[Crazy1_79]

I finally had success with a rev A23, It wasn't either of my two that I have but I finally did open a A23, the strange thing was that is gave me 69ff69ff69ffff instead of the 6f, it was last in the data stream November 3 and it was a A2013 that is about all I can say, I did the test glitch, took those setting and put them into the unlocking program and then lowered the delay all the way to 1100 and all the way to 127A it only took about a minute and a half, now I'm onto the other cards I need to unlock and they seem to be back to the 6fff reading, will post if I have any luck.

Good job...I find A23 the easiest, A81 more difficult, and 383's impossible. Don't really care about rom3, because I only have a few. Popped 40 plus rom 10's now.VCC is everything!

[Crazy1_79]

I agree, I ran test glitch just like you said, put those number in the unlock script and opened the delays to min and max, took only a minute or two, now I am back to struggling with the other cards

Originally Posted by Crazy1_79

I agree, I ran test glitch just like you said, put those number in the unlock script and opened the delays to min and max, took only a minute or two, now I am back to struggling with the other cards

OK, guys, can you tell me how to proceed from scratch? I mean what program are u using and what steps????

Thanks!!!

Originally Posted by majdiaz

OK, guys, can you tell me how to proceed from scratch? I mean what program are u using and what steps????

Thanks!!!

Do you have a modded loader? If so, what kind? Nothing will work unless you have a modded loader.

Originally Posted by LuckLarry

Do you have a modded loader? If so, what kind? Nothing will work unless you have a modded loader.

NO, not yet: you answered my question> Thanks!!!

[bendoverdave]

Dujaa from another testing site said that you can glitch an A23 locked rom 10 with just jumping a 220 ohm 1/2 watt .5% tolerance resistor at ATMEL chip on pins 6 and 8 and then testing scripts with adjusting the VCC and delay starts.

I know, know. Far fetched huh?

It's all about testing....

I don't think thats too likely. One of the things the mod does is change the clock cycle, and a simple resistor mod can't do that.

[bendoverdave]

I fixed my card and IRD about 1 1/2 weeks ago from the last ECM. I had used the nomore64-7 and unlocked my card with a personal password. I then cleaned and added new channel tiers with no PPV and then added (by accident) the nomore64-7ppvmaster blocker and for some reason when I inserted into IRD, my CAMID was all zeros.

So I went back to cleaning the card and after I entered the password for the blocker, it gave the "BD3 login failed" error in NagraEdit. I checked the ATR and said "CAM date request failed".

So here I am. I was trying to mod my Ultra T911 with all the information floating around but it's kinda confusing.

Oh well, that's testing.

crazy...you have a pm

[Crazy1_79]

chip you have a pm, well guys, I got one out of 5 cards to pop, can't get the other ones for the life of me, I can pop rom 3's but not rom 10's except for the above one, I used flash 7 to do that one, on the other ones, I can't get flash seven to get anything but resets, so I have to use 9, I also tried 8, but just can't get anywhere, I have changed resistance vcc settings, delays, you name it I tried it, If anyone can think of anything else, please let me know.

[t160hq]

Try

vcc start &H60
vcc limit &H50

Most of the rom 10's i popped I used the default settings on a AIO and they popped in minutes.

Only one gave me problems and using the settings above it popped in minutes. I was using flash 8 on the atmel. I then adjusted the pot for a nice mix of 6F and FF with maybe the occacional RESET.

It popped in about 15 minutes.

t160hq

[Crazy1_79]

T160HQ, it is funny you said that, I just entered 61 and 4F into my winexplorer script using flash 8 right as I got email that you posted this, I have the script running now, I will post results. Thank you. Glith analyzer gave me those two settings, I am using that new script in the download section that has the analyzer and opener all in one script, has anyone tried this script? I am hoping it is not a hoax. but it looks legit,

[ismarhadzia]

Anybody knows how to resolve this problem.
This was initialy Stream locked card.
I tried running new unlockers for Rev81 with moded loaders.
but this A81 shows CamID: 00 00 00 00 which is weard and I dont have any success while unlocking.
I am using A81/A23 unlocker V 1.0
I was successful on my other card revA23 wich opened with no porblem in few minutes.

