Post/Find new camera keys here
PV2Tool now has the ability to load challenge/response keys from an external file, pv2keys.txt. To generate this file, just run the nvramparser.exe utility (distributed with pv2tool) in the same directory as the new NVRAM.DAT file. NVRAM.DAT/Keys can be extracted from stubborn/unlockable cameras using one of the methods detailed in the HOWTO area. To post the pv2keys.txt file, just copy and paste their contents into a reply to this thread.

New keys?
BillW, Here is what nvramparser pulled from a 6550 NVRAM.DAT that I successfully unlocked using your flash shorting method. Hopefully there is some use for these numbers. S mattwhitt C 6745230100000000000000000000000000000000000000000000000000000000 C 0000000000000000000000000000000000000000000000000000000000000000 C 0000000000000000000000000000000000000000000000000000000000000000 C 0000000000000000000000000000000000000000000000000000000000000000 R 4c614d5300000000000000000000000000000000000000000000000000000000 R 0000000000000000000000000000000000000000000000000000000000000000 R 0000000000000000000000000000000000000000000000000000000000000000 R 0000000000000000000000000000000000000000000000000000000000000000

Thanks, but alas this key looks to be the "reset key". It seems at some point during your attempts you managed to reset the NVRAM.DAT file (a nerve pinch on the camera should show ID=LAMSSMAL0000 now). Thanks for the attempt anyway!

I extracted this NVRAM.dat with Winimager is this mess a good key?  H

 
            .             = 
9   : 
;   S   <   L   M   N   O   P   Q 
    02AD  05247  02588  >  R  ’ ?  C   D   E   @  A   B  % T  U  V  W  X  Y  P Z  <   € )#¾„álÖ®RIññ»é볦Û<‡>™$^ ·GÞ³MÈC»‹¦Z} 8%>ÔËü–õE; ‰ Û®2 šPî@x6ýI2öž}IÜ­OòD@fÐkÄ0·2;¡"ö"‘á‹Ú°Ê™¹rI,€~Å™Õ進êÉÌS¿g € 7Î)¢zØÒ@㊚„“-®ïÁ™«l…ï÷ÙM¡^*@gòÿ¾F-/ÅÉíÀünìÌøáë,dߣ³Bü@¾¬Äâ“í:U1ó’#÷eûY|඗Óx/±pµš¢yuäºIk! MªÆ˜“éª|Ë$¥9°ŠcLKy$ 
%  &  '   (  Ç )  ,  . 
/ 
F  8 H   G   *   - 
#   +  ã
0  þ 1  þ 2  â 3   6  I  ( J   K  @ ÿÿ 33óö

The NVRAM.DAT file is a binary format, hence the mess. Try running it though the "nvramparser" program mentioned at the top of this thread. It will make a human readable text file that is postable and usable by pv2tool for unlocking.

Sorry I'am doing my best.This is from a 6550/2b S RayM C 022923be84e16cd6ae529049f1f1bbe9ebb3a6db3c870c3e99245e0d1c06b747 C deb3124dc843bb8ba61f035a7d0938251f5dd4cbfc96f5453b130d890a1cdbae C 32209a50ee407836fd124932f69e7d49dcad4f14f2444066d06bc430b7323ba1 C 22f622919de18b1fdab0ca9902b9729d492c807ec599d5e980b2eac9cc53bf67 R 14371d0fce2915a27ad8d2400ce38a9a84932daeefc199ab6c85eff7d94da15e R 2a4067f20fffbe462d2fc5c9edc00cfc6eecccf8e1eb2c0364df1da3b30b42fc R 40be07191cacc4e293ed3a045531f39223f765fb597ce0b697d3782fb170b504 R 819aa27975e4ba120f496b21094daac6980293e9aa7ccb24a539b08a634c4b79

It's definitely a valid key, but it looks like Morcheeba's key! (the first known key) Did this camera unlock with pv2tool before? If not, there may be something different to these 6550 beasties!

No, it would not unlock and is not yet unlocked.I used mpho01s battery door method and it's in bootloader mode.I couldn't get to do anything with PV2tool,but I was able to download the flash with the resurrector tool.I'll try to download the flash again.

Ok, I read your other posts and I'm up to speed - is it possible that this key was accidentally pulled from your Ritz 6430 camera instead? In any case, this key is known, which is too bad. I'd really like to get a feel for what kind of key diversity is out there for the 6550 - so far nobody's been able to use codeknowbi's 6550 key to unlock another 6550.

I don't think so ,I am working on a bootload 6550 and I named the flash lockedbootldr when I down loaded it just to keep track of it, but I guess anythings possible.I downloaded the flash again and will try to extract the key again.

oops. Did I have two cameras connected at once? Maybe, but I can not get Winimage to read any of the flash files I down load from any of My 4 6550's (error can not read file)

After battery drop my flash was corrupted and I only had a 16k firmware - but I followed a previously posted method of searching for start of firmware and found at C000 - extracted using xedit32. I had to using pv2tool run pv2, format, and painstakingly upload several other files.

I haven't had a chance to look into it, but it may be possible to fix the FAT in the corrupted image. I looked at all of my stock flash images and the FAT was the same in each case. Fixing it may just be a matter of writing a small utility that overwrites the FAT in the image with a good copy - picture files will be orphaned, but the rest of the files should be ok. If the corrupted FAT has some consistant characteristics, it may even be possible to add this as an option to the pv2tool flash download routines. (similar to the way it offers to fix checksums in FIRMWARE.BIN)

Hi All, Here's a new key. BillW there is a small bug in PV2Tool 2.11, the generated key file won't completely load. You need to add a couple of <CrLF>'s to it. If you can fix PV2Tool in the next release that would be great. Also the msgbox alert on startup kind of gets to be a little annoying. Could you just place the message in the debug window. Thanks, mpho01 ID:DB60 4440 1882 S mpho01-6520-2B-02 C 02e700f44cd9e45e12bddbd1eeca0f65eaf572ce34c347d6c45be50b3fdfb7b4 C 1bfc880a05c0fda57fac6335ce0bab721382b356b8e7c8890d56681d33824c7b C 3a4aa69d868da77e773e44cf49bb3aec385a4f0ee845dbc20589889a26695622 C f8f8e21598e7e7d1409b05092682c1baa1a8ce608e858b69f21acceae13cdd91 R 9cc4074759bbc733f540d791bf5891841d1eaa41645ef8b05fd0a79b816ff8c2 R 235dc80925e40fe8897826c23591fd2cb172ee6e4a3654d977c773630fc0e726 R 42511ef6096e3d4bdf9d8d6bc49d3ca9aec68ee5a16b738ba14e138eb6989be9 R 0a0c04d89828732182d6a03fc5ec21eda6717460972e76b2e87a3282df5c85c4

mpho01 gets the high score with 2 keys donated to pv2tool so far! I'll look into the bug. I thought I -*test*-('")ed it pretty thoroughly, but I guess one got past me! Can do on the MessageBox thing too.