I have a rom 10 card that is at Rev a16, is there something out there to open the card?? thanks in avance :} :} :} ;)

I have a rom 10 card that is at Rev a16, is there something out there to open the card?? thanks in avance :} :} :} ;)
A16 should be open, if not look here
http://forums.dsstester.com/vbb/showthread.php?t=27764

A16 should be open, if not look here
http://forums.dsstester.com/vbb/showthread.php?t=27764


Hey thanks guy, thank you very much for the reply :wub:

moved...this is files area

my rom 10 to 102 cannot open please help
Opening of COM1 was successful
ATR String: 3F FF 95 00 FF 91 81 71 A0 47 00 44 4E 41 53 50
30 31 30 20 75 69 72 65 64 20 05
ROM Revision: 010
EEPROM Revision: uired
Dataspace pointer is bad - cannot continue
GetCamProvider failed
Using BD3 Key: 4E 69 70 50 45 72 20 49 73 20 61 20 62 75 54 74
Reading ROM10 failed
Closing of COM1 was successful

The below script fixes bad data space pointers. Fixes(glitches the OTP :yes: area)to fix the BOOTLOADER 90 00 !!! Have fun.:hat:



Option Explicit
Dim Shell
Set Shell = CreateObject("WScript.Shell")
dim TryCount
dim cl
dim rt
Dim CmdToGlitch
Dim CTGLen
Dim CTGRSP
Dim CS
Dim Bytes
Dim Bytes2
Dim DelayStart
Dim DelayLimit
Dim VCCStart
Dim VCCLimit
Dim GlitchType
Dim GlitchMax
Dim GlitchMin
Dim Delay
Dim VCC
Dim RstFlg
Dim Trys
Dim Mix
Dim RomType

Sub Main()
Sc.Verbose = 0
ClearOutputWindow

Reset()

Sc.Delay(20)

RomType = "Rom" & Chr(Sc.GetByte(17)) & Chr(Sc.GetByte(18))
If RomType <> "Rom10" And RomType <> "Rom11" Then
Sc.Print
Sc.Print "Unrecognised or unsupported ROM type." & vbCr
Sc.Print
Exit Sub
End If
'
Sc.Print "=====================" & vbCr
Sc.Print "Trying to fix a " & RomType & vbCr
Sc.Print "=====================" & vbCr
Sc.Print
'
Sc.Write("19 03 15 6010 21000DA0CA00000721050603FFFF002040 0E05 95 00")
Sc.Read(02)
Bytes = Sc.GetByte(1)
If Bytes < 4 Then
Sc.Print "Card did not respond correctly." & vbCr
Exit Sub
End If
Sc.Read(Bytes)
'
If Sc.GetByte(3) <> &H69 Or Sc.GetByte(4) <> &H85 Then '12 00 02 69 85
Sc.Print "Card does not appear to have a corrupted data space pointer." & vbCr
Exit Sub
End If
'
Sc.Delay(2000)

'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^

VCCStart = &h30 'h25 is standard, script is auto vcc dont change 90
VCCLimit = &h00 'h05 is standard, script is auto vcc dont change 02

'================================================= ==
'================================================= ==
'User selectable options
'================================================= ==
'================================================= ==

SetupUnlocker()

If RomType = "Rom10" Then
DelayStart = &H0E00
DelayLimit = &H1200
End If
'
If RomType = "Rom11" Then
DelayStart = &H12A0
DelayLimit = &H1600
End If

GlitchMax = 10 '7 is standard - 7, 8, or 9
GlitchMin = 4 '7 is standard - 6, or 7

Trys = 64 '100 is standard
Mix = 0.1428 '0.5 is standard - try 0.1 to 1.2 use for +-+-+-+- mix

'************************************************* *************************

If RomType = "Rom10" Then
CmdToGlitch = "210045A0D7008040 FD90500013B79700566D3B8388EC86F0895331F7D104EB6D17 119E1D3992D04C4E9AC2C718AC4A5F2E028A1C3A700721E5AF 0BC804EE4F56E4E58A4D4F274C12"
End If
'
If RomType = "Rom11" Then
CmdToGlitch = "210045A0D7008040 F497205D65EA9D9FC3F0D8FA379F9BDF39FF636F1CEFAF4B80 B3A31B66F758133CD2D241083542DEAB680FB5A4BB3D952E29 CD6CBC556C11AE9B2AD3CB432CDC"
End If

