| How To Guides | Files | Links | Toplists | Forums |
|
|
 Syndrome Nagra2 cards, AVR-X Nagra2 cards -------------------------------------------------------------------------------- Cloning with an UnLooper - What you will need: - WildThing2 or 3 or compatible (clone) unlooper. - WildThing 3.0 program - Wbin2img.exe conversion utility - Subbed card or subbed bin file - NON-CLONE IMG file programmed with the script of your choice. - Windows Notepad - Windows Calculator NOTE: As of this writing, WildThing software's latest version is 6.0. The reason I specified WT 3.0 as the program to be used with these instructions is because problems have been reported with the newer versions of the WildThing software in alt.DSS.hack. I cannot verify those problems via my own experience, but I know 3.0 works well, so I recommend its use. First thing I strongly advise that you shut down all possible programs running in the background on your computer which are not absolutely necessary to keep the machine up. In other words, disable/suspend things like task schedulers, virus scanners, screen savers and POWER MANAGEMENT settings. INSTRUCTION SET #1 - CLONING A SUBSCRIBED CARD Ensure that the software is in the "Read Card" mode by looking at the "Action" box in the lower left hand side of the program window. Be *sure* it says "Read Card!" Insert card you wish to clone and wait while the unlooper reads the card. When the unlooper finishes reading the card, you will automatically be
prompted for a name to save the card's dumped image under. Select a unique
name like "mysub.bin" and save the file. Select the bin file you just created from the subbed card, i.e. "mysub.bin," by browsing via the "Input File" box. Type in a short description for the IMG file you are about to create like "My subscribed IMG." Click in the small white box to the left of "Clone" to place a check mark in it. You will notice that the complete path and new file name for the IMG file you are about to create will automatically appear in the "Output File" box and the description you gave the file will also appear to the right of the abbreviation "Desc." along with the word "CLONE" added on to the description. Also note that a "C" is added on to your original ("Input File") bin file's name so that "mysub.bin will be converted to "mysubC.img." Don't change that because if your collection of images increases over time, it will always be easy to identify your cloned and non-cloned images from one another by the "C" appended onto the file names. Click on the "Convert" button at the bottom of the program window and then exit the program. NOTE!! What you do next is very easy to screw up if you don't work carefully. Take your time and watch what you do on the keyboard! You can screw up IMG file and possibly damage your card if you are not precise in the following editing process. Launch Window's Notepad program. Load the IMG file you just created (mysubC.img) into Notepad. The first few lines of the code will look like this: #My subscribed IMG CLONE The first change you want to make is to add a secondary description to the IMG file. This will enable you (or anyone else) to easily assign this IMG to one of the action buttons in WT30 and other versions of the WT program as the secondary description will appear on the button you assign it to. Remember, the buttons are small, so the secondary description should be as short as possible. You place the secondary description on a new line immediately under the primary description and it must be preceded by a # sign. Your results should look something like this: #My subscribed IMG CLONE Next, look at the first actual line of code in the IMG. The only value you're interested in on this line is the value of the fifth byte (every 2 characters represent a byte in hex code) so the value we're interested in this case is 00. That is the setting of the fuse byte of your IMG file. Now scroll down to the end of your IMG file and look at the last couple of lines. They should look something like this: :0F8FF0002279811CECFA24FD028679FFFFFFFF36 The last and short line of code in the IMG file is the config line. The fuse byte value in this line is the second hex value and *must* match the fuse byte value found in the first line of code of the IMG. Obviously wbin2img.exe has a bug because it assigns a config line of 00FF0201FE to any converted bin files and FF does not match the 00 fuse byte setting of the first line of code in this example! Okay, so now you're thinking what's the big deal? Just change the FF to 00 in the config line and everything should be cool right? WRONG! The last byte value of every line of code is called a "checksum" byte. It validates the code of the line it is on by a mathematical process so if you arbitrarily change any value on that line, the checksum byte would have to be changed to meet the requirements of the checksum equation. If that is not done, the entire line of code fails the checksum and will be invalidated! Result? Possible card failure and/or card damage! That's the bad news. Now, the good news is that 99% of the time, bin files that you convert with wbin2img.exe will either be clean bin files or stealthed bin files. Clean bin files always have a fuse byte setting of 00 while most stealthed bin files will have a fuse byte setting of 25. That means that all you will probably ever have to worry about is replacing your