Glitching script for old conaxcards?

[crypto]

Hello all!

I have heard it is a public old script to glitching the old conaxcards with out and public on internet.
Is there somone who can help me find this old script to glitch with??

Crypto
[email protected]

[bobi123]

intresting, where did you heard this news mate ?

i also am intresed in this script so if anyoen has it or know
anything about it , please send me an pm

cheers

bobi

[Marrek]

Old news,old scripts and nothing works,forget it guys

[bobi123]

Old news,old scripts and nothing works,forget it guys

thanks for replaying mate

PS ; id love to have even the old scripts if you have any
please coanct by pm if you do

[igors20]

Hi all!
Is there some soft to get keys from original CAS-7 card?
I think conaxdecrypter is too old. Does'nt work. Maybe it's possible to modify it
somehow for that?
Thanks.

OK. There is old script for winexplorer:
Option Explicit
Dim PC,PI,P1,P2,P3
Dim AC,A4
Dim Prc,Pre
Dim lh,la,ld,lq
Dim ins,dat
Dim ack,nack,dmp
Dim sb,sbh
Dim li,ln
Dim lb
Dim Q1,Q2
Dim S2,S5
Dim nrq,nrp,nrs
Dim lvv
Dim lvr(6),lv

lvv = " "
S2 = " "
S5 = " "
nrq = "nano > "
nrp = "nano < "
nrs = "rest : "

ack = True
nack = False
dmp = False

Function DATE(ls)
Dim lb,ly,lm,ld,lc
lb = Int("&h" & Mid(ls,1,2))
ld = Right("0" & lb,2)
lb = Int("&h" & Mid(ls,3,1))
ly = 20 & Right("0" & lb,2)
lb = Int("&h" & Mid(ls,4,1))
lm = Right("0" & lb,2)
DATE = ly & "-" & lm & "-" & ld
End Function


Function SNO(ls)
Dim ln,li,lh,ld,ll
ln = Len(ls)
For li = 1 to ln
lh = Mid(ls,li,1)
If lh>"0" Then
ld = Int("&h" & lh)
ll = ll + ld * 16 ^ (ln-li)
End If
Next
SNO = ll
End Function

Function ACKN(dmp)
Dim n,b,ack
Sc.Delay(50)
n = Sc.BytesInBuffer
if n<1 Then
ack = "FF"
else
Sc.Read(1)
b = Sc.GetByte(0)
ack = Right("0" & Hex(b),2)
End If
If dmp Then Sc.Print("<" & ack)
ACKN = ack
End Function

Function QUIT(le,wait)
Dim ln,lq,ld,lb,li
Sc.Delay(wait*10)
ln = Sc.BytesInBuffer
lq = ""
For li = 1 To ln
Sc.Read(1)
lb = Sc.GetByte(0)
ld = Right("0" & Hex(lb),2)
lq = lq & ld
Next
Select Case ln
Case 0
lq = "FFFF"
Case 1
lq = lq & "FF"
Case Else
If (ln-2) Then
If le Then Sc.Print("<" & Mid(lq,1,(ln-2)*2))
End If
lq = Mid(lq,(ln-2)*2+1,4)
End Select
If le Then Sc.Print("<" & lq)
Q1 = LCase(Mid(lq,1,2))
Q2 = LCase(Mid(lq,3,2))
QUIT = lq
End Function

Function TEXT(ls)
Dim lt,li,lb,ld
ld = Len(ls)
For li=1 to ld-1 Step 2
lb = Int("&h" & Mid(ls,li,2))
lt = lt & Chr(Int(lb))
Next
TEXT = lt
End Function

Function NANO(dat,ln,ByVal lvk)
Dim nan,ls,lvn
Dim N1,N2
Dim ld,lr,lk,le,lp,li
Dim lev,lq

dat = LCase(dat)
ld = Len(dat)
lvr(lv) = ld
lq = Len(lvk)
Do While ld>ln
nan = Mid(dat,ln,4)
N1 = Mid(nan,1,2)
N2 = Mid(nan,3,2)
lr = Int("&h" & N2)*2
le = 0
lp = 0
lk = lv * 2
lev = lvk & Mid(lvv,lq+1,lk)
Select case N1

