Glitch

[zam1000]

Hej.
Är det nån som vet nåt om glitching. Har letat som f-n men hittar inget som leder nån vart. Har en aning om att det är ett sätt att få ur information ur ett kort med låst pic-krets. Eller finns det nåt annat bra sätt som nån vet om.
Vet att amn kan skriva över pic:en, men det finns ju risk att det som finns där är krypterat och jag vet inget om dekryptering, hur stora är oddsen att kunna tolka det som finns i eepromen även om det är krypterat?? Vilka olika sätt att kryptera finns det??
zam

[Mach 1]

De kör dom jävligt hårt med i staterna .Jag har läst lite om detta , jag ska försök gräva fram lite info om de så åter kommer jag :wink: :arrow:

[Mach 1]

Här är lite med ordet glitch i . Jag hittar inte igen de som jag hade tänkt visa :-(

33 17 0A 31 FF 22 16 DB 62 19 5B 1B 13 1D 0B 44 FF 22 FF FF FF FF FF FF FF FF FF FF 00 00 00 00 FF FF FF FF 80 26 FF FF 78 FF E4 F6 D8 FD 75 81 E2 02 80 34 12 81 A4 12
80 E6 78 DC E6 D3 94 B6 50 4F 78 D8 E6 64 DD 70 41 08 E6 24 7E 60 1C 24 FE 60 18 24
E2 60 14 24 FE 60 18 24 E2 60 14 24 FE 60 10 24 DA 60 10 24 A4 60 08 24 74 60 04 24
This is the "First" 128 Bytes of the software, the first 16 bytes (33 17 oa ..) is the Siemens setup / card num. data.
from there on its Code & data ....

I think this is going to piss "Some" people off, but it's time that the "Few" that knows something stands out, .
But if the "Few" dont take contact, more will follow.....


Unlooper commands (SU-2):
--------------------------------------------------------------------- ----
Direct Commands
-------------------------------------------------------------------- -----
80 Card inserted (Return value: FF=yes 00=no)
90 Software version (Return 4 bytes)
A0 Turn off led
A1 Turn on green led
A2 Turn on red led
B0 xx Set glitch voltage (DAC)
----------------------------------------------------------------------- --
Glitch Packet Structure
------------------------------------------------------------------- ------
LEN 00
LEN = number of glitch packet bytes
Returned = xx yy
where xx = number of bytes processed
yy = number of bytes the unlooper has to send
------------------------------------------------------------------------ -
Glitch Packet Commands
-------------------------------------------------------------------- -----
00 End of Glitch Packet
01 Card Power Up
02 Card Power Down
03 Pull I/O Low
04 Pull I/O High
05 Abort if I/O High
06 Abort if I/O Low
07 Wait I/O Low
08 Wait I/O High
09 Glitch voltage and clock at same time
0A Glitch clock
0B Glitch Vcc
0C xx Glitch Vcc, delay xx, Glitch Vcc
0D xx Glitch clock, delay xx, glitch clock
0E xx Set watchdog = xx
0F End of Glitch Packet (same than 00)
1x Set transmission routines (bps)
bitmap last four bits: xxzz (xx set receive routine, zz set transmit rountine)
10 0000 9600 bps
11-1F xxxx other bps
2x xxxx Delay 0xxxxx clock cycles
3x xxxx Delay 1xxxxx clock cycles
4x xxxx Delay 2xxxxx clock cycles
5x xxxx Delay 3xxxxx clock cycles
6x xxxx Delay 4xxxxx clock cycles
7x xxxx Delay 5xxxxx clock cycles
8x Receive x+1 bytes
9x Receive 1x+1 bytes
Ax Receive 2x+1 bytes
Bx Receive 3x+1 bytes
Cx Transmit x+1 bytes
Dx Transmit 1x+1 bytes
Ex Transmit 2x+1 bytes
Fx Transmit 3x+1 bytes
You want atmel flash ?

