[EGG SUCKER]

I have a 103rev309 subed to a 921 ird. I use romcode for my blocker, the last time the key changed,I cleaned my card in romcode the went to niagramaster to check if the key 1 was changed and it was, I noticed that I had no boot strap so I CLEEN CODESPACED and saved bin and wrote back the old bin to the card.when I WENT TOREAD THE CARD IT READ, CARD LOCKED , so I went to n2edit tryed to read the card, it says :
ATR: 3F FF 95 00 FF 91 81 71 FF 47 00 44 4E 41 53 50 31 30 33 20 00 00 00 00 00 00 16
CAM Type: ROM103 Provider: Unknown
Reading Card Image...
Failed to read card.
so ,i try to unlock the card using unlock codes:
AABBCCDDAABBCCDD
FEEDBAADBEEFDEAD
BAADFEEDDEADBEEF
no dice,then i go back to nmaster and write the save bin to the card,then read the bin and it again says :card locked
can anyone help me with this mess I got myself into. thanks

[Zim]

have you tried to glitch back into it?

[PT2]

Originally Posted by Zim

have you tried to glitch back into it?

I think thats what he wants to know. What script to use to Glitch the Rom103 Rev309 ? I don't know . If you know let him know. He has a white nexus from mili and I think he said its flashed with newd RS. If someone knows a script to glitch this card let him know. I don't know the REv309 script..

[Zim]

I am thinkin it is not a 109 image but a clean image..."I noticed that I had no boot strap so I CLEEN CODESPACED and saved bin and wrote back the old bin to the card.when I WENT TOREAD THE CARD IT READ, CARD LOCKED"....so he should be able to glitch this..as far as a glitching script for 109 you could use the 108 and under I believe..but you need to make sure the image that was wrote to it does not have aniglitching.....if it has antiglitching you will loop the card

[EGG SUCKER]

Originally Posted by Zim

I am thinkin it is not a 109 image but a clean image..."I noticed that I had no boot strap so I CLEEN CODESPACED and saved bin and wrote back the old bin to the card.when I WENT TOREAD THE CARD IT READ, CARD LOCKED"....so he should be able to glitch this..as far as a glitching script for 109 you could use the 108 and under I believe..but you need to make sure the image that was wrote to it does not have aniglitching.....if it has antiglitching you will loop the card

do you recomend a script,and should I use n2edit or nmaster,thanks

[EGG SUCKER]

Originally Posted by Zim

I am thinkin it is not a 109 image but a clean image..."I noticed that I had no boot strap so I CLEEN CODESPACED and saved bin and wrote back the old bin to the card.when I WENT TOREAD THE CARD IT READ, CARD LOCKED"....so he should be able to glitch this..as far as a glitching script for 109 you could use the 108 and under I believe..but you need to make sure the image that was wrote to it does not have aniglitching.....if it has antiglitching you will loop the card

Zim its a 103rev309 not a 109,thanks

[Zim]

oh crap sorry, missread yesterday (budlights) for some reason I thought rom 102...... have you tried to glitch with the "rebelserf rom 103 OmniUnlocker_D_fubarATR"?

[EGG SUCKER]

Originally Posted by Zim

oh crap sorry, missread yesterday (budlights) for some reason I thought rom 102...... have you tried to glitch with the "rebelserf rom 103 OmniUnlocker_D_fubarATR"?

ok, fashed my white nexus with nd13,opened win50 or winexplore 5,tryed glitching with reblelserf rom103 omniunlocker d fubar atr and got this:
Rom 103, Rev 000 found.

Sc.Read: Timeout Reading Data From Card - 2 Bytes Requested, 0 Bytes Read, Continuing Script

Script Error on Line 370
Sc.GetByte: Requested Byte Exceeds Last Read Request

what does this mean?

