A little backdoor key tutorial by me...

[Roco]

Originally Posted by spikebaby

that is because its still locked

no i was still able to get boxkey using boxgetpc2 , if i was able to retrive bk using boxgetpc2 doesnt that mean its unlocked? I still get this in xncs though :

ATR=3FFF9500FF918171A04700444E41535030313020526576 41383240
Info=DNASP010 RevA82
Retrieving card info...
Card info retrieved
Dumping card,try #0.
Dumping card,try #1.
Dumping card,try #2.
Dumping card,try #3.
Couldnt Dump Card...

a bit slow on the reply there,lol,only a month or so late. not that fussed about that card now but just came across this thread again & noticed i never replyed

cheers

[Hennah04]

I know this tutorial was posted a long time ago but, this has helped me soooo much, so thank you. I had been trying for days to read or write to a couple of cards but I the programs couldn't because of the BD0 password. The D2C scripts didn't work, mrom didn't make a difference, I had no clue what to do with the info xncs gave me, thanks to this guide, as short and sweet as it is, I gained access to the card and now it's working beautifully. Thank you

[rizlaman]

Worked great for me to,thanks for great info!

[joc]

Can I use this method without unlooping the MOSC to find the BK and IED?

[G77]

no, this method is for cards which have been unlooped but have another method of protection on them.

[tariqz118]

thanks mate nice tut

[rogue]

Cheers mate,

been searching for about an hour looking for this exact info is the co70 one for back door key 3 anyone?

-rogue

[abbs2002]

Originally Posted by rogue

Cheers mate,

been searching for about an hour looking for this exact info is the co70 one for back door key 3 anyone?

-rogue

both CO40 & CO70 are back door key, 1 of them will do the job for you m8.

[MIKEDATA]

Hi all good frist post -AMO-....have done it this way and works frist time every time..BUT this will only work on a unlocked card that as the popup box asking for Bdk=backdoor keys.......

BD0 LOCKOUT IN NAGRAEDITfficeffice" />>>

You will need to use xncs1.8 to get the BD0 password, Just load up xncs1.8 from the cd or just make a folder up and copy all the files from the cd onto your pc and once you have done this run Xncs1.6 once xncs as loaded up and move your mouse pointer along the tags >>
until you see “settings” now all the boxes must be ticked BUT NOT “always install ghost” that must be unticked once you have done this hit the read tag and it will read your card in, once it has done this go to the “tools tag” and hit change Bdkeys and you should see all your bdkeys, now copy BD0 there are 2 ways of doing this..1...you can wright them down which takes time up....or step 2...you can copy and paste which i use...once you have done this close down xncs1.8 now open up nagraedit4.1 and do a full read again and when the password box pops up just paste into the box and them the card will dump ok....but make a note of the BD0 has you will need it again when you Wright back to the card....>>

Regards
MIKEDATA>>

[nads]

when I click the green button i get a box asking for the card provider ID?