Trouble unlocking Rom103 rev385

[mackscb]

I am trying to unlock this Rom103 rev385. It is a BGA chip mounted on a Reddevil bga card. Had fits getting the chip mounted and getting a good ATR. I am using a Mik Vortex with no pot and the RebelSerf 103_Rev307_387 Unlocker_Reader_newdRS_B script. I am using the default settings at the bottom of the script.

The script ran for a little over an hour and I got this:
Ram Intercept Installed. Trying to Open the 103.... Delay:3253 VCC:1C Glitch Type:07
Elapsed = 01:05:39
--------------------------------------------------------------------------------07Rst08-------------07Rst05-----------------------------------07Rst1B--------------
Sc.Read: Timeout Reading Data From Card - 2 Bytes Requested, 0 Bytes Read, Continuing Script
Script Error on Line 138
Sc.GetByte: Requested Byte Exceeds Last Read Request

And the script aborts. I put the card back in the Iso reader and still had a good ATR. I had to leave it for a day, but when I put it back in the unlocker I get the following:

Card not present or is not responsive.

I can still get a good ATR in n2edit. I haven’t seen this problem before when glitching, but it’s my first BGA. Has anyone else seen this error? Could this be caused by a bad solder joint and still give a good ATR? Any other suggestions?

[mackscb]

It seems my card is now failing to respond very early in the script. If you look near the top of the Main Sub, you see a call to ChkCard():

VG = VS1
sc.verbose = 0
Sc.Write("A0") ' turn led off
Clearoutputwindow
Call GetFileName()
If ChkCard() = 0 then
Fs.FileClose(OutFile)
exit sub
End If
If T7 = 1 then
Sc.MsgBox("Card not present or is unresponsive." & VBCr & " Unable to continue.")
Fs.FileClose(OutFile)
Exit Sub

So if T7 is set to 1 in ChkCard then the message I am getting is displayed. Looking at ChkCard, you see:

Function ChkCard()
sc.verbose = 0
ChkCard = 1
Print ""
Print " Checking Card's Eeprom Revision ......." & VBCr
sc.delay(2000)
ClearOutputWindow
Sc.Write("06 0E 03 01 03 9A 00") 'reset card
sc.read(02)
bytes = sc.getbyte(1)
If bytes < 27 then
T7 = 1
ClearOutputWindow
Exit Function

The function continues, but this is where T7 is set to 1. I don’t know what bytes<27 means, but I assume it means the card is not responding to the reset. So the question is, why is the card not responding to a reset in the script when it responds to a reset in N2edit? Could I put a sc.delay command of some value after the sc.read command to increase the response time?

[mackscb]

I reheated the solder points for the clc and rst connections and got the card to read in the unlocker. Trying to glitch again.

[Ohms]

those chips are tough to get going from what I have seen. I had one that was intermittent at best. Good luck man
Post back your results.

[mackscb]

OK, she popped. I hooked up the pot and tried 2K, then 1.5K and then 1K. It popped after 19 minutes at 1K.