Vorlon's Quick Guide to ExtremeHU
This guide covers the new Version 3.2a
These
Guides are maintained and hosted by The Vorlon Homeworld. Linking to this guide
is ok, however anyone interested in hosting this guide must first contact Vorlon001
for approval.
PLEASE
READ, VERY IMPORTANT:
The use, possession or importation of Test (Programmed/Pirate) Cards is Illegal in the United States. If you are a U.S. resident, you are required by law to subscribe and use of Test Cards of any kind is unlawful and subject to Criminal and Civil penalties according to U.S. law. We do not condone use of Test Cards to U.S. residents. You and you alone are SOLELY responsible for abiding by the laws of your Country, State, Province or Territory. THE DSS UNDERGROUND and THE VORLON HOMEWORLD WILL NOT BE HELD RESPONSIBLE FOR THE ACTIONS OF THE PEOPLE USING THIS DOCUMENT. This Guide is strictly for Canada and EDUCATIONAL USE ONLY. Also the DSS Underground and The Vorlon Homeworld along with Angelfire and the other sites,does not and will not take any responsibility for what might happen to any card using the following procedures. In other words, USE THESE GUIDES AT YOUR OWN RISK.
EQUIPMENT REQUIRED:
To work on HU cards you will first need a modified Unlooper or an HU Loader. This device is necessary to read the EEprom from the card and to write to the card.
The Modified Unlooper can be any unit that is ICP...in circuit programmable. Since all of the HU Loaders now come without a program in the Atmel chip, you will require a file called
UL4S.exe in order to use the 48/4C glitch required to work on USW7 cards. If you need more info on the art of Flashing, there is a Stickey Post in the H Unlooper forum that explains it in great detail. There is also a program called KK that works from a DOS window and gives you the option for all major flash programs.
If you are using an older unlooper design that does not support ICP, then you will either have to purchase an Atmel that is already programmed or build an Atmel programmer and use the current software to program the chip.
If you have an HU loader, then it already comes with a daughter board circuit. If you are adapting an older Unlooper, it is probably a very good idea to buy or build one of these. If you don't use one to start, you will probably have to short pins 13 & 14 of the Atmel chip to make your modified unit work.
If you purchase an HU Loader and it comes with a power supply, good. If not, invest in one of the variable voltage designes available at Radio Shack and other electronic supply houses. You will find many forum posts referring to setting these a particular way for a particular Unlooper or Loader.
Extreme HU is currently the most powerful and best piece of HU Software that is currently available as freeware and probably any Payware as well!
The most current version is ExtremeHU 3.2. It was introduced because of the release of the new USW7 that would not allow the standard 5C or 5E glitch to work. The program cleans a card correctly for USW 0700. It supports full PPV Wipe and it uses Extreme Hex files that will fully activate a card. This version has a new interface done by Shao and requires the UL4S ATMEL CODE for the new glitch to work. It will support HUFF atmel code for unlooping, however but this code is not compatible with the new glitch!
The full featured interface is pictured below. Since this is only a text guide we will keep it simple.
The toolbar can be used to navigate the program: The features are listed below from left to right. The functions are divided into the left side for working on a bin or image and the right side for working on a card directly. The new toolbar varies only slightly from the one in ExtremeHU1.52. It has added the PPV clean toilet paper icon. Also added is the B feature. When used with the UL4S Atmel code it now supports the 48/4C glitch required for USW 0700 cards! Because of this, it is recommended you create a new directory for this version so that you can keep 3.1 around for all of your previous uses. This guide will not supercede the previous one but will be a seperate one covering this version only. If you are having any problems with runtime errors with this program, download the ExtremeHUsupportfilesv3. Read the readme file and install the support package. This will eliminate the runtime errors.
Toolbar functions:
The Left side of the toolbar is for opening files, configuration, and working on a bin loaded into the program.
Open eeprom file..This will open
an existing .bin file.
save bin..Allow you save the bin after modification.
settings...Allows for the setting of program colors, com ports, glitch
settings, and other changable program features.
View decoded eeprom (edit mode)...Decrypts all known encrypted areas of
an eeprom for viewing in the editor.
clean current eeprom...Allows you to clean an image in memory without any
I/O operation.
Unmarry IRD in current eeprom (pulldown choice)-unmarry/virgin...in
memory unmarry of the loaded .bin file
Fix ATR 4th byte...4th byte repair of the image in memory incase it was
read with a bad 4th byte.
Patch hexfile to eeprom (pulldown choice) Normal/extreme..You can patch
an image in memory with a .hex file. Useful if a new clean hex is available or a
new 3M.
Below are the direct card operation toolbar
functions. These are all on the right side of the active toolbar with no image
loaded into the program.