Opening of COM1 was successful
ATR String: 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50
30 31 30 20 52 65 76 41 38 31 43
ROM Revision: 010
EEPROM Revision: RevA81
ProviderID: 08
CamID: 00 00 00 00
Using BD3 Key: 4E 69 70 50 45 72 20 49 73 20 61 20 62 75 54 74
Attempting to login to BD3
BD3 login failed
Reading ROM10 failed
Closing of COM1 was successful

[brownman]

anyone in here selling the moded t911 ? please send me an pm with the price

[Crazy1_79]

Just to update everyone, after a few weeks of pulling my hair out and trying every variation off resitance and vcc limit that I could possibly think of, I have popped two more A23's making it a grand total of 3. Here is my findings on all of it, Using the t911 black board in the clear case with a single turn 5 K trimmer from rat shack. I used newd9 for the flash, this is where it gets tricky, I could glitch into rom 3's at 378 ohms getting a good mixture of aaaafffff's therefore allowing me to pop all rom 3's I had laying around, I was using a 9volt 300MA power supply, now with the rom 10's I could only get 6f's at 378 ohms so I had to lower the resistance to around 100 ohms to get a good mix of 6f,ff's It looked great but it wouldn't open them, Finally after weeks of playing with voltage, resistance, and DC power input I have come to this, I set the pot for 348 ohms, 7.5 volts, 300 MA input to the loader, flash newd9 and using 10 for the vcc start and FFFF for the limit I have popped two cards in about 5 minutes or less. Regardless of what the script was giving me they still opened.

[anthony101]

crazy email me the flashes and what not and a quick how too i finally got mine modded and curios to see how it works i could read and read but i know you could sum it up for me would you please

[sukh77]

A little off topic from T911. Guys I have an Iso programmer. I had a rom10 that I could not open with my password it was at A23. I tried a winexplorer script that is posted in the files section labeled (PowersyncUnlockRom10ver3.zip) I ran it for little bit it was set to echostar programmer in winexplorer and it was running the various voltage tests I think. I aborted it during the third variation I think. Then the next day tried to see where the card was did a reset on the card the rev was at A21. Then I used the A21 rom popper script to unlock it from there and it worked. I don't know what the deal was. I have few other rom10 that I didn't program but are at rev A23 but have yet to unlock those I ran the same process on one so far but no success. Anyone else experience this or did I just get lucky.

[alwayswatching]

Originally Posted by Crazy1_79

I finally had success with a rev A23, It wasn't either of my two that I have but I finally did open a A23, the strange thing was that is gave me 69ff69ff69ffff instead of the 6f, it was last in the data stream November 3 and it was a A2013 that is about all I can say, I did the test glitch, took those setting and put them into the unlocking program and then lowered the delay all the way to 1100 and all the way to 127A it only took about a minute and a half, now I'm onto the other cards I need to unlock and they seem to be back to the 6fff reading, will post if I have any luck.

hey how are you doing long time since ive been here hope everything is ok with you and yours any way the reason im back is that i tryed that t911 mod but nowmy t911 is not being reconized i was wondering with those mods do you have to lift any of the pins on those chips we connect to like 7or 4 or any one my t911 is not doing anything when i try ti get the vcc measurements it says please insert your card and the card is already in there any info you can give me would be appreciated thanks again i hope to talk to you soon take care bud

[Crazy1_79]

no pins need to be lifted, are you using the black board, clear case model? or are you using a different model. With the blue board and the black board no pins need to be lifted. but I would triple check your trace cuts around the pin near the front the loader that has the jumper going to to the atmel chip and to the dip switches, I was getting time out errors untill I recut those. also make sure you are getting a good flash. What flash program are you using? if you are using xpatmel right click on the bar right below the window where the flashes are shown and it will ask if you want to show timing settings. click on that and change the timing to 60/50/1, make sure you change your settings in winex to the loader 2 setting in the readme that comes with the flashes. Throw me a few more details brother, exactly what are you getting. are you not recognized when you try to flash the chip? 1 and 5 are the dips that have to down to flash, 2 and 5 need to be down to unlock.

Guys,

Can any expert or a blind man like myself tell us how to mod a t911 in a step by step using simple language....TX

Originally Posted by Crazy1_79

no pins need to be lifted, are you using the black board, clear case model? or are you using a different model. With the blue board and the black board no pins need to be lifted. but I would triple check your trace cuts around the pin near the front the loader that has the jumper going to to the atmel chip and to the dip switches, I was getting time out errors untill I recut those. also make sure you are getting a good flash. What flash program are you using? if you are using xpatmel right click on the bar right below the window where the flashes are shown and it will ask if you want to show timing settings. click on that and change the timing to 60/50/1, make sure you change your settings in winex to the loader 2 setting in the readme that comes with the flashes. Throw me a few more details brother, exactly what are you getting. are you not recognized when you try to flash the chip? 1 and 5 are the dips that have to down to flash, 2 and 5 need to be down to unlock.