here we go
:1000000031C030C02FC02EC02DC02CC0D8C12AC0D6
:1000100029C028C027C057C09DC0 AAC0AFC0B1C06A
:10002000B3C0B5C0B7C0BDC0F6C0F2C0C1C0C7C084
:10003000DBC0F9 C048C062C063C062C061C060C0BC
:100040005FC05EC076C075C074C073C07BC07AC02C
: 1000500079C078C0EAC0EEC0F6C0FBC00CC106C1D2
:10006000FCC00AC110E518BB16E112BB1 FE417BBA8
:100070001EE711BB15E013BF12E019BF11E81FBD49
:1000800011E01EBDB49 9E3C214E019B918E11AB920
:10009000BB27DD271FED1DBF1127BFD16FD19923CE
:1000A 000E9F332F4E92FE295E770F0E0BA960994AB
:1000B000092EC0E663D199930A94E1F7EE24E3 9404
:1000C000FF24A0E611C01FED1DBF9A2F9056529934
:1000D00068C35AD19F2D58D1 FF2029F0CF1999918B
:1000E00053D1FA94E1F7DACF1D91E12FE03118F006
:1000F000E2 95EF703F96F0E03B9609948ED1F4CFF5
:100100001052812F7D916D91669500F0669510F4E7< br>:10011000000000C063957395839500006A95E9F728
:1001200000006FE37A95C9F700006 A958A95A9F7F0
:10013000DBCF1F73112E139462D19993F3941A9409
:10014000D9F7D2C F1F73112E13949D915FD11A94BA
:10015000E1F7CACF949A9398929A95988D9A969827
:1 00160008E9A949869EE80E014D1959A8D98BCCFC0
:1001700095988D9A96988E9A949AB6CF96 988E9ACC
:10018000B3CF969A8E98B0CF869BAECF9CCF8699F0
:10019000ABCF99CF969A 8E980CD18699FECFF894D2
:1001A000A3CF969A8E9805D1869BFECFF8949CCFCC
:1001B0 0002B2102D1B7F12BB000002BA95CF02B213
:1001C000102D1B7F12BB000002BA6D91669500F 0E6
:1001D000669510F4000000C0639500006A95E9F789
:1001E00012BB000002BA80CF6 D9102B2102D1B7FAE
:1001F000939A9398669500F0669510F4000000C0FD
:10020000639 500006A95E9F712BB000002BA6CCF53
:10021000939A939869CF02B2102D1B7F186012BB7E:100220
00000002BA61CFED905FCF9927B4999A95FB
:10023000ABD034CF93E5A8D095E5A6 D09DE2A4D06D
:1002400092E3A2D02BCF937018B31C7F192B18BB4D
:1002500025CF94D0 BBBD9ABD21CFAA278BD07A26BB
:10026000972D92D0A395A034C8F318CF99278CD09E
:10 0270008BD08AD013CF12CFD0E0C0E6983F08F0E1
:100280009850963F28F49F70192F9295911 BC90F93
:10029000CA9590E1092ECF93D0E0C0EC6FD099932E
:1002A0000A94E1F7CF919 0E1092E30D050D00A9412
:1002B000E1F71F93B0E0A0EC90E1092E11279D918A
:1002C00 019270A94E1F7912F1F919923C9F4B0E0FF
:1002D000A0EC9FE0092E112319F4C3950A949D90 78
:1002E0009D9199930A94E1F790E6990D9A959C1B3C
:1002F00050F493E449D0EE24E3 94FF24A0E6F4CE36
:1003000095E442D0CBCE9FE43FD0C8CEAF93CF93FD
:10031000B0E0 A0ECD0E0C0EB44249C919795551C34
:100320009D934394942D983011F459924424A03D08
:1003300009F4A0ECC03C89F7A0EBC0EC90E1492E99
:100340009D9199934A94E1F7CF91AF9 10895AF931E
:100350000F92B0E0A0EC90E1392EF5E0EEE49C9134
:10036000E90F9927F 91FC8950D923A94B1F70F90AC
:10037000AF910895AEBBE09A7DB20895C6985F9B99
:100 38000FECFC69A9CB108955D99B799FDCF9CB9EF
:100390000895669500F0669510F4000000C0 63951E
:1003A000839500006A95E9F700006FE38A95C9F725
:1003B0000895A2BF12E018 BFDE2C78940895DA9455
:1003C00009F0189580CE8E98969AF3DF869BFECF23
:1003D000 8699FECFF89408958E98969AEADF869BC8
:1003E000FECFF8940895192F12951927012E000CA D
:1003F000000C1025012E000C102510780895E22F16
:10040000F32F099418C02BC03EC 03DC0E42FF52F38
:1004100009944DC06AC084C083C01F70012E137040
:1004200006940 69422E032E0200D3B1F49E052E0A2
:10043000410F5B1F0895C7DF6BE581E0AADF08E08D
:100440006CEC82E0A6DF8894869B0894991F0A953D
:10045000B9F769E287E09DDF96988E9A 0895B3DF39
:1004600060EA80E096DF08E067E581E092DF88944B
:10047000869B089499 1F0A95B9F764E883E089DFA1
:1004800096988E9A08959FDF69E080E082DF08E009
:1004 900068E280E07EDF88948699089497950A95B3
:1004A000B9F766E280E075DF96988E9A08959 4DF3A
:1004B0009ADF6DE985E06DDF0AE0089418F49698FC
:1004C0008E9A03C00000969 A8E9867EC82E061DFF6
:1004D000110F991F0A9591F700C0969A8E9860EEB9
:1004E0008 1E057DF96988E9A089576DF7CDF6EE381
:1004F00081E04FDF0BE0089418F496988E9A03C0C1
:100500000000969A8E9862E581E043DF110F991FF3
:100510000A9591F763EA80E03CDF 96988E9A0895F9
:100520005BDF61E280E035DF0AE0889418F096989E
:100530008E9A03 C00000969A8E9864E280E029DFCC
:1005400096950A9599F76CE080E023DF08959ADE8E
: 10055000F7E3251F958EEA647177F27BBEFB6A276D
:10056000E2A26C45D665CCB59179B33F2 16BAE1252
:10057000E1665D49C04CEDF915C1FA33746FEBF5D6
:10058000A99DFD07395 563DB82407A54E717FC1DAE
:10059000D5970D35B7A83CCA8C0B28ECBD0F4290FF
:1005A 000474A88F89620038DBC8F14DDF45867A065
:1005B000944834784F3D73812C696D61F32D09 8621
:1005C0001C507537B83013C44BD4AA320008CB0C7A
:1005D000241BC7ACE5D2FEE4 AF99C5D0C69FDFF6B9
:1005E000380129A32F8A53DACF100251C3BAE01180
:1005F00022 0A6EF146C8B618894EAD1A2BC2E67FA4
:10060000E9A676807E72EE70B0054398627CD86869< br>:100610003EB193DC5F2E04FF9E603B1E59B4B223B3
:100620005E5C5BD95652A70E36849 BA4D3198344D3
:10063000F016EF87A157CE5A06A5C9D78B26D12A27
:10064000BB7DE84 D9CCDBF313AABB99241851DE1F0
:1006500019B91CE11AB9FF27E0E6DD27C0E6222719
:1 006600033271FED1DBF46C0B49B3DC0332311F49B
:10067000869B0EC0B79B2BC0222399F45F 9BF4CFBF
:100680009CB150985199509A3BD05FD04AD0ECCF52
:1006900044D091932395 E03D09F4E0E6283668F4D0
:1006A000E3CF5D9BEBCF99912A95C03D09F4C0E65D
:1006B0 004CD026D0332329F4D7CF96988E9A3FEF8B
:1006C000F0CF203288F6969A8E983327CDCF959 822
:1006D0008D9AB79903C0B49B06C0FBCF47C0959ACB
:1006E0008D9825D0C1CF95988 D9A96988E9A949A88
:1006F000B49BFECF9498969A8E98C198C09AB4CF26
:100700005D9 BFECF9CB908958699FECF95DE60EE85
:1007100081E03FDE8E98969A0895A2DE8E98969A92:100720
000895869BFECFE2DE8E98969A08951BE38D
:1007300019B95DE0E9DF09D0E3DF5A 95D9F75E9A90
:100740005E9BFECF1DE119B90895892F772768E0D8
:10075000881F18F4 8894979503C00894979573950B
:100760006A95B1F7509870FD509A0895B0E0BBBDFE
:10 07700092E89ABD0024C0E690E1999391E09993A4
:1007800090E2999393E0999395ED99939BE 09993D7
:1007900090E8999390E09993EE24E394FF24A0E6E7
:1007A000A3CC9F2D91301 1F7CA9598819F33F1F614
:1007B000FF27E0E6DD27C0E62227332760EE81E051
:1007C00 0E8DD8E98969A1BE319B95DE0B4DF4CCF53
:1007D000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 29
:1007E000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF19
:1007F000FFFFFFFFFFFFFFFFFF FFFFFFFFFFFFFF09
:100800000022EC513A2293C83A0F39587EB40E6A4E
:100810004361 7264426C61737465722056657273D1
:10082000696F6E20352E300012CA7C4BC99CA95AC4
:10083000C104CD50E500B7E9629B76362FAF840F37
:1008400000000000001B00000000000 0000100008C
:100850000000000000006600000000000000000032
:10086000FF0A00000 00B0000000000000000000074
:100870000000000000000000000000000000000078
:000 00001FF

