unlooper ? for rom 11

[wonko]

on a resonable grade t911 u should only really need to adjust the trimmer once - and it normally ends up going roughly front to back - u r looking for a vcc no lower than 19 but ideally high 1x to very low 2x - on a t911

it is not a good idea to use a critical card for this inital calibration - so one out of a jtagable box is fine but not from a 2110 lol

[tflrs]

Hi, I have just got a Wizard unlooper but there doesn't appear to be much in the way of support for it. I was told to just plug it in and run a script in winwex but I keep getting errors reading the card. Tried re flashing but keeps erroring when trying to write to the atmel, I have checked the cables and the ports, all seem well. Any ideas?

[javed]

fficeffice" />> >
How to Use that Modded T911 or Loader
This was written by a friend, posted with his blessing. (Big Thanks to Satellites and Rowdy for bringing this to legends!!!!)

How to Use that Modded T911 or Loader
Unlocker How to

These techniques apply to any UNLOCKER, weather it be a T911 or DSSDooda MODED T911, Nexus, T5, T6, Powersync, Absolute, Detonator, and so on…………..

Variables:

There are several variables involved here, any one of these affects the other, if one changes then the others will also change to some degree. PATIENCE is the word here, if you expect to slap a card in and open it up in 5 seconds then this unlocker isn’t for you. The current scripts are alike the first HUFF unlooping, it worked but required some patience and time. You’ll find that with the current unlocking scripts however, they are still work in progress and being refined. If you’re not a true Tester, then you probably won’t have the patience to work out all the settings to successfully unlock cards with your unit. For those people I suggest you find some one that’s willing to do it for you.

1. POWER SUPPLY: The power pack used to power the loader with, it needs to be a variable supply rated at least at 300 milliamps, with settings of 6VDC, 7.5VDC, 9VDC, and 12VDC. If regulated then this is a plus too. The Power Pack used here is a RadioShack PN: 273-1667.
2. COMPUTER: The ports settings of your serial port, should be set to: bits per second =115200, Data bits =8, Parity = None, Stop bits =1 and Flow control = X on / X off.
3. ADJUSTABLE POTS: You need to have one that has the range adjustable from 5K ohms to 0, set it to a static setting of 2.5K ohms (mid range). Some units come with no adjustability; a 2.2K ohm resistor is installed. For these units, no action is needed.
4. SCRIPT VCC SETTINGS: If the script being used requires you to plug in these settings then a test script must be run to find which settings to use. Some scripts now include Auto find and plug in the VCC settings found. Valid settings will vary depending on which power supply setting being used to power the loader.
5. WINEXPLORER: Configurations settings, the script being used has settings to achieve the correct responses needed, usually found in the text README file included with the script.

Powering the loader:

Thru various experiments with several brands of loaders and verification with oscilloscope waveforms, opening cards with one voltage only power supply on works on a true T911. So what’s a true T911 look like? Well it can be recognized by its board color. A true T911 is a board color of green only and uses two 74HC4053s for the multiplexing of signals to the card. So unless you have one of these units you’re going to need a variable power supply to achieve any real results unlocking rom3 or rom10 cards. You’ll find that setting the voltage input to 6 volts dc will give the desired pattern needed to unlock for Rom 10 cards on the clones, 9 volts dc will do the same for a Rom 3 card. This holds true about 75% of the time. Now adjusting the input voltage also affects the glitch voltage required to achieve it too. This holds more true to those units only using one 74HC4053 to multiplex with, like the Nexus T911. The required voltage also varied with computer used to glitch with too, so you can see that one set of settings may not work on another’s computer when it did work on yours. The quality of the power supply, being the regulation and noise ripple of it can keep you going in circles without achieving stable indications. This is why I recommend the Radio Shack model 273-1667; it’s a 3v, 4.5v, 6v, 7.5v, 9v and 12volt unit that’s regulated with 800 milliamps of power to spare. But only a 300 milliamp power supply is needed to achieve results.


