Page 1 of 2 12 LastLast
Results 1 to 10 of 15

Thread: Seca2 V7.3B and extracting Data

  1. #1
    Junior Member
    Join Date
    08-07-2009
    Posts
    20
    Uploads
    0

    Seca2 V7.3B and extracting Data

    Hi All,

    i've posted in French my question (http://www.satsupreme.com/showthread...et-Dump-EEPROM and i would if it's ok to ask the other countries their feeling on this card.

    I have an official card Seca2 7.3B
    Ident=00 9F
    Ident=00 A0
    Atr : 3BF711000140967070370E6CB6D69000
    It's a card used in the caraibe. It's not due to be changed and for the last 3 years i haven't anyone who managed to get data out of it.
    I like challenges and i would like to try.

    I have an unlooper 5030 modificado. I'm still learning how to use it (i'm very new to this world) but i understand the concept.
    After reading a bit, i understand that i need to extract quite a few information from the card (RSA Exponent..MK00/01, hash tables 9x...)

    After reading a few answer grom Grizou0 it seems i need to get an answer of 9028 on movexbug.
    I'm learning on how to use Winexplorer and scripting. I get quite a few timeout but i'm sure i'll sort it out sooner or later after long research.

    Any hints on how to work on the unlooper to extract the data are more than welcome.
    Thank you !

  2. #2
    Junior Member
    Join Date
    08-07-2009
    Posts
    20
    Uploads
    0

    Re: Seca2 V7.3B and extracting Data

    Hi again,

    i've tried to use movexbug to get a good answer.
    But i always get the same result 6700.
    I've tried to rotate the condo but no good.
    i use grx8 on atmel.
    I wonder if i'm missing something.

  3. #3
    Junior Member
    Join Date
    08-07-2009
    Posts
    20
    Uploads
    0

    Re: Seca2 V7.3B and extracting Data

    Grizou0,

    i saw on one of your post http://www.satsupreme.com/showthread...78-help-me-7.3 your answer regarding 7.3 card.
    You say :
    look at G1 for ramdom delay and G2 for 9028 status and next to have 9B08 ( movexbug at 000040 rom).
    Is this some parameter to define in Grizou unlooper soft ?
    What is G1 and G2 and how to set them please ?

    Thanks

  4. #4
    VIP Member Grizou0's Avatar
    Join Date
    27-03-2005
    Posts
    558
    Uploads
    37

    Re: Seca2 V7.3B and extracting Data

    6700 status is good for a beginner.
    In your script, you must to see a G1 ( first delay for the crash stack).
    Use only one G1 et step this one between 0200 and 0700. I think, you find a 9028 status.
    After, you can to apply next glitche tro have 9B08 ( movexbug OK).
    To extraction rom and eeprom, you need I/O adress routine. You must to use a len = FF in insB4 ( inclued into atmel).
    But it's another way......
    Most important in to find 9028 ( if there are not ramdom delay)
    Good luck

  5. #5

    Re: Seca2 V7.3B and extracting Data

    for your capa, can you delete it, you take a a good calage,
    I think you not needed for Mk,
    inject eepron file of month by EEEPdt soft

    excuse of may english

  6. #6
    Junior Member
    Join Date
    08-07-2009
    Posts
    20
    Uploads
    0

    Re: Seca2 V7.3B and extracting Data

    Hi thanks for the info .
    I'll try and let you know of thé résulte.
    For info i've taken out cv1.
    And using grx12. Is this ok ?

    I use an unlooper plus for info

  7. #7
    Junior Member
    Join Date
    08-07-2009
    Posts
    20
    Uploads
    0

    Re: Seca2 V7.3B and extracting Data

    Hi Again,

    i managed to get a 7.1 script to be changed.
    The only thing i'm missing is doc on ins B4 in order to send G1.

    I've searched on google and all i could find was this :
    C1 B4 xx xx 01 00 with xxxx from 2000h à FFFFh (which i may changed to 0200h to 0700h) to get 9028 status ?
    The only thing is i cannot use that command directly in the script. I'm not used to winexplorer and if anyone has an example i could use to send this command with G1 (if that is the right command to send) it woudl be good.

    Thank you

  8. #8
    VIP Member Grizou0's Avatar
    Join Date
    27-03-2005
    Posts
    558
    Uploads
    37

    Re: Seca2 V7.3B and extracting Data

    after send command ins B4, juste use delay 20 GGGG 0C
    20 is command delay
    GGGG delay 4bytes
    0C apply pulse glitche and wait answer card

  9. #9
    Junior Member
    Join Date
    08-07-2009
    Posts
    20
    Uploads
    0

    Re: Seca2 V7.3B and extracting Data

    Hi,

    can you give me an example of insb4 with delay 20 GGGG 0C included please ?
    most of the winexplorer script i found are like that :
    sc.write("0A 0E 20 C4 C1 0E 00 00 08 8a 00")
    sc.read(13)
    sc.write("20 0E 20 02 40 00 00 00 00 00 00 40 20" & (HexString(g1,4)) & "0A 20" & (HexString(g2,4)) & "0B 02 00 24 00 20 00 38 0A 20" & (HexString(g3,4)) & "0C 00")
    I'm trying hard to find insb4 example in winexplorer with 20 gggg 0c delay with no luck :(

    Thank you

  10. #10
    VIP Member Grizou0's Avatar
    Join Date
    27-03-2005
    Posts
    558
    Uploads
    37

    Re: Seca2 V7.3B and extracting Data

    InsB4 is inclued into atmel.
    See: Cmd 40 call insB4
    00000000 parameter
    000040 adress ROM for 9B08 status
    20 cmd delay and following HexString(g1,4) here , you are G1 first point glitch on insB4 code in rom
    0A glitche
    20 1 (hexString(G2,4) second delay 0B glitche and wait little 02 point glitche -> 00 and 24
    00 end of 0B cmd
    20 delay and 0038 -> 0A point glitche
    ...
    0C stop process and wait answer card

Page 1 of 2 12 LastLast

Similar Threads

  1. extracting keys
    By Zavain in forum Starsat
    Replies: 3
    Last Post: 31-08-2008, 09:43:42
  2. Philips DSR 7005 - extracting digital video
    By athlon1000 in forum Philips
    Replies: 0
    Last Post: 27-06-2008, 09:35:22
  3. extracting keys for nova
    By bacis in forum Irdeto
    Replies: 0
    Last Post: 03-04-2006, 11:55:33
  4. Seca2
    By GastonFernandez in forum Italian / Italiano
    Replies: 4
    Last Post: 10-11-2005, 12:30:51

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •