dual programer question [Archive] - DssTester.com

HerbGreen III

11-13-2001, 11:20 AM

Here is part of a guide for freetalk I have :

Create a directory on your hard drive named "freetalk" (C:\freetalk).
Extract all your files into the noted directory. When finished, your
Freetalk1.2 program should reside at C:\freetalk\freetalk.exe.
B. Copy all "e3m" files that you need, as well as other "*.ne*" files
required such as blocker. The most current e3m for Rom3 cards (288-02 and
A2012) is newe3m03.ne3, and for Rom2 cards 288-01) is newe3m02.ne2. The
most current version of these files can be found in the files section of
any good site.
C. For the best and most consistent results from Freetalk, your computer must
be running in "pure dos". Simply running the program from a dos prompt
within Windows9X is not acceptable.
The easiest way to make sure Freetalk will run well is to create a new
startup disk, and delete all lines within the "autoexec.bat" and "config.sys"
files on the floppy drive. In Windows9x, select "Start", "Settings", "Control
Panel", "Add Remove Programs". Then go to the tab "Startup Disk" and select
"Create Disk". Place a new floppy disk into your A: drive and Windows9X/ME
will format and copy all necessary dos operating system files to the floppy.
Once Windows9X is finished creating the startup disk, open both the
"autoexec.bat" and "config.sys" files on the floppy drive and delete all the
data in these files. Save the changes, and reboot your computer leaving the
disk in the drive, so the computer will boot from this modified floppy. Once
rebooted, your computer will now be in "pure dos" mode, without any drivers
loaded that can interfere with the programmer.
D. Now place your Dish Network card into the programmer.
E. Start Freetalk by type C:\freetalk\freetalk.exe, and hit the "Enter" key
on your keyboard. If you have done everything correctly, the program
should start up and identify your card.
The program will automatically identify the card and illustrate the DNA
version (such as REV372 or REV052). The most current version for Rom3 cards
is REV372 while the current version for Rom2 cards is REV052). This progress
can take anywhere from 2 to 10 seconds on average.
Some older Rom2 cards will also have a REV048 DNA version. If you have a
card with this version, you will not be able to successfully program your
card until you change the REV version manually to REV052. The data areas on
the REV048 are not consistent with the current version or Freetalk and any
other current software. The update code from REV048 to REV052 has been out
of the stream since late 2000, and therefore the only way to update these
older cards is to clone it from another REV052 card.
To update a REV048 Rom2 card, your best bet is to clone the card using the
image of a REV052 card. Cloning is beyond the scope of this guide. Various
cloning guides are included in the help/files/newbie areas of any good hobby
sites.
F. If the card is not identified, look at the bottom of the Freetalk screen
and see if the Com Port is correctly identified. By default, Freetalk
chooses auto detect which attempts to correctly identify the com port. If
the program cannot detect the right port, close the program and open the
freetalk.cfg file. This file is a text file with the *.cfg file
extension. Open the file in notepad, or edit.exe in dos. You will a line
"COM=0", which is the default com port setting of auto find. Change the
"0" in this line to the appropriate number and save the file. Restart the
program and your card should now be identified.
POTENTIALLY LOOPED CARDS
If Freetalk still refuses to identify your card, and you are sure that your
programmer is working properly, your card may very well be looped. On June
24, 2001 a major ECM was introduced to the data stream. Any card that did
not have blocker code installed was vulnerable to this ECM. Most cards
both Rom2 and Rom3) without blocker that had an invalid tier record or PPV
record were attacked and the loop code was installed on the card. Also, any
card that had the bug catchers disabled ($E051 =00), even if it had blocker
installed was also attacked, albeit differently. Unfortunately, the noted
ECM loop is currently not repairable.
The easiest way to confirm a lopped card is to insert the card into the IRD.
IF you can view the preview channels, then your card is NOT looped. However,
if you get a message stating "Card Not Inserted Correctly", then your card is
looped and can not be programmed at this time. There currently is no
publicly available dish unloopers, and private unloopers are still not
confirmed to exist by reputable users. If your card is looped, put it away
for now, as there is nothing that can be done with it at this time.
PROGRAMMING YOUR CARD
If everything is working successfully, Freetalk will now be running and will
have correctly identified your card. If Freetalk identifies your card as
anything other than a ROM2 (288-01) or Rom3 (288-02,A2012, AA-01 or AA-02),
then your Dish Network Card CANNOT be programmed at this time.
The Freetalk menu screen is organized by illustrating card data in on the
left side of the screen, commands are located on the right side, and real
time programming information will be presented on the bottom of the screen.
All commands are entered on the extreme bottom of the screen within the "cmd"
box.
CALIBRATION
The first thing to do after Freetalk successfully identifies your card as
ROM2 (within a REV052) or any ROM3 is to calibrate the byte delays. Opinions
