PDA

View Full Version : post your rom102 glitch results here

cantalope
12-18-2007, 04:41 AM
I am hoping that a moderator can put a sticky on this one. I want this to be a place for guys to cut and paste glitch success along with type of unlocker, win ex settings, and PS and POT settings. I think it would be a good reference tool/guide for what settings to use to glitch cards. I'm starting a seperate thread for rom 103 as well. Take a few minutes to post here guys and I'm sure it will help everyone once the thread stats growing.
cantalope
12-18-2007, 04:51 AM
Here is a rev 289 icam

******* Good response received! *********
55
===========================================
55 was hit at: Delay:1445 VCC:45 GlitchType:B5/07
Elapsed: 00:54:03
VCC Resolution: 0.0625
Delay Range: 1410 to 1453

********************************
* REV 10B+/289+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* YA CHINGASTE! :-) *
********************************

blue nexus, dip 2 only, 9v 350mA, 27-30 ohms
cantalope
12-18-2007, 05:00 AM
All below on a blue nexus, no diode mod, ohms between 27-32, 9v 350mA PS, loader 2 settings in winex. Hope this helps!


rev 10b

Rom 102, Rev 10B found.

Initial Parameters = Delay:1453 VCC:2E Glitch Type:B0/07

----------------------------------------------------------------------------------07Rst29----------------------------------------------------------07Rst25-----------07Rst25-----------------07Rst24------------------------------------------------------------------------------------------------------------------------------07Rst1C--------------------------07Rst1A-07Rst1A------------07Rst1A-----------------------------------07Rst18---------------------------------------------------------------07Rst14---------------------07+FF---------------------07Rst11----------------07Rst10-----07Rst10-07Rst10---------07+FF-07Rst0F---------------------07Rst0E---------------07Rst0D-----------------------------07Rst0C----07Rst0B-----------07Rst0B-----07Rst0A-------07Rst0A07+55 !!!!!!!
TX Data : A1

******* Good response received! *********
55
===========================================
55 was hit at: Delay:1453 VCC:0A GlitchType:B0/07
Elapsed: 00:00:59
VCC Resolution: 0.0625
Delay Range: 1410 to 1453

********************************
* REV 10B+/289+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* YA CHINGASTE! :-) *
********************************
b5 glitCh RebelSerf 102_Rev109_247 Unlocker.xvb Transmission Completed

bev rev 247

TX Data : A1

******* Good response received! *********
55
===========================================
55 was hit at: Delay:1441 VCC:33 GlitchType:B5/07
Elapsed: 00:07:36
VCC Resolution: 0.0625
Delay Range: 1440 to 1453

********************************
* REV 10B+/289+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* YA CHINGASTE! :-) *
********************************

b5 glitCh RebelSerf 102_Rev109_247 Unlocker.xvb Transmission Completed

bell rev 247

Elapsed = 00:07:33

-------07Rst10-----------------------------07Rst0E------------07Rst0E------------------07Rst0D07Rst0D-----07Rst0C-------------07+55 !!!!!!!
TX Data : A1

******* Good response received! *********
55
===========================================
55 was hit at: Delay:1441 VCC:0C GlitchType:B0/07
Elapsed: 00:07:45
VCC Resolution: 0.0625
Delay Range: 1439 to 1453

********************************
* REV 109+/247+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************

RebelSerf 102_Rev109_247 Unlocker.xvb Transmission Completed

dish rev 10B

07Rst10--------------------------------------07+55 !!!!!!!
TX Data : A1

******* Good response received! *********
55
===========================================
55 was hit at: Delay:143C VCC:0E GlitchType:B0/07
Elapsed: 00:02:54
VCC Resolution: 0.0625
Delay Range: 1439 to 1453

********************************
* REV 109+/247+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************

RebelSerf 102_Rev109_247 Unlocker.xvb Transmission Completed

dish rev 10b

07Rst0C----------------------------------------------------------07Rst08----------------07+55 !!!!!!!
TX Data : A1

******* Good response received! *********
55
===========================================
55 was hit at: Delay:1443 VCC:07 GlitchType:B0/07
Elapsed: 00:10:55
VCC Resolution: 0.0625
Delay Range: 1439 to 1453

********************************
* REV 109+/247+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************

RebelSerf 102_Rev109_247 Unlocker.xvb Transmission Completed
blao
12-18-2007, 05:57 AM
Delay : 143E Glitch Type : B5/07 0E : 20 Elapsed Time = 00:10:16
!07!-!08!--------------------!02!---------- ^ ------------------------!48!------------!45!---------------!41!------------------------------------------------------
********************************
* Elapsed Time: 00:10:38 *
* Delay:143E *
* VCC:31 *
* GlitchType:B5/07 *
* *
* Delay Range: 1439 to 1453 *
* VCC Range: 50 to 00 *
* VCC Resolution: 0.325 *
********************************
* REV 10B CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************

Delay : 144D Glitch Type : B0/07 0E : 1F Elapsed Time = 00:29:44
---------------------------------------------------------!15!----------------------------------!0B!---!0B!---------------------!05!------!04!------!03!--!03!----
********************************
* Elapsed Time: 00:30:07 *
* Delay:144D *
* VCC:03 *
* GlitchType:B0/07 *
* *
* Delay Range: 1439 to 1453 *
* VCC Range: 50 to 00 *
* VCC Resolution: 0.325 *
********************************
* REV 10B CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************

am Intercept Installed. Trying to Open the 102.... Delay:1440 VCC:3F Glitch Type:B5/07
Elapsed = 00:30:43
--------07Rst3E-------07Rst3E---------------------------------------------------07Rst39---------------------07Rst37-----------------------------------07Rst34------07Rst34----------------------------------07Rst31--------------07Rst30-----------------------07Rst2D-----------------------------07Rst2B------------------------------------------07Rst27-----------------------07Rst25-----------------------------------07Rst22-------------07Rst21--------------07Rst20-----------------------07Rst1E------------------------------------------------------------------------07Rst17-------------------07Rst15----------------07Rst14-----------------------07Rst12------07Rst11-07Rst11----------------07Rst10---------------------------07Rst0E-------------07Rst0D-----------------07Rst0B-07Rst0B--------------------------------07Rst08-07Rst08--07Rst08-------------------07Rst06--------------07Rst0507Rst05-------------07Rst0407Rst04------07+55 !!!!!!!
TX Data : A1
******* Good response received! *********
55
===========================================
55 was hit at: Delay:1440 VCC:04 GlitchType:B5/07
Elapsed: 00:31:56
VCC Resolution: 0.0925
Delay Range: 1439 to 1453
********************************
* REV 109+/247+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************
:D
cantalope
12-18-2007, 06:30 AM
blao that's toysrebel script u r using, correct?
blao
12-18-2007, 06:03 PM
blao that's toysrebel script u r using, correct?

yes with a powersync unlocker

i start open cards when a change delay to 1439 as you can see from script

diode mod seems to slow down speed of unlocking time but its not a big issue if is safer from real.

