Request A Response To Your Challenge here.

Challenge and response keys retrieved from camcorder: S YourNameHere C 09c11e473a8cc869b7a9f2acf03bc0f24ddef24f9fe8136efaeff330c78b5897 C 155cf1e3304f8bfa751e870d64168c79f71d79eb32f39ec8fcb82bcc2dafe8f1 C e84127922b45f8d0a47e9b35c7653b971d29d93fdff5864bc371d551168b9045 C 0b77aa9d53f475b2edd2156a40b13514670bf893cc7532bff821d908a9a8b65d R 09c11e473a8cc869b7a9f2acf03bc0f24ddef24f9fe8136efaeff330c78b5897 R 155cf1e3304f8bfa751e870d64168c79f71d79eb32f39ec8fcb82bcc2dafe8f1 R e84127922b45f8d0a47e9b35c7653b971d29d93fdff5864bc371d551168b9045 R 0b77aa9d53f475b2edd2156a40b13514670bf893cc7532bff821d908a9a8b65d Camera revision retrieved from camcorder: 53.14 Thanks so much!

need a response for this one
M220 33.04 Challenge and response keys retrieved from camcorder: S YourNameHere C 04624214392ca4f7b876ac6df142279db81d3ea01bf5f8eefd2b001601e9a9b3 C aab62f9bc0474059f598badec83cb773aaf2c7f25f787c36a8a42cd01fb0f2fb C 62d6f6d3731ceec15f72e53a1efa3ba9bba7eea9b5091778a467b8a81f0fb418 C deea1f231c53b8173f29b4e9bb23be2734643b2de350d29c3a9d2c08cbadf8f1 R 04624214392ca4f7b876ac6df142279db81d3ea01bf5f8eefd2b001601e9a9b3 R aab62f9bc0474059f598badec83cb773aaf2c7f25f787c36a8a42cd01fb0f2fb R 62d6f6d3731ceec15f72e53a1efa3ba9bba7eea9b5091778a467b8a81f0fb418 R deea1f231c53b8173f29b4e9bb23be2734643b2de350d29c3a9d2c08cbadf8f1 Camera revision retrieved from camcorder: 33.04 Thanks, no problem with other cams, just this one doen't want to unlock for me.

Re: need a response for this one
M220 33.04 Challenge and response keys retrieved from camcorder: S YourNameHere C 04624214392ca4f7b876ac6df142279db81d3ea01bf5f8eefd2b001601e9a9b3 C aab62f9bc0474059f598badec83cb773aaf2c7f25f787c36a8a42cd01fb0f2fb C 62d6f6d3731ceec15f72e53a1efa3ba9bba7eea9b5091778a467b8a81f0fb418 C deea1f231c53b8173f29b4e9bb23be2734643b2de350d29c3a9d2c08cbadf8f1 R 04624214392ca4f7b876ac6df142279db81d3ea01bf5f8eefd2b001601e9a9b3 R aab62f9bc0474059f598badec83cb773aaf2c7f25f787c36a8a42cd01fb0f2fb R 62d6f6d3731ceec15f72e53a1efa3ba9bba7eea9b5091778a467b8a81f0fb418 R deea1f231c53b8173f29b4e9bb23be2734643b2de350d29c3a9d2c08cbadf8f1 Camera revision retrieved from camcorder: 33.04 Thanks, no problem with other cams, just this one doen't want to unlock for me. download c2r or use my how to and it will unlock...or you are just making a mistake. What did you use to unlock your other camera? What is your current version of ops?

C2R worked for me, thanks ZAC! Been a while, but i think i unocked the first one with OPS 0.20 with Pandora key. not sure. Couldn't get a valid response with Cronuskey.

Please help me! Someone out there has to know the proper key response to my cam... C 0931e7c8cac5fa5af0faab9a73e8bc1637345030a6ef4521a5bbc33ec7301579 C c17eb82a1f53b21035ff259257d6244b4dd5c5c6018978867b2d974a0f133e8f C d5455c555a6b0a2695ef1c551d60f6849914a26877121fd1e12efbe4ec7624ab C 13cdfbd1e5d6aaa6fa14b7692b4fdac702390c9f7051e108be081795c6226fd8 Any help would be greatly appreciated. Thanks.

My code
Challenge and response keys retrieved from camcorder: S YourNameHere C 0942edb9dd092d7284dd94dca9878f3fc5a71057f0078d4d04294be60022dcfb C aaabe729797627c9b1beb622d0228cde29b342bbcf4c1c83b422473e129b5fa6 C 0a6435db8cbece587618af2600e3574f57a20e968840dd65a0a7de07118eb617 C 58925f39dd892b081b13054f0071fa7b979bf950e48cd7dc10e196a9c6a2e737 R 0942edb9dd092d7284dd94dca9878f3fc5a71057f0078d4d04294be60022dcfb R aaabe729797627c9b1beb622d0228cde29b342bbcf4c1c83b422473e129b5fa6 R 0a6435db8cbece587618af2600e3574f57a20e968840dd65a0a7de07118eb617 R 58925f39dd892b081b13054f0071fa7b979bf950e48cd7dc10e196a9c6a2e737 Camera revision retrieved from camcorder: 33.21 Help would be greatly appreciated!!! M220