Check ATR...This will reset the loader and request a card insert. ATR
will be read.
Clean card...This function will reset the loader and request a card
insert for cleaning.
Unmarry IRD...This function as above and will Unmarry/virgin a card.
Attempt to unloop card... This selection opens the unlooping options of
the program!
Change area settings...Prompt screen will allow you to just change area
settings.
Read eeprom from card...Direct card operation to read the card.
Write loaded image to card (lightning bolt)...Like BasicH, will write
image in memory to the card. This can be after you modified it in memory for
area, zip code, ID, etc.
Clear PPV... This feature will do a PPV Wipe. Use
only on a Subbed card or on card with activation. This is not for use on a 3M'ed
card.
Write hex to card (select screen comes up)...This will prompt for a .hex file and write it to the card. This now auto determines whether Extreme.hex or normal.hex file.
B selection on toolbar: This
will allow you to boot the card via the glitch you selected in the setup. You
can select from 2E,4C,and 48. DAC Settings are adjustable as in previous
versions!
Exit
Help
To setup the program, the way you want it, select the 3rd icon on the toolbar which is for program setup. Make your changes from the default and save the changes. The added buttons can be configured from this menu as well.
===============================================================
Before you attempt a read or write to the card, you should use the Check Mark feature of ExtremeHU to check the ATR and card info. You should especially check for the status of the 4th byte of the ATR. This must be 25. If it is not, then follow the steps below to correct this before you do anything else!
There are cases, where canceled subs are marked with a 4th byte of 24 instead of 25. The cleaning programs will correct this also but it may make the cards a little harder to glitch. Also,
some cards had this byte corrupted to 00.
If you get the 4th byte problem, the card will probably not glitch to program or it will glitch forever without ever programming. The reason is, that the programs are looking for a byte that is 25 and will not accept the 00. Fortunately, this can be corrected in a number of ways. In
this version of ExtremeHU, the card will read, even if the 4th byte is bad and
once loaded into memory, it can be corrected and written back to the card.
If your 4th ATR byte is correct, then the first and most important thing to do is to save your original card image before you do anything else! This is extremely important so that you have the correct update keys for your .bin saved!
1. Select the EEprom icon from the toolbar.
2. The program will reset the loader and prompt you to insert the card.
3. Insert the card into the loader.
4. The program will now glitch it's way into the card, read the eeprom into program memory.
5. Once loaded, the toolbar will be active on the left side. Select the second icon (Save bin) icon and save your bin.
Now that you have saved your card's original Eeprom, you are ready to program.
APPLY A 3M HEX FILE TO THE CARD:
PROGRAMMING THE VIRGIN OR TEST CARD:
You should have all of the Extreme Hex
files you will be using located in the Hex directory of ExtremeHU as the program
defaults to this directory when you request a .hex file.
a. Bring up ExtremeHU 3.2a
b. On the right side of the toobar under HEX, use the pulldown and select the Extreme Hex option.
c. From the window that opens up in the hex directory, select the .hex
file you are going to use.
Use ExtremeHU3.2a and the latest 3m.hex
or bin of your choice. This is important as the hashes are always changing and
the latest fixes are required.
d. Follow the screens as they execute. They will ask for zip code, local bytes, etc.
e. The program will then clean and Activate the card in one operation! This
will now work on USW7 updated cards!
If you have any doubts about the above program, and the instructions that come with it leave you unsure, download the visual guides for this program from the Premium Members File area
of the DSSUNDERGROUND or the Vorlon Homeworld, and study them to become familiar with the workings of this very fancy and involved program.
--------------------------------------------------------------------------------------------------------------------
Using a subbed card for testing has the following drawback. While you can read the sub and save the image, while testing, the card will not update like normal. If you put the original image back on the card at some later date, the card will not work because it has not been updated like it's legitimate counterparts. You will have to allow the card to remain in the stream for some time to allow the tiers you had, refresh.
APPLY AN ACTIVATION HEX FILE TO THE CARD:
If you are going to apply activation to a card, you must first clean the 3M off the card and apply a valid bin file to the card. Select the Clean Card icon from the toolbar on the right, and follow the Main Message Window prompts. Once the card is clean, you can apply an activation. For previously activated cards, the ExtremeHU Clean function will clean the card correctly, even at the new USW7 update
The procedure is the same as for applying a 3M. Simply select one of the latest Activation.hex files that has the latest tiers or a current ACT.bin and apply it to the card.
Applying activation to a subbed card will allow additional channels than what was subscribed. However, the added tiers will fall off after a period of time and you will be left with the original subbed tiers.