converted IMG config lines with valid config lines for either 00 or 25 fuse byte settings. Here they are! :00250A01D0 config line to substitute for IMG files with 25 as fuse byte setting :00000101FE config line to substitute for IMG files with 00 as fuse byte setting Just to be crystal clear... If the hex value for the fuse byte in the first line of code is 25 as in this example, #My stealthed IMG NON-CLONE then the config line should be... :00250A01D0 If the hex value for the fuse byte in the first line of code is 00 as in this example, #My subscribed IMG CLONE then the config line should be... :00000101FE On the rare occasion where your first line of code includes a fuse byte that's not 25 or 00, or if you are interested in learning more about the checksum byte and the equation used to validate each line of code, skip down to the "ABOUT CHECKSUMS" section at the end of this FAQ. Once you've completed editing the IMG file and have checked your work, save the IMG and exit Notepad. Now back to the easy stuff. Launch Wildthing 3.0 program. Again, look under the "Program Options" section of the program window and under the "Mode" column, select "Program Card" by clicking on the white dot to the left of the selection. In the upper left hand side of the program window, click on the "Open Image" button and select the .img file ("mysubC.img") you just converted and edited. Ensure that your .img file is loaded by looking in the "Action" box. It should contain the description ("My subscribed IMG CLONE") you gave your IMG file in wbin2img.exe. If everything appears as it should, insert the card you want to program into the unlooper. Once programming has completed, remove the card from the unlooper. Again, select the "Open Image" button from the upper left hand side of the program window and load the NON-CLONE scripted image you plan to use. Check the "Action" box to ensure that the IMG file is properly loaded. You should see something like "SS1.2a Central non-clone" or just "SS1.2a" depending upon how the person who created the image chose to describe it. Unless you know that the IMG you have loaded matches your time zone, click on the small white dot next to your time zone in the "Program Options" section of the program window. Reinsert the card you are programming in the unlooper. Once programming has completed, remove the card from the unlooper. You now have a cloned subbed card with your choice of programming on it! Reboot your receiver, insert the card and watch TV! INSTRUCTION SET #2 Type in a short description for the IMG file you are about to create like "My subscribed IMG." Click in the small white box to the left of "Clone" to place a check mark in it. You will notice that the complete path and new file name for the IMG file you are about to create will automatically appear in the "Output File" box and the description you gave the file will also appear to the right of the abbreviation "Desc." along with the word "CLONE" added on to the description. Also note that a "C" is added on to your original ("Input File") bin file's name so that "mysub.bin will be converted to "mysubC.img." Don't change that because if your collection of images increases over time, it will always be easy to identify your cloned and non-cloned images from one another by the "C" appended onto the file names. Click on the "Convert" button at the bottom of the program window and then exit the program. NOTE!! What you do next is very easy to screw up if you don't work carefully. Take your time and watch what you do on the keyboard! You can screw up IMG file and possibly damage your card if you are not precise in the following editing process. Launch Window's Notepad program. Load the IMG file you just created (mysubC.img) into Notepad. The first few lines of the code will look like this: #My subscribed IMG CLONE The first change you want to make is to add a secondary description to the IMG file. This will enable you (or anyone else) to easily assign this IMG to one of the action buttons in WT30 and other versions of the WT program as the secondary description will appear on the button you assign it to. Remember, the buttons are small, so the secondary description should be as short as possible. You place the secondary description on a new line immediately under the primary description and it must be preceded by a # sign. Your results should look something like this: #My subscribed IMG CLONE Next, look at the first actual line of code in the IMG. The only value you're interested in on this line is the value of the fifth byte (every 2 characters represent a byte in hex code) so the value we're interested in this case is 00. That is the setting of the fuse byte of your IMG file. Now scroll down to the end of your IMG file and look at the last couple of lines. They should look something like this: :0F8FF0002279811CECFA24FD028679FFFFFFFF36 The last and short line of code in the IMG file is the config line. The fuse byte value in this line is the second hex value and *must* match the fuse byte value found in the first line of code of the IMG. Obviously wbin2img.exe has a bug because it assigns a config line of 00FF0201FE to any converted bin files and FF does not match the 00 fuse byte setting of the first line of code in this example! Okay, so now you're thinking what's the big deal? Just change the FF to 00 in the config line and everything should be cool