Rev 109 Unlocker Released

[Crazy1_79]

Word is it is at 10x now. servers are too busy to get in so I would agree. when I get it I will post it in d/l section here at dssftp! It is for 109 and HIGHER! so 10B is there too!. confirmed working, I am 1 for 1 on rev 10B cards

[Crazy1_79]

UPDATE:

it is released. I have uploaded it to files section. I have not tested it as I only have 10B card that are stream locked. so use at your own risk, but the coder site I am a part of says this is the real deal.

[Crazy1_79]

uploads are down, I guess it is your guys lucky night. here it is. just copy and paste it to a notepad and save it with a .xvb extention so winexplorer recognizes it.


'************************************************* *************************************
'* New VB SCRIPT CREATED BY REBELSERF - 12/01/06 *
'* *
'* FOR STREAM LOCKED ROM 102S REVISION 109/247 OR HIGHER. *
'* USES ONLY NEWDRS FLASH WITH LOADER *
'* LOADER MUST USE MAX4619 OR ADG733 SWITCHES FOR RELIABLE UNLOCKING *
'* USE LOADER SWITCH 2 0R 3 *
'* HAPPY UNLOCKING AND GOOD LUCK!! *
'* *
'************************************************* *************************************
Option Explicit
Dim Shell
Set Shell = CreateObject("WScript.Shell")
Dim StartDate
Dim FileName
Dim OutFile
Dim BuffFlg
Dim bytes2
Dim GltParm
Dim ParLen
Dim ReslFlg
Dim LoopCntr
Dim RstFlg
Dim DlType
Dim Rs2Flg
Dim DlFlg
Dim bytes
Dim Uflg
Dim Acnt
Dim Mix
Dim VS1
Dim VT1
Dim DS1
Dim LP1
Dim LP2
Dim T1
Dim T2
Dim T3
Dim T4
Dim T5
Dim T6
Dim T7
Dim T8
Dim VG
Dim DD
Dim RT
Dim GT
LP1 = 1
BuffFlg = 0
LoopCntr = 0
GltParm = 176
ReslFlg = 0
Rs2Flg = 0
ParLen = 2
RstFlg = 1
DlType = 64
DlFlg = 0
Uflg = 0
VT1 = 1
DS1 = &h140B
DD = &h1453
GT= 7
RT = DS1 'Do not change any values above this line
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^


Sub Main()

Setupunlocker()
If CheckChipVer <> 1 then
Sc.MsgBox("Flash Version NDRS needed to run this script" & VbCr & "Flash your Loader with NewDRS.hex")
Exit Sub
End if
' These, AND ONLY THESE :), are the variables you can change for rom 102 any revision up to 108/244
LP1 = 40 'Number of tries per delay FROM 20-100 in multiples of 20
VS1 = 46 'YOU CAN CHANGE THIS FROM 02-255 = semi-automatic VCC range - Loader dependent
Mix = .0625 'Glitch VCC resolution - attempts per VCC = 1/mix
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^
VG = VS1
sc.verbose = 0
Sc.Write("A0") ' turn led off
Clearoutputwindow
If ChkCard() = 0 then
Sc.MsgBox(" Unsupported Rom Version: Rom " & T1 & ", Rev " & T4 & " found." & VbCr & "This Script is for use with Rom 102, Rev 109/244 and higher")
exit sub
End If
If T7 = 1 then
Sc.MsgBox("Card not present or is unresponsive." & VBCr & " Unable to continue.")
Exit Sub
End If
sc.verbose = 0
Sc.Write("06 0E 03 01 03 9A 00") 'reset card
sc.read(02)
bytes = sc.getbyte(1)
sc.read(bytes)
sc.delay(16)
Sc.write("2A 6023 210020A0CA00001A041801018600AA9D9D9D9D9D9D9D9D9DAE 69CC7A9BBE000000000088 0E108500")
Sc.Read(2)
bytes = sc.getbyte(1)
If bytes > 5 then
sc.read(bytes)
bytes = sc.getbyte(0)
bytes2 = sc.getbyte(3)
If bytes = 18 and bytes2 = 132 then
Sc.MsgBox("Revision 105/241 or higher code not active on the card." & VbCr & " Card may be open or revision masked." & VBCr & " Unable to continue.")
exit sub
End if
End If