same result with the b5 script as you can see
greenie-monster
12-18-2007, 08:28 PM
Blau what DIP and OHMS and power supply you using for your powersync?
sand7115
12-19-2007, 08:32 AM
07Rst4507Rst4507+FF----07Rst5C------07Rst5B07Rst5C07Rst5C------07Rst5C-------07Rst5B-------------------------------07Rst59-----------07+55 !!!!!!!
TX Data : A1
******* Good response received! *********
55
===========================================
55 was hit at: Delay:1415 VCC:59 GlitchType:B5/07
Elapsed: 00:18:14
VCC Resolution: 0.0625
Delay Range: 1410 to 1453
********************************
* REV 10B+/289+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* YA CHINGASTE! :-) *
********************************
Script F:\Winexplorer\b5 glitCh RebelSerf 102_Rev109_247 Unlocker.xvb Transmission Completed
eric keri
12-23-2007, 08:58 AM
Rom 102, Rev 10B found.
Initial Parameters = Delay:1453 VCC:2E Glitch Type:B0/07
-----------------------------07Rst2C----------------------------07Rst2A-------07Rst2A--------------------------------07Rst28-----------------------------------------------------------------------------------------07Rst23---------------------07Rst21------------------------------------07Rst1F----07Rst1F---------------07Rst1E07Rst1E-----------07Rst1E---------07Rst1D---07Rst1D---07Rst1D----07Rst1D---07Rst1D-----07Rst1C--07Rst1C--------07+55 !!!!!!!
TX Data : A1
******* Good response received! *********
55
===========================================
55 was hit at: Delay:1453 VCC:1C GlitchType:B0/07
Elapsed: 00:00:37
VCC Resolution: 0.0625
Delay Range: 1410 to 1453
********************************
* REV 10B+/289+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* YA CHINGASTE! :-) *
********************************
lightning0009
12-25-2007, 05:40 AM
Blue Nexus, diode mod, switch 4 only, 200 ohms.

Rom 102, Rev 10B found.

Initial Parameters = Delay:1443 VCC:10 Glitch Type:B0/07

---07Rst10----------------07Rst0F--------07Rst0E--------------07Rst0E07+55 !!!!!!!
TX Data : A1

******* Good response received! *********
55
===========================================
55 was hit at: Delay:1443 VCC:0E GlitchType:B0/07
Elapsed: 00:00:08
VCC Resolution: 0.0625
Delay Range: 1443 to 1446

********************************
* REV 109+/247+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************

Ram Intercept Installed. Trying to Open the 102.... Delay:1443 VCC:06 Glitch Type:B0/07

Elapsed = 00:01:51

---------07Rst06-07Rst06--------------------07Rst04--------07Rst04--------07Rst04-----07Rst03--------07Rst03----------------07Rst02----------07Rst01--07+55 !!!!!!!
TX Data : A1

******* Good response received! *********
55
===========================================
55 was hit at: Delay:1443 VCC:01 GlitchType:B0/07
Elapsed: 00:02:08
VCC Resolution: 0.0625
Delay Range: 1440 to 1490

********************************
* REV 109+/247+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************

Modified\DT RebelSerf 102_Rev109_247 Unlocker.Modified.xvb Transmission Completed

Ram Intercept Installed. Trying to Open the 102.... Delay:1444 VCC:07 Glitch Type:B0/07

Elapsed = 00:02:18

07Rst07----07Rst07----------------------07Rst0607Rst06---------------------07Rst04-07Rst0407Rst04----------------------------07Rst03---07Rst0307Rst03-------07Rst0207Rst02---------------07Rst02------07Rst01----07Rst01-------------------------07Rst0F--------------07Rst0E-07+4A------------07Rst0D07Rst0D07Rst0D-------07Rst10-------------------07+55 !!!!!!!
TX Data : A1

******* Good response received! *********
55
===========================================
55 was hit at: Delay:1444 VCC:0E GlitchType:B0/07
Elapsed: 00:02:53
VCC Resolution: 0.0625
Delay Range: 1440 to 1490

********************************
* REV 109+/247+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************

DT RebelSerf 102_Rev109_247 Unlocker.Modified1440.xvb Transmission Completed


Ram Intercept Installed. Trying to Open the 102.... Delay:1447 VCC:12 Glitch Type:B5/07

Elapsed = 00:08:34

--------07Rst12--07Rst12-----07Rst12-07Rst12------------07Rst11---07Rst11---------------------07+55 !!!!!!!
TX Data : A1

******* Good response received! *********
55
===========================================
55 was hit at: Delay:1442 VCC:10 GlitchType:BA/07
Elapsed: 00:08:46
VCC Resolution: 0.0625
Delay Range: 1443 to 1446

********************************
* REV 109+/247+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************



Ram Intercept Installed. Trying to Open the 102.... Delay:1447 VCC:08 Glitch Type:B5/07

Elapsed = 00:06:04

-------07Rst08--------07Rst0807Rst08-----------------------07Rst06----------------------07Rst05----------------------------------07Rst03-----------------------------------07Rst1007Rst10-----------------------------07Rst0E-----07+55 !!!!!!!
TX Data : A1

******* Good response received! *********
55
===========================================
55 was hit at: Delay:1442 VCC:0E GlitchType:BA/07
Elapsed: 00:06:23
VCC Resolution: 0.0625
Delay Range: 1443 to 1446

********************************
* REV 109+/247+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************


Ram Intercept Installed. Trying to Open the 102.... Delay:1447 VCC:06 Glitch Type:BA/07

Elapsed = 00:11:44

------07Rst06-----07Rst05--------------07Rst04-----07Rst04------07Rst04---------------------07Rst03----------07Rst0207Rst02---------------07Rst01-------------07Rst10----------------------07Rst0E-----------07Rst0E----07Rst0D--------07+55 !!!!!!!
TX Data : A1

******* Good response received! *********
55
===========================================
55 was hit at: Delay:1442 VCC:0D GlitchType:B0/07
Elapsed: 00:12:07
VCC Resolution: 0.0625
Delay Range: 1443 to 1446

********************************
* REV 109+/247+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************


Rom 102, Rev 10B found.

Initial Parameters = Delay:1443 VCC:10 Glitch Type:B0/07

-07Rst10---07Rst10--------------------07Rst0F--------------------------------07Rst0D---07Rst0D------------07Rst0C----------------------------07Rst0A----------------------------------07Rst08---07+55 !!!!!!!
TX Data : A1

******* Good response received! *********
55
===========================================
55 was hit at: Delay:1443 VCC:08 GlitchType:B0/07
Elapsed: 00:00:17
VCC Resolution: 0.0625
Delay Range: 1443 to 1446

********************************
* REV 109+/247+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************


Ram Intercept Installed. Trying to Open the 102.... Delay:1444 VCC:1A Glitch Type:B5/07

Elapsed = 00:05:09

---07Rst1A---------------------------------------07Rst17---07Rst17-------07Rst17--------------------------------07Rst15-------------------------07Rst13-----07Rst13-----07Rst13------------------------------07Rst11-----07Rst1107Rst11--07Rst11------------------07Rst10----07Rst10--------07Rst0F---07Rst0F--------------------07Rst0E---------07Rst0D--07+55 !!!!!!!
TX Data : A1

******* Good response received! *********
55
===========================================
55 was hit at: Delay:1444 VCC:0D GlitchType:B5/07
Elapsed: 00:05:42
VCC Resolution: 0.0625
Delay Range: 1443 to 1446