WinExplorer:

There are two different configuration settings that are required to get the scripts to respond properly, pay attention to detail on these settings. The earlier version scripts required the settings be set up to LOADER 2 configurations as follows;

Communication tab

Com= pick your port
Data baud=115200
Reset baud=115200
Parity =none
Receive timeout=1000
Byte delay=100
Reset delay=100
Stop bits =1
Byte convention= direct
Flush echo bytes= no check
Flush receive buffer= check

===========================
Advanced tab

Check mark in device reset (no atr)
No check mark in ignore receive timeout
DTR= low
RTS= high
Toggle line = RTS
Save these settings to LOADER 2, make sure its set to these settings.

The newer scripts now require the LOADER 3 settings to achieve the results needed as follows;

These are new so double check them:

Communication tab

Com= pick your port
Data baud=115200
Reset baud=115200
Parity =none
Receive timeout=1000
Byte delay=100
Reset delay=100
Stop bits =1
Byte convention= direct
Flush echo bytes= no check
Flush receive buffer= check

===========================
Advanced tab

Check mark in device reset (no atr)
No check mark in ignore receive timeout
DTR = low
RTS = high
Toggle line = DTR

Save you settings to LOADER 3 make sure it is set to these settings.

Adjusting the Pot :

If you have an OHM Meter, measure across the Card slot VCC pin to ground for a reading of 2.5K to 2.2K ohms. If you have no pot to adjust then skip this adjustment, your 2.2K ohm resistor is already set to the range we need. Once you have the pot in the MID range position then keep track of how many turns you go from that point in either direction. You can measure it in ¼, ½ and clock type turns (1 thru12), doesn’t matter what method you use just keep track of it.>>

For those that don’t have an OHM meter to set this mid point you can use the script to set it at mid point. Simply flash the loader with NEWD 6, write the TEST BIN to a good already open Rom 3 card and fire up the first Penga unlocker script using the AAAAFFFFAAAAFFFFs. With the script running adjust the Pot to see an equal amount of AAAAs and FFFFs being displayed in a diagonal pattern, when you get some where close to seeing this adjust the pot very slowly in ¼ to 1/8 turns to see the equal pattern. This gives us the starting point we need. Next fire up the second Penga script of test find, it’ll display a pattern of: “++++__++__++__++__+++++__++++++++_____++_++_ __++” , there again use only small increments of the pot to achieve this. The solid pattern of: “++__++__++__++__++__++__++__++__++__++__” isn’t the pattern we want, the broken and ill regular one is the one we do want. You may have to adjust the power supply input voltage to achieve this. Now once this is set DONOT vary it much, keep track of where it was and how to get back too it or you'll be setting it up all over again. Even if you’re not going to unlock a Rom3 you still need to use this method to set up the loader in a range that can unlock a Rom10 card too.


to be continued...

[javed]

Rom 3 Cards :

If the loader has been set up correctly, flash it with NEWD 6 to start unlocking a ROM3 card. The script to use next is Penga’s Test Find v2, this will give you a narrowed down setting to plug into the script that actually unlocks the card. If you get RESET all the time or the dreaded : “Sc.Read: Timeout Reading Data From Card - 2 Bytes Requested, 0 Bytes Read” then it’s time to back off the pot adjustment ¼ turn at a time, until the script responds correctly. Simply put not enough voltage going to the card. You also can lower or raise the power supply input voltage to get past this. What we want to see is the script showing us it auto adapted and is displaying “+++__++_++++_++++_+++++++_”. If it goes more than 3 lines of solid “++++++++++++++++++++”s then it will time out with the error shown above. Time to increase, or decrease the input voltage or the pot adjustment.
If successful with the Test find you’ll have a VCC, Glitch and Delay to plug into the actual unlocking script. It will report that the Success to you as follows:

===========================================
Success on Test Glitch, Try #45
VCC = 20 (~0.627450980392157 vdc)
Glitch Delay = 002F
Glitch type 06
READ 20-23 from ram, glitch =CCE280
===========================================

===========================================
VCC = &h20
Glitch type = &h06
Glitch delay = &h10A5
GLITCHED past 0C BUG!!!, unlocker is good to go.
Use the above settings on real unlocker script
3FFF9500

Until it gives you these findings, it’s all hit and miss from there on, I’ve had some take as long as 3 days to see the OC bug hit.