Here's mine. I'm using a 230 with 54.14 Challenge and response keys retrieved from camcorder: S YourNameHere C 09028aea551e9101c9d47b5ab182815f9f025fead424fa5a045b45e559b66530 C ba12141c4c8f43e339400365b127a5bc2f602016fe9cb4c4fbd1cd8e9c302a4a C 31583ead6ac9d7601a9bfd563a701d5e31a767f453d2745da76a2cf3edc2e7bd C df3ad242b8b5959ff34d32d85545306c2d3efa2cdbae824c8f8f29bb5354e3b0 R 09028aea551e9101c9d47b5ab182815f9f025fead424fa5a045b45e559b66530 R ba12141c4c8f43e339400365b127a5bc2f602016fe9cb4c4fbd1cd8e9c302a4a R 31583ead6ac9d7601a9bfd563a701d5e31a767f453d2745da76a2cf3edc2e7bd R df3ad242b8b5959ff34d32d85545306c2d3efa2cdbae824c8f8f29bb5354e3b0 Camera revision retrieved from camcorder: 53.14 a response code would be greatly appreciated thank you in advance!!

My two cams
I have two cams, OPS 21 in use Camera revision: 33.21, Model 220 (Rite-Aid) C 093ea25a7a6ffebb38d5351f2ecefaff41baffd5520db8d41ba361d65a544296 C 32c9321fce8d5a8447673bd2c8e8f343f040bbb47756b5591517e5b09f0d7cb3 C 74345d52170ada201de6be4d4a8a91d4f7fb17f5b6911ae6394a69c6706321d2 C f22a2bdb9e0e06f882f8c778fcde5e1a1e951a8157e670e250e5f800157eb85a Camera revision: 53.14, Model 230 (CVS) C 09d723f452f930b78ff568cc54d2839eb56bc8e8ce7ad06ea6f68ceb5a9f8a4a C 77d77318a7b3d93a90522fdbf96d19a92e30e741a6485be7e43eb37b9b03e3a8 C 15cc235fd51fa9847c2eb8e7e965d975a43f69b07d5d535c70d91f7bccd82c7c C 955e39b026672afd1a3309d66de14c6adf3f561c99e140341370d8d43545ea2d It's cool that there's still a good 'challenge' on all of these cams! I was at the old pv2 forum as Ansel Adams in 2004. I see that there are other Furries here too.. :)

S YourNameHere C 090b2314c97c9899cdffafb87d01abfc4c039e790d5524b04e2151b3e8ace88a C d4d9ced440efbeb1e29b3de08d39d125024f6eee085a3135bfce51a831585208 C 2a667bcf4ae98b155859a8b4d9fa98abe15f33c02a2c186a6320a0edca5210c7 C fdba134b0df4678cd541d67c8acf6855933ad7389a524314e31f27cadc228c8f R 090b2314c97c9899cdffafb87d01abfc4c039e790d5524b04e2151b3e8ace88a R d4d9ced440efbeb1e29b3de08d39d125024f6eee085a3135bfce51a831585208 R 2a667bcf4ae98b155859a8b4d9fa98abe15f33c02a2c186a6320a0edca5210c7 R fdba134b0df4678cd541d67c8acf6855933ad7389a524314e31f27cadc228c8f New to the forums, but this is the key I received from Ops .20 Firmware is 53.14, Also, how can I try to unlock myself and kinda tinker with the software?

unlocking yourself involves 1 of 2 things. performing a "kaycatch" which is modifying a camera that you CAN use to have your challenge, going to cvs, having them unlock it, getting it back, and running to a computer. or soldering the Tsop (the long chip with tiny solder points) to a flash smartcard reader. both difficult. very

New to the forums, but this is the key I received from Ops .20 Firmware is 53.14, Also, how can I try to unlock myself and kinda tinker with the software? Desolder flash pin 19 and lift off pad. Then try shorting data pins at various times during power up, followed by checing for a changed challenge in OPS log. If you get the timing and the shorting just right you may end up with a challenge and response of either all 0s or all FFs which you could add to saturnkeys.txt and then unlock camcorder followed by a download of USP.BIN containing real keys. After that just resolder pin 19 and you will then be able to apply Duggasco's LocKfree and Massdugg.

Desolder flash pin 19 and lift off pad. Then try shorting data pins at various times during power up, followed by checing for a changed challenge in OPS log. If you get the timing and the shorting just right you may end up with a challenge and response of either all 0s or all FFs which you could add to saturnkeys.txt and then unlock camcorder followed by a download of USP.BIN containing real keys. After that just resolder pin 19 and you will then be able to apply Duggasco's LocKfree and Massdugg. Interesting. I assume pin 19 is some sort of write enable to lower the chances of accidentally corrupting the memory. I assume that the camera reads from flash inorder to determine what to send for the challenge. However there are two things I dont understand. 1. I thought someone had tried to break the encryption and determined that 53.14 must be using a different algorithm. If this is the case, doesnt that mean that even if you get a non "09" challenge, you still wont beable to generate a response? 2. If I am able to unlock, I assume the next step you describe (with the USP.BIN and lockfree) will require writing to flash. Would I need to resolder the pin while the thing is on?