********************************
* REV 109+/247+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************


Ram Intercept Installed. Trying to Open the 102.... Delay:1446 VCC:06 Glitch Type:B0/07

Elapsed = 00:33:52

----------------------------07Rst04-------07Rst04------------------07Rst03---------------------07Rst01-----07+55 !!!!!!!
TX Data : A1

******* Good response received! *********
55
===========================================
55 was hit at: Delay:1446 VCC:01 GlitchType:B0/07
Elapsed: 00:34:02
VCC Resolution: 0.0625
Delay Range: 1443 to 1446

********************************
* REV 109+/247+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************
Ram Intercept Installed. Trying to Open the 102.... Delay:1445 VCC:0F Glitch Type:B5/07

Elapsed = 00:05:32

-----07Rst0F----07+4A-----07Rst0E----------------------------07Rst0D-----------------07Rst0C----------07Rst0B07Rst0B-07Rst0B-07Rst0B---------------------07Rst0A---07Rst0A------07Rst0A----------------07Rst09---------------------------------07Rst07----07+A0----07Rst06--------07Rst06----------------07+00----------------07Rst04----------07Rst03-----07Rst03-------07Rst03-----------07Rst02------07Rst20-----------07Rst1F--07Rst1F--------------07Rst1E-----------------07Rst1D------07Rst1D-----07Rst1D07Rst1D-07Rst1D-07Rst1D--------07Rst1C-----------------------07Rst1B--07+A207Rst1B-07Rst1B------------07Rst1A-07+00--------07Rst1A-------------07Rst19-------------------07Rst18-----------07Rst1707Rst17-------------07Rst17---07+55 !!!!!!!
TX Data : A1

******* Good response received! *********
55
===========================================
55 was hit at: Delay:1445 VCC:17 GlitchType:B5/07
Elapsed: 00:06:42
VCC Resolution: 0.0625
Delay Range: 1443 to 1446

********************************
* REV 109+/247+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************


Ram Intercept Installed. Trying to Open the 102.... Delay:1446 VCC:05 Glitch Type:B0/07

Elapsed = 00:24:10

--07Rst05--------------07+55 !!!!!!!
TX Data : A1

******* Good response received! *********
55
===========================================
55 was hit at: Delay:1446 VCC:04 GlitchType:B0/07
Elapsed: 00:24:14
VCC Resolution: 0.0625
Delay Range: 1443 to 1446

********************************
* REV 109+/247+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************
eric keri
12-25-2007, 06:00 AM
Hey lightning0009 (http://www.dssftp.com/forum/member.php?u=13883) were they all 10b's.?
Hit one in 8 secs NICE...
I got 1 in 37 secs with 2 dip down only...

What was the script's you used?

You only use dip 4 down?

I have the blue nexus with the diode and It says to use 2 and 5 down. 1 and 6 to flash.
lightning0009
12-25-2007, 06:39 AM
I used this script.

DT RebelSerf 102_Rev109_247 Unlocker.Modified1440.xvb

I've tried 2 and 5 on the dips, but I've never unlocked one with those. Dip 4 only I used. All rev10b's.

I got a couple stubborn one here, I'll try 2 and 5 on those for a bit.
eric keri
12-25-2007, 07:13 AM
HAve you looped any with dip 4 down only?
lightning0009
12-25-2007, 07:22 AM
Yes, I have looped about half of em.
cantalope
12-25-2007, 09:25 AM
A few more here: Blue Nexus Dip 4 only; 7.5v 300mA; winex settings as per script



bev 245
!!!!!!!
TX Data : A1
******* Good response received! *********
55
===========================================
55 was hit at: Delay:1420 VCC:14 GlitchType:B0/07
Elapsed: 00:23:40
VCC Resolution: 0.0625
Delay Range: 1410 to 1453
********************************
* REV 109+/245+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************

bev 247

bev 247
TX Data : A1
******* Good response received! *********
55
===========================================
55 was hit at: Delay:143D VCC:03 GlitchType:B5/07
Elapsed: 00:12:52
VCC Resolution: 0.0625
Delay Range: 1439 to 1453
********************************
* REV 10B+/289+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* YA CHINGASTE! :-) *
********************************
jughead69
12-25-2007, 11:25 AM
That script sez it's for the slower chips, are you using them or MAX4619?
0zone
12-25-2007, 11:33 AM
Rev105
Let the 102 Glitching continue....
LETS TRY NEW DELAY
Glitch Delay = 0336
VCC = 1B

+---+---+---+---+---+---+---+---+---+--
TX Data : A1
===========================================
Glitch Success!! A0FF-INTERCEPT IS ON
BootLoader 6F 00 RSP Received!!
VCC = 0F (~0.28921568627451 vdc)
Glitch Delay = 0336
Glitch type 06
===========================================

Rev106
Let the 102 Glitching continue....
AVR delay = 03
Glitch Delay = 39ED
VCC = 10

RX Data : D8 00 02 6F 00 B5
--
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : -
RX Data : D8 00 02 6F 00 B5 --
RX Data : -
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : -
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : DE CA FE C0 FF EE
===========================================
Glitch Success!! DE CA FE C0 FF EE
Card is Unlocked!!!
VCC = 03 (~5.88235294117647E-02 vdc)
Glitch Delay = 39ED
Glitch type 07
===========================================
wewe
12-25-2007, 08:07 PM
is it possible to have that xvb plz??
DT RebelSerf 102_Rev109_247 Unlocker.Modified.xvb

i have a 2c7 that just wont quit! 18H in a row on a blue nexus
ive tried almost everything i have mvp 6.3 blue nexus modded and a green t911 modded
anyone as an idea??
blao
12-27-2007, 04:01 PM
i think is this one

'************************************************* *************************************
'* ____ __ _______ ____ *
'* / __ \___ / /_ ___ / / ___/___ _____/ __/ *
'* / /_/ / _ \/ __ \/ _ \/ /\__ \/ _ \/ ___/ /_ *
'* / _, _/ __/ /_/ / __/ /___/ / __/ / / __/ *
'* /_/ |_|\___/\____/\___/_//____/\___/_/ /_/ *
'* *
'* ____ _ __ __ __ __ *
'* / __ \____ ___ ____ (_) / / /___ / /___ _____/ /_____ _____ *
'* / / / / __ `__ \/ __ \/ / / / / __ \/ / __ \/ ___/ //_/ _ \/ ___/ *
'* / /_/ / / / / / / / / / / /_/ / / / / / /_/ / /__/ ,< / __/ / *
'* \____/_/ /_/ /_/_/ /_/_/\____/_/ /_/_/\____/\___/_/|_|\___/_/ *
'************************************************* *************************************
'* FOR STREAM LOCKED ROM 102S REVISION 10B. *
'* USES ONLY NDRS Flash *
'* Modified by DT for use with Powersync *
'* With 4619 Chips. OHMS not to exceed 192 Switch 4 *
'* *Use on 109s at your own risk* *
'* *
'* *
'************************************************* *************************************
Option Explicit
Dim Shell
Set Shell = CreateObject("WScript.Shell")
Dim StartDate
Dim FileName
Dim OutFile
Dim BuffFlg
Dim bytes2
Dim GltParm
Dim ParLen
Dim ReslFlg
Dim LoopCntr
Dim RstFlg
Dim DlType
Dim Rs2Flg
Dim DlFlg
Dim bytes
Dim Uflg
Dim Acnt
Dim Mix
Dim VS1
Dim VT1
Dim DS1
Dim LP1
Dim LP2
Dim T1
Dim T2
Dim T3
Dim T4
Dim T5
Dim T6
Dim T7
Dim T8
Dim VG
Dim DD
Dim RT
Dim GT
LP1 = 1
BuffFlg = 0
LoopCntr = 0
GltParm = 176
ReslFlg = 0
Rs2Flg = 0
ParLen = 2
RstFlg = 1
DlType = 64
DlFlg = 0
Uflg = 0
VT1 = 1
DS1 = &h1380
DD = &h1453
GT= 7
RT = DS1 'Do not change any values above this line
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^