StartDate = Now()
Print "Initial Parameters = Delay:" & HexString(RT, 4) & " VCC:" & HexString(VG, 2) & " Glitch Type:" & HexString(GltParm, 2) & "/" & HexString(GT, 2)& vbcr & vbcr
Do
'sc.verbose = 1
Sc.Write(HexString(GltParm, 2) & HexString(VG, ParLen))
Acnt = 0
If RstFlg = 1 then
Do
Sc.Write("06 0E 03 01 03 9A 00") 'reset card
Sc.Read(02)
Bytes = Sc.Getbyte(1)
If Bytes > 25 then
Sc.Read(27)
RstFlg = 0
Exit Do
End if
Acnt = Acnt + 1
If Acnt > 5 then
Sc.MsgBox(" Check Loader Settings. Invalid or no atr. Card may be looped.")
exit sub
End If
Loop
'Sc.verbose = 1
Sc.write("09 6004 21C1018869 84 00")
Sc.Read(2)
bytes = sc.getbyte(1)
sc.read(bytes)
Sc.Write("14 600C 214009A0CA0000032201010E2D 0E15 5005 00")
sc.read(2)
Bytes = Sc.Getbyte(1)
Sc.Read(Bytes)
Bytes = Sc.Getbyte(3)
If Bytes <> &hA2 And Bytes <> &h6F Then
Sc.MsgBox(" Improper Cmd22 response. Unable to continue.")
Exit Sub
End If
Sc.Delay(40)
End If
If RstFlg = 0 then
'sc.verbose = 1 'debug the packets
Sc.Write("37 702C 8D00A7A000000000000000000000AA000505007AC400807180 9CA64BB76B1864CD7C1631768008AE55CC7A9B3C" & HexString(DlType,2) & HexString(RT,4) & HexString(GT,2) & "0E20 85 00")
Sc.read(2)
bytes = sc.getbyte(1)
If bytes > 5 then
sc.read(bytes)
bytes = sc.getbyte(0)
bytes2 = sc.getbyte(3)
If bytes = &hD8 and bytes2 = &h55 then
Sc.verbose = 1
UFlg = 1
End If
If bytes = &hD8 and bytes2 = &h6F then
Print "-"
VG = VG - mix
RstFlg = 0
Rs2Flg = 0
Else
Print HexString(GT,2) & "+" & HexString(bytes2,2)
RstFlg = 1
Rs2Flg = Rs2Flg + 1
VG = VG + mix
End If
Else
PRINT HexString(GT, 2) & "Rst" & HexString(VG, 2)
RstFlg = 1
Rs2Flg = Rs2Flg + 1
VG = VG + mix
End if
If Uflg = 1 then
Print " !!!!!!!" & VBCr
Sc.Write("A1")
Shell.Run "%comspec% /c echo " & Chr(07) & Chr(07) & Chr(07) & Chr(07) & Chr(07), 0, True
Sc.delay(500)
print
print "******* Good response received! *********"& VbCr
PRINT " " & HEXSTRING(bytes2,2) & VbCr
Sc.Print "===========================================" & VbCr
print " " & HexString(bytes2, 2) & " was hit at: Delay:" & HexString(RT, 4) & " VCC:" & HexString(VG, 2) & " GlitchType:" & HexString(GltParm, 2) & "/" & HexString(GT, 2) &VBCr
print " Elapsed: " & TimeDiff(StartDate,Now())& vbcr
Print " VCC Resolution: " & mix & vbcr
Print " Delay Range: " & HexString(DS1, 4) & " to " & HexString(DD, 4) & VBCr
print
PRINT "********************************" & VBCR
PRINT "* REV 109+/247+ CAM NOW OPEN!! *" & VBCR
PRINT "* PROCEED AS NORMAL *" & VBCR
PRINT "* GOOD LUCK! :-) *" & VBCR
PRINT "********************************" & VBCR
exit sub
End If
If VG < VT1 then
VG = VS1
End If
LP2 = LP2 + 1
If LP2 > LP1 / mix then '
ClearOutputWindow
RT = RT + 1
IF RT = &h1421 Then
RT = &h1443
End If
LP2 = 0
print
print "" &vbcr
print "Ram Intercept Installed. Trying to Open the 102.... Delay:" & HexString(RT, 4) & " VCC:" & HexString(VG, 2) & " Glitch Type:" & HexString(GltParm, 2) & "/" & HexString(GT, 2) & VBCr & vbcr
sc.print "Elapsed = " & TimeDiff(StartDate,Now())& vbcr & vbcr
If RT > DD then
RT = DS1 - 1
GltParm = GltParm + 5
If GltParm > 186 Then
GltParm = 176
End If
If GltParm = 181 Then
If ReslFlg = 0 Then
ReslFlg = 1
LP1 = LP1 * 2
VS1 = VS1 * 2
VT1 = VT1 * 2
ParLen = 4
End If
End If
If GltParm <> 181 Then
If ReslFlg = 1 Then
ReslFlg = 0
LP1 = LP1 / 2
VS1 = VS1 / 2
VT1 = VT1 / 2
ParLen = 2
End If
End If
End If
End If
If VS1 >= 254 then
exit sub
End If
If DlType = &h40 Then
DlType = &h20
Else
DlType = &h40
End If
If VG =< 1 then
VG = VS1
End if
End If
If Rs2Flg >= 3 Then
Rs2Flg = 0
VG = VS1
If VT1 > 10 Then VT1 = 10
End If
If VG < VT1 Then
VG=VS1
End If
If VG + mix <=0 Then
VG = VS1
VT1=VT1+1
END If
Loop
End Sub