as to whether or not calibration is useful vary significantly from person to
person. As a result, I've decided to include this step. If you choose to
calibrate, it should be done before you proceed with any of the other steps.
The intent of Calibration is to increase the reliability of the writing and
reading of a Dish Card by alter the timming of the reads and writes. I
would suggest that calibration be performed with either a standard dish
programmer (3.68 MHz) or most definitely with a DTV (3.57 MHz) programmer.
To calibrate your card, Press "C". When asked to for confirmation type "Y"
and press the ENTER key. Calibration typically takes a few minutes to
complete however there have been reports of calibration requiring up to
15 minutes!
If you find that your programmer refuses to calibrate after an extended
period of time (roughly 10 minutes) you can quit the process by using the
"ESC" key. I have found that many programmers and cards will not calibrate.
If yours doesn't, don't worry, you will probably be fine anyway.
After your programmer has been calibrated you are ready for the next step.
Again, if your programmer never calibrated, don't worry just go to the next
step.
OPTION X
If you card is a Rom2 this section is not necessary. However, most people
should have a good understanding of this command regardless. If you are
using a Rom3 card, this command is an absolute necessity.
One of the most significant features of Freetalk1.2 is the inclusion of the
X Command, which checks the backdoor of Rom3 cards. In Mid February, the
read/write hole (backdoor) to Rom3 cards was initially closed. However, on
June 21st, the hole was reclosed via new data stream code. Therefore, Rom3
cards that have been in the data stream since that time, without blocker,
have their read/write holes closed. Cards that have not been in the data
stream since June21st must be order to be programmed. The following table
will help to clarify the dates and ability to open the card:
Rom2 Cards with or without blocker= Never been closed. Card may be looped
though via ECM on July24th.
Rom3 Cards without blocker
In data stream ONLY prior to Mid February – Open and can be programmed.
In data stream between Mid February to June 21st – Closed but can be
opened. However, reopening the card WILL market the OTP (One Time
Programmable) area of the card that has been a target of recent ECM.
More on that below.
In data stream after June 21st – Closed, can not be programmed at this time.
If you have a Rom3 card, it is imperative that you check the backdoor of the
card using the X command. The backdoor check allows you to verify whether
card has been updated using X command. It uses a default backdoor password,
so of course it is not the same as the actual one and will display the
following message "Backdoor appears to exist but password incorrect". If you
get this message, your backdoor is still functional and the card may be
programmed. The response is the key as to whether the card has been updated
to block dumps.
If Freetalk gives you the following message when checking the backdoor
"Backdoor is disabled, Caution - CAM may contain anti-tamper code updates",
then your card is locked and will need to be reopened. Do not attempt to dump
your card YET if the backdoor has been disabled. If you get this error,
continue to the next step. However, if the card has been in the data stream
after June 21st without blocker code installed, you will not be able to reopen
the card. If this is the case, put the card away for now.
If the backdoor is still open, you can continue to the "GETTING THE CAM
NUMBER" section. If Freetalk reports that anti-tampering software has been
added to your card, you will need to reopen the card IF the card has not been
the data stream since June 21st.
REOPENING LOCKED ROM3 CARDS
The single most important feature of Freetalk1.2C is the reopening command
for Rom3 cards. As mentioned above, in mid February the read/write holes
backdoor) to Rom3 cards were closed. However, on June 21st, the hole was
reclosed. Cards that were in the data stream between Mid February and June
21st can be opened, and must be opened in order to be programmed.
If your card was confirmed to have its Backdoor disabled, and the card has
not been in the data stream after June 21st, Freetalk has had excellent
success reopening the backdoor to the card.
It should be noted that reopening of the card does come with some expense:
the card will be marked at address $E051 when it is reopened. Cards that
have been marked in this area have been a target for the most recent ECM.
However, with the installation of Blocker code on the card, the marking has
not yet had an effect on the programmability of the card. The general view
of the marking is that it is a small price to in order to re-access the
card. Because the card will be marked, a special blocker code (no OTP) will
need to be used on the card. However, new blocker code is being designed to
work on both marked and unmarked cards.
More discussion regarding this will be stated later.
Press "O" (Open Cam), and follow the directions as instructed. If
successful, your Rom3 card is now reopened and can be programmed once again.
A few important notes regarding reopened Rom3 cards. As of the date of this
guide, SOME reopened ROM3 will not roll the decrypt keys (Key0 and Key1).
Therefore, in order to use a reopened ROM3 card, you will need to write the
current Key0 and Key1 keys to the card. However, it appears that most cards
will require that you only write the keys once, thereafter the keys should
roll.