Sub Main()
Call Setupunlocker()
If CheckChipVer <> 1 then
Sc.MsgBox("Flash Version NDRS needed to run this script" & VbCr & "Flash your Loader with NewDRS.hex")
Exit Sub
End if
' These, AND ONLY THESE :), are the variables you can change for rom 102 any revision up to 108/244
LP1 = 16 'Number of tries per delay FROM 20-100 in multiples of 20
VS1 = 16 'YOU CAN CHANGE THIS FROM 02-255 = semi-automatic VCC range - Loader dependent
Mix = .0625 'Glitch VCC resolution - attempts per VCC = 1/mix
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^
VG = VS1
sc.verbose = 0
Sc.Write("A0") ' turn led off
Clearoutputwindow
If ChkCard() = 0 then
Sc.MsgBox(" Unsupported Rom Version: Rom " & T1 & ", Rev " & T4 & " found." & VbCr & "This Script is for use with Rom 102, Rev 109/244 and higher")
exit sub
End If
If T7 = 1 then
Sc.MsgBox("Card not present or is unresponsive." & VBCr & " Unable to continue.")
Exit Sub
End If
sc.verbose = 0
Sc.Write("06 0E 03 01 03 9A 00") 'reset card
sc.read(02)
bytes = sc.getbyte(1)
sc.read(bytes)
sc.delay(16)
Sc.write("2A 6023 210020A0CA00001A041801018600AA9D9D9D9D9D9D9D9D9DAE 69CC7A9BBE000000000088 0E108500")
Sc.Read(2)
bytes = sc.getbyte(1)
If bytes > 5 then
sc.read(bytes)
bytes = sc.getbyte(0)
bytes2 = sc.getbyte(3)
If bytes = 18 and bytes2 = 132 then
Sc.MsgBox("Revision 105/241 or higher code not active on the card." & VbCr & " Card may be open or revision masked." & VBCr & " Unable to continue.")
exit sub
End if
End If
StartDate = Now()
Print "Initial Parameters = Delay:" & HexString(RT, 4) & " VCC:" & HexString(VG, 2) & " Glitch Type:" & HexString(GltParm, 2) & "/" & HexString(GT, 2)& vbcr & vbcr
Do
'sc.verbose = 1
Sc.Write(HexString(GltParm, 2) & HexString(VG, ParLen))
Acnt = 0
If RstFlg = 1 then
Do
Sc.Write("06 0E 03 01 03 9A 00") 'reset card
Sc.Read(02)
Bytes = Sc.Getbyte(1)
If Bytes > 25 then
Sc.Read(27)
RstFlg = 0
Exit Do
End if
Acnt = Acnt + 1
If Acnt > 5 then
Sc.MsgBox(" Check Loader Settings. Invalid or no atr. Card may be looped.")
exit sub
End If
Loop
'Sc.verbose = 1
Sc.write("09 6004 21C1018869 84 00")
Sc.Read(2)
bytes = sc.getbyte(1)
sc.read(bytes)
Sc.Write("14 600C 214009A0CA0000032201010E2D 0E15 5005 00")
sc.read(2)
Bytes = Sc.Getbyte(1)
Sc.Read(Bytes)
Bytes = Sc.Getbyte(3)
If Bytes <> &hA2 And Bytes <> &h6F Then
Sc.MsgBox(" Improper Cmd22 response. Unable to continue.")
Exit Sub
End If
Sc.Delay(40)
End If
If RstFlg = 0 then
'sc.verbose = 1 'debug the packets
Sc.Write("37 702C 8D00A7A000000000000000000000AA000505007AC400807180 9CA64BB76B1864CD7C1631768008AE55CC7A9B3C" & HexString(DlType,2) & HexString(RT,4) & HexString(GT,2) & "0E20 85 00")
Sc.read(2)
bytes = sc.getbyte(1)
If bytes > 5 then
sc.read(bytes)
bytes = sc.getbyte(0)
bytes2 = sc.getbyte(3)
If bytes = &hD8 and bytes2 = &h55 then
Sc.verbose = 1
UFlg = 1
End If
If bytes = &hD8 and bytes2 = &h6F then
Print "-"
VG = VG - mix
RstFlg = 0
Rs2Flg = 0
Else
Print HexString(GT,2) & "+" & HexString(bytes2,2)
RstFlg = 1
Rs2Flg = Rs2Flg + 1
VG = VG + mix
End If
Else
PRINT HexString(GT, 2) & "Rst" & HexString(VG, 2)
RstFlg = 1
Rs2Flg = Rs2Flg + 1
VG = VG + mix
End if
If Uflg = 1 then
Print " !!!!!!!" & VBCr
Sc.Write("A1")
Shell.Run "%comspec% /c echo " & Chr(07) & Chr(07) & Chr(07) & Chr(07) & Chr(07), 0, True
Sc.delay(500)
print
print "******* Good response received! *********"& VbCr
PRINT " " & HEXSTRING(bytes2,2) & VbCr
Sc.Print "===========================================" & VbCr
print " " & HexString(bytes2, 2) & " was hit at: Delay:" & HexString(RT, 4) & " VCC:" & HexString(VG, 2) & " GlitchType:" & HexString(GltParm, 2) & "/" & HexString(GT, 2) &VBCr
print " Elapsed: " & TimeDiff(StartDate,Now())& vbcr
Print " VCC Resolution: " & mix & vbcr
Print " Delay Range: " & HexString(DS1, 4) & " to " & HexString(DD, 4) & VBCr
print
PRINT "********************************" & VBCR
PRINT "* REV 109+/247+ CAM NOW OPEN!! *" & VBCR
PRINT "* PROCEED AS NORMAL *" & VBCR
PRINT "* GOOD LUCK! :-) *" & VBCR
PRINT "********************************" & VBCR
exit sub
End If
If VG < VT1 then
VG = VS1
End If
LP2 = LP2 + 1
If LP2 > LP1 / mix then '
ClearOutputWindow
RT = RT + 1
IF RT = &h1421 Then
RT = &h1443
End If
LP2 = 0
print
print "" &vbcr
print "Ram Intercept Installed. Trying to Open the 102.... Delay:" & HexString(RT, 4) & " VCC:" & HexString(VG, 2) & " Glitch Type:" & HexString(GltParm, 2) & "/" & HexString(GT, 2) & VBCr & vbcr
sc.print "Elapsed = " & TimeDiff(StartDate,Now())& vbcr & vbcr
If RT > DD then
RT = DS1 - 1
GltParm = GltParm + 5
If GltParm > 186 Then
GltParm = 176
End If
If GltParm = 181 Then
If ReslFlg = 0 Then
ReslFlg = 1
LP1 = LP1 * 2
VS1 = VS1 * 2
VT1 = VT1 * 2
ParLen = 4
End If
End If
If GltParm <> 181 Then
If ReslFlg = 1 Then
ReslFlg = 0
LP1 = LP1 / 2
VS1 = VS1 / 2
VT1 = VT1 / 2
ParLen = 2
End If
End If
End If
End If
If VS1 >= 254 then
exit sub
End If
If DlType = &h40 Then
DlType = &h20
Else
DlType = &h40
End If
If VG =< 1 then
VG = VS1
End if
End If
If Rs2Flg >= 3 Then
Rs2Flg = 0
VG = VS1
If VT1 > 10 Then VT1 = 10
End If
If VG < VT1 Then
VG=VS1
End If
If VG + mix <=0 Then
VG = VS1
VT1=VT1+1
END If
Loop
End Sub