Now assuming the OC bug was hit in the test script, we need to plug this info onto the unlocker script. To do this, find the script and load it into winexplore. In winexplorer, the upper right window displays the script currently loaded into it. Click in the area and scroll down until you see the Lines of Red showing VCC, GLITCH and DELAY. Drag your cursor over the numbers after the =&hxxxxx and type your findings in the appropriate spots, then start the script and be patient. When it Hits the OC Bug it’ll display that the ffice:smarttags" />lace>CAMlace> IS OPEN NOW. Now proceed over to Nagra Edit 4.1 and perform an OneStepClean with an ISO card reader, writer. This Loader WILL NOT work in Nagra Edit 4.1 as an ISO card reader so doesn’t try.

The Powersync V2a script does have the VCC Find included in it for a Rom 3. You Must use it’s Flash for the script to ID the card and the script to use. When you start the script it’ll prompt you with a menu of “unlock rom3” or “VCC Analyzer”. If you already know what VCC voltage to use then use the Unlock button, otherwise select the Vcc Analyzer button. Its auto find, so you see it take off, showing you; “+++++++++++++++++++++++++++”
“++++++++++++++++++++++__+++”
“++___+++__+++_++__+__+++++__”

Note the voltage out to the right of each line and the delays, let it run a few minuets to stabilize and copy down the best looking pattern lines, delays and Vcc settings. Now restart the script and this time selects the rom3 unlocker. Enter the data prompted for and let it unlock the card, when done the script will flash the activity LED on you loader, indicating it unlocked the Rom 3 card. Go to Nagra Edit 4.1 with an ISO card reader writer and perform an OneStepClean. If successful the card will clean ok and be back at REV 372 and open.

Rom 10 Cards :

These are the harder card to unlock if it’s a generic loader you’re using, but you have success with time. You’ll need to flash the loader with either NEWD 7, 8 or 9. There is no test bin and test script for a Rom 10 card like with the Rom 3 card. With Rom 10s you use the actual card you’re going to unlock to test its VCC settings required to unlock it. Now fire up the VCC Analyzer 2. In winexplorer, make sure the Configuration is set to Loader 3. Now in the top right window you see the script you loaded into winexplorer. Start the script, when the script completes it should display the start and stop VCC settings to use as follows;

VCC Ceiling: 25
VCC Floor..: 1F

If it displays:
VCC Ceiling: 00
VCC Floor..: 00

Then we need to adjust the starting VCC settings from the default ones used, to do this look in the script window for:
Const VAVCCTestMax = &h30 '<--- Set this to the MAXIMUM VCC to test the card with.
Const VAVCCTestMin = &h10 '<--- Set this to the MINIMUM VCC to test the card with.
Const VATryLimit = 10 '<--- Set this to the NUMBER of times to glitch each VCC.
Const VADelay = &h1235 '<--- Set this to the DELAY to use for each glitch.

Set the VAVCCTestMax =&hxx to a higher hex value, like 3F (valid hex starts are up to FF).
Set the VAVCCTestMin =&hxx to 30, this moves the range to 3F to 30 that’ll be tested.

What we want to see here is the script displaying the 6F FF pattern as follows:
“6FFF6FFF6F6F6FFF6F6F6F6FFFFFFF6FFF6F6F6F6FFF 6FFF6 FFF”.
The percentage of hits to be at 60/40.

If you get RESET all the time or the dreaded : “Sc.Read: Timeout Reading Data From Card - 2 Bytes Requested, 0 Bytes Read” then it’s time to back off the pot adjustment ¼ turn at a time, until the script responds correctly. Simply put not enough voltage going to the card. You also can lower or raise the power supply input voltage to get past this. If you get “________________________” then it will time out. Time to increase, or decrease the input voltage or the pot adjustment. A blockered card will show different characters than the 6F, some show “?s” instead or “!s” instead. The principal objective is to have a 60/40 mix of it and the “__”s.

I’ve had success with using 6 Volts dc to power the unit to as high as 9 volts dc, VCC settings like 68 to 28. One has to really play with all the settings to get a loader setup for rom10 unlocking blockaded cards.
A23s seem to open fairly easy but some can be real hard too. Patience is the word here too.

