader Settings. Invalid or no atr. Card may be looped." & vbcr & " Unable to continue.")
exit sub
End If
Sc.Write("B0" & HexString(VG, 2))
Sc.Delay(10)
sc.verbose = 1 'debug the packets
Sc.write("15 03 15 600C 2100098D00EE3100A7559D9D88 0E" & HexString(IntTim, 2) & "85 00")
Sc.Read(2)
bytes = sc.getbyte(1)
sc.read(bytes)
If bytes > 5 then
bytes = sc.getbyte(3)
If bytes = 111 then
BuffFlg = 1
sc.delay(10)
Sc.write("67 03 15 60 5E 21005B8ECA9D9D9D9D559D9D9D9D9D9D9D9D9D9D9D9D9D9D9D 9D9D9D71801864A64BB76BCD7C1630C0B9021864CD7C168219 BB071864CD7C163176C2081864CD7C16BF00CA0520FE" & HexString(DtPnt, 2) & "BFA1FF270187BC88011E050060DB82190C0100FBFB88 0E01 83 00")
Sc.Read(02)
bytes = sc.getbyte(1)
Sc.read(bytes)
End If
End If
End If
If BuffFlg = 1 then
Sc.Write("A0")
Sc.Delay(20)
Sc.write("0D 03 15 6004 F4C101BC88 0E01 83 00")
Sc.Read(2)
bytes = sc.getbyte(1)
sc.read(bytes)
Sc.Write("12 03 15 6003 48C00088 0E01 83 20" & HexString(RT,4) & HexString(GT, 2) & "0E10 00")
sc.read(2)
Bytes = Sc.Getbyte(1)
Sc.Read(Bytes)
End If
Sc.Delay(5)
Sc.write("0D 03 15 6004 F4C101BC88 0E10 83 00")
Sc.Read(2)
bytes = sc.getbyte(1)
If bytes > 3 then
sc.read(bytes)
bytes = sc.getbyte(0)
bytes2 = sc.getbyte(3)
If bytes = 79 then
print "-"
VG = VG - mix
Else
If bytes =< 72 and RngFlg = 0 then
If bytes >= 64 then
If RngFlg < 3 then
RngFlg = RngFlg + 1
End If
RngLo = RT - 3
If RngLo < DS1 then
RngLo = DS1
End If
RngHi = RngLo + 5
RT = RngLo
End If
End If
BuffFlg = 0
Print "+" & HexString(bytes,2)
VG = VG + mix
End If
Else
PRINT " Rst" & HexString(VG, 2)
BuffFlg = 0
VG = VG + mix
sc.write("02 03 00")
sc.write("02 02 00")
End if
If BuffFlg = 0 then
Sc.Write("08 0E 03 10 01 01 03 9A 00") 'reset card
sc.read(02)
bytes = sc.getbyte(1)
sc.read(bytes)
sc.delay(16)
Sc.write("2C 03 15 6023 210020A0CA00001A041801018600AA9D9D9D9D9D9D9D9D9DAE 69CC7A9BBE000000000088 0E06" & HexString(RdLen, 2) & "00")
Sc.Read(2)
bytes = sc.getbyte(1)
If bytes > 5 then
sc.read(bytes)
bytes = sc.getbyte(0)
bytes2 = sc.getbyte(3)
If bytes = 18 and bytes2 = 132 then
sc.write("13 03 15 600A 210007A0FF0000024800330E02 85 00")
Sc.Read(2)
bytes = sc.getbyte(1)
If bytes > 5 then
sc.read(bytes)
bytes = sc.getbyte(0)
bytes2 = sc.getbyte(3)
If bytes = 18 and bytes2 = 105 then
UFlg = 1
End If
End If
End If
End if
End If
If Uflg = 1 then
Print " !!!!!!!" & VBCr
Sc.Write("A1")
Shell.Run "%comspec% /c echo " & Chr(07) & Chr(07) & Chr(07) & Chr(07) & Chr(07), 0, True
Sc.delay(500)
print
print "******* Good response received! *********"& VbCr
PRINT " " & HEXSTRING(bytes2,2) & VbCr
Sc.Print "===========================================" & VbCr
print " " & HexString(bytes2, 2) & " was hit at: Delay:" & HexString(RT3, 4) & " VCC:" & HexString(VG, 2) & " GlitchType:" & HexString(GT, 2) &VBCr
print " Elapsed: " & TimeDiff(StartDate,Now())& vbcr
Print " VCC Resolution: " & mix & vbcr
Print " Delay Range: " & HexString(RngLo, 4) & " to " & HexString(RngHi, 4) & VBCr
print
SC.DELAY(700)
PRINT "********************************" & VBCR
PRINT "* 102 CAM NOW OPEN!! *" & VBCR
PRINT "* WRITE A VIRGIN IMAGE TO CARD *" & VBCR
PRINT "* PROCEED AS NORMAL *" & VBCR
PRINT "* GOOD LUCK! :-) *" & VBCR
PRINT "********************************" & VBCR
exit sub
End If
If VG < VT1 then
VG = VS1
End if
If VG > VS1 then
If VG >= 254 then
VG = VS1 / 2
End If
End If
If VG + mix = 0 or VG + 1 = 0 then
VG = VS1
End if
GT = GT - 3
If GT < 6 then
GT = 9
End If
LP2 = LP2 + 1
If LP2 > LP1 / mix then
ClearOutputWindow
RT = RT + 1
RT3 = RT
BuffFlg = 0
LP2 = 0
print
print "" &vbcr
print "Buffer Intercept Installed. Trying to Open the 102.... Delay:" & HexString(RT, 4) & " VCC:" & HexString(VG, 2) & " Glitch Type:" & HexString(GT, 2) & VBCr & vbcr
sc.print "Elapsed = " & TimeDiff(StartDate,Now())& vbcr & vbcr
If RT >= RngHi and RngFlg > 0 then
RT = RngLo
RngFlg = RngFlg + 1
If RngFlg >= 3 then
RngFlg = 0
RngLo = DS1
RngHi = DD
End If
End If
If RT > 1056 then
DS1 = 864
DD = DS1 + 96
RngLo = DS1
RngHi = DD
RT = RngLo
End If
If RT = 960 then
DS1 = 960
DD = DS1 + 96
RngLo = DS1
RngHi = DD
RT = RngLo
End If
End If
Loop
End Sub