Function HexString(Number,Length)
Dim RetVal
Dim CurLen
RetVal=Hex(Number)
CurLen=Len(RetVal)
If CurLen<Length Then
RetVal=String(Length-CurLen,"0") & RetVal
End If
HexString=RetVal
End Function
Function CheckChipVer()
CheckChipVer = 1
sc.write("90")
delay(80)
If sc.read(4) <> 4 then
CheckChipVer = 0
Exit Function
End if
If getbyte(0) <> &H4E then CheckChipVer = 0
If getbyte(1) <> &H44 then CheckChipVer = 0
If getbyte(2) <> &H52 then CheckChipVer = 0
If getbyte(3) <> &H53 then CheckChipVer = 0
End Function
Function TimeDiff (StartTime, EndTime)
Dim Hours, Minutes, Seconds
Seconds = DateDiff("s", StartTime, EndTime)
If Seconds > 90000 Then Seconds = 90000
If Seconds < 0 Then Seconds = 0
Minutes = Seconds / 60
Minutes = Fix(Minutes)
Seconds = Seconds - (Minutes * 60)
Hours = Minutes / 60
Hours = Fix(Hours)
Minutes = Minutes - (Hours * 60)
Seconds = CStr(Seconds)
Minutes = CStr(Minutes)
Hours = CStr(Hours)
If Len(Seconds) = 1 Then Seconds = "0" + Seconds
If Len(Minutes) = 1 Then Minutes = "0" + Minutes
If Len(Hours) = 1 Then Hours = "0" + Hours
TimeDiff = Hours & ":" & Minutes & ":" & Seconds
End Function
Function ChkCard()
sc.verbose = 0
ChkCard = 1
Print ""
Print " Checking Card's Eeprom Revision ......." & VBCr
sc.delay(2000)
ClearOutputWindow
Sc.Write("06 0E 03 01 03 9A 00") 'reset card
sc.read(02)
bytes = sc.getbyte(1)
If bytes < 27 then
T7 = 1
ClearOutputWindow
Exit Function
End If
sc.read(bytes)
sc.delay(16)
T1 = chr(sc.getbyte(16))
T2 = chr(sc.getbyte(17))
T3 = chr(sc.getbyte(18))
T4 = chr(sc.getbyte(23))
T5 = chr(sc.getbyte(24))
T6 = chr(sc.getbyte(25))
T1 = T1+T2+T3
T4 = T4+T5+T6
If asc(T4) = 0 then
T4 = "000"
End If
Print " Rom " & T1 & ", Rev " & T4 & " found." & VBCR
print
Sc.delay(1500)
T8 = mid(T4, 3,1)
Select Case T8
Case "A"
T8 = 10
Case "B"
T8 = 11
Case "C"
T8 = 12
Case "D"
T8 = 13
Case "E"
T8 = 14
Case "F"
T8 = 15
End Select
If left(T4, 2) = 24 then
If T8 < 7 then
ChkCard = 0
exit function
End If
End If
If left(T4, 2) = 10 then
If T8 < 9 then
ChkCard = 0
exit function
End If
End If
If T1 <> "102" then
ChkCard = 0
exit function
End If
End Function
Function setupunlocker()
Wx.BaudRate = 115200
Wx.ResetBaudRate = 115200
Wx.Parity = 0 ' 0 = None, 1 = Odd, 2 = Even, 3 = Mark, 4 = Space
Wx.StopBits = 0 ' 0 = 1 stop bit, 1 = 1.5 stop bits, 2 = 2 stop bits
Wx.DTRControl = 0 ' Initial state of DTR 0 = off, 1 = on
Wx.RTSControl = 1 ' Initial state of RTS 0 = off, 1 = on
Wx.ResetDelay = 100 ' In microseconds
Wx.ByteDelay = 10 ' In microseconds
Wx.RxByteTimeout = 3000 ' In milliseconds
Wx.ResetMode = 2 ' 0 = No Resets, 1 = ISO Reset (Expect a ATR), 2 = Device Reset (No ATR)
Wx.ResetLine = 1 ' 0 = Toggle RTS for Reset, 1 = Toggle DTR for Reset
Wx.ByteConvention = 1 ' 0 = Inverse, 1 = Direct
Wx.FlushEchoByte = 0 ' 0 = no flush, 1 = flush - A Phoenix interface will echo each byte transmitted.
Wx.FlushBeforeWrite = 1 ' 0 = no flush, 1 = flush - Flush the receive buffer before each write to strip off Null bytes.
Wx.IgnoreTimeouts = 1 ' 0 = Abort script on a receive timeout, 1 = Ignore all receive timeouts
Wx.ResetAfterTimeout = 0 ' 0 = Don't reset after a timeout, 1 = do a reset after a timeout - Not used if "IgnoreTimeouts=0"
Wx.LogTransactions = 0 ' 0 = Don't log transactions, 1 = log transactions
Wx.DisplayUSW = 0 ' Display USW after script complete 0 = no, 1 = yes
Wx.DisplayFuse = 0 ' Display Fuse after script complete 0 = no, 1 = yes
End function
wewe
12-27-2007, 07:33 PM
yessssss! finally!!! 2c7 now open!!! thx DVD and all others!!!
heres my setupld gateway p3 1g blue nexus diode modded pot 10k 25turns
and plugs to fit multimeter to be precise script RebelSerf102_Rev109_247Unlocker ps 9v 300ma
lowered delay to 130a and started high at 700ohm and lowered slowly and stopped at every rst response i had as i was getting real low i started going back up just a hair at every response cuz if u go too low the script fails so i kept going down and down and then at 3mins25sec delay 130e 55 was hit to my big suprise my heart stopped i think lol so many hours wasted and in 3 min 25 paff open!!!
i stopped and pluged multi meter and i was at 59.4ohm
glad if this helps i used to do this on rom10 with old t911 i figured what the heck!!
again thx!!
Ram Intercept Installed. Trying to Open the 102.... Delay:130E VCC:16 Glitch Type:B0/07
Elapsed = 00:02:56
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------07Rst08-----------------------------------------------07Rst06------------------07Rst0507Rst05-----------07Rst04----------------07+55 !!!!!!!
TX Data : A1
******* Good response received! *********
55
===========================================
55 was hit at: Delay:130E VCC:03 GlitchType:B0/07
Elapsed: 00:03:24
VCC Resolution: 0,0625
Delay Range: 130A to 1453
********************************
* REV 109+/247+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************
Script C:\Documents and Settings\Administrateur\Bureau\New Folder (2)\unlock\RebelSerf102_Rev109_247Unlocker\RebelSe rf 102_Rev109_247 Unlocker.xvb Transmission Completed
thats my response
cantalope
12-29-2007, 05:01 AM
wewe and all others that have posted here; thank you. I started this thread in hopes that we could help one another with glitching. I am glad to see it happening here. Dvd has contributed quite a bit on these forums and other sites and he deserves credit for that. Lets keep up the good work guys! I have a 2c7 that has been troubling me for weeks; I have run scripts on it off and on; just didn't think of going that low with the starting delay. Hope this does the trick. Anyhow guys Happy New Year!
wewe
12-29-2007, 06:01 PM
i am working on another 2c7 tried it on mvp6.3 and no pop or loop
gonna try on the blue nexus and keep u posted

