The Flying Dutchman - Mosc 7.3 NL and VL card's

[Asure]

7.3 NL:

Status bug : 9028
Glitch use : G1-0559 G2-091F G3-9DC2
Status bug : 9028
Glitch use : G1-0559 G2-091F G3-9DC2
Status bug : 1F00
Glitch use : G1-0559 G2-091F G3-9DC2

But how to exploit it ?

Sent 3 card to atr3B to find UA with similar glitch parameters. :(
Only have 'broken' cards left to experiment on now. Insiders must have wall filled up with broken/no good cards ? :)

This will goto atr 3B, don't use:
SendGP("10F70E20C4C10C00000880FCC7" & "010203AA" & "20D7260A20" & (HexString(g1,4)) & "0A20" & (HexString(g2,4)) & "0B020024002000380A209DC2" & "0A81")

Status ua : 9001 (aargh!) = 3B9001
Glitch use : G1-0507 G2-0923

This also interesting while searching for UA with the glitch above:

Status ua : 9B08
Glitch use : G1-0556 G2-091E

Be careful or your card may end up in atr3B and gain damage!

Edit:
After setting up a proper glitch test on another (still good) card, i find several points of interest where the card responds '9000' but no change takes place.
This is with two clock glitch like in 7.1B. Is there an extra glitch needed for 7.3 ?

[sc4nn4gr1ll1]

@sc4nn4gr1ll1

try this for scan movexbug anwser 9028

Function TestG()
Dim ins1,entete,compt,part1,part2,part3,g1,g 2,g3,ECO,EEP,REP,pp
call reset()
Sc.print(" *** Test MovxBug ***" & vbcr)
sc.print(vbcr)
sc.print(vbcr)
sc.print " Unlooper stop when anwser = 9028" & (vbcr)
sc.print " ------------------------------"
sc.print (vbcr)

for g1=&h0500 to &h0700 step &h01
for g2=&h0900 to &h09FF step &h01
for g3=&h9DC2 to &h9DC2 step &h01

sc.verbose=1
for pp=0 to 1
Sc.Write("A1")
SendGP("100EFF018F")
sc.delay(300)

sc.write("0A 0E 20 C4 C1 0E 00 00 08 8a 00")
sc.read(13)
sc.write("20 0E 20 02 40 00 00 00 00 00 00 40 20" & (HexString(g1,4)) & "0A 20" & (HexString(g2,4)) & "0B 02 00 24 00 20 00 38 0A 20" & (HexString(g3,4)) & "0C 00")

sc.delay(3200)
sc.read(3)
GPR(0) = Sc.GetByte(0)
GPR(1) = Sc.GetByte(1)
GPR(2) = Sc.GetByte(2)

sc.print ( "Statut bug : "& HexInv(GPR(1),2) & HexInv(GPR(2),2)& vbcr)


if HexInv(GPR(1),2) & HexInv(GPR(2),2) = "9028" then
sc.print (vbcr)
sc.print "9028 FOUND" & (vbcr)
sc.print "----------------------"& (vbcr)& (vbcr)
call reset()
exit function
end if
next
sc.print (vbcr)
sc.print " !!" & (vbcr)
sc.print "--------------------------"& (vbcr)& (vbcr)
sc.print (" whe go on ")
sc.print (vbcr)
next
next
next
call reset()
End Function
'+++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++++++++++++
woutje

I'm having trouble I can run this function with the firmware for atmel V4B5. You can go for a good 9028? Thanks

[Asure]

You need to flash atmel/xilinx combo. GRX for example, with 10mhz.

It didn't bring me any success other than 9028.

[sc4nn4gr1ll1]

I get only 9b00, 1F00, 0F1F

[Asure]

You need modify the script to narrow down the search parameter.
I used 5030 unlooper 10mhz+grx, or try zzbug atmel.

Example

Status bug : 9028
Glitch use : G1-0559 G2-091F G3-9DC2
Status bug : 9028
Glitch use : G1-0559 G2-091F G3-9DC2
Status bug : 1F00
Glitch use : G1-0559 G2-091F G3-9DC2

for g1=&h0558 to &h0560 step &h01
for g2=&h0910 to &h092F step &h01
for g3=&h9DC2 to &h9DC2 step &h01

With capacitator halves separated (open) from eachother.

If the above glitches not give 9028:
When get 9B00 write down the glitch parameter.
Status bug : 9B00
Glitch use : G1-0621 G2-091F G3-9DC2
Lock down G1 0621 to 0622.. trry g2 0900-09FF again.. see what happens..

[sc4nn4gr1ll1]

I need to find ways to write on a card seka 7.0b, someone can give me a hand? Regards

[sc4nn4gr1ll1]

How can I do to clear the pin of the card without knowing its value?

[woutje]

How can I do to clear the pin of the card without knowing its value?

brute force

There lots of programs and xvb.scripts arround to brute your pin


woutje

[sc4nn4gr1ll1]

I just solved ... I need help on a card seka 7.0b Polish

I can not send the loader ..

[woutje]

no need brute force.
You must know only adress of this C130.
Only jump on this adress to clear pin code.
This adress depending for the rom.

true :) but sc4nn4gr1ll1 dont have loader on card
so only option is brute then

woutje