Function HexString(Number,Length)
Dim RetVal
Dim CurLen
RetVal=Hex(Number)
CurLen=Len(RetVal)
If CurLen<Length Then
RetVal=String(Length-CurLen,"0") & RetVal
End If
HexString=RetVal
End Function

Function CheckChipVer()
CheckChipVer = 1
sc.write("90")
delay(80)
If sc.read(4) <> 4 then
CheckChipVer = 0
Exit Function
End if
If getbyte(0) <> &H4E then CheckChipVer = 0
If getbyte(1) <> &H44 then CheckChipVer = 0
If getbyte(2) <> &H31 then CheckChipVer = 0
If getbyte(3) <> &H33 then CheckChipVer = 0

End Function

Function TimeDiff (StartTime, EndTime)
Dim Hours, Minutes, Seconds
Seconds = DateDiff("s", StartTime, EndTime)
If Seconds > 90000 Then Seconds = 90000
If Seconds < 0 Then Seconds = 0
Minutes = Seconds / 60
Minutes = Fix(Minutes)
Seconds = Seconds - (Minutes * 60)
Hours = Minutes / 60
Hours = Fix(Hours)
Minutes = Minutes - (Hours * 60)
Seconds = CStr(Seconds)
Minutes = CStr(Minutes)
Hours = CStr(Hours)
If Len(Seconds) = 1 Then Seconds = "0" + Seconds
If Len(Minutes) = 1 Then Minutes = "0" + Minutes
If Len(Hours) = 1 Then Hours = "0" + Hours
TimeDiff = Hours & ":" & Minutes & ":" & Seconds
End Function

