anybody can make sentinel dump bin file to dng

[Harleych]

help, anybody can convert my sentinel supur pro dumped bin file to dng,

here is the bin file

http://rapidshare.com/files/118474173/DDE1.bin.html

thanks

[alphasxb]

use EDGESPRO11.exe to dump the sentinel

then you can get the *.dng directly!

what kind of tools you use to get the dde1.bin?

[Harleych]

I have try edgespro11.exe, but it run about half an hour, and can't get the dng file.

so i dump the dongle data with dumper, which download from http://www.software-key.org/

and mortujao send me a dng file. but it can not run correctly!

anyone can help me?

[sparpacillon]

use pva dumper to obtain .dmp file to be converted with f1_nodongle.

[alphasxb]

use pva dumper to obtain .dmp file to be converted with f1_nodongle.

at last use the vusb emu

[gamebit0]

12 algo
cell 08 enhanced algo
Cell_08 = 2750 Cell_09 = d390 C6 = 3763
cell 0a enhanced algo
Cell_0a = 41dd Cell_0b = f303 C6 = 3763
cell 14 enhanced algo
Cell_14 = 2903 Cell_15 = e93c C6 = 3763
cell 18 enhanced algo
Cell_18 = 54c9 Cell_19 = c441 C6 = 3763
cell 1a enhanced algo
Cell_1a = 1ba9 Cell_1b = e650 C6 = 3763
cell 22 enhanced algo
Cell_22 = 21a2 Cell_23 = e055 C6 = 3763
cell 24 enhanced algo
Cell_24 = 0f8a Cell_25 = fa4e C6 = 3763
cell 28 enhanced algo
Cell_28 = 4cb2 Cell_29 = e86a C6 = 3763
cell 2a enhanced algo
Cell_2a = 4845 Cell_2b = e067 C6 = 3763
cell 2e enhanced algo
Cell_2e = 49ec Cell_2f = c8fb C6 = 3763
cell 32 enhanced algo
Cell_32 = 4598 Cell_33 = cca0 C6 = 3763
cell 3a enhanced algo
Cell_3a = 7ef5 Cell_3b = f9e7 C6 = 3763
Converting to registry file...
All done. Press any key....

[y8y8y8y]

alphasxb
sparpacillon
Who copy from whom? :)

gamebit0
Is it from .bin?

Harleych
You write before you read. READ this forum or use SEARCHER !!! There is a full description on how to do what you want. :rolleyes:

[gamebit0]

y8y8y8y, yes, something wrong?
reg for ruboard vusb:

REGEDIT4
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\ru-board\mulators\Dump\DDE10000]
"Name"="Dump for DDE1h dongle"
"DongleType"=dword:00000003
"Type"=dword:00000000
"CellType"=hex:01,01,03,03,03,03,03,03,\
03,03,03,03,00,00,01,01,\
00,01,00,00,03,03,00,00,\
03,03,03,03,00,00,00,00,\
00,00,03,03,03,03,00,00,\
03,03,03,03,00,01,03,03,\
01,00,03,03,00,00,00,01,\
00,00,03,03,00,00,00,00
"sntMemory"=hex:66,13,E1,DD,00,00,00,00,82,F5,00,00,63,37,00, 00,\
50,27,90,D3,DD,41,03,F3,2F,64,2C,34,00,00,B2,15,\
00,00,24,09,00,00,00,00,03,29,3C,E9,20,13,24,80,\
C9,54,41,C4,A9,1B,50,E6,00,00,00,00,00,00,00,00,\
FA,04,A4,E1,A2,21,55,E0,8A,0F,4E,FA,8E,A4,C4,4C,\
B2,4C,6A,E8,45,48,67,E0,00,00,52,4C,EC,49,FB,C8,\
04,04,00,00,98,45,A0,CC,00,00,00,00,00,00,09,18,\
00,00,00,00,F5,7E,E7,F9,00,00,00,00,00,00,00,00

[y8y8y8y]

gamebit0
Nothing wrong, good to know who can do that job :rolleyes:

[BfoX]

"sntMemory"=hex:66,13, ... - Dongle Number 4966 is for DeveloperID 56801

[y8y8y8y]

"sntMemory"=hex:66,13, ... - Dongle Number 4966 is for DeveloperID 56801

56801 == DDE1h :rolleyes:

[gamebit0]

Nothing wrong, good to know who can do that job it's not so hard. f1_pva in public. simply look inside dump

[y8y8y8y]

it's not so hard. f1_pva in public. simply look inside dump
f1_pva may give you solver, yes, but .bin file contract differently from pva dumper.
Did you get WP as well?