However there are two things I dont understand. 1. I thought someone had tried to break the encryption and determined that 53.14 must be using a different algorithm. If this is the case, doesnt that mean that even if you get a non "09" challenge, you still wont beable to generate a response? 2. If I am able to unlock, I assume the next step you describe (with the USP.BIN and lockfree) will require writing to flash. Would I need to resolder the pin while the thing is on? 1.If your timing is good enough to alter the 09 challenge with practice you might be able to alter the response which immediately follows the challenge when reading in USP.BIN. Please post any success at achieving a change to the 09 challenge - especially timing details. 2. After an OPS unlock with a shorted/zapped response key, you would download USP.BIN which contains the real response key (note PD does not include embedded encryption code in the camcorder - only on their processing stations, camcorder has response key in flash - so algorithm changes do not matter if you can access flash). You should not resolder until you have confirmed you have a working real response key and are ready to take some live videos. Caution shorting without raising pin 19 created many bricks on the older model 200s when trying to force replacement of USP.BIN with FSP.BIN (FSP had a known response key until PD put the same USP key in FSP). There is a high probability that any shorting during read of USP.BIN will alter more than just the keys (other parameters which control video resolution and quality) and that could prevent a successful power up and thus no ability for OPS to check challenge key. Again if anyone can short the flash to cause a different challenge key - please report the details. It probably won't take long after such a success to tweak the method producing a desired response. Even failures could provide useful information.

Oh, I did not know the response was on the chip. hmm, maybe there is a way I can stick something ontop of the entire flash chip with leads coming down to the pins. Like if I made a PCB with the same layout as the flash chip but had thru-holes instead of SMT. then it could reach down and touch each lead of the flash chip. Then I would think it would be possible to provide power to the chip and read everything on it directly. The only problem is that it would be way too expensive for me to make a PCB just for this. Maybe I can rig something up somehow. I think this would be safer since you would not be shorting anything. It would also be safer that attempting to desolder the chip. The only other thing I can think of is perhaps trying a buffer overflow attack. I would think this type of application wouldnt have any bounds checking. However I have no experience in doing this sort of thing.

08 challenge in m400 still cams
Can anyone unlock these still cams? They start with an 08 challenge: They are model 400 cams from rite aid. 08 99 39 6F 42 5A 8E EA 9A 30 B0 DA 09 61 DC 53 E4 41 2B DF 1A 53 1E C6 66 B2 7A 8C C8 AF 56 BA 35 BC 72 E2 8E 89 CA DD CF 6C 6B 57 89 06 86 8E 92 24 C3 56 FA E3 D7 61 42 18 59 BD C9 EE D1 9E 87 D1 13 5E FD 8B CB C2 6C AD 58 7F 46 31 DE FC E2 5D 96 5A 73 EB 69 B2 3B 66 BE 9D FC D7 90 FA B0 A1 C3 EB 79 AA B8 21 DB BB 1F 5A 29 2A 0C 27 3D B6 4D F3 6C B2 FC 41 BA 66 50 35 49 B2 B8 56 08 A1 80 E3 E9 BA 4D 6D B4 57 B6 B5 96 CC 4A 5C B4 73 8F 23 E0 AC F3 0C 25 21 05 BC 9F 4F E5 24 90 42 F9 60 B1 9F E2 DF C6 E8 AF C5 75 FC 50 8D 58 DD 4D F3 51 B6 B8 11 1E 1D 60 C8 2D 95 47 61 B1 57 56 74 F5 52 50 09 F0 70 05 FE 1B 1B C8 A9 7F 00 22 BD 12 12 C8 72 43 D2 CB E0 D4 CE 0F AC E8 68 FE E7 5D D9 7D 33 5B 76 1F 28 2D 31 99 F6 50 62 77 4B CA C8 0D 77 BD CA AF CE 3C 03 25 4D 08 FB AC 08 5B 1E CE 44 FB 7C 3A AE FA 0F 15 A1 D2 B8 CC AD 62 26 5F 99 E7 F9 00 A8 29 27 DC 1C F2 9F 39 F9 C4 2D C1 0B CB 9E 1D 2A 11 24 C6 BD F1 FC 18 7D CE 4D A9 7C 05 54 D8 65 1F BE A9 05 4C 55 D0 0A 0D DF 0B 0B 30 43 B5 C9 01 EE 99 B5 BF 75 04 B2 4D 7C 1E 1B 2A D6 79 08 A3 EE EB CD 47 65 99 C4 9C FC 55 4D 10 B5 2A 12 32 35 34 90 22 6D B5 D3 46 79 66 80 3F C8 0B 19 1C 7E 4A 7D

View Full Version: Request A Response To Your Challenge here.