how do i get box key

[andymirf]

Sorry if this question has been answered, but the answer still escapes me.

I have a B09 card which i need to read and, as other in this thread have indicated, Nagraedit gives bad password on BD3.

I have tried boxgetpc2 and that fails to give me the box key.

I have tried XNCs and recovered my ird, but not box key.

1 have tried the two D2C scripts (666's and the other one) but no look.

So i am now stuck.

If anyone can give me any pointers on how to get into this card i would be greatfull.

BTW its for a 2110 so i have no other way of getting this information.

[yusuf_gaz]

Originally Posted by andymirf

Sorry if this question has been answered, but the answer still escapes me.

I have a B09 card which i need to read and, as other in this thread have indicated, Nagraedit gives bad password on BD3.

I have tried boxgetpc2 and that fails to give me the box key.

I have tried XNCs and recovered my ird, but not box key.

1 have tried the two D2C scripts (666's and the other one) but no look.

So i am now stuck.

If anyone can give me any pointers on how to get into this card i would be greatfull.

BTW its for a 2110 so i have no other way of getting this information.

Hi

Sounds like the card needs unlooping if boxgetpc and xncs havent worked.

Did xncs let you into the card if it did you should have got the bk.

Try romstudio backdoor method. When you ran the d2c did the packets take cos if it did then you may have allready lost your bk and you may have a doorstop now.

Regards

[Ian_Spliffy]

He wont have a doorstop 'cus its 2100..
if it comes to it, you will have to JTAG it, thats all =)

Still, like you said if he used A3E - B09 D2C, his cards BK is screwed (unless you have what the D2C message log said, and you can get it from the communication log dump)

[andymirf]

Thamks guys. Just to really clarify, i have two boxes in the house (one pace and one sammy). I have been trying with the pace card due to the fact i can jtag it if required.

Interestingly though, now i have run the d2c scripts against this card, Mron (reset card) still gives me the correct ird (checked with nagra serial number conversion). I don't think that either of the d2c scripts have done anything to this card (though ic ould be wrong).

Anyway, back to the sammy card, as this is the important one. Am i correct in assuming that the suggestion is to run the card back through the unlopper with the BOD script that was origionally used to unloop this card? (I really could do with not screwing this card!)

Thanks again for you help guys.

[andymirf]

just a bit of an update: I have managed to obtain the bk and ird from my sammy card using sidewinder and my unlooper. My only issue now is reusing the origional cards. Mron seems not to like them, but i will keep trying.

[yusuf_gaz]

Originally Posted by Ian_Spliffy

He wont have a doorstop 'cus its 2100..
if it comes to it, you will have to JTAG it, thats all =)

Still, like you said if he used A3E - B09 D2C, his cards BK is screwed (unless you have what the D2C message log said, and you can get it from the communication log dump)

Hi

It would have been a doorstop as he was talking about a 2110 and the original poster was talking about a 2100, this is what happens when threads gets hijacked lol.

Anyway he`s managed to get his bk so alls well.

Regards

[andymirf]

Sorry for hijacking the thread, but it seemed no-one had replied for a while to the origional poster and i had what seemed the same issue.

[reddiesel]

Originally Posted by andymirf

just a bit of an update: I have managed to obtain the bk and ird from my sammy card using sidewinder and my unlooper. My only issue now is reusing the origional cards. Mron seems not to like them, but i will keep trying.

Put the dc2 in comm not patch, when reading after if it asks for backdoor put in EDCA5E0011 etc.