[gamebit0]

f1_pva may give you solver, yes, but .bin file contract differently from pva dumper.
Did you get WP as well?
WP in dump, already
first 192 bytes it's memory & celltype
then algocell(dword) & responses for "previous" response started from 0x00000000 (512 bytes\128 query)

[y8y8y8y]

ok, I see....AA BB CC == (AA BB) memory + (CC) celltype.
Can you explain the 00C0, what is going on there?

[gamebit0]

Can you explain the 00C0, what is going on there?
tell current offset
oh. as i said before...
from 0x00C0
algo cell number(dword) 0x00000008
then algo response on the query =0x00000000, then response on the query = 0xD28F2F91(previous response)

[y8y8y8y]

tell current offset

0000-00BF = memory + celltype, right?
00C0-00C4 = ????
00C4 and up to the end is algos, but what is the structure?

[gamebit0]

0000-00BF = memory + celltype, right? yes
00C0-00C1 = WP
00C2-00C3 = ???? wrong!
WP it's cell4 in dump
look
query = 0x00000000, response = 0xD28F2F91
query = 0xD28F2F91, response = 0x6A0F2B9B
....
last for algo cell8:
query = 0xE28769DB, response = 0xEB5E9FD1
in dump we have only responses!

[y8y8y8y]

yes

query = 0x00000000, response = 0xD28F2F91
query = 0xD28F2F91, response = 0x6A0F2B9B

Isn't it :
query = 0x00000008, response = 0xD28F2F91
how many Q/R for each cell and how do know for what cell num. this Q/R?

[gamebit0]

Isn't it :
query = 0x00000008, response = 0xD28F2F91
no. read carefully! offset = 0x00C0 - it's algo cell number = 0x00000008. offset = 0x00C0+4 - it's response on the query = 0x000000000. offset = 0x00C0+8 - it's response on the query = 0xD28F2F91(==previous response!)
how many Q/R for each cell 128 responses on every algo. no query in dump!

[y8y8y8y]

10x for the info

[foffa]

hello all

HERE IS DNG HOPE IT WORKING :D

TEST AND GIVE ME NEWS :cool:

[Git]

I've lost count of how many times I've stated the PVA dump format, but here we go again. y8y8y8y8 and Gamebit0, you are close, but the queries sequentially sent are as follows.

Qn is the nth Query, Rn is the response to the nth Query.

Q0 = 0x80000000; R0 = ...
Q1 = 0x00000000; R1 = ...
Q2 = R1; R2 = ...
Q3 = R2; R3 = ...
...
Qn = Rn-1
...

Responses are stored in the dmp file starting at Offset 0xC0. Data 0x00..0xBF is more or less as discussed.

Git

[benito]

i think it should be Q0: 0x00000080. I tested it with SproEval and it returns correct value. Not with 0x80000000 or 0x00000008
Or SproEval use another byte order :)

[y8y8y8y]

I've lost count of how many times I've stated the PVA dump format, but here we go again. y8y8y8y8 and Gamebit0, you are close, but the queries sequentially sent are as follows.

Qn is the nth Query, Rn is the response to the nth Query.

Q0 = 0x80000000; R0 = ...
Q1 = 0x00000000; R1 = ...
Q2 = R1; R2 = ...
Q3 = R2; R3 = ...
...
Qn = Rn-1
...

Responses are stored in the dmp file starting at Offset 0xC0. Data 0x00..0xBF is more or less as discussed.

Git

It is nice, but we did not disused pva format :) In any case where I see the cell num for Q/A in pva format?

I am confuse,on
Q0=00000000
R0=912F8FD2
Q1=912F8FD2
R1=039A3199
but in .bin dump R1 is different, why?

[gamebit0]

I am confuse,on
Q0=00000000
R0=912F8FD2
Q1=912F8FD2
R1=039A3199
but in .bin dump R1 is different, why? i think u must sleep before :)

[alphasxb]

y8y8y8y, yes, something wrong?
reg for ruboard vusb:

REGEDIT4
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\ru-board\mulators\Dump\DDE10000]
"Name"="Dump for DDE1h dongle"
"DongleType"=dword:00000003
"Type"=dword:00000000
"CellType"=hex:01,01,03,03,03,03,03,03,\
03,03,03,03,00,00,01,01,\
00,01,00,00,03,03,00,00,\
03,03,03,03,00,00,00,00,\
00,00,03,03,03,03,00,00,\
03,03,03,03,00,01,03,03,\
01,00,03,03,00,00,00,01,\
00,00,03,03,00,00,00,00
"sntMemory"=hex:66,13,E1,DD,00,00,00,00,82,F5,00,00,63,37,00, 00,\
50,27,90,D3,DD,41,03,F3,2F,64,2C,34,00,00,B2,15,\
00,00,24,09,00,00,00,00,03,29,3C,E9,20,13,24,80,\
C9,54,41,C4,A9,1B,50,E6,00,00,00,00,00,00,00,00,\
FA,04,A4,E1,A2,21,55,E0,8A,0F,4E,FA,8E,A4,C4,4C,\
B2,4C,6A,E8,45,48,67,E0,00,00,52,4C,EC,49,FB,C8,\
04,04,00,00,98,45,A0,CC,00,00,00,00,00,00,09,18,\
00,00,00,00,F5,7E,E7,F9,00,00,00,00,00,00,00,00








