Seca2 V7.3B and extracting Data

[adinani01]

Hi All,

i've posted in French my question (http://www.satsupreme.com/showthread...et-Dump-EEPROM and i would if it's ok to ask the other countries their feeling on this card.

I have an official card Seca2 7.3B
Ident=00 9F
Ident=00 A0
Atr : 3BF711000140967070370E6CB6D69000
It's a card used in the caraibe. It's not due to be changed and for the last 3 years i haven't anyone who managed to get data out of it.
I like challenges and i would like to try.

I have an unlooper 5030 modificado. I'm still learning how to use it (i'm very new to this world) but i understand the concept.
After reading a bit, i understand that i need to extract quite a few information from the card (RSA Exponent..MK00/01, hash tables 9x...)

After reading a few answer grom Grizou0 it seems i need to get an answer of 9028 on movexbug.
I'm learning on how to use Winexplorer and scripting. I get quite a few timeout but i'm sure i'll sort it out sooner or later after long research.

Any hints on how to work on the unlooper to extract the data are more than welcome.
Thank you !

[adinani01]

Hi again,

i've tried to use movexbug to get a good answer.
But i always get the same result 6700.
I've tried to rotate the condo but no good.
i use grx8 on atmel.
I wonder if i'm missing something.

[adinani01]

Grizou0,

i saw on one of your post http://www.satsupreme.com/showthread...78-help-me-7.3 your answer regarding 7.3 card.
You say :

look at G1 for ramdom delay and G2 for 9028 status and next to have 9B08 ( movexbug at 000040 rom).

Is this some parameter to define in Grizou unlooper soft ?
What is G1 and G2 and how to set them please ?

Thanks

[Grizou0]

6700 status is good for a beginner.
In your script, you must to see a G1 ( first delay for the crash stack).
Use only one G1 et step this one between 0200 and 0700. I think, you find a 9028 status.
After, you can to apply next glitche tro have 9B08 ( movexbug OK).
To extraction rom and eeprom, you need I/O adress routine. You must to use a len = FF in insB4 ( inclued into atmel).
But it's another way......
Most important in to find 9028 ( if there are not ramdom delay)
Good luck

[powerman21000]

for your capa, can you delete it, you take a a good calage,
I think you not needed for Mk,
inject eepron file of month by EEEPdt soft

excuse of may english

[adinani01]

Hi thanks for the info .
I'll try and let you know of thé résulte.
For info i've taken out cv1.
And using grx12. Is this ok ?

I use an unlooper plus for info

[adinani01]

Hi Again,

i managed to get a 7.1 script to be changed.
The only thing i'm missing is doc on ins B4 in order to send G1.

I've searched on google and all i could find was this :
C1 B4 xx xx 01 00 with xxxx from 2000h à FFFFh (which i may changed to 0200h to 0700h) to get 9028 status ?
The only thing is i cannot use that command directly in the script. I'm not used to winexplorer and if anyone has an example i could use to send this command with G1 (if that is the right command to send) it woudl be good.

Thank you

[Grizou0]

after send command ins B4, juste use delay 20 GGGG 0C
20 is command delay
GGGG delay 4bytes
0C apply pulse glitche and wait answer card

[adinani01]

Hi,

can you give me an example of insb4 with delay 20 GGGG 0C included please ?
most of the winexplorer script i found are like that :

sc.write("0A 0E 20 C4 C1 0E 00 00 08 8a 00")
sc.read(13)
sc.write("20 0E 20 02 40 00 00 00 00 00 00 40 20" & (HexString(g1,4)) & "0A 20" & (HexString(g2,4)) & "0B 02 00 24 00 20 00 38 0A 20" & (HexString(g3,4)) & "0C 00")

I'm trying hard to find insb4 example in winexplorer with 20 gggg 0c delay with no luck :(

Thank you

[Grizou0]

InsB4 is inclued into atmel.
See: Cmd 40 call insB4
00000000 parameter
000040 adress ROM for 9B08 status
20 cmd delay and following HexString(g1,4) here , you are G1 first point glitch on insB4 code in rom
0A glitche
20 1 (hexString(G2,4) second delay 0B glitche and wait little 02 point glitche -> 00 and 24
00 end of 0B cmd
20 delay and 0038 -> 0A point glitche
...
0C stop process and wait answer card