Once we have the setting we need, time to plug then into the actual unlocking script. Take these Vcc setting and edit them into the script the same way you did in the VCC analyzer, just scroll down to the line and edit in your VCC settings. Run the script now, it’ll tell you when it’s done, unlocked the card.
Use the same procedure as we did for Rom 3 cards, open up Nagra Edit 4.1 with an ISO card reader/ writer connected and perform an OneStepClean. When completed the card will be back at Rev 16 and ready to go.

POWERSYNC Unlocker Ver2a

Start by Flashing the loader with one the included flashes for Rom 10s (d7-7, d8-8, d9-9). Then fire up the script, it’ll ID the loader if flashed with their flash and prompt you with “BEV”, “CHUCK” or “abort”. Select your provider. It’ll then prompt you for a starting VCC to use and even suggests a starting one, enter what you need; (valid are FF to 00). Then it’ll prompt you for the stop VCC setting, also suggesting a stop setting ;( valid is FF to 00). Some cards do require more than normal voltage to respond correctly or the suggested settings don’t produce the pattern wanted to unlock. If you get RESET all the time or the dreaded : “Sc.Read: Timeout Reading Data From Card - 2 Bytes Requested, 0 Bytes Read” then it’s time to back off the pot adjustment ¼ turn at a time, until the script responds correctly. Simply put not enough voltage going to the card. You also can lower or raise the power supply input voltage to get past this. What we want to see is the script showing us; “++__+++_____++++_++_+++_____+”. If it gave you the results of the complete range you used, then abort the script and restart it plugging in some different values. Or time to increase, or decrease the input voltage or the pot adjustment. If you started the script with too broad of settings like “6F to 02” then pay attention to the VCC points that are indicating good hits, stop the script and start over with your refined start and stopping VCC points. The script will execute the VCC settings it finds and proceed with those to the actual unlocking script. It’ll prompt you for a start and stop delay settings to use. If this is a A23 your unlocking use it’s suggested delays, if it’s a blockered card then use a broader range of delays. I’ve had blockered cards pop at a delay of 1109, 1121 and 1249. When the script has completed unlocking, it’ll flash the activity LED until you remove the card. At this point open Nagra Edit 4.1 with an ISO card reader/ writer connected and performs an OneStepClean. When done the card will be at Rev A16 again and open, ready to use.fficeffice" />>>
> >
> >

[javed]

fficeffice" />> >
> >
>>
>>

Hacks how to T911 ROM 10 & 101 and 102 Unlocking Using Moded T911 UNLOCKER:>> HACKS GUIDE TO Smart Card UNLOCKING the complete guide to T911 ROM 10 101 and 102 Unlocking on Windows XP. COM PORT SETTINGS ON YOUR PC go to START/SETTINGS/CONTROLPANEL/SYSTEM/HARDWARE/DEVICEMANAGER then select PORTS/COMPORT 1. SET Your Settings as Follows port settings bits per second 115200 \ data bits 8 \parity none \stop bits 1 \Flow control Xon/Xoff>> referrelative="t" o:spt="75" coordsize="21600,21600">ath o:connecttype="rect" gradientshapeok="t" o:extrusionok="f">ath> >> we will start with the loader It has been my experience these loaders glitch at a very very low setting so patience is the key here we will start with flashing very easy to flash move the switch to the left u position flip switches 1 and 5 down for flashing for unlocking loader settings areROM 10: 9 volt /switches 2and5 to unlock ROM 101:7 1/2 volts /switces 1and5 down to unlock ROM 102: 6 volts /1and3 down to unlock >> >> 2 and 5 down with switch in the p position or to the left for ROM 10 Unlocking Different cards require different settings >> >> download the XP ATMEL Flashes or the ufp 16d depending on which one you downloaded the ufp16d i have posted contains all the flashes >> I think thus far if its ufp 1.6 open it Click on file/load another box pops up Select your flash from the list Click on connect it will verify your loader is connected properly. the settings i use are the lock bits set to read and write Click erase a few times and either Click write or auto program you may have to Click write or auto program a few times till you get a good write when you get a good write then proceed to next step>> __________________>>