Function ChkCard()
ChkCard = 1
Print ""
Print " Determining type of Unlock needed ......." & VBCr
sc.delay(2000)
ClearOutputWindow
Sc.Write("08 0E 03 10 01 01 03 9A 00") 'reset card
sc.read(02)
bytes = sc.getbyte(1)
If bytes = 0 or bytes < 27 or bytes > 27 then
RT7 = 1
ClearOutputWindow
Exit function
End If
sc.read(bytes)
sc.delay(16)
T1 = chr(sc.getbyte(16))
T2 = chr(sc.getbyte(17))
T3 = chr(sc.getbyte(18))
T4 = chr(sc.getbyte(23))
T5 = chr(sc.getbyte(24))
T6 = chr(sc.getbyte(25))
T1 = T1+T2+T3
T4 = T4+T5+T6
If asc(T4) = 0 then
T4 = "000"
End If
If left(T4, 2) = "24" then
DtPnt = 156
End If
If left(T4, 2) = "10" then
DtPnt = 167
End If
If left(T4, 2) = "28" then
DtPnt = 165
End If
If T1 <> "102" then
ChkCard = 0
exit function
End If
If Dtpnt = 165 and T4 >= 284 then
ChkCard = 0
exit function
End If
If Dtpnt = 167 and T4 >= 106 then
ChkCard = 0
exit function
End If
If Dtpnt = 156 and T4 >= 241 then
ChkCard = 0
exit function
End If
DtPnt = 191
Print " Rom " & T1 & ", Rev " & T4 & " found." & VBCR
print
Sc.delay(1500)
Sc.write("14 03 15 600B 210008A0CA0000020400CD88 0E08 86 00")
Sc.Read(2)
bytes = sc.getbyte(1)
If bytes < 6 then
RdLen = 133
IntTim = 48
print " Proceeding with Really Fooked Unlocking :-D......"
Sc.Delay(2000)
exit function
end If
if bytes > 5 then
sc.read(bytes)
bytes = sc.getbyte(0)
bytes2 = sc.getbyte(3)
If bytes = 18 and bytes2 = 132 then
RdLen = 133
IntTim = 21
SlFlg = 1
print " Proceeding with Normal Unlocking......"
Sc.Delay(2000)
exit function
Else
RdLen = 131
IntTim = 48
print " Proceeding with Fubared Unlocking :-)......"
Sc.Delay(2000)
end If
End If
End Function

Function setupunlocker()
Wx.BaudRate = 115200
Wx.ResetBaudRate = 115200
Wx.Parity = 0 ' 0 = None, 1 = Odd, 2 = Even, 3 = Mark, 4 = Space
Wx.StopBits = 0 ' 0 = 1 stop bit, 1 = 1.5 stop bits, 2 = 2 stop bits
Wx.DTRControl = 0 ' Initial state of DTR 0 = off, 1 = on
Wx.RTSControl = 1 ' Initial state of RTS 0 = off, 1 = on
Wx.ResetDelay = 100 ' In microseconds
Wx.ByteDelay = 10 ' In microseconds
Wx.RxByteTimeout = 500 ' In milliseconds
Wx.ResetMode = 2 ' 0 = No Resets, 1 = ISO Reset (Expect a ATR), 2 = Device Reset (No ATR)
Wx.ResetLine = 1 ' 0 = Toggle RTS for Reset, 1 = Toggle DTR for Reset
Wx.ByteConvention = 1 ' 0 = Inverse, 1 = Direct
Wx.FlushEchoByte = 0 ' 0 = no flush, 1 = flush - A Phoenix interface will echo each byte transmitted.
Wx.FlushBeforeWrite = 1 ' 0 = no flush, 1 = flush - Flush the receive buffer before each write to strip off Null bytes.
Wx.IgnoreTimeouts = 1 ' 0 = Abort script on a receive timeout, 1 = Ignore all receive timeouts
Wx.ResetAfterTimeout = 0 ' 0 = Don't reset after a timeout, 1 = do a reset after a timeout - Not used if "IgnoreTimeouts=0"
Wx.LogTransactions = 0 ' 0 = Don't log transactions, 1 = log transactions
Wx.DisplayUSW = 0 ' Display USW after script complete 0 = no, 1 = yes
Wx.DisplayFuse = 0 ' Display Fuse after script complete 0 = no, 1 = yes
End function