Function HexString(Number,Length)
Dim RetVal
Dim CurLen
RetVal=Hex(Number)
CurLen=Len(RetVal)
If CurLen<Length Then
RetVal=String(Length-CurLen,"0") & RetVal
End If
HexString=RetVal
End Function

Function CheckChipVer()
CheckChipVer = 1
sc.write("90")
delay(80)
If sc.read(4) <> 4 then
CheckChipVer = 0
Exit Function
End if
If getbyte(0) <> &H4E then CheckChipVer = 0
If getbyte(1) <> &H44 then CheckChipVer = 0
If getbyte(2) <> &H52 then CheckChipVer = 0
If getbyte(3) <> &H53 then CheckChipVer = 0

End Function

Function TimeDiff (StartTime, EndTime)
Dim Hours, Minutes, Seconds
Seconds = DateDiff("s", StartTime, EndTime)
If Seconds > 90000 Then Seconds = 90000
If Seconds < 0 Then Seconds = 0
Minutes = Seconds / 60
Minutes = Fix(Minutes)
Seconds = Seconds - (Minutes * 60)
Hours = Minutes / 60
Hours = Fix(Hours)
Minutes = Minutes - (Hours * 60)
Seconds = CStr(Seconds)
Minutes = CStr(Minutes)
Hours = CStr(Hours)
If Len(Seconds) = 1 Then Seconds = "0" + Seconds
If Len(Minutes) = 1 Then Minutes = "0" + Minutes
If Len(Hours) = 1 Then Hours = "0" + Hours
TimeDiff = Hours & ":" & Minutes & ":" & Seconds
End Function

Function ChkCard()
sc.verbose = 0
ChkCard = 1
Print ""
Print " Checking Card's Eeprom Revision ......." & VBCr
sc.delay(2000)
ClearOutputWindow
Sc.Write("06 0E 03 01 03 9A 00") 'reset card
sc.read(02)
bytes = sc.getbyte(1)
If bytes < 27 then
T7 = 1
ClearOutputWindow
Exit Function
End If
sc.read(bytes)
sc.delay(16)
T1 = chr(sc.getbyte(16))
T2 = chr(sc.getbyte(17))
T3 = chr(sc.getbyte(18))
T4 = chr(sc.getbyte(23))
T5 = chr(sc.getbyte(24))
T6 = chr(sc.getbyte(25))
T1 = T1+T2+T3
T4 = T4+T5+T6
If asc(T4) = 0 then
T4 = "000"
End If
Print " Rom " & T1 & ", Rev " & T4 & " found." & VBCR
print
Sc.delay(1500)
T8 = mid(T4, 3,1)
Select Case T8
Case "A"
T8 = 10
Case "B"
T8 = 11
Case "C"
T8 = 12
Case "D"
T8 = 13
Case "E"
T8 = 14
Case "F"
T8 = 15
End Select
If left(T4, 2) = 24 then
If T8 < 7 then
ChkCard = 0
exit function
End If
End If
If left(T4, 2) = 10 then
If T8 < 9 then
ChkCard = 0
exit function
End If
End If
If T1 <> "102" then
ChkCard = 0
exit function
End If
End Function

