The Flying Dutchman - Mosc 7.3 NL and VL card's

[Asure]

yes use zzbug2 for 10mhz 7.3 behave same as 7.1b
woutje

I've been testing a lot and the clockglitches for 7.1B are not the same as 7.3 it seems..Did you mean something else..

Any hints ?

[sc4nn4gr1ll1]

As you write on the serial card 7.3b? Regards

Any advice?

[sc4nn4gr1ll1]

The card has these providers ..

009F CanalSat Reunion (16E)/Caraibes (31W/34W)
00A0 (Old) AB Sat

Is a 7.3, but with the Flying Dutchman software I can not dump the key and even to write the serial.
There is something different '....has anyone ever worked on?

Regards

[sc4nn4gr1ll1]

This glitch is not valid on card 7.3 French (CanalSatellite)

24 10 F7 0E 06 C4 7C CF FF FF EF 80 FC C7 FF D7 FF FF 77 BB 33 DD 20 01 65 09 20 03 04 0A 20 01 61 0C 25 FE 00

I'm trying to write the serial but not working.

[sc4nn4gr1ll1]

I'm just trying to write the serial with that glitch, the original value of xxyy I think it was 002B.
The card is a 7.3 provider with 00A0 and 009F...Here is the reading of the provider:

Ident=00 9F
Nome Provider=CANALSATELLITE
Scadenza =01/01/1991
PPUA =00 21 27 3C
BitMaP =00000000000EA010
Key Presenti=F0
Regiona Code=0B
**************************************************************
Ident=00 A0
Nome Provider=CANALSATELLITE2
Scadenza =00/00/1990
PPUA =00 00 00 00
BitMaP =FFFFFFFFFFFFFFFF
Key Presenti=F0F2F3
Regiona Code=00

Saluti

[sc4nn4gr1ll1]

Atmel Ver. : V5B4
Atr : 3BF711000140967070370E6CB6D69000

[sc4nn4gr1ll1]

I think it is a 7.3b, you can advise me on how to try to write on the card.

[sc4nn4gr1ll1]

Want to say this B4?

"10F70E20c4C1b4" & "C000" & "09" & "80C8" & "02" & ( jjt ) & "81"

Regards

[woutje]

@sc4nn4gr1ll1

try this for scan movexbug anwser 9028

Function TestG()
Dim ins1,entete,compt,part1,part2,part3,g1,g 2,g3,ECO,EEP,REP,pp
call reset()
Sc.print(" *** Test MovxBug ***" & vbcr)
sc.print(vbcr)
sc.print(vbcr)
sc.print " Unlooper stop when anwser = 9028" & (vbcr)
sc.print " ------------------------------"
sc.print (vbcr)

for g1=&h0500 to &h0700 step &h01
for g2=&h0900 to &h09FF step &h01
for g3=&h9DC2 to &h9DC2 step &h01

sc.verbose=1
for pp=0 to 1
Sc.Write("A1")
SendGP("100EFF018F")
sc.delay(300)

sc.write("0A 0E 20 C4 C1 0E 00 00 08 8a 00")
sc.read(13)
sc.write("20 0E 20 02 40 00 00 00 00 00 00 40 20" & (HexString(g1,4)) & "0A 20" & (HexString(g2,4)) & "0B 02 00 24 00 20 00 38 0A 20" & (HexString(g3,4)) & "0C 00")

sc.delay(3200)
sc.read(3)
GPR(0) = Sc.GetByte(0)
GPR(1) = Sc.GetByte(1)
GPR(2) = Sc.GetByte(2)

sc.print ( "Statut bug : "& HexInv(GPR(1),2) & HexInv(GPR(2),2)& vbcr)


if HexInv(GPR(1),2) & HexInv(GPR(2),2) = "9028" then
sc.print (vbcr)
sc.print "9028 FOUND" & (vbcr)
sc.print "----------------------"& (vbcr)& (vbcr)
call reset()
exit function
end if
next
sc.print (vbcr)
sc.print " !!" & (vbcr)
sc.print "--------------------------"& (vbcr)& (vbcr)
sc.print (" whe go on ")
sc.print (vbcr)
next
next
next
call reset()
End Function
'+++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++++++++++++
woutje

[Asure]

There is a typo in the DIM area.

Dim ins1,entete,compt,part1,part2,part3,g1,g 2,g3,ECO,EEP,REP,pp

Also, consider modifying the sc.print a bit for easier finding:

sc.print ( "Status bug : "& HexInv(GPR(1),2) & HexInv(GPR(2),2)& vbcr)
sc.print ( "Glitch use : "& (HexString(g1,4)) & (HexString(g2,4)) & (HexString(g3,4)) & vbcr)

It will output some short-read details in Winexplorer.

(Yes, i started testing with the V7.1A glitch ranges, just a guess..)

Status bug : 9B00
Glitch use : 051409299DC2
Status bug : 3BF7
Glitch use : 051409299DC2

And, you can easily see what is currently being tested (for later use)
Considering the possible options by looking at G1 range theres a lot of space to cover to find 9028.

Unfortunately, almost all movx docs are in french, which is not my native language. I have no good idea(yet) how to exploit movx once found, to move further.

[EDIT]
Ok, status 9028 found.. time for more reading..
[EDIT2]
This one also works, but not with original 9B08 reply on 7.3 (9028 instead)
sc.write("1C 0E 20 02 40 00 00 00 00 00 00 40 20" & (HexString(g1,4) & " 0A 20" & "09 25" & "0B 02 00 1E 00 20 9D C2 0C 00") '7.1 timing modded for 7.3
(the VCC glitch was lowered 0200 instead of 0329 on orignal 7.1) ^free timing G2 added.. :) Note: this is with two halves of the Capa almost full separated.)