[mrfreeze]

You Got To Remmember Bin Now You It Is Got To Unlock The Card That Is Why It Is Not Letting You Write So What Ever Ev You Have You Got To Get The Script For That Then Once You Do That Ge A Virgin Bin Of Your Image Then Write To It Whould Be Good After That

[dw8]

but what script is best for unlocking a bad rev

[Bandit5906]

Depends upon the rev you are unlocking. Once unlocked you will need to clean the card and save. Then it will be unlocked and at rev 103.

[vegasmax]

Failed to find Blocker Patch! Has anyone seen this before?? Card has been working for over and year no problems, card is currentl unlocked, I get this message but also notice no provider shown? Suggestions how to proceed.........Thanks Guys !!!!!!!!!

[Bandit5906]

Reload the original image and program as before.

[vegasmax]

Bandit5906Reload the original image and program as before.10 Hours Ago 05:17 PM
Great..sounds easy...but I am not 100% sure how to do that, I am not very knowlagagable on the process...where do i find the "image" etc/
Soory I kow it's a stupid question but you guys are Mega Brains and all this stuff make easy sence to you. Thanks for your help and interest!!!!:)

[eric keri]

Ok guys I had the same problem on 2 cards. both cards unknown provider and both password locked. REVS 10b and rev 10c..I didn't have the passwords. So I messed around with a few script, got alot that gave me error's.
I finally ended up useing ---Unknown_Provider_RSX1--- It opened up the 10b card but the 10c well long story on that one. But i had to modify it.. It ran in the glitcher for about a half hour.. I was getting alot of false NO ATR hits with it to. So if you plain on useing that script don't get scared if you see NO ATR. just rerun the script.

that script runs XXXXXXXXXXXXXXXXXXXXXXX all the way till it opens so don't think it is not working. I used my blue nexus diode mod. at around 225 to 260ohm's.

I will have to say that this SCRIPT is-NOT- good for blockered REV10C cards.

I popped my unknown provider password locked REV10B cam with this script!