> >

> >

> > You will need an universal power supply at least 300ma 600 is good and db9 straight thru serial cable to connect to your comport found at Radio Shack, Fry’s Electronics or Wal Mart. Next a23uv for ROM 10 or Window Explorer preferably 5.0 and your unlocking scripts whether it be for ROM 10, ROM101 or ROM102 Explorer Settings are as follows, in Windows Explorer Click on configure>> There are three different configuration settings that may be required to get the scripts to respond properly, pay attention to detail on these settings. The earlier version scripts required the settings be set up to LOADER 2 configurations as follows; Communication tab Com= pick your port Data baud=115200 Reset baud=115200 Parity =none Receive timeout=1000 Byte delay=100 Reset delay=100 Stop bits =1 Byte convention= direct Flush echo bytes= no check Flush receive buffer= check Advanced tab Check mark in device reset (No ATR) No check mark in ignore receive timeout DTR= low RTS= high Toggle line = RTS Save these settings to LOADER 2, make sure its set to these settings. The newer scripts now require the LOADER 3 settings to achieve the results needed as follows; These are new so double check them: Communication tab Com= pick your port Data baud=115200 Reset baud=115200 Parity =none Receive timeout=1000 Byte delay=100 Reset delay=100 Stop bits =1 Byte convention= direct Flush echo bytes= no check Flush receive buffer= check Advanced tab Check mark in device reset (No ATR) No check mark in ignore receive timeout DTR = low RTS = high Toggle line = DTR Save you settings to LOADER 3 make sure it is set to these settings. lastly if you get time out errors in explorer click on Program settings tab and uncheck everything except Associate WinExplorer Files if using a23uv1 for rom10 explorer is not needed all files are posted in the forum here >>

[javed]

fficeffice" />> > You will need an universal power supply at least 300ma 600 is good and db9 straight thru serial cable to connect to your comport found at Radio Shack, Fry’s Electronics or Wal Mart. Next a23uv for ROM 10 or Window Explorer preferably 5.0 and your unlocking scripts whether it be for ROM 10, ROM101 or ROM102 Explorer Settings are as follows, in Windows Explorer Click on configure>> There are three different configuration settings that may be required to get the scripts to respond properly, pay attention to detail on these settings. The earlier version scripts required the settings be set up to LOADER 2 configurations as follows; Communication tab Com= pick your port Data baud=115200 Reset baud=115200 Parity =none Receive timeout=1000 Byte delay=100 Reset delay=100 Stop bits =1 Byte convention= direct Flush echo bytes= no check Flush receive buffer= check Advanced tab Check mark in device reset (No ATR) No check mark in ignore receive timeout DTR= low RTS= high Toggle line = RTS Save these settings to LOADER 2, make sure its set to these settings. The newer scripts now require the LOADER 3 settings to achieve the results needed as follows; These are new so double check them: Communication tab Com= pick your port Data baud=115200 Reset baud=115200 Parity =none Receive timeout=1000 Byte delay=100 Reset delay=100 Stop bits =1 Byte convention= direct Flush echo bytes= no check Flush receive buffer= check Advanced tab Check mark in device reset (No ATR) No check mark in ignore receive timeout DTR = low RTS = high Toggle line = DTR Save you settings to LOADER 3 make sure it is set to these settings. lastly if you get time out errors in explorer click on Program settings tab and uncheck everything except Associate WinExplorer Files if using a23uv1 for rom10 explorer is not needed all files are posted in the forum here >>