Crazy,
I have the t911 black board. I think it is referred to as a Nexus T911. I haven't been able to pop cards with this thing for the life of me. I was using the blue board and popped all rom10 cards I tried. But, in the mod instructions I followed for the black board I had to lift 2 pins. Pin 4 and 5 of the 74hc00 if I remember correctly. Are you sure that they are not suppose to be lifted? Here is the mod I followed.

[DrSagan]

You guys need to stop worrying what color the board is, pay more attention to the layout of the chips and of course the traces.

blknite, I modded one of those and it is very hard to lift those pins and get all the trace solder out from under the pins, check that very carefully with a magnifying glass. Are you trying with rom10 or 3?

All I did was test for continuity after the pin was lifted. Both were fine. I have noticed that with the first bunch of cards that I did with my other modded t911 popped almost immediately, but the last 5 or 6 cards that I have been working on I can't get them to pop for the life of me. All are rom10 a23's and are returning 6f6f6f6f6f etc. I am using a 10k single turn pot. Once I hit like 300 I start to get 6f's but I then can continue up to 5,6,7k and I still get 6f's. Anything bleow 300 or so just reset's. Change vcc, delay's etc. Not sure but was there anything else in the stream that was updated to change the areas that were glitching?? I have also changed flashes. I am lost as to why these won't pop. I have let them run as long as 3 days and still just get 6f's. Any help or input would be greatly appreciated.
BlkNite

[DrSagan]

A little lost here, are you saying this loader used to work and now doesn't or ??

I have 2 modded t911's. One is a typical blue board t911. The other 1 I have is a Nexus t911 or black board. The blue board t911 used to work very well. Then I started to have a few problems getting into cards. It was taking quite a while (hours) but would open them. I had a Nexus sitting around so I decided to mod it. I followed 1 of the schematics and double checked everything. It works just as it is suppose to as far as flashing and responses just doesn't open the cards. I ended up hooking the blue board back up and giving it a whirl again. Just having some issues with getting the last few cards open. 4 are returning 6f6f6f6f and the other is 69696969 which I have read is usually a blockered card.

[DrSagan]

I don't have an answer for you, sorry. If you have a voltmeter, you might poke around and make sure the 7805 is still sending 5v and something hasn't happened to it and/or your power supply. I would bet you are using the same power supply for both. Wish I could help more...I haven't had a failure on mine yet so I don't know where to start looking

Thanks for the help anyway. I did get 2 more cards today that popped within 5 minutes on my original t911. Just these other cards that I need to work on. I will check the voltage regulator though and make sure all is good.
BlkNite

[t160hq]

Originally Posted by Crazy1_79

I set the pot for 348 ohms, 7.5 volts, 300 MA input to the loader, flash newd9 and using 10 for the vcc start and FFFF for the limit I have popped two cards in about 5 minutes or less. Regardless of what the script was giving me they still opened.

Thanks Crazy1_79.

After reading this post I tried something similar on the only rom3 I have that just would not pop no matter what I tried. Figgured I had nothing to lose.

I used a modded wildthing with a 2.2k resistor instead of a pot. Flash was newd6. I used the orginal unlockrom3.xvb. The only changes I made in the script were:

VCCStart = &h10
VCCLimit = &hFF

Started up the script. I forget what the window was showing but it wasen't the usual readout for glitch tries. I just ignored it and let it run. Took about 3 hours then the card should be open message popped up in the winexplorer window.

Switched to nagra and tried to read the cam. Nagra reported it was still closed. Just on a whim I hit it with Nagra bug buster set for 512 a couple of times.

Tried reading again and it worked. Wrote a clean image and I'm using it now. So far it works like a champ.

t160hq

[Crazy1_79]

t160hq, glad I could be of help, I have opened a couple more rom 10's, I have 2 that I just can't get open. have been playing with vcc's start and limit and ignoring what the script is giving me, I am getting all 6f's but that is what I got when I popped those two, all 6f6f6f6f and they still opened. I did get cocky and let one of my good rom 10 get streamlocked without a blocker and now that is one of them I can't get back open. I am still playing with it though.