[EGG SUCKER]

can anyone help me please?

you need to find the rom103 atr repair script at dssftp that worked for my 103 said same thing then just use Rom103_Omniunlocker.xvb with NewdRS will fix it right up if you havent already got it that is

[EGG SUCKER]

Originally Posted by s_gm06

you need to find the rom103 atr repair script at dssftp that worked for my 103 said same thing then just use Rom103_Omniunlocker.xvb with NewdRS will fix it right up if you havent already got it that is

can you send me booth ,that would be great ,thanks

[mili]

Well I have recieved a cad back from a 921 customer who is in the same shoes. RebelSerf Rom103 OmniUnlocker_D_FubarATR.xvb below will try to glitch your card IF you don;t have the real rev 309 on it. I managed to glitch into this ROM103 but it will not read or write in N2E and will read only in Nagramaster 3.8.4 but won't write. I am fresh out of ideas on this one too.

'**************************************************************************************
'* ORIGINAL VB SCRIPT MODDED BY TEAM REBELSERF - 5/06/06                              *
'*                                                                                    *
'* FOR STREAM LOCKED, PASSWORD LOCKED ROM103s.                                        *
'* AUTOMATIC VCC, SEMI-AUTO DELAY RANGE                                               *
'* USES ONLY NEWD13.HEX WITH LOADER                                                   *
'* THANKS TO A CERTAIN SLAVE DRIVER  ;-)                                              *
'*                                                                                    *
'*                          HAPPY UNLOCKING AND GOOD LUCK!!                           *
'*                                                                                    *
'**************************************************************************************
Option Explicit
Dim Shell
Set Shell = CreateObject("WScript.Shell")
Dim StartDate
Dim BuffFlg
Dim bytes2
Dim IntTim
Dim RngFlg
Dim RngHi
Dim RngLo
Dim SlFlg
Dim RdLen
Dim DtPnt
Dim bytes
Dim Uflg
Dim Acnt
Dim Mix
Dim VS1
Dim VT1
Dim DS1
Dim LP1
Dim LP2
Dim RT2
Dim RT3
Dim RT7
Dim VG
Dim DD
Dim TL
Dim RT
Dim T1
Dim T2
Dim T3
Dim T4
Dim T5
Dim T6
Dim GT
RT7 = 0
LP1 = 1
BuffFlg = 0
RngFlg = 0
SlFlg = 0
Uflg = 0
VT1 = 1
DS1 = 960
DD = DS1 + 96
GT=  6
RngLo = DS1
RngHi = DD
RT = RngLo
RT3 = RT                        'Do not change any values above this line
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Sub Main()
Setupunlocker()
If CheckChipVer <> 1 then
Sc.MsgBox("Flash Version ND13 needed to run this script" & VbCr & "Flash your Loader with NewD13.hex")
Exit Sub
End if
' These, AND ONLY THESE :), are the variables you can change for Rom103 any revision up to 305/385
LP1       =  40      'Number of tries per delay FROM 20-100 in multiples of 20
VS1       =  40      'YOU CAN CHANGE THIS FROM 02-255 = semi-automatic VCC range - Loader dependent