Function setupunlocker()
Wx.BaudRate = 115200
Wx.ResetBaudRate = 115200
Wx.Parity = 0 ' 0 = None, 1 = Odd, 2 = Even, 3 = Mark, 4 = Space
Wx.StopBits = 0 ' 0 = 1 stop bit, 1 = 1.5 stop bits, 2 = 2 stop bits
Wx.DTRControl = 0 ' Initial state of DTR 0 = off, 1 = on
Wx.RTSControl = 1 ' Initial state of RTS 0 = off, 1 = on
Wx.ResetDelay = 100 ' In microseconds
Wx.ByteDelay = 10 ' In microseconds
Wx.RxByteTimeout = 3000 ' In milliseconds
Wx.ResetMode = 2 ' 0 = No Resets, 1 = ISO Reset (Expect a ATR), 2 = Device Reset (No ATR)
Wx.ResetLine = 1 ' 0 = Toggle RTS for Reset, 1 = Toggle DTR for Reset
Wx.ByteConvention = 1 ' 0 = Inverse, 1 = Direct
Wx.FlushEchoByte = 0 ' 0 = no flush, 1 = flush - A Phoenix interface will echo each byte transmitted.
Wx.FlushBeforeWrite = 1 ' 0 = no flush, 1 = flush - Flush the receive buffer before each write to strip off Null bytes.
Wx.IgnoreTimeouts = 1 ' 0 = Abort script on a receive timeout, 1 = Ignore all receive timeouts
Wx.ResetAfterTimeout = 0 ' 0 = Don't reset after a timeout, 1 = do a reset after a timeout - Not used if "IgnoreTimeouts=0"
Wx.LogTransactions = 0 ' 0 = Don't log transactions, 1 = log transactions
Wx.DisplayUSW = 0 ' Display USW after script complete 0 = no, 1 = yes
Wx.DisplayFuse = 0 ' Display Fuse after script complete 0 = no, 1 = yes
End function

[tommyoz]

This is great news indeed. If I only had a Rev109.

[James-x]

so this will work for rev 247?

[Crazy1_79]

Confirmed working, it was luck I think, but here it is!

Rom 102, Rev 10B found.

Initial Parameters = Delay:140B VCC:2E Glitch Type:B0/07

--------------------------------------------------------------------------07+55 !!!!!!!
TX Data : A1

******* Good response received! *********
55
===========================================
55 was hit at: Delay:140B VCC:29 GlitchType:B0/07
Elapsed: 00:00:10
VCC Resolution: 0.0625
Delay Range: 140B to 1453

********************************
* REV 109+/247+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************

[James-x]

or maybe this is the rael deal this very good news

[Wyzzard]

Crazy1 79....I got the same response on 2 of my 10B's....but when I try and read it states that it locked.....what is my next step after using the new s/w?

[Wyzzard]

OK....figured it out, after you unlock the 109/10B you have to read in N2 Edit and then write back to card and all is good. Yes, this does work!

[jskey]

what type of unlocker are u using?

[James-x]

well i have a nother looped card use new scripted did every thing right to the T. tryed to unlock rev 247 15 min into quit. no atr well i am scwed

[Stockwell_Day]

James, did you DrSaggan (sp?) mod to your unlocker to stablize your voltage prior to using this script?

[natalian]

try this new script on rev245-(109) and give me window error Unsupported Rom Version:Rom102,Rev245 found. This Script is for use with Rom 102,Rev109/244 and higher. Any one now how change the setings so I can run the script?