' X = Strike O = Hit
' See user options below.
' New VB Script File - Created 2/14/2008
' Works on SOME Soft-locked and Higher Revision Unknown Provider CAM's
' MUST USE RSX1 Flash!!!
' Thanks goes out to Rebelsurf and all involved
' In the Release of this Updated Flash and RM1A unlocker.
setupunlocker()
Sub Main()
dim Try,TryMAX,Glitch,Delay,DelaySTART,DelayMIN,Vcc,Vc cSTART,VccMIN
dim DelayTYPE,VccTYPE,InitDelay,Cntr,bytes,RstFlg,Loop Cntr
Const SND_SYNC = 0 ' play synchronously (default)
Const SND_ASYNC = 1 ' play asynchronously
sc.clearoutputwindow
LoopCntr = 0
If CheckChipVer = 1 Then
Else
Sc.MsgBox("This script requires RSX1 atmel code. Please flash your loader with RSX1.")
Exit Sub
End If
sc.write("A0")'Turn OFF LED
'User Options
'******************************
InitDelay = &h1D00 ' Initial delay for resend processing
VccSTART = 26 ' 32 = &h20
VccMIN = 09 ' 09 = &h09
DelaySTART = &h00DA ' Normal = &h00CE
DelayMIN = &h00D6 ' Normal = &h00AE
TryMAX = 50 ' # of gltch attempts per delay
Glitch = 5 ' 5,6,7,8
VccTYPE = 181 ' 176,181,186
DelayTYPE = 32 ' should be 32 or 64
'******************************
Vcc = VccSTART
Try = 0
Delay = DelaySTART
sc.verbose = 0
sc.print("Let the glitching begin..."& VbCr)
StartDate = Now()
Do
'Check to see if our Glitch hit
Do
LoopCntr = LoopCntr + 1
Sc.Write("06 0E 03 01 03 9A 00") 'reset card
Sc.Read(02)
bytes = Sc.Getbyte(1)
If bytes > 25 then
Sc.Read(27)
RstFlg = 0
Exit Do
else
sc.PlaySound "doh.wav",SND_ASYNC
Sc.MsgBox(" Check Loader Settings. Invalid or no atr. Card may be looped.")
exit sub
End If
Loop
sc.write("2A 6023 210020A0CA00001A041801018600AA9D9D9D9D9D9D9D9D9DAE 55CC7A9BBE0000000000B4 0E08 85 00")
sc.read(2)
If sc.getbyte(&h01) > 4 then
sc.read(sc.getbyte(&h01))
sc.print("O")
'Now I need to unlock the card,
sc.write("14 600D 21 00 0A A0 FF AA BB CC DD AA BB CC DD 74 0E03 85 00")
sc.read(2)
bytes = sc.read(sc.getbyte(&h01))
if bytes > 4 then
bytes = sc.getbyte(&h03)
If bytes = &h90 then
sc.print( vbcr & "Password has been accepted...")
end if
If bytes <> &h55 then
'or if its unlocked
sc.write("2A 6023 210020A0CA00001A041801018600AA9D9D9D9D9D9D9D9D9DAE 55CC7A9BBE0000000000B4 0E08 85 00")
sc.read(2)
sc.read(sc.getbyte(&h01))
sc.write("11 600A 210007A0FF000002480033 0E03 85 00")
sc.read(2)
sc.read(sc.getbyte(&h01))
bytes = sc.getbyte(&h03)
else
end if
'check for $55 response
if bytes = &h55 then
sc.write("A1" )
sc.progressbox "",0,0,""
sc.verbose = 0
sc.print(VbCr & VbCr & "********************************" & VbCr)
sc.print("**** Good response received ****"& VbCr)
sc.print("**** " & Hexstring(bytes,2) & " ****" & Vbcr)
sc.print("********************************" & VbCr)
sc.print(VbCr & VbCr)
sc.print("================================" & VbCr)
sc.print(" Elapsed: " & TimeDiff(StartDate,Now()) & VbCr)
sc.print(" Attempt: " & LoopCntr & VbCr)
sc.print(" Delay: " & hexstring(DelayTYPE,2) & hexstring(Delay,4) & VbCr)
sc.print(" Glitch: " & hexstring(Glitch,2) & VbCr)
sc.print(" Vcc: " & hexstring(VccTYPE,2) & hexstring(Vcc,2)& VbCr)
sc.Print("================================" & VbCr)
sc.print(VbCr & VbCr)
sc.print("********************************" & VbCr)
sc.print("* REV 10C+ CAM NOW OPEN!! *" & VbCr)
sc.print("* PROCEED AS NORMAL *" & VbCr)
sc.print("* GOOD LUCK! :-) *" & VbCr)
sc.print("********************************" & VbCr)
sc.print("............Logging Data to file." & VbCr)
sc.log("**** Good response received ****"& VbCr)
sc.log("**** " & Hexstring(bytes,2) & " ****" & Vbcr)
sc.log(" Elapsed: " & TimeDiff(StartDate,Now()) & VbCr)
sc.log(" Attempt: " & LoopCntr & VbCr)
sc.log(" Delay: " & hexstring(DelayTYPE,2) & hexstring(Delay,4) & VbCr)
sc.log(" Glitch: " & hexstring(Glitch,2) & VbCr)
sc.log(" Vcc: " & hexstring(VccTYPE,2) & hexstring(Vcc,2)& VbCr)
exit do
else
end if
end if
end if
call GetParams(Vcc,VccMIN,VccStart,Try,TryMAX,Delay,Del ayMIN,DelayStart,DelayType,VccType)
Do
Sc.Write("06 0E 03 01 03 9A 00") 'reset card
Sc.Read(02)
bytes = Sc.Getbyte(1)
If bytes > 25 then
Sc.Read(27)
RstFlg = 0
Exit Do
else
sc.PlaySound "doh.wav",SND_ASYNC
Sc.MsgBox(" Check Loader Settings. Invalid or no atr. Card may be looped.")
exit sub
End If
Loop
sc.write("02 15 00")
sc.read(2)
Sc.Write("09 6004 21 C1 01 A9 48 84 00") 'Set IFS = $A9
Sc.Read(2)
sc.read(sc.getbyte(&h01))
Sc.Write("10 600B 21 00 08 A0 CA 00 00 02 C0 00 06 87 8B 00") 'CMD_C0
Sc.Read(2)
sc.read(sc.getbyte(&h01))
Cntr = 0
do
Cntr = Cntr + 1
Sc.write("16 7010 21 00 A7 A0 CA 00 00 A2 1A 00 A5 00 00 00 00 00 A5 5BAA 00") ' Send 2X
sc.read(2)
sc.read(sc.getbyte(&h01))
loop until Cntr = 2
Sc.Write("08 6003 21 C0 00 E1 83 00") ' Resync
Sc.Read(2)
sc.read(sc.getbyte(&h01))
sc.write("5D 6058 21 00 55 8e ca 65 65 65 65 65 65 65 65 65 9d 00 05 05 00 7AC40080 9b 9c cd 51 a1 42 42 11 00 42 42 18 64 ae 4b bf 6b 9d 9d 9d 9d cd 51 a1 42 10 00 42 cd 51 af 20 0a 9d 9d 9d 9d 9d 9d 9d 9d bc 88 9d cd 7c 16 31 76 80 08 9b 9d 11 00 9d cd 51 a1 42 10 00 9d 20 fe bc 83 00") ' Send Bootloader to IO buffer
sc.read(2)
sc.read(sc.getbyte(&h01)) ' Expect 12 81 00 93 Response