Case "01","03"
Sc.Print(Chr(13) & lev & nan)
ln = ln + 4
ls = Mid(dat,ln,lr)
ln = ln + lr
lvn = Mid(lvv,1,lq+lk+2)
Sc.Print(Chr(13) & lvn & ls & S2 & TEXT(ls))
lp = lr

Case "09"
Sc.Print(Chr(13) & lev & nan)
ln = ln + 4
ls = Mid(dat,ln,4)
lvn = "???" & Mid(lvv,4,lq+lk-3+2)
Sc.Print(Chr(13) & lvn & ls)
ln = ln + 4
ls = Mid(dat,ln,4)
Select Case Mid(ls,1,1)
Case "e"
lvn = "Emm"
Case "0"
lvn = "Ecm"
Case Else
lvn = "???"
End Select
lvn = lvn & "Pid" & Mid(lvv,7,lq+lk-6+2)
Sc.Print(Chr(13) & lvn & ls)
ln = ln + 4
lp = lr

Case "10","15","20","43"
Sc.Print(Chr(13) & lev & nan)
ln = ln + 4
ls = Mid(dat,ln,lr)
lvn = Mid(lvv,1,lq+lk+2)
Sc.Print(Chr(13) & lvn & ls)
ln = ln + lr
lp = lr

Case "13"
Sc.Print(Chr(13) & lev & nan)
ln = ln + 4
ls = Mid(dat,ln,2)
lvn = "???" & Mid(lvv,4,lq+lk-3+2)
Sc.Print(Chr(13) & lvn & ls)
ln = ln + 2
lp = 2

Case "11"
Sc.Print(Chr(13) & lev & nan)
ln = ln + 4
ls =Mid(dat,ln,16)
lvn = "PBM" & Mid(lvv,4,lq+lk-3+2)
Sc.Print(Chr(13) & lvn & ls)
ln = ln + 16
lp = 16

Case "21","22","f0","70"
Sc.Print(Chr(13) & lev & nan)
ln = ln + 4

Case "23"
Sc.Print(Chr(13) & lev & nan)
ln = ln + 4
ls = Mid(dat,ln,lr)
lvn = "S/N" & Mid(lvv,4,lq+lk-3+2)
Sc.Print(Chr(13) & lvn & ls & S2 & SNO(ls))
ln = ln + lr
lp = lr

Case "14","26":
Sc.Print(Chr(13) & lev & nan)
ln = ln + 4
If lr>4 then
lp = 4
Else
lp = lr
End If
ls = Mid(dat,ln,lp)
lvn = Mid(lvv,1,lq+lk+2)
Sc.Print(Chr(13) & lvn & ls)
ln = ln + lp


Case "28","2f"
Sc.Print(Chr(13) & lev & nan)
ln = ln + 4
ls = Mid(dat,ln,lr)
lvn = "Date :" & Mid(lvv,7,lq+lk-6+2)
Sc.Print(Chr(13) & lvn & ls & S2 & DATE(ls))
ln = ln + lr
lp = lr


Case Else
lp = ld - ln + 1
ls = Mid(dat,ln)
lvn = nrs & Mid(lvv,lq+1,lk+4)
Sc.Print(Chr(13) & nrs & ls)
ln = ld
Exit Do
End Select
lr = lr - lp
if lr Then
lv = lv + 1
lvr(lv) = lr
End if
For li = lv-1 to 0 Step -1
lvr(li) = lvr(li) - (lp + 4)
Next
For li = lv to 1 Step -1
lp = lvr(li)
Select Case lp
Case 0
Select Case li
Case 0
Exit Do
Case Else
lv = li
End Select
Case 1,2,3,4
ls = Mid(dat,ln,lp)
lvn = Mid(lvn,1,lq+li*2+2)
Sc.Print(Chr(13) & lvn & ls)
ln = ln + lp
lvr(li) = 0
lv = li - 1
Case Else
lv = li
Exit For
End Select
Next


Loop
NANO = ln
End Function

Function DATA(dmp,dat)
Dim rpl,ls,lt
Dim lx,ln,ld
Dim li,lb
Dim ll,lnd
lv = 0
dat = LCase(dat)
lnd = Len(dat) / 2
Select Case lnd