Mix       =  0.5     'Glitch VCC resolution - attempts per VCC = 1/mix
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
VG = VS1
sc.verbose = 0
Sc.Write("A0") ' turn led off
Clearoutputwindow
If ChkCard() = 0 then
Sc.MsgBox("  Unsupported Rom Version: Rom " & T1 & ", Rev " & T4 & " found." & VbCr & "This Script is for use with Rom 103, Revs up to 305/385")
Exit Sub
End if
If RT7 <> 0 then
Sc.MsgBox(" Invalid or no atr. Card may be looped or an unsupported rom." & vbcr & "                                Unable to continue.")
exit sub
end if
Clearoutputwindow
StartDate = Now()
Print "Initial Parameters = Delay:" & HexString(RT, 4) & "  VCC:" & HexString(VG, 2) & "  Glitch Type:" & HexString(GT, 2)& vbcr & vbcr
Do
If BuffFlg = 0 then
Acnt = 0
Do
sc.delay(10)
Sc.Write("07 0E 03 10 01 03 9A 00")    'reset card
Sc.Read(02)
Bytes = Sc.Getbyte(1)
If Bytes > 25 then
Sc.Read(27)
Exit Do
End if
Acnt = Acnt + 1
If Acnt > 5 then
Sc.MsgBox(" Check Loader Settings. Invalid or no atr. Card may be looped." & vbcr & "                                Unable to continue.")
exit sub
End If
Loop
Sc.Write("B0" & HexString(VG, 2))
Sc.Delay(10)
sc.verbose = 0   'debug the packets
Sc.write("15 03 15 600C 210009CD9DEE3100D0149D7688 0E" & HexString(IntTim, 2) & "85 00")
Sc.Read(2)
bytes = sc.getbyte(1)
sc.read(bytes)
If bytes > 5 then
bytes = sc.getbyte(3)
If bytes = 111 then
BuffFlg = 1
sc.delay(10)
Sc.write("67 03 15 60 5E 21005B8ECA9D9D9D9D559D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D9D71801864A64BB76BCD7E0030C0B9021864CD7E0032D0BB071864CD7E0031BDC2081864CD7E00BF00CA0520FE" & HexString(DtPnt, 2) & "BFA1FF270187BC80000500004FE132D00C0100FBFB88 0E01 83 00")
Sc.Read(02)
bytes = sc.getbyte(1)
Sc.read(bytes)
End If
End If
End If
If BuffFlg = 1 then
Sc.Write("A0")
Sc.Delay(20)
Sc.write("0D 03 15 6004 F4C101BC88 0E01 83 00")
Sc.Read(2)
bytes = sc.getbyte(1)
sc.read(bytes)
Sc.Write("12 03 15 6003 48C00088 0E01 83 20" & HexString(RT,4) & HexString(GT, 2) & "0E10 00")
sc.read(2)
Bytes = Sc.Getbyte(1)
Sc.Read(Bytes)
End If
Sc.Delay(5)
Sc.write("0D 03 15 6004 F4C101BC88 0E10 83 00")
Sc.Read(2)
bytes = sc.getbyte(1)
If bytes > 3 then
sc.read(bytes)
bytes = sc.getbyte(0)
bytes2 = sc.getbyte(3)
If bytes = 79 then
print "-"
VG = VG - mix
Else
If  bytes =< 72 and RngFlg = 0 then
If bytes >= 64 then
If RngFlg < 3 then
RngFlg = RngFlg + 1
End If
RngLo = RT - 3
If RngLo < DS1 then
RngLo = DS1
End If
RngHi = RngLo + 5
RT = RngLo
End If
End If
BuffFlg = 0
Print "+" & HexString(bytes,2)
VG = VG + mix
End If
Else
PRINT " Rst" & HexString(VG, 2)
BuffFlg = 0
VG = VG + mix
sc.write("02 03 00")
sc.write("02 02 00")
End if
If BuffFlg = 0 then
Sc.Write("08 0E 03 10 01 01 03 9A 00")   'reset card
sc.read(02)
bytes = sc.getbyte(1)
sc.read(bytes)
sc.delay(16)
Sc.write("2C 03 15 6023 210020A0CA00001A041801018600AA9D9D9D9D9D9D9D9D9DAE69CC76D8BE0000000000C7 0E06" & HexString(RdLen, 2) &  "00")
Sc.Read(2)