In applying activation to a virgin card, the tiers will also eventually fall off. While you can use the tier blocking feature to prevent this, it is not recommended as this will make the card more of an ECM target. Also, currently they are hashing for tier blocking so do not use this feature at this time. All Tier blocking is currently being hashed!
------------------------------------------------------------------------------------------------------------------
HU CARD CLONING:
Cloning an HU card may be required under some circumstances.
a. The card was a canceled sub and is blacklisted.
b. The card's eeprom was corrupted and you do not have the original .bin.
c. You wish to clone a current paid sub .bin to your test card. (Save it's original image.)
The method you use to clone a card will depend on the program you are using to do this. HUExtreme
1.65 to 3.2a will work with Normal .hex files. You can also load in a .txt file saved in HUPro, or a .bin file saved in Eclipse or other program that saves a card read in .bin format. You
will require version 3.2a, however to work with cards that are at USW7.
If using another program and you have to convert file types....txt to hex or text to bin, etc. a good utility program to use is HUeeputil 1.4a. This allows you to load...say a .txt file, change timezone, zip code, etc. and save the image in any format you need. You can also extract the CAMID and ZKT table for use on an H card. This will be saved in a WT Image format. This can be used with an unlooper or as an image patch in
BasicH3.3.
CLONE THE CARD:
ExtremeHU 1.65..... 3.2a
1. In ExtremeHU 1.65 to 3.2a select File and Load eeprom. Load the selected .bin into the program.
2. If you have only the HU card and have not saved the .bin as yet, use the read eeprom icon on the right side of the toolbar and follow the instructions in the message window. Once the image is in memory, you can alter the zipcode, and other features selected on the right side of the main screen and then select File, and Save as...and save the file in the format you want.
3. Either way, since the image is in program memory, it can now be written to the card. Simply click on the Lightning Bolt on the toolbar and follow the instructions on the message screen. You
can use any version to write a USW7 bin to a card one the bootstrap is loaded,
but only Version 3.2a will read a card at USW7.
4. When using ExtremeHU 1.65 to 3.2a always wait a second or two as the program always resets the HU Loader before performing an I/O function to a card.
-------------------------------------------------------------------------------------------------------------------
FINAL NOTES ON THE HU CARD:
1. The method used to get into these cards by means of glitching, allows the card to be hacked. However, the problem is that this method, unlike the H card, can often loop a card under certain conditions. ANY TIME YOU GLITCH A CARD TO READ, WRITE, CLONE, 3M, YOU TAKE A CHANCE OF LOOPING A CARD.
2. Looped Cards: YOUR CARD IS LOOPED....IF
a. When inserted in the IRD, you get no preview channels.
b. A read in Winex in a programmer or in another program gives an ATR of FF.
c. A read in Winex in a programmer set to the P3 mode, gives a reset failed.
d. A read in any program gives an ATR of FF, 00, 90 00, 3F or any other such reading.
A card with a few bytes corrupted at the end or the 4th byte being 00 can often be cleaned, using the clean function in one of the above programs. Just remember that if the ATR is corrupted, there is a greater chance of looping the card!
In this section, I will address the cards that will glitch but not load. If the 4th byte of the ATR is 25, then the card will read and write. If it won't, it is a voltage or timing problem with the loader and has nothing to do with the software. The glitch sequences used to get into a card are standard. They all work. If you are having a problem, it is usually that the glitch voltage reference is too high, or the timing of the loader oscillator is off (Usually too high in frequency). Those are the causes, not the software. If you do not have a daughter board and are not using a loader and you have good success, then excellent. If not, add one. It does help.
The truely unglitchable 7F type cards are now addressed in this update of
ExtremeHU.
------------------------------------------------------------------------------------------------------------------
The current Readme file for version 3.2a
New in 3.2a
·You can now adjust the Glitch Settings.
·Added Ins 2E and Ins 4C glitching.
·Fixed a bug with the auto recognizing of Hex files.
If you get hex errors when running this program, it is because there are no added skins. Open the .ini file and under program settings add the following line:
ActiveSkin=none
Extreme HU 3.2
You must have had 1.6 OR later installed and WORKING for this version to work.
If you do not meet the above condition, then you will need to install the
Extreme HU Support Files.
This file will unzip to C:\Program Files\Extreme HU by default. If you have
Extreme HU installed in a different folder, then you will need to change the
path name when prompted when unzipping.
**** This verison will create a new ini file. Old values are NOT saved!! ****
New in 3.2
·Brand new look to the program. (Thanks Shao)
·New Glitching to support USW0700 cards. (Thanks to those who wish to remain Anonymous)
·You can now associate bin file with Extreme HU. (see below)
·There are now 4 custom glitch ranges for UL4S unlooping.
·Extreme Hex and Normal hex file are now automatically detected when you open them.