CTGRSP = 6

'************************************************* *************************

CTGLen = GetPacketLen(CmdToGlitch) 'calculate length of packet

CTGLen = CTGLen / 2
CTGLen = CTGLen + 1

CS=DoCheckSum (CmdToGlitch) 'Calculates packet Checksum
CmdToGlitch = CmdToGlitch + CS 'add checksum to packet

GlitchType = GlitchMax

Delay = DelayStart

TryCount = 0

RstFlg = 1

VCC = VCCStart
ClearOutputWindow

Sc.Print " INITIAL PARAMETERS " & VbCr & vbcr
Sc.Print " Glitch Delay = "& HexString(Delay, 4) & VbCr
Sc.Print " VCC = "& HexString(VCC, 2) & VbCr
sc.print " Glitch Type = "& HexString(glitchtype, 2) & VbCr
Sc.Print " " & VbCr

Do
If RstFlg = 1 Then
Reset()

Sc.Write("0C 03 15 A4 21C1016485 0E01 84 00")
Sc.Read(2)
bytes = Sc.GetByte(1)
Sc.Read(bytes)
RstFlg = 0
Else
'send our glitch command
Sc.Write("B0" & HexString(VCC, 2)) 'set glitch VCC

Sc.Write(HexString((CTGLen + 12), 2) & "0315 60" & HexString((CTGLen-1 ), 2) & CmdToGlitch & "20" & HexString(Delay, 4) & HexString(GlitchType, 2) & "0E158500")
Sc.Read (02)

Bytes = Sc.GetByte(1)
rt = Bytes
If Bytes > 3 Then
Sc.Read(Bytes)
Bytes = Sc.GetByte(0)
Bytes2 = Sc.GetByte(3)

If Bytes = &H12 Then
VCC = VCC - Mix
Sc.Print "-" '& hexstring(VCC, 2)
Else
VCC = VCC + Mix
Sc.Print "+" '& hexstring(VCC, 2)
If Bytes <> &H00 And Bytes <> &hFF Then
Sc.Print HexString(bytes,2)
End If
RstFlg = 1
End If
'
If Bytes2 = &h90 Then
'
If (RomType = "Rom10" And Bytes = &H00) Or (RomType = "Rom11" And Bytes = &H12) Then
Sc.Print HexString(bytes2 ,2) & "!!!!!" & VBCR
Sc.Delay(300)
Sc.Verbose = 1
Sc.Write("A1")

Sc.Print VbCr

Shell.Run "%comspec% /c echo " & Chr(07) & Chr(07) & Chr(07) & Chr(07) & Chr(07), 0, True

Sc.Print "===============================================" & VbCr
Sc.Print "Glitch Success!! " & UCase(RomType) & " DATA SPACE POINTER FIXED" & VbCr
Sc.Print "BootLoader 90 00 RSP Received!!" & VbCr
Sc.Print "VCC = "& HexString(VCC, 2) & " (~" & ((5/255) * VCC) &" vdc)" & VbCr
Sc.Print "Glitch Delay = "& HexString(Delay, 4) & VbCr
Sc.Print "Glitch type " & HexString(GlitchType, 2) & VbCr
Sc.Print "Developed @ http://pinklush.tk/" & VbCr
Sc.Print "===============================================" & VbCr
Exit Sub
End If
End If
Else
VCC = VCC + Mix + Mix
print "Rst" & HexString(VCC,2)
RstFlg =1
End If
'
If VCC + Mix = 0 Then
VCC = VCCStart
End if
'
GlitchType = GlitchType - 1
If GlitchType < GlitchMin Then
GlitchType = GlitchMax
End If
'
TryCount = TryCount + 1
If TryCount > Trys/Mix Then
TryCount = 0
'
ClearOutPutwindow

Delay = Delay + 1
If Delay > DelayLimit Then
Delay = DelayStart
End If
'
Sc.Print "" & VbCr
Sc.Print " TRYING NEW DELAY.... " & VbCr
Sc.Print " Glitch Delay = "& HexString(Delay, 4) & VbCr
Sc.Print " VCC = "& HexString(VCC, 2) & VbCr
sc.print " Glitch Type = "& glitchtype & VbCr
Sc.Print " " & VbCr
End If
End If
Loop
End Sub

'************************************************* ******************************************
'functions *
'************************************************* ******************************************

Function GetPacketLen (Packet)
'removes all spaces and calculates thength of the packet
Dim Length
Dim Temp
Dim PK
Dim i

PK = ""

Length = Len(Packet) 'get packet length with spaces
For i = 1 to Length
Temp = Mid(Packet, i, 1)
If Temp <> " " Then 'remove all spaces in packet
PK = PK + Temp
End if
Next