ATR level

--> A10610010E068F00 , Read , A0

System Key

--> A1
DAC=110 to 130
B0 DAC,2
0810012000980BBF00
For SLE44.. the dump has made with ATR attack for switching the CARD on different mode.
After that, issuer key must be given or bruteforced ;p

Or change some first byte of eeprom...
as this code will be executed during next ATR... but the trick is find the good adresse..

Are you ready to code a fun flash ? with 256 or 512 eeprom... ?
If the algo is RSA .. why not use basiccard with RSA ..... like spanish guys make for nagravision ? It could be more easy..

So but the tricks is not clearing the screen but learn.. and

Or if you want to start new one from scratch...
As you want...............;;
enjoy conax cracked

[Harleyman]

Hej! 8)

Mach1, din info rör kort med Siemens processor t.ex. Conax.
Annan info jag hittat om glitching rör kort med Atmel processorer.
Zams kort är ett silverkort och glitching av det har i alla fall
inte jag hittat nånstans.
Glitching över huvud taget verkar mest ha att göra med att
tvinga ur originalkort dess info.

Jag är oxo nyfiken på hur man ska kunna få ur Zams silverkort
sitt innehåll!!

Viatool verkar bara ge PPUA men inga nycklar....

[Mach 1]

Jo jag vet att de är conax . Men de jag tänkte visa handlade inte om något speciellt system utan om hur de går till . :?

[Harleyman]

Hej! 8)

Mach1, informationen i sig var mycket intressant!
Jag ville bara berätta att Zam har ett silverkort så
om nån vet mer om hur man tvingar ur ett sånt sitt
innehåll vore det toppen!