> >

>> I would like to start by saying it takes patience to setup your loader computers vary but it is a great learning experience There are several variables involved here so i state again BE PATIENT we will start with a ROM 10 loader flashed with newd9 if using a23uv1 click on the little lock a screen pops up Click start unlocking i used standard setting for rom10 a23 while it is running using a small tipped screwdriver turn the little screw beside your card slot counter clockwise or if you have a ohm meter un hook the loader and connecting to each point of the[ pointometer] the little blue box beside the card slot ZERO it out fine tuning is the key here with the loader hooked up a card in the slot and running look at your screen while you adjust the loader we will be looking for a distinctive pattern yours may look like this to begin with all --------------------------------------- or all ++++++++++++++++++ we want a combination of ++++__++__++__++__+++++__++++++++_____++_++___++ turning your screwdriver very very small increments one way or the other about a 60 /40 combination if it starts erroring out adjust your screw settings very very carefully to compensate the glitching starts when the broken pattern is achieved when you get a good pattern restart your script and let it run patience is the key most ROM 10s popped under 8 minutes but this can vary i have seen as much as 4 hours.>> If Using Windows Explorer:>> >> Open explorer Click on open script choose the script you will be running ROM10, ROM101 & ROM102 check all your settings flash your loader for the type of card your unlocking and start your script again we are looking for the distinctive broken pattern for glitching. I have found 101s are a pain to unlock so it may take a little while after it unlocks read it in a ISO Smartcard loader you can purchase them at Also your results should resemble this with a successful unlock . Executing Script: C:\unlockRom10-A23 OPEN.XVB TX Data : A0 TX Data : A0 TX Data : A1 TX Data : 07 0E 03 10 01 03 9A 00 RX Data : 07 1B RX Data : 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50 30 31 30 20 52 65 76 41 32 TX Data : 12 15 AB 21 00 08 A0 CA 00 00 02 12 00 06 55 0E 03 85 00 RX Data : 12 06 RX Data : 12 00 08 92 04 1B Now we will try 0C00 delay 6969696969FF6969FFFF69FF6969FFFFFFFFFFFFFFFFFFFFFF 69FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF6969 now we will try 0C01 delay 6969FF696969FF69FF69FF69FFFFFFFFFFFFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFFFFFFFFFFFFFF69FF696969FFFFFFFFFFFF 69FF6969FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF696969 69 now we will try 0C02 delay 696969FF6969FF69FFFF69FF69FFFFFFFFFFFFFFFFFFFFFFFF FF69FF69FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF6969696969 69 now we will try 0C03 delay 69FF69FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF696969FF696969 69 now we will try 0C04 delay FF69FFFFFFFFFF6969FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF6969FF69FF6969FFFF FF now we will try 0C05 delay FFFFFFFFFFFFFFFFFFFFFFFFFFFFFF696969696969FF69FFFF 69FF69 now we will try 0C06 delay 6969FF69FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF6969FF6969 696969FFFF69FFFF6969FFFFFFFFFFFFFFFFFFFFFFFFFFFFFF FFFFFF696969FF696983 *********** we hit our bug ************* 1200078303 =========================================== 83 was hit at 0C06 delay ----VCC WAS 6A TX Data : 0A 15 A3 21 92 00 B3 0E 03 85 00 RX Data : 0A 06 RX Data : 12 60 20 00 C5 *************************** * A23 CAM should be OPEN * * test in Nagra to see. * * if not, try again. * *************************** Script C:\unlockRom10-A23 OPENwithsound.XVB Transmission Completed use niagraedit to read your rom10 and niagraedit 2 beta 7 for rom 101/102 cards >>

[alder191]

thanks javed, it gives me a real insight to where i am going wrong, alot harder than i first thought, will try my cyclone unlooper whitch i got today

[javed]

i have tried to give you as much information as i can. i could send this to moderators, then they will have look, edit it, and then put it for other people. So i thought i will paste it in the forum Directly.dont know if the moderators will like it helping this way ? There are lots of variable invovled in it. once you go through all of the options and find a right one for your self then its done. next time it becomes more easier... Please let me know when you succed glitching you card.

[reddiesel]

Thanks for that Javed thats interesting reading, and you answered my next question about a suitable power supply.

[paul001]

Hi

I have a Cyclone unlooper but am having trouble flashing it. Keep getting error unrecognised com port. I have set the dip switches in varius combinations as follows 1-6 and tried 1-5 even open and closed. i have checked the coms port settings and are set as stated in the tut but no luck. I have tried different comms port as well. My serial lead is conected to a usb converter. No problem when using Phoenix programmer. Any suggestions.