·Clean Function now supports USW 0700.
·Added the "Set Fuse Bytes" option to the EEPROM and Card Menus.
·Added the "Encrypt Extreme Hex" option to the Tools Menu.
·Fixed another bug with the trailing spaces at end of Hex files.
·And as always a few other minor changes.
BIN Associations: If you associate your bin files to Extreme HU, you can then just click on the bin file and Extreme HU will start and load that bin file. You can also click on a bin file while Extreme HU is running and the bin file will be loaded into the program.
note: The glitch settings are hard coded in the program and can not be changed via the settings window.
Thanks to RAM9999, AOL6945, -unatester-, No1b4me and others for the wealth of information they have posted.
Extreme HU would not be where it is today without their knowledge and willingness to share it.
Revision History
Version 3.1
·Added Sound Support. (disabled by default)
·Added the option to turn off the auto-saving of bin files.
·Added unlooping support for the Mikobu III.
·Clean Function now sets IRD to Unmarried, instead of Virgin.
·If using an Extreme Hex, you now have the option to cancel loading if a StartMsg is displayed.
·Prgram now ignores trailing spaces at end of Hex files.
·The Tier/Date activation file option is now available from the menu.
·Fixed a bug that would crash the program if unlooping attempts reached 32767.
·Just a few other minor changes.
Version 3.0
·Added unlooping support for the HUFF Atmel Code.
·Added unlooping support for the UL4S Atmel Code.
·Added Ins5c glitching support for the UL4S and U6.0 Atmel Codes.
·Faster glitching with some hardware.
·Added a shutdown protection if users attempts to close Extreme HU while I/O is in progress.
·Added drag and drop support for bin files. (just drag and drop a bin file into the message window)
·Added Graphical Buttons to most menus.
·Replaced the Card Fix 4th byte with a Unloop Card option. (see below)
·Changed the way the unlooper/loader LEDs operate. (see below)
·Program no longer waits until card is removed to display eeprom dump after read.
·Added more sites for downloading the guides. (thanks to Vorlon001)
·Fixed a bug that would write a clone bin to the card even if you answered No.
·Fixed a bug that was not allowing the Clone Card to Card option to work.
·Fixed a few other minor bugs.
How do you fix 4th byte since the option is no longer in Extreme HU?
Any time Extreme HU loads the boot strap the 4th byte is fixed. It has always been this way.
Unlooper/Loader LEDs
The Red LED will now flash during each step of normal glitching and each attempt to load boot strap during unlooping.
The Green LED will only come on once boot strap is loaded.
Version 2.0a
·Added the ability to assign normal hex and bin files to the quick buttons.
·Added Ins5c glitching support for the Mikobu II Ultra Glitcher.
·Fixed a bug that could cause runtime error 380 when writing a normal hex file.
·Fixed a bug that was preventing the checksum calculator from working.
note: when a bin file is assigned to a quick button, it will only write to the card.
Version 2.0:
·Added the ability to keep the boot strap active. (see below)
·Added an option to display Active Card Info while boot strap is active.
·Added "Quick Buttons" for quick loading of Extreme Hex and Activation Files.
·Added support for user defined DAC values for glitching.
·Added an ATRDAC option to the glitch settings menu. (see below)
·Added support for Ins5C glitching. (see below)
·Added support for the max amount of tiers. (82)
·Added a glitching progress bar.
·Added Non DST Time Zones.
·Fixed runtime error 9 when to many tiers were selected
·Fixed runtime error 76 during autosave.
-Active Boot Strap-
A new option has been added to the menu and tool bar. The Boot Card Option will
load the boot strap onto the card and remain loaded until you choose to shutdown
the card. This allows you to perform multiple I/O functions while only glitching
into the card 1 time.
-Ins5C Glitching-
Ins5C glitching is ONLY supported with the U5.1 atmel code.
-ATRDAC Settings-
Setting the ATRDAC to Auto, will cause Extreme HU to first search for a good ATRDAC
value. If no ATRDAC is found and the U5.1 atmel code is installed, Ins5C glitching
will be attempted.
Setting the Fixed ATRDAC value to 00 will cause Extreme HU to always attempt Ins5C
glitching if atmel U5.1 code is loaded.
Setting the Fixed ATRDAC value to any other number, (such as 80) will cause Extreme HU
to only use Ins5E glitching.
When you first bring up version 3.2 you will notice the addition of some blank quick buttons. These are a new feature that will allow you to run Extreme Hex files directly from these buttons instead of going through all the previous motions! This is useful for multiple card work or for commonly used .hex or .bin files.
This page updated 06/12/02
This Document is (c) copyright 2002 by Vorlon001, all rights reserved