Case 0
lx = Int("&h" & P3)
Sc.Delay(lx*10)
lx = Sc.Read(lx) - 1
rpl = ""
For li=0 to lx
lb = Sc.GetByte(li)
rpl = rpl & Right("0" & Hex(lb),2)
Next
If dmp Then Sc.Print("<" & rpl)
ln = NANO(rpl,1,nrp)

Case Else
If dmp Then Sc.Print(">" & dat)
ln = 1
ln = NANO(dat,ln,nrq)
Sc.Write(dat)

End Select
DATA = QUIT(dmp,lnd)
End function

Function HEAD(dmp,lh,ack)
lh = LCase(lh)
PC = Mid(lh,1,2)
PI = Mid(lh,3,2)
P1 = Mid(lh,5,2)
P2 = Mid(lh,7,2)
P3 = Mid(lh,9,2)
If dmp Then Sc.Print(Chr(13) & "->" & lh)
Sc.Write(lh)
if ack Then
HEAD = ACKN(dmp)
Else
HEAD = QUIT(dmp,5)
End If
End Function


Sub Main()
Dim RetVal
Dim ls
ls = " VbScript for Telenor SC"
RetVal = Sc.MsgBox(" Set TX & RX Dump", vbYesNo,ls)
Sc.Print RetVal

Select Case RetVal
Case 6
dmp = True
Case 7
dmp = False
End Select
'Sc.ProgressBox " Searching For valid kod" & vbcr & " It can take some days !",sb,9999

Sc.Print(chr(13) & ls)
Sc.Print(chr(13) & " Telenor SmartCard Information")
'Sc.Print(chr(13) & " AutoFinder Secret CODE "& chr(13)&chr(13))
Sc.Verbose = False

lh = HEAD(dmp,"dd26000003",ack): ld = DATA(dmp,"100101")
lh = HEAD(dmp,"ddca0000"&Q2,ack): ld = DATA(dmp,"")
lh = HEAD(dmp,"dd82000014",ack): ld = DATA(dmp,"111201F00FFFFFCD000009040B00E0 3026A0E019 ")
lh = HEAD(dmp,"ddca0000"&Q2,ack): ld = DATA(dmp,"")
lh = HEAD(dmp,"dda4000009",ack): ld = DATA(dmp,"13070009040B000045")
lh = HEAD(dmp,"ddca0000"&Q2,ack): ld = DATA(dmp,"")

Sc.Print()
ls = "Subscriptions Test"
RetVal = Sc.MsgBox(" " & ls, vbYesNo,ls)
If RetVal=6 then
Sc.Print("Themes")
lh = HEAD(dmp,"ddb2000003",ack)
ld = DATA(dmp,"1501aa")
Do While Q1="98"
lh = HEAD(dmp,"ddca0000" & Q2,ack): ld = DATA(dmp,"")
Loop

Sc.Print()
ls = "Programms"
Sc.Print(ls)
lh = HEAD(dmp,"ddb2000003",ack)
ld = DATA(dmp,"150103")
Do While Q1="9c"
lh = HEAD(dmp,"ddca0000" & Q2,ack): ld = DATA(dmp,"")
Loop
End if

ls = "Hash Test"
RetVal = Sc.MsgBox(" " & ls, vbYesNo,ls)
If RetVal=6 then
lh = HEAD(dmp,"dda200004A",ack)
ld = DATA(dmp,"14480080F04470424320D638EEE7BB CC86ADF132 1A76C84921840251038953F6B1B85FD793114A9D 5E130515DF 9997CFF6C90F553C39C06E8FE365C32086FFDEB1 DF39C4FBEA C5209F37")
lq = Mid(la,1,2)
Select case lq
Case "60"
If dmp Then Sc.Print("<"&lq)
lq = Mid(la,3,2)
Select case lq
Case "60"
If dmp Then Sc.Print("<"&lq)
la = QUIT(dmp,0)
Case Else
Sc.Read(1)
lb = Sc.GetByte(0)
lq = lq & Right("0" & Hex(lb),2)
If dmp Then Sc.Print("<"&lq)
End Select
End Select
Select case Q1
Case "98"
lh = HEAD(dmp,"ddca0000" & Q2,ack): ld = DATA(dmp,"")
lh = HEAD(dmp,"ddca0000" & Q2,ack): ld = DATA(dmp,"")
lh = HEAD(dmp,"ddca0000" & Q2,ack): ld = DATA(dmp,"")
lh = HEAD(dmp,"ddca0000" & Q2,ack): ld = DATA(dmp,"")
End select
lh = HEAD(dmp,"dd82000014",ack)
ld = DATA(dmp,"111201F00FFFFFCD000009040B00E0 3026A0E019 ")
End If