[Crazy1_79]

There is a script that allows it to glitch the 245. i know at 10x. I will fix it tomorrow if you ahve not gotten by then.

[sukh77]

Damn I can't wait to try. winexplorer can't set the data rate for the loader using win Vista. Going back to winxp.

[M.E.]

I'll bet we are all going to pay dearly for this in the near future. Not just with a revision update either. I don't want to put a damper on everyone's spirit but I can see the providers about to do some house cleaning. Starting with cleaning some clocks. I don't think that its going to stop there either. Have fun with it while you can.

[James-x]

James, did you DrSaggan (sp?) mod to your unlocker to stablize your voltage prior to using this script? doesnt matter now i only had one card to test with now i will have to get another card somwhere?

[Littlebear151]

hi crazy1,
did you change any of the winexplorer settings, I have a 10b that I don't know anything about thought I might give the SW a try

If this thing really works on 10b you know it won't be long till we will be looking at a new rev.

LB

[wtp]

Alls I get is ------------------ with milis unlocker. Rom102 rev287 any ideas

[Ohms]

Be sure to use the no-loop diode mod on your unlocker ah la Dr. Sagan.
Set your ohms to 700 (assumes white nexus)
Glitch the bitch. Be ready to loop it.

If you can't stand looping it....don't glitch it.

Even the best testers loop roms when glitching. I know some of the best testers. They all have piles of looped roms.

[wtp]

Yes mine is white or clear I guess. I'm not sure I'm reading the ohms right but if I'm looking at the buttom, pot and switch towards me. I one probe on the center connection and one on the connection to the right. Theres 3 connections. Kinda like a upside down triangle. But can only get 500 something ohms with meter set at 200k.

[Ohms]

if you look at the top with the switches on the left and the pot on the right, there are two silver solder points just to the right of the pot. Measure your ohms there.

Do not move the pot while the script is running. What I do is pull the card, disconnect all cables, adjust the pot, and then start again.

[wtp]

ok I have 2000k, 200k, 20k, 2000 and 200 which setting are you using? I found the two solder points but can't get even close to 700 ohms on any setting. Iget different readings depending on which one I put the red or black lead on. What I'm sying is if you turn the leads around I gain like 200 ohms. Sorry, alittle confused now

[Crazy1_79]

Be sure to use the no-loop diode mod on your unlocker ah la Dr. Sagan.
Set your ohms to 700 (assumes white nexus)
Glitch the bitch. Be ready to loop it.

If you can't stand looping it....don't glitch it.

Even the best testers loop roms when glitching. I know some of the best testers. They all have piles of looped roms.
LOL, I gaurantee the looped pile is alot taller than the unlooped working pile!!

[Crazy1_79]

hi crazy1,
did you change any of the winexplorer settings, I have a 10b that I don't know anything about thought I might give the SW a try

If this thing really works on 10b you know it won't be long till we will be looking at a new rev.

LB
HEY LB< the one I popped, I did not change anything, it happened to fast to let me think about it
the second I looped, I gave it hell for one cycle of the delays, modifying the VCC higher, when vcc gets low, the card resets more, I have a personal opinion that excessive resets leads to looping. so I try to minimize them with vcc adjustments. That card woulnd't pop so I lowered vcc into the reset range where resets are more common, guess what? it looped. Oh well. 1 out of 2 aint' bad.

[mackscb]

ok I have 2000k, 200k, 20k, 2000 and 200 which setting are you using? I found the two solder points but can't get even close to 700 ohms on any setting. Iget different readings depending on which one I put the red or black lead on. What I'm sying is if you turn the leads around I gain like 200 ohms. Sorry, alittle confused now If you have the diode mod on your unlocker, you will get different readings depending on which contacts you put the red and black leads on. One end of the diode is connected to one of the pot connections. I am using the higher of the two readings to set my pot. That best matches what I get when I check the pot setting before connecting it to the unlocker.

