rom11 backdoor password???

[noassetts]

Got this when using nagraeit 4.1 any ideas how I can get into it via back door I have unlooped this rom11 B0D and got this below
I have got the BK using jtag on 2100c, I just would like to know for future reference if there is a way of breaking into this......

and if not how can I re-use this card? how do I reset it to use again as a spare clean card

Thanks

[g80878]

In nagra edit click on the comms tab , Open D2C , select the A3E_B09 script , send D2C. This should do the trick and set the password to EDCA5E00112233445566778899EDCA5E. Should then allow you into the card for cleaning

[noassetts]

Originally Posted by g80878

In nagra edit click on the comms tab , Open D2C , select the A3E_B09 script , send D2C. This should do the trick and set the password to EDCA5E00112233445566778899EDCA5E. Should then allow you into the card for cleaning

Where do I find the A3E_B09 script

scrub that found it

[g80878]

Originally Posted by noassetts

Where do I find the A3E_B09 script

Goto the download section , its in with all the mosc stuff ( right at the top )

[slufc]

I think I`m right in saying u want to open the card without wiping the bk and ird.If that is the case, using the D2c files will erase them.I
I had a card with a blocker on it and ended up frying the card after trying for weeks.But anyway came across this on another forum so dont know if it works but the guy who wrote it knows his onions.He is highly respected on that forum......anyway try this
To remove the blocker with nagraedit click tools -> remove card lock
enter this password
C0 A1 FF BB 17 92 FC D0
By the way the blocker is pretty average and has being doing the rounds for years.
Someone added the stupid readme about the card killing itself etc probably trying to look clever - or make some money selling it.


hope it works...good luck

[noassetts]

just splilt drink on keyboard FFFFFFFFFFF***********iiiiiiiittttttttt back soom

[noassetts]

Originally Posted by slufc

I think I`m right in saying u want to open the card without wiping the bk and ird.If that is the case, using the D2c files will erase them.I
I had a card with a blocker on it and ended up frying the card after trying for weeks.But anyway came across this on another forum so dont know if it works but the guy who wrote it knows his onions.He is highly respected on that forum......anyway try this
To remove the blocker with nagraedit click tools -> remove card lock
enter this password
C0 A1 FF BB 17 92 FC D0
By the way the blocker is pretty average and has being doing the rounds for years.
Someone added the stupid readme about the card killing itself etc probably trying to look clever - or make some money selling it.


hope it works...good luck

Hi mate, and thanks for the tip,,, It didnt work for me though,,but kept it for future ref:

I used g80878 kermits fix us muppets eh!

[noassetts]

Originally Posted by g80878

Goto the download section , its in with all the mosc stuff ( right at the top )

All done thanks m8

Opening of COM1 was successful
ATR String: 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50
30 31 31 20 52 65 76 42 30 44 3C
ROM Revision: 011
EEPROM Revision: RevB0D
ProviderID: 5C
CamID: 27 74 28 64
Using BD3 Key: 4E 69 70 50 45 72 20 49 73 20 61 20 62 75 54 74
Attempting to login to BD3
BackDoor login verified
Dumping Dataspace
Backdoor retrieval has been blocked
Attempting to login to BD3
Attempting to login to BD0
Unable to login, bad password detected
Attempting to login to BD0
BackDoor login verified
Dumping CodeSpace
Reading ROM11 successful
Card read successfully
Efficiency: 95.1%, Packets: 143, Retries: 7, Time: 194.30s
Closing of COM1 was successful

[slufc]

did it give u the bk or was it wiped clean?

[noassetts]

Originally Posted by slufc

did it give u the bk or was it wiped clean?

Do you know what I never looked will do it now

--=================================================--

any ideas on this below a different rom11 just want to use card unless I can get info off it

Opening of COM1 was successful
ATR String: 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50
30 31 30 20 52 65 76 41 38 32 40
ROM Revision: 010
EEPROM Revision: RevA82
Dataspace pointer is bad - cannot continue
GetCamProvider failed
Using BD3 Key: 4E 69 70 50 45 72 20 49 73 20 61 20 62 75 54 74
Reading ROM10 failed
Closing of COM1 was successful