popped a 247 yesterday with mvp in 3min 20sec with b5 script

and looped a 289 in nexus pot too high near 400ohm
my bad i fell asleep ahh well its the joy of testing!!
donkey3
12-29-2007, 07:43 PM
HI, newbie question, I got two looped 102 rev 247, any chance of unlooping with these scripts, I got an orange nexus, any one know of any success of unlooping with no atr, one card was looped by d**h, the other while I was in early stages of programming, thanks ..:rolleyes:
satnutzz
12-29-2007, 09:15 PM
HI, newbie question, I got two looped 102 rev 247, any chance of unlooping with these scripts, I got an orange nexus, any one know of any success of unlooping with no atr, one card was looped by d**h, the other while I was in early stages of programming, thanks ..:rolleyes:

.............and you posted this in this thread because you are in the early stages of reading?
cantalope
12-30-2007, 01:20 AM
LOL......early stages of reading. Well I have yet to "unloop" or revive a fubared ATR. There are scripts for this purpose and people that claim to have done this. It may as well be true.....but I cannot verify if it is or not personally. To add my own personal experience I have a free sample of this holy water that I got mailed to me off this infomercial; I rubbed a few drops on the card and what do you know!!!! I got an ATR and I can read and write to it. I am selling this card on ebay along with a piece of bread that you can see Jesus's face in.

I hope this outlines what is involved in unlooping cards.
donkey3
12-30-2007, 08:54 AM
:d
old school
12-30-2007, 05:10 PM
289 icam from a 311
Clear or white nexus unlocker
Dips 2 & 5 on
Ohms @ 2.59 at the 20k setting
Using the "b5 glitCh RebelSerf 102_Rev109_247 Unlocker"

It took about 9.5 hours of glitching this time to open.
donkey3
12-30-2007, 05:46 PM
:):d
greenie-monster
12-31-2007, 12:39 AM
Hey lightning0009 can you upload that rebelserf script you're using. Please
fd11
12-31-2007, 04:06 AM
Rev105
Let the 102 Glitching continue....
LETS TRY NEW DELAY
Glitch Delay = 0336
VCC = 1B

+---+---+---+---+---+---+---+---+---+--
TX Data : A1
===========================================
Glitch Success!! A0FF-INTERCEPT IS ON
BootLoader 6F 00 RSP Received!!
VCC = 0F (~0.28921568627451 vdc)
Glitch Delay = 0336
Glitch type 06
===========================================

Rev106
Let the 102 Glitching continue....
AVR delay = 03
Glitch Delay = 39ED
VCC = 10

RX Data : D8 00 02 6F 00 B5
--
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : -
RX Data : D8 00 02 6F 00 B5 --
RX Data : -
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : -
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : D8 00 02 6F 00 B5 --
RX Data : DE CA FE C0 FF EE
===========================================
Glitch Success!! DE CA FE C0 FF EE
Card is Unlocked!!!
VCC = 03 (~5.88235294117647E-02 vdc)
Glitch Delay = 39ED
Glitch type 07
===========================================
hey Ozone, can you tell me what script used on the 106 and what kind of pot and switch settings
lightning0009
01-03-2008, 07:50 PM
Hey lightning0009 can you upload that rebelserf script you're using. Please


I'm using that DT modified rebelsurf script. The one posted in this thread. Now I start the delay at 1440, but that is just because my unlocker seems to hit the high rev ones right around 1446, yours might hit in a different spot. I did have some sucess with using switches 2 and 5 also on my blue nexus. Pot still between 25- 200 ohms.

switches 2 and 5 on my blue nexus.

Ram Intercept Installed. Trying to Open the 102.... Delay:1445 VCC:03 Glitch Type:B0/07

Elapsed = 01:47:54

---------07Rst03---07+55 !!!!!!!
TX Data : A1

******* Good response received! *********
55
===========================================
55 was hit at: Delay:1445 VCC:02 GlitchType:B0/07
Elapsed: 01:47:58
VCC Resolution: 0.0625
Delay Range: 1443 to 1446

********************************
* REV 109+/247+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************
brouter
01-03-2008, 08:31 PM
Anybody know how to mod a sureshot xtreme to open rom102s?
I've seen urls posted here and on other sites saying it's possible but none of them pan out when I click on them.
Thankx in advance.
hairyballs520
01-09-2008, 11:28 AM
Well I didnt have the guts to even try , but thanx DVD for the push to give it a shot !! well she gave the panties up faster than a 2 dollar whore here 's what i used Mikobu N2, 1.04OHMS on 20k scale 12volt plug script used was that new RM_A1 & allot of luck here the results


****** Good response received! *********
55
===========================================
55 was hit at: Delay:00AE VCC:0027 GlitchType:B0/07
Timeout Factor:04
Elapsed: 00:00:07
VCC Resolution: 0.0625
Delay Range: 00AE to 00CE
********************************
* Rom102, Rev109 CAM OPEN! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************
:D :D :D :p :p :p :D
greenie-monster
01-09-2008, 04:37 PM
1.04OHMS on 20k scale

That's 1040 ohms not 1.04ohms (1 ohm is impractile!)
ckeays
01-09-2008, 05:01 PM
Anyone had any luck with RM1A and rom 102, rev 248?
If so can you post settings with ohms and dip switches?

I am using Orange Nexus original with 4619's and sw 4 down.
215 ohms. So far no luck. (didn't loop it yet)
hairyballs520
01-09-2008, 09:59 PM
Green monster why u bust in balls i know 1.04 =1040 but on 20k scale its read 1.04 hence the read in 20k dam dude read I hate when people go off track on threads sorry people
ckeays
01-10-2008, 01:43 AM
I had my 248 going for 3 hrs today, still nothing. Hey, at least it didn't loop!

My loader has always been really quick.(orange Nexus original)
hairyballs520
01-14-2008, 07:02 AM
102 REV 105, Yellow Mikobu N2 ,12vplug, 1.04 on 20K SCALE!!