[A-Team]

Unlocked ALOT of cards without DrSagans mod -take your time it works -

[sukh77]

Loader 2 settings
Mili's clear/white nexus 4619
Switch 2 and 3.
Rom 102 rev 109

Results:
******* Good response received! *********
55
===========================================
55 was hit at: Delay:1446 VCC:23 GlitchType:B0/07
Elapsed: 00:28:12
VCC Resolution: 0.0625
Delay Range: 140B to 1453

********************************
* REV 109+/247+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************

And we have another

TX Data : A1

******* Good response received! *********
55
===========================================
55 was hit at: Delay:144C VCC:22 GlitchType:B0/07
Elapsed: 00:43:02
VCC Resolution: 0.0625
Delay Range: 140B to 1453

********************************
* REV 109+/247+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************

[Ohms]

switch 2 & 3 eh? Well I'll be danged. You have the Dr. Sagan mod installed on that one?? How long did it take and what were your ohms set to? Is that 28 minutes?


Friggin COOL MAN

[sukh77]

Bought from Mili don't know what mod it came with.

[wtp]

I have heard, not sure if there right or not that diode mod loopes just as easy it just depends on how far your willing to go with the settings. Don't flame me just repeating what I've heard. I do not have the diode installed. I have had really good luck with mili's unlocker until I have been trying 285's and 287's

[Ohms]

The diode mod is just to prevent voltage spikes durring that occur on the 4619 based unlockers. It's was called a no-loop mod because it prevents the common looping that results from these spikes. However, the diode will not prevent software looping.

[snaplunt]

Is this normal guys


Ram Intercept Installed. Trying to Open the 102.... Delay:1410 VCC:2E Glitch Type:B0/07

Elapsed = 00:04:36

---07Rst2E--07Rst2E-07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E0 7Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07 Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07R st2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rs t2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst 2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2 E07Rst2E07Rst2E07

[snaplunt]

Can some one please post their winexplorer settings, i have been trying since yesterday with no luck.

[mili]

Looped one, will not risk the rest.

mili

[snaplunt]

FINALLY i poped one rom102rev10b

Ram Intercept Installed. Trying to Open the 102.... Delay:1446 VCC:1D Glitch Type:B0/07

Elapsed = 00:18:57

----------------------------------------07Rst1A------------07Rst1A-----------07Rst19-07Rst19--------------------------------07Rst17------------------------------------------------------07Rst14---------------07Rst13----------07Rst12-----------------------------------------07Rst10----07Rst10--------------------------------------07Rst0D---07Rst0D------------------07Rst0C---------------------------------------07Rst0A-----------------07Rst09---------07Rst0807Rst08-07Rst08----07+55 !!!!!!!
TX Data : A1

******* Good response received! *********
55
===========================================
55 was hit at: Delay:1446 VCC:08 GlitchType:B0/07
Elapsed: 00:19:37
VCC Resolution: 0.0625
Delay Range: 140B to 1453

********************************
* REV 109+/247+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************

Script C:\Documents and Settings\xxxxxxx\Desktop\New Folder (2)\RebelSerf 102_Rev109_247 Unlocker.xvb Transmission Completed

[dewyscrewmandho]

I have a moded T-911 and I'm not sure what chip I have in it, it's about two years old with a clear blue case and the board is a green colour. So I don't know if I have the 4619 chip or not, and if I don't have that chip, will it make a difference if I use it with the diod mod? if yes what is the name of the chip that I would ask for at my electronic store? and is there a diagram as to what chip I take out and where I put this one in? I know 20 questions...lol but hey I'm trying to learn here so please be nice...lol
Cheers and thanks to every one who has helped me in the past!!!!!

[CYCO]

This is what i get when trying to run script. Any Ideas on what i need to do? Have tried different switch settings.
Rom 102, Rev 109 found.

Initial Parameters = Delay:140B VCC:2E Glitch Type:B0/07


Script Error on Line 141
Sc.GetByte: Requested Byte Exceeds Last Read Request

[Crazy1_79]

I have a moded T-911 and I'm not sure what chip I have in it, it's about two years old with a clear blue case and the board is a green colour. So I don't know if I have the 4619 chip or not, and if I don't have that chip, will it make a difference if I use it with the diod mod? if yes what is the name of the chip that I would ask for at my electronic store? and is there a diagram as to what chip I take out and where I put this one in? I know 20 questions...lol but hey I'm trying to learn here so please be nice...lol
Cheers and thanks to every one who has helped me in the past!!!!!
you have the 4053 chips. I have read reports of people popping cards with them. but I dont think it is wise. you want the max4619 chip. they will probally have to order them if they can get them. do a search for t911 mod green board, sounds like you have one of the originals. the 4053 chips are the ones you solder the pot onto. at least one of them is, the other is right next to it.

