Noob MOSC Advice

[wiredworm]

Hi there,

I've been handed a V*rgin VBox (Samsung) which was working fine until recently with a MOSC card.

I've not done anything with MOSC's before. Usually the boxes brought to me have already had the IRD and BK determined and is noted somewhere on the box - but in this case the box is clean. In fact it doesn't look like talkback has even been cut (which seems very risky to me).

Can anyone help me with what i'd need to do to dump the IRD and BK? Is it possible to retrieve this data from the MOSC?

I've fired up Inifinity USB Unlimited and switched it to VCP mode. Then I've run Nargaedit and tried to read the card. I get this error message:

Attempting to login to BD3
Unable to login, bad password detected

My first guess is that the card needs unlooping - but here is where I have my first question. If the card has previously been 'hacked' by someone then surely this means they would have unlooped it then? Or is it possible for them to re-loop it when done thus preventing anyone else from working on their modded card?

If necessary i'd consider picking up a unlooper so that I can do the necessary.

Also, i'm guessing that if I get the data off the card it would definately be worth cutting talkback on the box before returning it to them. The very fact that talkback hasn't been cut would suggest that the box could have been sent a signal to kill the card? Is that a possibility too?

Thanks for any advice you can give.

Cheers

Edit: I guess that as this is a newer model of box then it's unlikely it's BK would be in the database?

[wiredworm]

It's not in the database unfortunately.

[abbs2002]

Originally Posted by wiredworm

Hi there,

I've been handed a V*rgin VBox (Samsung) which was working fine until recently with a MOSC card.

I've not done anything with MOSC's before. Usually the boxes brought to me have already had the IRD and BK determined and is noted somewhere on the box - but in this case the box is clean. In fact it doesn't look like talkback has even been cut (which seems very risky to me).

Can anyone help me with what i'd need to do to dump the IRD and BK? Is it possible to retrieve this data from the MOSC?

I've fired up Inifinity USB Unlimited and switched it to VCP mode. Then I've run Nargaedit and tried to read the card. I get this error message:

Attempting to login to BD3
Unable to login, bad password detected

My first guess is that the card needs unlooping - but here is where I have my first question. If the card has previously been 'hacked' by someone then surely this means they would have unlooped it then? Or is it possible for them to re-loop it when done thus preventing anyone else from working on their modded card?

If necessary i'd consider picking up a unlooper so that I can do the necessary.

Also, i'm guessing that if I get the data off the card it would definately be worth cutting talkback on the box before returning it to them. The very fact that talkback hasn't been cut would suggest that the box could have been sent a signal to kill the card? Is that a possibility too?

Thanks for any advice you can give.

Cheers

Edit: I guess that as this is a newer model of box then it's unlikely it's BK would be in the database?

Not cutting talk back is very risky and most probably that card is fooked, you will have to unlock the card to find out; if the IRD is all 0’s then it has been hit and the BK will most diffo start with 6D56……., if the box is sammy 2110 then then there won’t be any other way of getting BK from that box but if it’s sammy 2100 you can still save the box by jtag method.
If you put Mosc card in the search you will get all the info you need to unlock it and set it up m8.

Ps: Also card can be modded and flashed with new image, when put on stream some images do lock again and to get to that card will requier a password or unlooping again.

[abbs2002]

You can follow this tut and see if you can get the password for you card;

open XNCS, click settings and tick all options except "ghost must be in eeprom" now click the green reset button, once card details are displayed click read card. Now click the eeprom tab and scroll through the eeprom dump until you find lines co40 and co70 make a note of the data at these two lines, (these are the BD keys!) 1 of them will unlock the card for you.
Close XNCS, open nagraedit 4.1, read card, once again it will prompt for BD keys (box will pop up) try the co40 if not then try co70, it may take a few attempts but you will eventually get access, then click on the blue key (Remove card lock) so you don’t have to face it again; once your in there another box will pop up use the same key that worked for you only this time you will need just the first 16 digits of it no the whole 32 and that should clear the lock m8.

[wiredworm]

Thanks for the suggestions. I've just tried XNCS. The reset seems to go just fine - but when I try to read the card I get this:

Unsuficient bytes for atr(9),not a nagra card.
ATR=124005A00100900066
Sorry...Not Dumping card.

I'm guessing this isn't good news.

The box is a SMT-2110C so as mentioned above if I can't unlock the card or if it's been wiped then i'm out of luck? Is that correct?

[abbs2002]

Originally Posted by wiredworm

Thanks for the suggestions. I've just tried XNCS. The reset seems to go just fine - but when I try to read the card I get this:

Unsuficient bytes for atr(9),not a nagra card.
ATR=124005A00100900066
Sorry...Not Dumping card.

I'm guessing this isn't good news.

The box is a SMT-2110C so as mentioned above if I can't unlock the card or if it's been wiped then i'm out of luck? Is that correct?

yep, 2110 with out a paired card is useless m8.

[wiredworm]

Just tried a few more times and also tweaked the settings in VCP. It seemed that sometimes it was getting further than others - i've just managed to get it to dump.

CO40 is just all zeros across the whole line. CO70 seems to have valid data. How many of the digit pairs do I use for the password? All 16 of them?

[abbs2002]

Originally Posted by wiredworm

Just tried a few more times and also tweaked the settings in VCP. It seemed that sometimes it was getting further than others - i've just managed to get it to dump.

CO40 is just all zeros across the whole line. CO70 seems to have valid data. How many of the digit pairs do I use for the password? All 16 of them?

all of them m8, if you need to rest set the lock key then use the first 16 digits.

[wiredworm]

Ok, so I tried and sure enough when I try to read the card it fails to login to BD3. At this point I entered the values found at C070.

It then says:

Attempting to login to BD3
BackDoor login verified
Dumping Dataspace
Attempting to restore BackDoor 0 key
Attempting to login to BD3
Attempting to login to BD0
Backdoor0Command: *Lots of Hex Digits*
Unable to login, bad password detected.

It then asks for the backdoor 0 password. I've tried the values found at CO40 and CO70 but neither works. I've also tried a second dump just in case the values at CO40 were just not read correctly but it's still all zeros.

Any more clues please?

Thanks for your help BTW.

[wiredworm]

Sorry for the bump - but does anyone have any clues on this issue before I put the box and card in the bin?

Cheers