sc.write(hexstring(VccTYPE,2) & hexstring(Vcc,2))'set Glitch VCC
sc.write("A2")'Set LED RED
sc.write ("E044")
Sc.Write("20 7011 D8 92 B2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 44 20" & hexstring(InitDelay,4) & "5B AA " & hexstring(DelayTYPE,2) & hexstring(Delay,4)& hexstring(Glitch,2) & " 0C04 00") 'Resend last response
Sc.Read(2) ' $51-$56 = 8D 00 A7 44 BC A9 Glitch at $4648
sc.verbose = 0
sc.read(sc.getbyte(&h01))
sc.progressbox "Vcc:" & vbTab & hexstring(VccTYPE,2) & hexstring(Vcc,2) & vbtab & "Attempt:" & vbTab & Try & Vbcr & "Glitch:" & vbTab & hexstring(Glitch,2) & Vbtab & "Delay:" & vbTab & hexstring(DelayTYPE,2) & hexstring(Delay,4) ,Try,TryMAX,"Glitching..."
sc.print("X")
sc.verbose = 0
loop
call unlocked()
End Sub
Sub GetParams(Vcc,VccMIN,VccStart,Try,TryMAX,Delay,Del ayMIN,DelayStart,DelayType,VccType)
'dim Vcc,VccMIN,VccStart,Try,TryMAX,Delay,DelayMIN,Dela yStart,DelayType,VccType
If Vcc < VccMIN then
Vcc = VccSTART
else
Vcc = Vcc - .625
end if
If Try < TryMAX then
Try = Try + 1
else
If Delay =< DelayMIN then
Delay = DelayStart
Try = 1
sc.print(VbCr)
else
Delay = Delay - 1
Try = 1
sc.print(VbCr)
sc.verbose = 0
end if
end if
If DelayTYPE = 64 then
DelayTYPE = 32
Else
DelayTYPE = 64
end if
if VccType = 176 then
VccType = 176
else
VccType = 176
end if
end sub
sub unlocked()
Cntr = 0
sc.verbose = 0
Sc.PlaySound "urgent.wav",SND_ASYNC
do
Cntr = Cntr + 1
sc.write("A1")
sc.delay(33)
sc.write("A2")
sc.delay(33)
sc.write("A0")
sc.delay(33)
loop until Cntr = 10
Sc.PlaySound "woohoo.wav", SND_SYNC
end sub