GetPacketLen = Len(PK) 'return packet length without spaces
End Function


Function DoCheckSum (Packet)
'claculates lrc and removes any spaces in data
Dim Temp
Dim Length
Dim PK
Dim CheckSum
Dim i

PK=""

Length = Len(Packet) 'get packet length with spaces
For i = 1 to Length
Temp = Mid(Packet, i, 1)
If Temp <> " " Then 'remove all spaces in packet
PK = PK + Temp
End if
Next

CheckSum = 0

Length = Len(PK) 'get packet length without spaces
For i = 0 to Length
i=i+1 'Simulate Step 2 in VB scripting
Temp = Mid(PK, i, 2)
CheckSum = CheckSum XOR Hex2Dec(Temp) 'Calc Checksum
Next

DoCheckSum = HexString(CheckSum, 2) 'convert checksum to a hex strimg and return it to caller
End Function

Function Hex2Dec(HexNumber)
' This function takes 1 argument, a string containing a hex value of any digit length
' and returns the decimal equivalent
Dim DecimalValue
Dim DigitCount
Dim Digit
Dim HexDigit

HexNumber = Replace(UCase(HexNumber), " ", "")
DigitCount = Len(HexNumber)

For Digit = 1 To DigitCount

HexDigit = Mid(HexNumber, Digit, 1)
If Asc(HexDigit) < 58 Then
DecimalValue = HexDigit * 16 ^ (DigitCount - Digit)
Else
DecimalValue = (Asc(HexDigit) - 55) * 16 ^ (DigitCount - Digit)
End If
Hex2Dec = Hex2Dec + DecimalValue
Next

End Function

Function HexString(Number,Length)
' This function takes 2 arguments, a number and a length. It converts the decimal
' number given by the first argument to a Hexidecimal string with its length
' equal to the number of digits given by the second argument
Dim RetVal
Dim CurLen
RetVal=Hex(Number)
CurLen=Len(RetVal)
If CurLen<Length Then
RetVal=String(Length-CurLen,"0") & RetVal
End If
HexString=RetVal
End Function

Function SetupUnlocker()
Sc.Print "________________Setting up WinExplorer_________________" & VbCr

Wx.BaudRate = 115200
Wx.ResetBaudRate = 115200
Wx.Parity = 0 ' 0 = None, 1 = Odd, 2 = Even, 3 = Mark, 4 = Space
Wx.StopBits = 0 ' 0 = 1 stop bit, 1 = 1.5 stop bits, 2 = 2 stop bits
Wx.DTRControl = 0 ' Initial state of DTR 0 = off, 1 = on
Wx.RTSControl = 1 ' Initial state of RTS 0 = off, 1 = on
Wx.ResetDelay = 100 ' In microseconds
Wx.ByteDelay = 10 ' In microseconds
Wx.RxByteTimeout = 500 ' In milliseconds
Wx.ResetMode = 2 ' 0 = No Resets, 1 = ISO Reset (Expect a ATR), 2 = Device Reset (No ATR)
Wx.ResetLine = 1 ' 0 = Toggle RTS for Reset, 1 = Toggle DTR for Reset
Wx.ByteConvention = 1 ' 0 = Inverse, 1 = Direct
Wx.FlushEchoByte = 0 ' 0 = no flush, 1 = flush - A Phoenix interface will echo each byte transmitted.
Wx.FlushBeforeWrite = 1 ' 0 = no flush, 1 = flush - Flush the receive buffer before each write to strip off Null bytes.
Wx.IgnoreTimeouts = 1 ' 0 = Abort script on a receive timeout, 1 = Ignore all receive timeouts
Wx.ResetAfterTimeout = 0 ' 0 = Don't reset after a timeout, 1 = do a reset after a timeout - Not used if "IgnoreTimeouts=0"
Wx.LogTransactions = 0 ' 0 = Don't log transactions, 1 = log transactions
Wx.DisplayUSW = 0 ' Display USW after script complete 0 = no, 1 = yes
Wx.DisplayFuse = 0 ' Display Fuse after script complete 0 = no, 1 = yes
End function

Function Reset
'resets the card and reads off the atr. this also determines rom type
Sc.Write("02 03 00")
Sc.Write("02 02 00")
Sc.Delay(16)
Sc.Write("07 0E 03 10 01 03 9A 00") 'reset card
Sc.Read(02)
Bytes = Sc.GetByte(1)
If Bytes > 25 Then
Sc.Read(Bytes)
End if
End Function