wonderful work!
just respect! hehe

I THINK HASPHL2007 IS A SIMPLY TOOLS FOR GENERAL USE!
BUT THE EDGE SOLVER FOR HARDLOCK DUMP IS SOMETHING WRONG!
I HOPE SOMEONE CAN SHARE A PUB TOOLS TO SOLVE THE hl****.bin
SO THAT IT CAN BE USED BY NORMAL !

JUST MY MIND! SORRY FOR MY POOR ENGLISH!

[Harleych]

y8y8y8y do the great job, the reg file works very well.

Thank you very much.

thank you foffa too, but the dng file cause the computer restart, it can work.

thank you everybody paticipate the thread all!

[y8y8y8y]

y8y8y8y do the great job, the reg file works very well.

Thank you very much.

thank you foffa too, but the dng file cause the computer restart, it can work.

thank you everybody paticipate the thread all!

The 10x goes to gamebit0, as he did the reg :rolleyes:

[Harleych]

now i can do reg file myself.

Thank you!

[Git]

i think it should be Q0: 0x00000080. ...Or SproEval use another byte order :)

Well, yes, it does! Try it for yourself. Internally, the hex value (as passed to the Query function) is 0x80000000. How that gets byte swapped by the PVA file and by SproEval2 compared to the Query function is something I have to work out every single time I deal with it! The point is, when I or anybody else I hope, writes a hex value in the C format as 0x12345678 they mean that number exaqctly and are not concerned if the cpu handles that as 12345678 or 78563412 or the file stores it as 12345678, 78563412, 56781234 or 34127856. All are possible and all exist. The important thing is that the actual number is 0x12345678

I was lucky/unfortunate enough to have learned my craft before Intel reared their ugly endian head and I never managed to just "know" byte order again. It used to be how common sense dictates, now it isn't :(

Git

[y8y8y8y]

Git
In PVA format how many Q/R stored for each cell ( is it 128?) and how can I know for what cell num. this set of Q/R ?

After a while:
ok, there is 1024 Q/R for each cell, when
Q0=00000080
R0=XXXXXXX
Q1=00000000
R1=AAAAAAAA
Q2=AAAAAAAA
R2=BBBBBBBB
Q3=BBBBBBBB
.......
Qn=R(n-1) : n>1

But for what cell those Q/Rs?

[benito]

of course for each algorithmic ;)

[y8y8y8y]

of course,but for what number of cell (algo) this set of Q/Rs?

[gamebit0]

of course,but for what number of cell (algo) this set of Q/Rs?You must to analyze each celltype

I am confuse,on
Q0=00000000
R0=912F8FD2
Q1=912F8FD2
R1=039A3199
but in .bin dump R1 is different, why?

Sorry, my mistake. i forgot about the shift of response

[Git]

@y8

There is one block of 1024 responses for each active algo cell. You can find out which cells have algo by checking accessCode is 0x03. Following code will open a PVA V3.3 dump if it is valid and read the cell data and access codes into arrays.

Git

fopen_s(&dmpFILE, filename, "rb");
if(dmpFILE == 0)
{
printf("file %s not found\n", filename);
return 10;
}

memset(&descriptorArray[0], 0x00, 28*4);

dmpFileLength = flength(dmpFILE);

// Is it a valid dump file?
if( ((dmpFileLength - 0xC0) & 0xFFF) == 0 )
{
numQueries = (dmpFileLength -0xC0) >> 0x0C;
printf("\nNumber of Query Cells = %d \n", numQueries);
cell=0;
counter=0;

// read 32 access code *words*
for(cell=0; cell<32; cell++) // cell = 0, 1, 2, ..., 30, 31
{
fread(&accessCodes[cell], 2, 1, dmpFILE);
if( (cell > 3) && (accessCodes[cell] == 0x0303) )
{ // we have a Query cell pair
printf("%#2.2X ", cell*2);
queryCells[counter] = cell*2; // store as 0x08, 0x0A, ..., 0x3C, 0x3E
counter++;
}
} // cell for loop
printf("\n");

// read 64 data cell words
for(i=0; i<64; i++)
fread(&dataBuffer[i], 2, 1, dmpFILE);

} // if dmpFileLength...