Function HexString(Number,Length)
' This function takes 2 arguments, a number and a length. It converts the decimal
' number given by the first argument to a Hexidecimal string with its length
' equal to the number of digits given by the second argument
Dim RetVal
Dim CurLen
RetVal=Hex(Number)
CurLen=Len(RetVal)
If CurLen<Length Then
RetVal=String(Length-CurLen,"0") & RetVal
End If
HexString=RetVal
End Function

Function CheckChipVer()
sc.verbose = 0
CheckChipVer = 1
sc.write("90")
delay(80)
If sc.read(4) <> 4 Then
CheckChipVer = 0
Exit Function
End If
If getbyte(0) <> &H52 Then CheckChipVer = 0
If getbyte(1) <> &H53 Then CheckChipVer = 0
If getbyte(2) <> &H58 Then CheckChipVer = 0
If getbyte(3) <> &H31 Then CheckChipVer = 0
sc.verbose = 0
End Function
Function TimeDiff (StartTime, EndTime)
Dim Hours, Minutes, Seconds
Seconds = DateDiff("s", StartTime, EndTime)
If Seconds > 90000 Then Seconds = 90000
If Seconds < 0 Then Seconds = 0
Minutes = Seconds / 60
Minutes = Fix(Minutes)
Seconds = Seconds - (Minutes * 60)
Hours = Minutes / 60
Hours = Fix(Hours)
Minutes = Minutes - (Hours * 60)
Seconds = CStr(Seconds)
Minutes = CStr(Minutes)
Hours = CStr(Hours)
If Len(Seconds) = 1 Then Seconds = "0" + Seconds
If Len(Minutes) = 1 Then Minutes = "0" + Minutes
If Len(Hours) = 1 Then Hours = "0" + Hours
TimeDiff = Hours & ":" & Minutes & ":" & Seconds
End Function
Function setupunlocker()
Wx.BaudRate = 115200
Wx.ResetBaudRate = 115200
Wx.Parity = 0 ' 0 = None, 1 = Odd, 2 = Even, 3 = Mark, 4 = Space
Wx.StopBits = 0 ' 0 = 1 stop bit, 1 = 1.5 stop bits, 2 = 2 stop bits
Wx.DTRControl = 0 ' Initial state of DTR 0 = off, 1 = on
Wx.RTSControl = 1 ' Initial state of RTS 0 = off, 1 = on
Wx.ResetDelay = 100 ' In microseconds
Wx.ByteDelay = 10 ' In microseconds
Wx.RxByteTimeout = 3000 ' In milliseconds
Wx.ResetMode = 2 ' 0 = No Resets, 1 = ISO Reset (Expect a ATR), 2 = Device Reset (No ATR)
Wx.ResetLine = 1 ' 0 = Toggle RTS for Reset, 1 = Toggle DTR for Reset
Wx.ByteConvention = 1 ' 0 = Inverse, 1 = Direct
Wx.FlushEchoByte = 0 ' 0 = no flush, 1 = flush - A Phoenix interface will echo each byte transmitted.
Wx.FlushBeforeWrite = 1 ' 0 = no flush, 1 = flush - Flush the receive buffer before each write to strip off Null bytes.
Wx.IgnoreTimeouts = 1 ' 0 = Abort script on a receive timeout, 1 = Ignore all receive timeouts
Wx.ResetAfterTimeout = 0 ' 0 = Don't reset after a timeout, 1 = do a reset after a timeout - Not used if "IgnoreTimeouts=0"
Wx.LogTransactions = 0 ' 0 = Don't log transactions, 1 = log transactions
Wx.DisplayUSW = 0 ' Display USW after script complete 0 = no, 1 = yes
Wx.DisplayFuse = 0 ' Display Fuse after script complete 0 = no, 1 = yes
End function

[eric keri]

New one! card was locked and provider unknown. Glitched opened the card.