End Sub

and result:

Executing Script: C:\w\Conax2.xvb

Trying to reset card...
Reset Successful

RX ATR : 3B 24 00 30 42 30 30
7
VbScript for Telenor SC
Telenor SmartCard Information
nano > 1001
01
nano < 2001
01
nano < 2802
Date :0b00 2000-00-11
nano < 2f02
Date :002c 2002-12-00
rest : 300104
nano > 1112
PBM01f00fffffcd0000
nano > 0904
???0b00
EmmPide030
nano > 26a0
e019
nano < 2218
nano < 0904
???0b00
EmmPide030
nano < 2307
S/N00000055c601e3 1439039971
nano < 2307
S/N000000002ae300 2810624---------------------??????????????????
nano > 1307
???00
nano > 0904
???0b00
EcmPid0045
nano < 2106
nano < 0904
???0b00
EcmPid0045

nano > 1448
0080
nano > f044
nano > 7042
nano > 4320
d638eee7bbcc86adf1321a76c849218402510389 53f6b1b85f d793114a9d5e13
rest : 0515df9997cff6c90f553c39c06e8fe365c32086 ffdeb1df39 c4fbeac5209f37
nano < 2604
0102
0004
nano < 260f
0380
nano < 010b
97984e6f20616363657373 ??No access-------------------??????????????
nano < 2602
0382
nano < 2602
0381
nano > 1112
PBM01f00fffffcd0000
nano > 0904
???0b00
EmmPide030
nano > 26a0
e019

Script C:\w\Conax2.xvb Transmission Completed

Executing Script: C:\w\Conax2.xvb

Trying to reset card...
Reset Successful

RX ATR : 3B 24 00 30 42 30 30
6
VbScript for Telenor SC
Telenor SmartCard Information
->dd26000003<26>100101
nano > 1001
01<980E
->ddca00000e<CA<20010128020B002F02002C300 104
nano < 2001
01
nano < 2802
Date :0b00 2000-00-11
nano < 2f02
Date :002c 2002-12-00
rest : 300104<9000
->dd82000014<82>111201f00fffffcd000009040 b00e03026a 0e019
nano > 1112
PBM01f00fffffcd0000
nano > 0904
???0b00
EmmPide030
nano > 26a0
e019<981A
->ddca00001a<CA<221809040B00E030230700000 055C601E32 307000000002AE300
nano < 2218
nano < 0904
???0b00
EmmPide030
nano < 2307
S/N00000055c601e3 1439039971
nano < 2307
S/N000000002ae300 2810624<9000
->dda4000009<A4>13070009040b000045
nano > 1307
???00
nano > 0904
???0b00
EcmPid0045<9808
->ddca000008<CA<210609040B000045
nano < 2106
nano < 0904
???0b00
EcmPid0045<9000
Themes
->ddb2000003<B2>1501aa
nano > 1501
aa<9806
->ddca000006<CA<260401010500
nano < 2604
0101
0500<9820
->ddca000020<CA<261E0380011A9693436F6E617 820436F6E6 46974696F6E616C20416363657373
nano < 261e
0380
nano < 011a
9693436f6e617820436f6e646974696f6e616c20 4163636573 73 ??Conax Conditional Access<9804
->ddca000004<CA<26020382
nano < 2602
0382<9804
->ddca000004<CA<26020381
nano < 2602
0381<9816
->ddca000016<CA<26140301011050726F6475637 4204F72646 572696E67
nano < 2614
0301
nano < 0110
50726f64756374204f72646572696e67 Product Ordering<9819
->ddca000019<CA<2617030201135375627363726 97074696F6 E20537461747573
nano < 2617
0302
nano < 0113
537562736372697074696f6e20537461747573 Subscription Status<9812
->ddca000012<CA<26100303010C4576656E74205 3746174757 3
nano < 2610
0303
nano < 010c
4576656e7420537461747573 Event Status<9813
->ddca000013<CA<26110304010D4368616E67652 0434120504 94E
nano < 2611
0304
nano < 010d
4368616e67652043412050494e Change CA PIN<9815
->ddca000015<CA<26130305010F4D61747572697 4792052617 4696E67
nano < 2613
0305
nano < 010f
4d6174757269747920526174696e67 Maturity Rating<9803
->ddca000003<CA<260102
nano < 2601
02<9400
Programms
->ddb2000003<B2>150103
nano > 1501
03<9C06
->ddca000006<CA<260401020000
nano < 2604
0102
0000<9C14
->ddca000014<CA<26120380010E96934576656E7 4205374617 47573
nano < 2612
0380
nano < 010e
96934576656e7420537461747573 ??Event Status<9C04
->ddca000004<CA<26020382
nano < 2602
0382<9C04
->ddca000004<CA<26020381
nano < 2602
0381<9C03
->ddca000003<CA<260102
nano < 2601
02<9400
->dda200004a<A2>14480080f04470424320d638e ee7bbcc86a df1321a76c84921840251038953f6b1b85fd7931 14a9d5e130 515df9997cff6c90f553c39c06e8fe365c32086f fdeb1df39c 4fbeac5209f37
nano > 1448
0080
nano > f044
nano > 7042
nano > 4320
d638eee7bbcc86adf1321a76c849218402510389 53f6b1b85f d793114a9d5e13
rest : 0515df9997cff6c90f553c39c06e8fe365c32086 ffdeb1df39 c4fbeac5209f37<9412
->dd82000014<82>111201f00fffffcd000009040 b00e03026a 0e019
nano > 1112
PBM01f00fffffcd0000
nano > 0904
???0b00
EmmPide030
nano > 26a0
e019<9C1A