bytes = sc.getbyte(1)
If bytes > 5 then
sc.read(bytes)
bytes = sc.getbyte(0)
bytes2 = sc.getbyte(3)
If bytes = 18 and bytes2 = 132 then
sc.write("13 03 15 600A  210007A0FF0000024800330E02 85 00")
Sc.Read(2)
bytes = sc.getbyte(1)
If bytes > 5 then
sc.read(bytes)
bytes = sc.getbyte(0)
bytes2 = sc.getbyte(3)
If bytes = 18 and bytes2 = 105 then
UFlg = 1
End If
End If
End If
End if
End If
If Uflg = 1 then
Print " !!!!!!!" & VBCr
Sc.Write("A1")
Shell.Run "%comspec% /c echo " & Chr(07) & Chr(07) & Chr(07) & Chr(07) & Chr(07), 0, True
Sc.delay(500)
print
print "******* Good response received! *********"& VbCr
PRINT "     " & HEXSTRING(bytes2,2) & VbCr
Sc.Print "===========================================" & VbCr
print "     " & HexString(bytes2, 2) & " was hit at:  Delay:" & HexString(RT3, 4) & " VCC:" & HexString(VG, 2) & " GlitchType:" & HexString(GT, 2) &VBCr
print "     Elapsed: " & TimeDiff(StartDate,Now())& vbcr
Print "     VCC Resolution: " & mix & vbcr
Print "     Delay Range: " & HexString(RngLo, 4) & " to " & HexString(RngHi, 4) & VBCr
print
SC.DELAY(700)
PRINT "********************************" & VBCR
PRINT "*      103 CAM NOW OPEN!!      *" & VBCR
PRINT "* WRITE A VIRGIN IMAGE TO CARD *" & VBCR
PRINT "*      PROCEED AS NORMAL       *" & VBCR
PRINT "*       GOOD LUCK! :-)         *" & VBCR
PRINT "********************************" & VBCR
exit sub
End If
If VG < VT1 then
VG = VS1
End if
If VG > VS1 then
If VG >= 254 then
VG = VS1 / 2
End If
End If
If VG + mix = 0 or VG + 1 = 0 then
VG = VS1
End if
GT = GT - 3
If GT < 6 then
GT = 9
End If
LP2 = LP2 + 1
If LP2 > LP1 / mix then
ClearOutputWindow
RT = RT + 1
RT3 = RT
BuffFlg = 0
LP2 = 0
print
print "" &vbcr
print  "Buffer Intercept Installed. Trying to Open the 103....    Delay:" & HexString(RT, 4) & "  VCC:" & HexString(VG, 2) & "  Glitch Type:" & HexString(GT, 2) & VBCr & vbcr
sc.print "Elapsed = " & TimeDiff(StartDate,Now())& vbcr & vbcr
If RT >= RngHi  and RngFlg > 0 then
RT = RngLo
RngFlg = RngFlg + 1
If RngFlg >= 3 then
RngFlg = 0
RngLo = DS1
RngHi = DD
End If
End If
If RT > 1056 then
DS1 = 864
DD = DS1 + 96
RngLo = DS1
RngHi = DD
RT = RngLo
End If
If RT = 960 then
DS1 = 960
DD = DS1 + 96
RngLo = DS1
RngHi = DD
RT = RngLo
End If
End If
Loop
End Sub
Function HexString(Number,Length)
Dim RetVal
Dim CurLen
RetVal=Hex(Number)
CurLen=Len(RetVal)
If CurLen 4 then
CheckChipVer = 0
Exit Function
End if
If getbyte(0) <> &H4E then CheckChipVer = 0
If getbyte(1) <> &H44 then CheckChipVer = 0
If getbyte(2) <> &H31 then CheckChipVer = 0
If getbyte(3) <> &H33 then CheckChipVer = 0
End Function
Function TimeDiff (StartTime, EndTime)
Dim Hours, Minutes, Seconds
Seconds = DateDiff("s", StartTime, EndTime)
If Seconds > 90000 Then Seconds = 90000
If Seconds < 0 Then Seconds = 0
Minutes = Seconds / 60
Minutes = Fix(Minutes)
Seconds = Seconds - (Minutes * 60)
Hours = Minutes / 60
Hours = Fix(Hours)
Minutes = Minutes - (Hours * 60)
Seconds = CStr(Seconds)