How do i fix the provider UNKNOWN with opened card? On the bin @ line 30c0 it does say A7 BF !

What is left to do.?

[arxontas]

read card with n2edit 2.58 then do a cleancodespace and then hit write.. then read it.. if it say unknown provider then open a GOOD clean image we call it virging image and write it.. then read again and u will get the provider..

[eric keri]

read card with n2edit 2.58 then do a cleancodespace and then hit write.. then read it.. if it say unknown provider then open a GOOD clean image we call it virging image and write it.. then read again and u will get the provider..

I know that. But that card is for a married IRD. Well the bin is for a married set...

[arxontas]

It is the same way .. Hope u have the original image .. When u open the card for the first time did u save the image?? If yes write that image.. The best way do it this way here..
Open ur card and USE ONLY n2edit 2.58 and read it.. It is ok if it is unknown provider..
Now clean code space and hit WRITE. Then read card ..IF stil it is unknown provider, open the original image u have saved at the time u open the card for the first time.. and hit write.. then read card and u will see ur provider .. Then clean code space and hit write again so ur card will be CLEAN no codes.. IF u do not have that original image then HOPE u have the image u allways using with that card and IRD and OPEN it and write it to ur card .. Then read it and u will get the provider u are looking for.. 100%
IT IS easy ... NOW before u do any reading or writing at the N2edit go to the setings and change the both delays to 100 and save them that way the card will be read and write slower but more secure.. IF some how it wont write and say errow just hit write again and u will be fine..

IF u do not have any of the above images then u are out of luck to have it SUB ..
Hope this help u.. Take ur time and read what i say..

[eric keri]

I do have the original bin. I did save it. And I did what you said but It is still unknown. That bin is UNKNOWN! How will it bring the provider back?

The original (glitched) bin is UNKNOWN.

[arxontas]

So u never program that card before?? The card is a SUB and u try to open it and when u open it it came unknown provider .... I thing u did not use the corect settings or file to open and thats why u have unknown provider..
Now the only way to use it as a sub u may have to put the card in the streem IF THE RECEIVER TAKES IT AND AFTER IT IS OK RE GLITCH IT AGAIN.
Do u realy need it to be a SUB?? if not then u have to mod the receiver and use public #s if u need private #s u have to use the GenDT08 SK v3.3 to married card and ird..

I do not know any other ways how to fix the unknown provider sorry..

[puppycake]

eric try to read it with another utility or two(try nagraedit5.2 first)it may be possible that the intercept isn't compliant with that proggy.If that is the case you can change the intercept to work with n2edit 2.58.It's worth a shot bro try to read it and see what you get.:confused::confused:

[arxontas]

Yes i see that.. BUT let see what are u using to read card?? PLEASE use ISO and not the unlocker If u using the unlocker to read then thats ur problemm read it with ISO and let us know.. what u get..

[2warm]

what script should i use on a 102 unknown provider password locked,rev 10c card! thanks

[gun smoke]

Easiest way to fix Unknown Provider is spend $25 and send card to someone who knows what he is doing or screw up your card and how much are those cards going for at the moment?
I had 2 w/unknown provider and within a week I had them back and are working flawlessly

where can I find a company like that,I have a few carrds I need unlocked that are at rev10a.
Thank's

[JT]

Rev10a is pretty easy to work with by today's standards. If you have a nexus or powersync unlocker you can do them yourself without too much risk of looping them.

[gizmolite]

gun smoke, buy a nexus unlocker from mili and a vip download membership and I'll help you learn how to unlock those yourself, by the way, my friends call me Gizmoloop, don't know why though.....Giz