I have been trying to crack this Rom2 card for some time now. I have tried several different programs and gone through hundreds of posts on dozens of boards.

The most recent thing I have tried is FT1.3. I attempted to apply the rev052rl.ne2 patch to it. Patients is easy...but i get this error that says "Abnormal CAM response on Send-Program terminated"

This Card belongs to a Model 3000 ird so I have to crack it inorder to get the Boxkeys.

Other programs said they were
"checking backdoor"
"Backdoor appears to be closed"
"unable to retrieve password"

and everything stops. Some guidence would be great or this thing becomes a boat anchor.

I haven't played with a rom2 before but from what I've read, rom2's backdoor cannot be closed by Charlie.

Have ya tried nagraedit1.1 and run bugsbuster on it? nagraedit1.1 seems to work better with rom2's. Run bugsbuster on it, then don't read but write to it with a clean ne2 first. While running bugsbuster, pulling the card in and out also seems to help for some people.

hope it'll turn into something more useful than a boat anchor. btw, it's the first time I hear this expression. I usually call them ice scrapers. ;)

Well,

I live in S. Az. I don't get much ice nor is there an anchorable amount of water. So either saying is an oxymoron. Or mabey I'm the moron. :)

Here's what I did. I set Bugbuster (NE1.1) to the highest setting and let it run all night a the tried to write a good ne2 to the cam and......
nothing.

Is there someone out there that can give one last suggestion or mabey someone would like to try the card themselves. I just want the boxkeys off it.

It aint that popular that the Rom2 backdoors get closed but there is a Blocker to prevent it from happening.

There isn't a NaWorm for the Rom2, just Rom3's.

Hey Diego. It has happened to me many times in which I attempt to program a rom2 card and then all of a sudden it says BackDoor Closed. Al you need to do is just bug buster the sucker many times and eventually it will pop... Works all the time for me..

I have never been able to program this card. I am sure glad that I have 2 DP301's and a AVR. I'll keep butchering this ROM2 but I think it might be broken somehow. Has anyone heard of that?

the card is software looped bugbuster has been the choice of fixing never had the opertunity to try it but i have heard it works.. but not to often..

Dish deactivated this card at the end of subscription when we moved from one state to the other. Does anybody know if that makes a differnace?

I beleive you should be-able to get the Boxkeys etc from the card.

I'll try and find something for ya.

Copy and Paste

Posted by: starblazer

How to unloop Rom2's + some Rom3's
Not all looped cams R created equal, I can't even begin to imagine all the different ways U can loop them . So , with this in mind heres how I loop mine to test different methods of unlooping
I write a nee file to the cam as a bin file
I open a bin file and starting at $E040 hold the "0" button down to rewrite the whole eeprom with zeros. This one loops -em real good !
And my personal favorite: Drink 30 beer then try to write anything to ur cam.

!!! I haven't been able to crack the last method yet!!!

The only way to successfully unloop rev378 and below rom3's and rev052 rom2's ,is to get ur iso communicating optimally with ur own computer. I can't explain how to do this , other than play around with ur com port settings and ur power supply for the iso ( use a variable voltage adapter ) . Some times by spiking the power up and down , while running bugbuster , will pop the atr back.
I personally feel the best iso for dish/bev is the emulator1


Open Nagra Edit1.1
1: set Bug Buster for rom 3 and@2048 , it will start out with LED on steady , jack cam in and out till Led blinks constantly, let it complete.
2: BB rom2 set @ 8192, let it complete.
3: BB rom2 set @ 1024, jack it till led flashes , run 3/4 through then jack it 4 times then abort.
4: Start up FT3.1d on desktop ( not in pure dos ). see if cam info comes up in green. If it does continue, if it does'nt then start process again.
5: Boot FT3.1d in pure dos. hit Q , backspace 4 times then type E020 hit enter. Then typeff11223344556677 ,hit enter. response should be 00820082. Hit Q backspace 4 times then type E028 hit enter, then type 8899aabbccddeeff , hit enter. Same response. Hit Q , backspace 4 times then type E030 hit enter. type e933526576303532 , hit enter . hit Q backspace 4 times , type E038 then enter. type 0009baed123b2705 , hit enter.
Hit esc. pull cam and floppy. restart.
6: goto nagra 2.0 do a read U should now have a good ATR but wrong password. Run BB rom2 @ 128 let it run then set at 1024 , run 1/2 way then start jacking cam every 2 seconds or so . Do a read , it should now read. open a good rom2 image ( if ya don't have one find one ) write to cam , it will take at least 4 tries but then ur set to loop it again. I,ve written rom 3 rev 381 bins to my rom2's and used this bullshit to reopen them every time.


Keep in mind that I don't usually Copy & Paste for anyone!

As always, AT YOUR OWN RISK!

Thanks for the copy and paste mercy. I have been searching for a few months now and that is the first time I have seen that method. I'll try it this weekend and let everyone know what happens.

If it pops one free semi nude pic of the wife or nanny I'll let Noteuser choose :)

Thanks for the help. All i am getting from the card is

"Abnormal Cam Response-Program Terminated!"
Freetalk3.1d won't calibrate or nothing.

I'll just keep plugg'n along until it pops.

Thanks again!

NoteUser:

In the spirit of good sportsmanship Please Choose.
Nanny or Wife.

Both are worth seeing:)

NoteUser:

In the spirit of good sportsmanship Please Choose.
Nanny or Wife.


Nanny

Geat Pick!

Let me set the Location:

Las Vegas, 2002, We came back to the hotel roon early. The Nanny had been out sun-bathing.

Thanks for the help;)

Diego69

:D

i have a rom2 that is this Opening of COM1 was successful
Logging into card
ROM Revision : 002
EEPROM Revision: Rev052
Checking for back door
Backdoor appears to be closed, aborting.
Error reading image from card
cant get to pop help.thanks.........

does anyone have that will share or post a link to the old rom3 scripts that used pengas and no1, worm -iso based scripts?
Im testing a idea for so series as well 206 and need the worm settings as a reference..
THANK YOU IN ADVANCE...
DVD...

Wow...........memories.........