Minutes = CStr(Minutes)
Hours = CStr(Hours)
If Len(Seconds) = 1 Then Seconds = "0" + Seconds
If Len(Minutes) = 1 Then Minutes = "0" + Minutes
If Len(Hours) = 1 Then Hours = "0" + Hours
TimeDiff = Hours & ":" & Minutes & ":" & Seconds
End Function
Function ChkCard()
ChkCard = 1
Print ""
Print "    Determining type of Unlock needed ......." & VBCr
sc.delay(2000)
ClearOutputWindow
Sc.Write("08 0E 03 10 01 01 03 9A 00")   'reset card
sc.read(02)
bytes = sc.getbyte(1)
If bytes = 0 or bytes < 27 or bytes > 27 then
RT7 = 1
ClearOutputWindow
Exit function
End If
sc.read(bytes)
sc.delay(16)
T1 = chr(sc.getbyte(16))
T2 = chr(sc.getbyte(17))
T3 = chr(sc.getbyte(18))
T4 = chr(sc.getbyte(23))
T5 = chr(sc.getbyte(24))
T6 = chr(sc.getbyte(25))
T1 = T1+T2+T3
T4 = T4+T5+T6
If asc(T4) = 0 then
T4 = "000"
End If
If left(T4, 2) = "30" then
DtPnt = 167
End If
If left(T4, 2) = "38" then
DtPnt = 165
End If
If T1 <> "103" then
ChkCard = 0
exit function
End If
DtPnt = 191
Print "     Rom " & T1 & ", Rev " & T4 & " found." & VBCR
print
Sc.delay(1500)
Sc.write("14 03 15 600B 210008A0CA0000020400CD88 0E08 86 00")
Sc.Read(2)
bytes = sc.getbyte(1)
If bytes < 6 then
RdLen = 133
IntTim = 48
print "     Proceeding with Really Fooked Unlocking :-D......"
Sc.Delay(2000)
exit function
end If
if bytes > 5 then
sc.read(bytes)
bytes = sc.getbyte(0)
bytes2 = sc.getbyte(3)
If bytes = 18 and bytes2 = 132 then
RdLen = 133
IntTim = 21
SlFlg = 1
print "     Proceeding with Normal Unlocking......"
Sc.Delay(2000)
exit function
Else
RdLen = 131
IntTim = 48
print "     Proceeding with Fubared Unlocking :-)......"
Sc.Delay(2000)
end If
End If
End Function
Function setupunlocker()
Wx.BaudRate = 115200
Wx.ResetBaudRate = 115200
Wx.Parity = 0 ' 0 = None, 1 = Odd, 2 = Even, 3 = Mark, 4 = Space
Wx.StopBits = 0 ' 0 = 1 stop bit, 1 = 1.5 stop bits, 2 = 2 stop bits
Wx.DTRControl = 0 ' Initial state of DTR 0 = off, 1 = on
Wx.RTSControl = 1 ' Initial state of RTS 0 = off, 1 = on
Wx.ResetDelay = 100 ' In microseconds
Wx.ByteDelay = 10 ' In microseconds
Wx.RxByteTimeout = 3000 ' In milliseconds
Wx.ResetMode = 2 ' 0 = No Resets, 1 = ISO Reset (Expect a ATR), 2 = Device Reset (No ATR)
Wx.ResetLine = 1 ' 0 = Toggle RTS for Reset, 1 = Toggle DTR for Reset
Wx.ByteConvention = 1 ' 0 = Inverse, 1 = Direct
Wx.FlushEchoByte = 0 ' 0 = no flush, 1 = flush - A Phoenix interface will echo each byte transmitted.
Wx.FlushBeforeWrite = 1 ' 0 = no flush, 1 = flush - Flush the receive buffer before each write to strip off Null bytes.
Wx.IgnoreTimeouts = 1 ' 0 = Abort script on a receive timeout, 1 = Ignore all receive timeouts
Wx.ResetAfterTimeout = 0 ' 0 = Don't reset after a timeout, 1 = do a reset after a timeout - Not used if "IgnoreTimeouts=0"
Wx.LogTransactions = 0 ' 0 = Don't log transactions, 1 = log transactions
Wx.DisplayUSW = 0 ' Display USW after script complete 0 = no, 1 = yes
Wx.DisplayFuse = 0 ' Display Fuse after script complete 0 = no, 1 = yes
End function

