Unlooper Guide Version 3.

0 (For Beginners and Experts)

Created By: Z-One

Unloopers can be very easy to use if you understand how to use them.
This guide will go over the basics. If you do not read the guide over
before using your unlooper, you may make a mistake that can ruin your
card. Please do not touch your unlooper until you read this guide and
make sure you understand everything. Have fun with your new toy!

**Warning** Use this guide and it's instructions at your own risk.
Experience is the best teacher. Our goal is to provide you with enough
information to help you begin your journey. Unlooping cards is an art,
not a science. There is no one perfect method, as all cards present
different problems. **Warning**

Why Buy an Unlooper?

Anyone who has begun to explore the world of DSS cards will soon find
out that DSS cards have a number of protections built into them. One
of these protections causes the card to stop accepting any commands.
This is called a “loop” because, in effect, it causes the cards
programming to endlessly loop instead of communicating through the ISO-
7816 interface (the pad of electrical contacts.)

Another protection built into the cards is the ability to protect

itself from being read by normal ISO-7816 smartcard reader/programmers.
Various holes in the programming have allowed normal reader/programmers
to bypass this protection, but the holes are often closed by updates to
the programming, and new holes must be exposed before the
reader/programmer method will work again.

An unlooper is made to help with both of these problems. By sending

glitches, or precisely timed unexpected jolts of electricity to the
card, the card can be made to un-loop. The programming on the Amtel
chip used in the unlooper controls the timing and voltage of these
glitches.

The unlooper can also be used to read the entire contents (called a
‘dump’) of a card, or write an image back to a card. This can be done
without the hassle of opening and closing whatever hole is exposed at
that time. That makes unloopers extremely useful during the times
between updates when reader/programmers don’t work.

What’s Included In The Zpack

1) Wild_Thing_Buttons
2) Useful Images
3) Winbin2img.exe
4) WT30 registry editor

How To Install Everything

1) Download WT30 from the download or alternate download page.

 1) Extract WT30
2) Install WT30
3) Double Click On The Wild_Thing_Buttons program to clear buttons
2-6 in the program, so you can personalize the software better.
The buttons you are replacing are unneeded. If you want to know
what each one does there is a description later on in this guide.

Now you have WT30 setup and ready to use after reading the rest of the
instructions

Differences In Chips

WildThing 1 Chip

This is the first generation chip. It is able to fix common newbie

errors, which lock cards up. This chip will also clean any program off
the card and restore it to factory settings. You will be able to read
the image off a card, and apply images to other cards. This chip does
not have good results with Magi ECM cards. This chip only works in
DOS. The DOS program normally used with this chip is Prog.exe.

WildThing 2 Chip

This chip does everything the WT1 chip does, and more. This chip adds
more glitch points and is better at repairing cards that were hit by
the 10/6 ECM, and cards that have an ATR of 99. The WT2 chip is a
little more successful at repairing cards with no ATR.

Super-Chip

The “super-chips” out are supposed to be more powerful than the normal
WT2 chip, but our tests have shown it to be the same. Until further
improvements and additional software is made, the super-chip will not
be useful for the average person to have.

Available Software

WT 1 software

Prog.exe DOS based

That is really the only option you have for unlooping with a WT1

WT 2, and Superchip Software

Prog.exe DOS based, works with all unloopers

BasicU05 Essentially BasicH for unloopers
WildThing 3.0 Windows based, preferred version for most operations
WildThing xx xx = any version that other than 3.0. Windows based,
NOT recommended. Has functions that allow writing bin
files directly to cards, but this function never
works correctly. Many reported bugs.
M.exe, M2.exe DOS based, very dangerous to use, this program can be
used to attempt to give a card an ATR. It’s great if
 it works, but it should be used as a LAST resort.
Cards not fixed by these programs are usually left in
an unfixable state.

Conversion Programs

Wbin2img.exe This program is used to convert .bin files to images

or .img files. There are Windows and DOS based
versions.

**Warning** Unloopers are not like programmers. You DO NOT put the card
in unless you want it to start working. If you have the card in the
unlooper and open up a program it will begin working immediately so
keep the card out until you have selected a procedure. **Warning**

Images and Bins - What’s the difference?

A DSS card has a 4096 byte (4K) area that contains a lot of
information. It is this 4K area that is read and written during
programming or unlooping. There are two file formats, .bin and .img.

When a card is read, it is read as a .bin (binary) file, also called a

dump. A .bin file is normally 4K in size and contains all of the
contents of the card.

A bin can be written to a card using BasicU. It is important to note

that when writing to a card, all of the programs here only write data
that is different on the card. That is, each byte on the card is
compared to what is being written, and only the different bytes are
actually written.

The best, and fastest way to write information to a card is by using

the WildThing 3.0 software. In order for the unlooper to write a file
to a card with the WildThing software, it must be in an image file
format. These files have the extension “.img”. This format is
described in a readme file that comes with that software.

Converting a .bin file TO .img file

WBin2Img.exe is a windows based file converter. No installation is

required.