Script C:\w\Conax2.xvb Transmission Completed

________________________________________ __________ _

add2
another script :

Option Explicit
Dim A,l,n,AA,d
Dim SW,x,s1,s2,dd

Sub Main()
'Sc.Verbose = False
Dim name, knh

Sc.Write("DD C6 00 00 03 1C 01 00")
RX
If SW<>"9011" Then
Do While SW<>"9000"
Sc.Write("ddca0000"& s2)
RX
name =""
For n = 7 To Sc.GetByte(6)
name =name & chr(Sc.GetByte(n))
Next

Sc.Print(chr(13) & name & chr(13))
DATA(24)
DATA(28)
DEC_HEX(32)
Sc.Print(chr(13))
DATA(38)
DATA(42)
DEC_HEX(46)

Loop
End If
End sub

Function DEC_HEX(d)
Dim knh
knh =""
For n = d To d+3
knh=hex(Sc.GetByte(n))
If Len(knh) = 1 Then knh = "0" & knh
Sc.Print( knh )
Next
End Function

Function DATA(dd)
Dim cd,m,mn,y,yd,z
If Sc.GetByte(dd)>31 Then
d = Sc.GetByte(dd)- 32
yd=10
ElseIf Sc.GetByte(dd)>63 Then
yd=20
d = Sc.GetByte(dd)- 64
'ElseIf Sc.GetByte(24)>31 Then
'd = Sc.GetByte(24)- 32
Else
d = Sc.GetByte(dd)
yd=0
End If
y = 1990+yd
If Sc.GetByte(dd+1)>15 And Sc.GetByte(dd+1)<32 Then
m = Sc.GetByte(dd+1)- 16
y = y + 1
ElseIf Sc.GetByte(dd+1)>31 And Sc.GetByte(dd+1)<64 Then
m = Sc.GetByte(dd+1)- 32
y = y + 2
ElseIf Sc.GetByte(dd+1)>63 And Sc.GetByte(dd+1)<128 Then
m = Sc.GetByte(25)- 64
y = y + 3
ElseIf Sc.GetByte(dd+1)>127 Then
m = Sc.GetByte(dd+1)- 128
y = y + 4
Else
m = Sc.GetByte(dd+1)
End If