mili

[SURFGUY]

When all else fails -- send your card to Mauisun for unlocking HE IS REAL GOOD AT IT WHEN THEY ARE SOFT LOOPED!

Surfguy

read 103 100% write well forced worked now it back to normal herei used this workedkd 4 me

FinalIntercept103FM

[EGG SUCKER]

the card and 921 ird you sold to me mili,I unlocked it everything was good untill I messed up the card. i used the fubar but no luck also used Rom103_Omniunlocker.xvb with NewdRS same thing I posted upabove
I notied I have a atr but rev. s_gm06 do you unlock the card first then use the FinalIntercept103FM . I guess I have figure out how to unlock this card

[mili]

Unfortunately it sounds yours is toast too.

mili

[MAKS01]

Hopefully you kept a backup image of your 103 card. If you did you can get another Rom103 and program with your 921 info.

[EGG SUCKER]

Originally Posted by MAKS01

Hopefully you kept a backup image of your 103 card. If you did you can get another Rom103 and program with your 921 info.

I save the image in n2edit but it gives me a cant see image error .I also saved it in niagra mater and that image is ok, my question is when I open saved nm image it has everything but atr,when I put in the 103 card of that image and reset the atr it shows the atr .so should I write that to the new 103 card or put in the the info on the new card from the old card to get my 921 running? it there a step to writing the image off old card to new. I just dont want to skrew up this new card

[MAKS01]

When opening an image in Nagramaster it will not show an ATR as you are not communicating with the card. You are just opening a saved image.

Just verify that the backup image you are opening has the correct IRD# and personal info from your 921. Then clean the codespace of the backup image back to rev 300. Check that your dataspace starts at A700 (If not move it), add your tiers and then add Blocker. Also make sure the keys are correct and up to date (Change 2-3 times a day). Save the bin file with all the changes.

Now before writing to the card - open the saved image again in Nagramaster and verify that the image shows REV30B, and all your info has not changed. If all is okay then write the image to your new unlocked 103 card.

Let me know how it goes. If you are still not sure, PM me and I can work with you and your BIN file to get your 921 back up.

[EGG SUCKER]

Originally Posted by MAKS01

When opening an image in Nagramaster it will not show an ATR as you are not communicating with the card. You are just opening a saved image.

Just verify that the backup image you are opening has the correct IRD# and personal info from your 921. Then clean the codespace of the backup image back to rev 300. Check that your dataspace starts at A700 (If not move it), add your tiers and then add Blocker. Also make sure the keys are correct and up to date (Change 2-3 times a day). Save the bin file with all the changes.

Now before writing to the card - open the saved image again in Nagramaster and verify that the image shows REV30B, and all your info has not changed. If all is okay then write the image to your new unlocked 103 card.

Let me know how it goes. If you are still not sure, PM me and I can work with you and your BIN file to get your 921 back up.

thanks MAKS01 for your help,my old image is at rev 300 the data space is at what # in the nm window, are you talking about the 30c0 line? that line I have a7bf870380800000000000000000. also I will be using romcode for my blocker.thanks

[MAKS01]

I hope your 921 was an ex-subbed unit being at rev 300. Check if there is info at A500 or A700. You should see something start with 0C ....

Also in Nagramaster, check if the IRD# and Smartcard number (Old looped one)match what you are using.

If you want you can PM your bin, and I can see. Then send you back a modified one.

[EGG SUCKER]

Originally Posted by MAKS01

I hope your 921 was an ex-subbed unit being at rev 300. Check if there is info at A500 or A700. You should see something start with 0C ....

Also in Nagramaster, check if the IRD# and Smartcard number (Old looped one)match what you are using.

If you want you can PM your bin, and I can see. Then send you back a modified one.

my 921 is ex-subbed at 300,thank god At a700:OC00020F0200000001010100000 A500 is all zeros

[MAKS01]

That is perfect! Go ahead and load blocker and tiers. And you should be all set.

[DrSagan]

Originally Posted by mili

Well I have recieved a cad back from a 921 customer who is in the same shoes. RebelSerf Rom103 OmniUnlocker_D_FubarATR.xvb below will try to glitch your card IF you don;t have the real rev 309 on it. I managed to glitch into this ROM103 but it will not read or write in N2E and will read only in Nagramaster 3.8.4 but won't write. I am fresh out of ideas on this one too.

Mili, are you still having problems with this card?

[EGG SUCKER]

Originally Posted by MAKS01

That is perfect! Go ahead and load blocker and tiers. And you should be all set.

thank you very much for your help.my 921 is up and running well.I would like to thank the others also for there imput.thankyou guys

[MAKS01]

Glad you got it going!!! This is why keeping a backup of your image is so important.

[Newfygarge]

just reglitched into one of these using Rebelserf 103 Rev_ 307_387unlocker_reader. Took less than 5 minutes. Been at this Rom 103 at least 6 weeks. YEAH!