[tjh]

Question: Will this unlock Rev 287?

Sukh77: What was your resistance on your white Nexus?

TJH

[sukh77]

Didn't ohm it out. My default is the middle or center however you want to look at it.

[wtp]

I've tried evrything I can with mili's unlocker. Even put a new pot on and still get ------------------ with a 287. Time to look for a new unlocker.

[Crazy1_79]

I've tried evrything I can with mili's unlocker. Even put a new pot on and still get ------------------ with a 287. Time to look for a new unlocker.
that is what you are suppose to get, maybe rst and once in a while a + if you are getting --------------- keep it going, that is perfect., you dont' get ++ on higher revs

[wtp]

ok well thats good to hear but when running for 2 hrs there is nothing.

[zeros]

im gonna give it a try .. what should i flash my nexus with before i run this script? thanks !

[zeros]

i tryed to flash it with newdrs. but it gives me a error (unable to locate all of the hex files for newrs there needs to be a *.exe.program and a*.exe eeprom .hex for each flash.) anyone know what i did wrong.. i copied the .hex file into my xpatmel folder.. thanks for the help!

[CYCO]

i tryed to flash it with newdrs. but it gives me a error (unable to locate all of the hex files for newrs there needs to be a *.exe.program and a*.exe eeprom .hex for each flash.) anyone know what i did wrong.. i copied the .hex file into my xpatmel folder.. thanks for the help!

You need both files. the hex and the eeprom. There are 2 for each flash

[zeros]

i downloaded the file from the download page.. but i didnt see a eprom file in their.. their was a hex file and xvb file... where could i find the eprom file...?

thanks alote !

[CYCO]

i downloaded the file from the download page.. but i didnt see a eprom file in their.. their was a hex file and xvb file... where could i find the eprom file...?

thanks alote !


#16 in unlocking utilities

[zeros]

thanks guess ill have to wait till tommrow.. to download it .. thanks again!

[JT]

How many of you guys posting success, especially you Crazy, have installed the "no loop" diode?

[zeros]

mine looped.... oh well... i was using the nexus . and the rebel script was going for 15 minutes or so then.... no ATR....

[Ohms]

Crazy is running the Dr. Sagan no-glitch-loop mod

[JT]

I havn't added that diode to any of my loaders yet. Going with emu is so much more cost effective. At some point though I need to know if that no loop diode is really worth it. Dr. Sagan is one smart cookie, so there's probably something to it if I had to guess. It's not as if it will take more than about a minute per loader to add it.

Now to get a bit off topic, but any reason we can't use a Zener diode instead of the Shotzky? (I know I spelled that wrong) I don't know enough about the difference.

[gun]

open a 245 after 72 hours blue nexus 2 5 down and its working thank you

[mustwatchtv]

Ram Intercept Installed. Trying to Open the 102.... Delay:141E VCC:09 Glitch Type:B0/07

Elapsed = 00:26:29

---07Rst08-07Rst08--07Rst0807Rst08-07Rst08---07Rst0807Rst0807Rst08-07Rst2E---------07Rst2D-----07Rst2D07Rst2D----07Rst2D--------07Rst2D---------------07Rst2C-------------------07Rst2B---07Rst2A07Rst2B---------------------------------------------------------------------------07Rst26---------07Rst25-----07Rst25------07Rst25--07Rst25---07Rst25------07Rst2407Rst24------07Rst24----------------07Rst23----------------------07Rst22-----------07Rst21-----------------------------------------------------------------07+55 !!!!!!!
TX Data : A1

******* Good response received! *********
55
===========================================
55 was hit at: Delay:141E VCC:1D GlitchType:B0/07
Elapsed: 00:27:18
VCC Resolution: 0.0625
Delay Range: 140B to 1453

********************************
* REV 109+/247+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************

white case nexus from here, 4619 chip and no diode mod
new RDS flash
dip 2 and 5 on
9v 300Ma and pot was .211 ohm under 2k
loader 2 settings in winex 5.0 full screen

happy glitching

[wtp]

Heres what I got so far


Ram Intercept Installed. Trying to Open the 102.... Delay:1446 VCC:5A Glitch Type:B5/07
Elapsed = 22:06:46
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
still nothing

[gun]

open a 247 blue nexus 2 5 down THANK YOU

[gcan]

hey guys, does anyone have diode mod pics of the mikobu N2(yellow mikobu 4619 unlocker)?