Select case m
case 1:
m = " jan. "
case 2:
m = " feb. "
case 3:
m = " mar. "
case 4:
m = " apr. "
case 5:
m = " maj. "
case 6:
m = " iun. "
case 7:
m = " iul. "
case 8:
m = " avg. "
case 9:
m = " sep. "
case 10:
m = " okt. "
case 11:
m = " hov. "
case 12:
m = " dec. "
case 13:
m = " 13 ? "
case 14:
m = " 14 ? "
case 15:
m = " 15 ? "
End select
If Len(d)=1 Then d= "0"&d
Sc.Print( d & m & y & " ")
End Function

Function RX
Sc.Delay(500)
x = Sc.BytesInBuffer
Sc.Read(x)
s1= hex(Sc.GetByte(x-2))
s2= hex(Sc.GetByte(x-1))
If len(s1)=1 Then s1="0" & s1
If len(s2)=1 Then s2="0" & s2
SW = s1 & s2
End Function

and result:

Trying to reset card...
Reset Successful

RX ATR : 3B 24 00 30 42 30 30

Timeout from 58 command

Trying to reset card...
Reset Successful

RX ATR : 3B 24 00 30 42 30 30

Timeout from 58 command

Trying to reset card...
Reset Successful

ATR: 3B 24 00 30 42 30 30

Convention: DIRECT
Protocol: T=0
TB1 = 00

Historical Bytes: 30 42 30 30
0 B 0 0

Programming Voltage = 0.0 volts
Programming Current = 25ma
Maximum Clock Frequency = 0.0MHz

This card uses an internal clock:
Work ETU = 0.0001041667 seconds
Guard Time = 0.0012500000 seconds
Baud Rate After Reset = 9600

Executing Script: C:\w\Data_conax2.xvb

Trying to reset card...
Reset Successful

RX ATR : 3B 24 00 30 42 30 30
TX Data : DD C6 00 00 03 1C 01 00
RX Data : 00 98 62
TX Data : DD CA 00 00 62
RX Data : CA 32 2F 10 10 01 0F 42 61 6C 74 6B 6F 6D 31 20
20 20 20 20 20 20 30 02 21 86 30 02 3E 86 20 04
01 00 00 3E 30 02 21 85 30 02 3F 85 20 04 01 00
00 3E 32 2F 10 40 01 0F 42 61 6C 74 6B 6F 6D 20
34 20 20 20 20 20 20 30 02 21 86 30 02 3E 86 20
04 01 00 03 00 30 02 35 86 30 02 3C 86 20 04 00
00 00 00 90 00

Baltkom1
01 iun. 2004 30 iun. 2004 0100003E
01 maj. 2004 31 maj. 2004 0100003E _________A little bit better but should be 2008!!!!!!

Script C:\w\Data_conax2.xvb Transmission Completed


I marked some strange lines. Other s/n ???; and 010b no access ?
and incorrect date ( first and second script)
I think this script created for CAS3, not for CAS7
Maybe someone can modify it for cas7?
If so I will send him full result with MK,SA/UA e.t.c ))

Waiting for answer.
Thanks.

[bobi123]

can you send that script to me mate.
i will try to modife it , and see if it works

send it to karibole12000 at gmail dot com

cheers

bobi

[igors20]

Add info here:
http://id-discussions.com/forum/show...t=conax&page=4

and logs here:

http://rapidshare.com/files/117021280/bcard.rar.html password:qwerty


and here:

http://rapidshare.com/files/131083850/con1.zip.html



Someone help.
If need some additional logs I will do.
Thanks.
regards.

[igors20]

Sorry for duplicating but I can't edit previous message

http://id-discussions.com/forum/show...t=conax&page=4
Technical info.

and logs here:

http://rapidshare.com/files/117021280/bcard.rar.html password:qwerty

and here:

http://rapidshare.com/files/131083850/con1.zip.html
There is very interesting prog (special.exe) for extracting keys from original (old) MOSC.
Theoretically after some reverse engineering :)))) and regarding first link
someone good coder (hope) can write
new conaxdecrypter.

Someone help.
If need some additional logs I will do.
Thanks.
regards.

[rolfpeter]

ok i will try to changes it ti cas7.

[trofast]

http://www.westai.com/ click on the download link. You need to register to get there. There is some good conax scripts. have fun.