TX Data : 90
RX Data : 4E 44 31 33
Let the 102 Glitching begin....
+---+---+--NoRsp+-+---+--NoRsp+-+---+---+---+---+---+---+-NoRsp+--+-NoRsp+--+-+--+-NoRsp+--+---+-+--+-NoRsp+--+-+--+-NoRsp+--+-+-NoRsp+-+-+--+-NoRsp+--+-NoRsp+--+-NoRsp+--+-NoRsp+-NoRsp+-+-NoRsp+--+-NoRsp+--+-
TX Data : A1
===========================================
Glitch Success!! A0FF-INTERCEPT IS ON
BootLoader 6F 00 RSP Received!!
VCC = 18 (~0.475490196078431 vdc)
Glitch Delay = 0320
Glitch type 07
===========================================
Script C:\Documents and Settings\Compaq_Owner\Desktop\102 folder\new.xvb Transmission Completed
slickflick
01-14-2008, 10:32 AM
I'm using that DT modified rebelsurf script. The one posted in this thread. Now I start the delay at 1440, but that is just because my unlocker seems to hit the high rev ones right around 1446, yours might hit in a different spot. I did have some sucess with using switches 2 and 5 also on my blue nexus. Pot still between 25- 200 ohms.

switches 2 and 5 on my blue nexus.

Ram Intercept Installed. Trying to Open the 102.... Delay:1445 VCC:03 Glitch Type:B0/07

Elapsed = 01:47:54

---------07Rst03---07+55 !!!!!!!
TX Data : A1

******* Good response received! *********
55
===========================================
55 was hit at: Delay:1445 VCC:02 GlitchType:B0/07
Elapsed: 01:47:58
VCC Resolution: 0.0625
Delay Range: 1443 to 1446

********************************
* REV 109+/247+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************

Do you always adjust the pot higher when you get all 07rst2007rst2007rst20 ? or you just leave it? I get a mix and a few seconds i just start getting rst rst.. trying to open a rev 247 using b5 script..

thanks
studyhard
01-19-2008, 05:41 AM
Do you always adjust the pot higher when you get all 07rst2007rst2007rst20 ? or you just leave it? I get a mix and a few seconds i just start getting rst rst.. trying to open a rev 247 using b5 script..

thanks

I have same with you like
Rom 102, Rev 109 found.
Initial Parameters = Delay:140B VCC:2E Glitch Type:B0/07
07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E0 7Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07 Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07R st2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rs t2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst 2E07Rst2E07Rst2E
Script Error on Line 141
Sc.GetByte: Requested Byte Exceeds Last Read Request

As you see if I don't increase the pot then it will stop. I still have no luck to open anything.
bill8
01-28-2008, 06:50 AM
Here are my settings and results:

Rev 10B
Blue Nexus; Flashed with NewDrs (dips 1 and 6 down); ran script with only dip 2 down as suggested in the script; trim pot at approx 2.2 kOhms

******* Good response received! *********
55
===========================================
55 was hit at: Delay:1415 VCC:11 GlitchType:B5/07
Elapsed: 00:13:57
VCC Resolution: 0,0625
Delay Range: 1410 to 1453
********************************
* REV 10B+/289+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* YA CHINGASTE! :-) *
********************************

Script: b5 glitCh RebelSerf 102_Rev109_247 Unlocker
Wiley-X
01-29-2008, 07:40 AM
I'm running 50% using RM-1A with a white nexus....
opened two 10C's, looped one 10C and one 10B.

White Nexus, 9vdc @ 400ma, 125 ohms (started @ 250 ohms and worked down by 10 ohms, moving every 10 minutes).
bill8
01-29-2008, 02:11 PM
Here's my second card popped results:

Rev 247
Blue Nexus; Flashed with NewDrs (dips 1 and 6 down); ran script with only dip 2 down as suggested in the script; trim pot at approx 550 Ohms

******* Good response received! *********
55
===========================================
55 was hit at: Delay:1443 VCC:1C GlitchType:B5/07
Elapsed: 02:59:30
VCC Resolution: 0,0625
Delay Range: 1410 to 1453
********************************
* REV 10B+/289+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* YA CHINGASTE! :-) *
********************************

Script: b5 glitCh RebelSerf 102_Rev109_247 Unlocker

Good luck everyone!!
bill8
blao
01-30-2008, 07:42 PM
powersync set up 3000 10 100
5k pot at 197 ohms
switch 1 only

Parameters-> Delay:387B VCC:0B Glitch Type:B0/07 Timeout Factor:04
Elapsed: 00:10:13
.................................................. ...................
................................................ !!!!!!!
******* Good response received! *********
55
===========================================
55 was hit at: Delay:387B VCC:000C GlitchType:B0/07
Timeout Factor:04
Elapsed: 00:10:38
VCC Resolution: 0.25
Delay Range: 3869 to 3899
********************************
* Rom102, Rev107 CAM OPEN! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************

Parameters-> Delay:3882 VCC:20 Glitch Type:B0/07 Timeout Factor:03
Elapsed: 00:14:09
.................................................. .................. !!!!!!!
******* Good response received! *********
55
===========================================
55 was hit at: Delay:3882 VCC:000F GlitchType:B0/07
Timeout Factor:04
Elapsed: 00:14:23
VCC Resolution: 0.25
Delay Range: 3869 to 3899
********************************
* Rom102, Rev108 CAM OPEN! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************

Parameters-> Delay:00CD VCC:25 Glitch Type:B0/07 Timeout Factor:03
Elapsed: 01:32:33
.................................................. ...................
.................................................. ...................
.................................................. ...................
.................................................. ...................
.................................................. ...................
.................................................. ...................
.................................................. ...................
.................................................. ...................
.................... !!!!!!!
******* Good response received! *********
55
===========================================
55 was hit at: Delay:00CD VCC:001D GlitchType:B0/07
Timeout Factor:04
Elapsed: 01:35:14
VCC Resolution: 0.0625
Delay Range: 00AE to 00CE
********************************
* Rom102, Rev10B CAM OPEN! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************:D
blao
01-31-2008, 12:36 AM
I have same with you like
Rom 102, Rev 109 found.
Initial Parameters = Delay:140B VCC:2E Glitch Type:B0/07
07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E0 7Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07 Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07R st2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rs t2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst 2E07Rst2E07Rst2E
Script Error on Line 141
Sc.GetByte: Requested Byte Exceeds Last Read Request

As you see if I don't increase the pot then it will stop. I still have no luck to open anything.


too many rst.:eek: the only time i had that responce was with a f.u. card a applied wrong script to it.
sorry
Crazy1_79
01-31-2008, 12:50 AM
I have same with you like
Rom 102, Rev 109 found.
Initial Parameters = Delay:140B VCC:2E Glitch Type:B0/07
07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E0 7Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07 Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07R st2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rs t2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst 2E07Rst2E07Rst2E
Script Error on Line 141
Sc.GetByte: Requested Byte Exceeds Last Read Request

As you see if I don't increase the pot then it will stop. I still have no luck to open anything.

Use the new RM_1A script. it will work much better with much less chance of looping
ge2
01-31-2008, 01:32 AM
I have same with you like
Rom 102, Rev 109 found.
Initial Parameters = Delay:140B VCC:2E Glitch Type:B0/07
07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E0 7Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07 Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07R st2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rs t2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst2E07Rst 2E07Rst2E07Rst2E
Script Error on Line 141
Sc.GetByte: Requested Byte Exceeds Last Read Request

As you see if I don't increase the pot then it will stop. I still have no luck to open anything.