right? WRONG! The last byte value of every line of code is called a "checksum" byte. It validates the code of the line it is on by a mathematical process so if you arbitrarily change any value on that line, the checksum byte would have to be changed to meet the requirements of the checksum equation. If that is not done, the entire line of code fails the checksum and will be invalidated! Result? Possible card failure and/or card damage! That's the bad news. Now, the good news is that 99% of the time, bin files that you convert with wbin2img.exe will either be clean bin files or stealthed bin files. Clean bin files always have a fuse byte setting of 00 while most stealthed bin files will have a fuse byte setting of 25. That means that all you will probably ever have to worry about is replacing your converted IMG config lines with valid config lines for either 00 or 25 fuse byte settings. Here they are! :00250A01D0 config line to substitute for IMG files with 25 as fuse byte setting :00000101FE config line to substitute for IMG files with 00 as fuse byte setting Just to be crystal clear... If the hex value for the fuse byte in the first line of code is 25 as in this example, #My stealthed IMG NON-CLONE then the config line should be... :00250A01D0 If the hex value for the fuse byte in the first line of code is 00 as in this example, #My subscribed IMG CLONE then the config line should be... :00000101FE On the rare occasion where your first line of code includes a fuse byte that's not 25 or 00, or if you are interested in learning more about the checksum byte and the equation used to validate each line of code, skip down to the "ABOUT CHECKSUMS" section at the end of this FAQ. Once you've completed editing the IMG file and have checked your work, save the IMG and exit Notepad. Now back to the easy stuff. Launch Wildthing 3.0 program. Look under the "Program Options" section of the program window and under the "Mode" column, select "Program Card" by clicking on the white dot to the left of the selection. In the upper left hand side of the program window, click on the "Open Image" button and select the .img file ("mysubC.img") you just converted from the subbed bin file. Ensure that your .img file is loaded by looking in the "Action" box. It should contain the description ("My subscribed IMG CLONE") you gave your IMG file in wbin2img.exe. If everything appears as it should, insert the card you want to program into the unlooper. Once programming has completed, remove the card from the unlooper. Again, select the "Open Image" button from the upper left hand side of the program window and load the NON-CLONE scripted image you plan to use. Check the "Action" box to ensure that the IMG file is properly loaded. You should see something like "SS1.2a Central non-clone" or just "SS1.2a" depending upon how the person who created the image chose to describe it. Unless you know that the IMG you have loaded matches your time zone, click on the small white dot next to your time zone in the "Program Options" section of the program window. Reinsert the card you are programming in the unlooper. Once programming has completed, remove the card from the unlooper. You now have a cloned subbed card with your choice of programming on it! Reboot your receiver, insert the card and watch TV! ABOUT CHECKSUMS The checksum equation is the sum of all the bytes in the line (except the checksum byte) subtracted from 00. 00 - (00 + fuse byte + version + 01) = checksum 00 - (00 + 25 + 0A + 01) = D0 00 - (30) = D0 Fire up your windows calculator, select "Scientific" view from the "View" tab then select "Hex" and "Byte" to place the calculator in the correct mode. You can then verify the checksum of the above config line yourself. Okay, so let's say that you find you have an image where the fuse byte setting in the first line of code is 27. All you need to do is substitute that value in the above config line, recalculate and then substitute the new checksum byte your calculation arrives at. Thus, a valid config line for a fuse byte of 27 is arrived at thus: 00 - (00 + 27 + 0A + 01) = CE 00 - (32) = CE :00270A01CE Remember though, that the version number can be any valid hexadecimal number you want it to be, so another completely valid config line for a fuse byte setting of 27 could be :00270101D7 or :00270201D6 etc. etc. If you're the naturally curious type like me, you might also wonder if you can change the fuse byte for the IMG file altogether. The answer is yes, but you have to follow one simple rule. The byte immediately following the fuse byte must Xor off the fuse byte to FF. Using an example from earlier in the FAQ, let's change the fuse byte of this IMG file from 25 to 27 in the code line. #My stealthed IMG NON-CLONE First of all, we have to Xor 27 off FF to find out what to change the byte following our new fuse byte to. 27 Xor FF = D8 So the new code line becomes: :1080200027D8440D0103122026A447DB0257010084 Notice that so long as you change the value of the byte following the fuse byte to Xor off the fuse byte to FF, the checksum of the line (84) remains the same. 00 - (10 + 80 + 20 + 00 + 27 + D8 + 44 + 0D + 01 + 03 + 12 + 20 + 26 + A4 + 47 + DB + 02 + 57 + 01 + 00) = 84 00 - (7C) = 84 Don't forget! You must also go down to the config line of the IMG file and change the fuse byte there as well and recalculate the checksum for the config line too!
|