[mtmt1us]

I would like to see that pic also !!

[gcan]

I would like to see that pic also !!

here ya go, i didnt know i had the pic.......gcan

[scabby]

It says it opened in Winex ( ie success blah blah) I forgot to use N2Edit first tried Nagraedit it wouldnt read .Then I read the forums a bit and tried N2Edit but same no read (fails) what should i do retry to glitch?

[scabby]

I havn't added that diode to any of my loaders yet. Going with emu is so much more cost effective. At some point though I need to know if that no loop diode is really worth it. Dr. Sagan is one smart cookie, so there's probably something to it if I had to guess. It's not as if it will take more than about a minute per loader to add it.

Now to get a bit off topic, but any reason we can't use a Zener diode instead of the Shotzky? (I know I spelled that wrong) I don't know enough about the difference.

As far as I know the diff is Breakdown voltage of schottky is .3v where as silicone is .7v Also power handling the ratings on schotky much higher this one is rated for 20v 1a this is off top of head id have to check

[scabby]

got it to read had to use mr ultimate only one that woyuld read it no need to reglitch

[Zim]

shit, I looped one too.....

[gcan]

i looped two so far.................................gcan

[steve2555]

I've tried evrything I can with mili's unlocker. Even put a new pot on and still get ------------------ with a 287. Time to look for a new unlocker.
Do you have all your traces cut?

[spoof]

Cyclone Unlocker
Rom 102, Rev 109 found.
<snipped>
Ram Intercept Installed. Trying to Open the 102.... Delay:1416 VCC:25 Glitch Type:B0/07

Elapsed = 00:11:17

-----------07Rst25-----------------------------------------------------------------07Rst21-----------------------07Rst1F----------------07Rst1E07Rst1E-----------------------07Rst1D------07Rst1D-------------07Rst1C--------------------------07Rst1A------------------------------07Rst19--------------------------------------07Rst16-------------07Rst16--------------------07Rst14---------------07Rst14--------------------07Rst12-----------07Rst1207Rst1207Rst12-------------------------------------------07+55 !!!!!!!
TX Data : A1

******* Good response received! *********
55
===========================================
55 was hit at: Delay:1416 VCC:2B GlitchType:B0/07
Elapsed: 00:11:56
VCC Resolution: 0.0625
Delay Range: 140B to 1453

********************************
* REV 109+/247+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************

Script C:\Users\doddsb\Dish\Unlocking Scripts\RebelSerf 102_Rev109_247 Unlocker.xvb Transmission Completed

But then when I try to read it in an ISO or loader it says "NO ATR" WTF??!!!

[spoof]

Sorry about previous post, couldn't reset ATR using N2Edit 2.58 initally after unlock.
NagraMaster4.0.7 did show ATR, since I'm curious I went back to N2Edit 2.58 and it then did also show ATR. Tried w/N2Edit but wouldn't read. Went back to NagraMaster4.0.7 & it read it.

woohoo!!!

[Crazy1_79]

hey spoof there is a new program out now, RM_1A it is a whole new glitch attack and has a very less likely chance of looping cards, You can find it in the downloads and just about anywhere where sattelite peeps hang out. I suggest you use that from now on.

[spoof]

I've had it since it came out but have not yet got it to work for me.
using Cyclone Unlocker, flashed properly with RSX1. Tried all 4 com delay settings but I keep getting the following;
Parameters-> Delay:00AE VCC:28 Glitch Type:B0/07 Timeout Factor:04
then pop up window saying 'Improper Cmd22 response. Unable to continue.'
using vista, will try xp maybe?