I would not use any script with the unlocker that gives such responses. Change your unlocker first...
sierra99
01-31-2008, 05:19 AM
milli white nexus 2and 5 on.....9 volts....romaster 1a....

1.

Parameters-> Delay:00B3 VCC:27 Glitch Type:B0/07 Timeout Factor:03
Elapsed: 00:12:56

........ !!!!!!!

******* Good response received! *********
55
===========================================
55 was hit at: Delay:00B3 VCC:0027 GlitchType:B0/07
Timeout Factor:04
Elapsed: 00:12:58
VCC Resolution: 0.0625
Delay Range: 00AE to 00CE
********************************
* Rom102, Rev10B CAM OPEN! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************


2.

Parameters-> Delay:00AF VCC:1C Glitch Type:B0/07 Timeout Factor:03
Elapsed: 00:02:40

.................................................. ...................
.................................................. ...................
.................................................. ...................
.................................................. ...................
.................................... !!!!!!!

******* Good response received! *********
55
===========================================
55 was hit at: Delay:00AF VCC:0025 GlitchType:B0/07
Timeout Factor:04
Elapsed: 00:03:58
VCC Resolution: 0.0625
Delay Range: 00AE to 00CE
********************************
* Rom102, Rev10B CAM OPEN! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************
tamng78
02-01-2008, 08:42 AM
powersync set up 3000 10 100
5k pot at 197 ohms
switch 1 only

Parameters-> Delay:387B VCC:0B Glitch Type:B0/07 Timeout Factor:04
Elapsed: 00:10:13
.................................................. ...................
................................................ !!!!!!!
******* Good response received! *********
55
===========================================
55 was hit at: Delay:387B VCC:000C GlitchType:B0/07
Timeout Factor:04
Elapsed: 00:10:38
VCC Resolution: 0.25
Delay Range: 3869 to 3899
********************************
* Rom102, Rev107 CAM OPEN! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************

Parameters-> Delay:3882 VCC:20 Glitch Type:B0/07 Timeout Factor:03
Elapsed: 00:14:09
.................................................. .................. !!!!!!!
******* Good response received! *********
55
===========================================
55 was hit at: Delay:3882 VCC:000F GlitchType:B0/07
Timeout Factor:04
Elapsed: 00:14:23
VCC Resolution: 0.25
Delay Range: 3869 to 3899
*****************************

I follow your post same setting same switch poped in 20 mins thanks

Parameters-> Delay:3886 VCC:16 Glitch Type:B0/07 Timeout Factor:03
Elapsed: 00:20:42
......... !!!!!!!
******* Good response received! *********
55
===========================================
55 was hit at: Delay:3886 VCC:0014 GlitchType:B0/07
Timeout Factor:03
Elapsed: 00:20:44
VCC Resolution: 0.25
Delay Range: 3869 to 3899
********************************
* Rom102, Rev285 CAM OPEN! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************
hairyballs520
02-01-2008, 12:12 PM
Yellow Mikobu N2 ,12vplug, 1.04 on 20K SCALE last 2 r 102 rev 103

Ram Intercept Installed. Trying to Open the 102.... Delay:13BB VCC:14 Glitch Type:B5/07
Elapsed = 03:00:03
---------07Rst13-----07Rst13-----07+FF07Rst12-------07+FF--07Rst12-07Rst12--------07Rst12-07Rst12-07Rst12------------------------07Rst10----07Rst10---07+FF--07Rst1007Rst10-----------------------07Rst0E07Rst0F07+FF--------------------------------------------------------------07Rst58------------------------------------------------07Rst55-------------------07Rst54-----------------------------------------------------------------------------------------------------07Rst4E---------------------------------------------------------------------------------------------------------------------------------------------07Rst45-------------------------------------------------------------------------------------------07Rst3F--------------------------------------------------07Rst3C-------------------------------------------------------------------------------------------------07Rst36-----07Rst36-----------------------------------07Rst3407Rst34---------------------------------------------07Rst31----------------------07Rst30------------------07Rst2F--------------------------------------------------------------------------------------------------------------------07+55 !!!!!!!
TX Data : A1
******* Good response received! *********
55
===========================================
55 was hit at: Delay:13BB VCC:28 GlitchType:B5/07
Elapsed: 03:01:24
VCC Resolution: 0.0625
Delay Range: 139B to 140B
********************************
* REV 287+/289+ CAM NOW OPEN!! *
* PROCEED AS NORMAL *
* GOOD LUCK! :-) *
********************************
Script C:\Documents and Settings\Compaq_Owner\Desktop\bomber icam (287-289) modded rebelserf\bomber icam (287-289) modded rebelserf.xvb Transmission Completed
------------------------------------------------------------------
Let the 102 Glitching continue....
LETS TRY NEW DELAY
Glitch Delay = 0329
VCC = 36

+---+---+-NoRsp+--+---+---+---+---+-+--+---+--NoRsp+-+-+--+-+--+-+--+-+--+-+--+-+--+-+--+---+-+--+-+-
TX Data : A1
===========================================
Glitch Success!! A0FF-INTERCEPT IS ON
BootLoader 6F 00 RSP Received!!
VCC = 22 (~0.666666666666667 vdc)
Glitch Delay = 0329
Glitch type 06
===========================================
Script C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Temporary Directory 4 for ROM102_ND13_A0FF-INTERCEPT-autoVCC_20 edited for unlocking rev 105.zip\ROM102_ND13_A0FF-INTERCEPT-autoVCC_20 edited for unlocking rev 105.xvb Transmission Completed
-------------------------------------------
Glitch Delay = 0326
VCC = 16

+-NoRsp+-NoRsp+-+-+-NoRsp+-+-+-NoRsp+-+-NoRsp+-NoRsp+-+-+-NoRsp+-+-NoRsp+-NoRsp+-+-+-NoRsp+-+-NoRsp+-NoRsp+-+-+-NoRsp+-+-NoRsp+-NoRsp+-+-+-NoRsp+-+-+-NoRsp+-+-NoRsp+-NoRsp+-+-NoRsp+-NoRsp+-+-NoRsp+-NoRsp+-+-+-NoRsp+-+-+-NoRsp+-+-+-NoRsp+-+-+-NoRsp+-+-NoRsp+-NoRsp+-+-NoRsp+-NoRsp+-+-NoRsp+-NoRsp+-+-NoRsp+-NoRsp+-+-+-NoRsp+-+-NoRsp+-NoRsp+-+-NoRsp+-NoRsp+-+-NoRsp+-NoRsp+-+-+-NoRsp+-+-NoRsp+-NoRsp+-+-+-NoRsp+-+-NoRsp+-NoRsp+-+-NoRsp+-NoRsp+-+-
TX Data : A1
===========================================
Glitch Success!! A0FF-INTERCEPT IS ON
BootLoader 6F 00 RSP Received!!
VCC = 16 (~0.441176470588235 vdc)
Glitch Delay = 0326
Glitch type 07
===========================================
Script C:\Documents and Settings\Compaq_Owner\Desktop\102 folder\new used on my 105and under.xvb Transmission Completed