1) In the Input file box, choose the .bin file you want to convert
2) In the Desc. Box, type in a description of the image file you are
about to create. This is purely informational, but a good description
helps when you are loading it in WildThing.

This is the tricky part, you have to choose if you want to have the
.img be a clone or not a clone.

Non-Clone This creates an image file with only the programming that
has been applied to the card. The card-specific data is
not put in the img file. This kind of file is useful if
you only want to copy the programming of a card onto
another card.
Clone This creates an image file that contains all of the data from the
bin file, including the card’s CAM ID and ZKT. This kind
of file is useful if you need to make a card look and act
exactly like another card. Keep in mind that this will
overwrite important data on any card it is written to, so
don’t forget to make backups of that card.

**Warning** Writing a clone image to a card will overwrite important

data. ALWAYS save the contents of a card before you overwrite it!
**Warning**

3) Put a checkmark in the box you want: non-clone or clone

4) Choose the directory where you want it to write the file
5) Click Convert

How to apply a bin file

This is a feature in BasicU5 that will allow you to apply a bin file,
without converting it over to an .img file. This is a quick way to
clone another cards information using an unlooper. If the bin file is
more than just the cards image, then it is better to convert it to
an .img and use WT30.

Instructions for WildThing! 3.0

We recommend that you install WildThing! 3.0 for your unlooping needs.
Once you install it you will see many different options.

Modes and What They Do

Program Card This uses the .img file that you have opened, it
defaults to Fix Card
Read This just reads the card and lets you save it as a .bin file
(this is called a dump)
Un 99 Glitch 1 This uses different glitch point to try and bring the
card back to life if the card reads all 99’s in the
programmer.
Un 99 Glitch 2 This uses another set of glitch points to try and
bring the card back to life.
Magic Glitch 1 This used different glitch points to try and clean a
magi card for you.
Magic Glitch 2 This uses another set of glitch points to try and
clean a magi for you.

Quick-Load Buttons

Fix Card This fixes the card and cleans it without installing
a clone image to it
Clone1A This clones an image to the card (not recommended
because DTV has this image too, its better to clone
your own image to the card)
Wild3m This is a 3m script, but it's not as good as some of
the stealth out there
W3m Clone This clones the card with their .bin file and puts
 the Wildthing 3m on it. Not very useful as the .bin
they use is dead now.
Button 5 and 6 These are free for you to use go to Option-Setup and
click on 5 or 6 and chose the path of your image you
want to be quick loaded. Once you choose the path
exit WT30 and go back in and it should be there.

If you use the registry edit, you can program buttons 2-6 also. Just
run the Wild_Thing_Buttons file and it will adjust the registry for you
so that buttons 2-6 can be setup to use your own images.

How to clean a card

Option 1 (WT30)

Unloopers are great tools to clean a card that has been locked or that
has an unknown script on it.

1) Make sure Program Card is checked

2) Click on the quick button FIX CARD
3) Stick the card in

If you don't get an error message then you have just cleaned the card
back to 26 updates

Option 2 (BasicU, only works for non-looped cards)

Use can clean the card 2 different ways, using this program. The first
requires the least amount of work. This is the One-Step-Clean option.
All you do is click on the icon and it will read, clean, save, and
write the clean image to your card. You can select what USW you want
it to be cleaned to, by clicking on the arrow next to the icon and
selecting which option best fits your need. The Second one leaves more
chance for human error. First click on the magnifying glass, this will
read the card, then click on the ambulance (you can select the USW you
want it to clean to), then save the cleaned image, and write it back to
your card.

How to copy the bin of a card

Use this process to extract the bin file from different cards

1) Make sure Read is checked

2) Insert the card
3) Save it

You now have a .bin file of the card you just read. Read how to convert
it to an .img file above. There are directions on how to install a
clone or a script below

How to write a cloned image to a card

Option 1 (WT30)

1) Make sure Program Card is checked

2) Click on open image
3) Choose the .img you want to use and check the clone button if it
prompts you.
4) Insert the card

You now have a cloned card

Option 2 (BasicU)

1) Open up the bin file that you want to clone to the card
2) Click on the ambulance icon to clean the bin file
3) Click on the lightning bolt to write the new bin to the card

How to install a script

What is a script? A script is written to be used by WinExplorer in

conjunction with an ISO 7816 reader/programmer. It sends commands and
data to a DSS card and typically installs or removes customized
programming. The software to use scripts with unloopers has not been
written as of this date.

However, if you have used a script to install code on a card, you can
use the unlooper to make a copy of that card and install it on another
card. The advantage here is that the unlooper can accomplish this in
seconds, where the script can take several minutes to do the same thing.

The process is quite simple:

1) Make a copy of the card (read mode in WT 3.0)

2) Convert the .bin file you created to an img file (Wbin2img.exe)
3) Use WildThing! 3.0 to open that .img file
4) Insert card in unlooper

You now have just "programmed" with your unlooper

How to read the cards info or eprom

You can now use BasicU5, which is in the same format at BasicH, to read
your cards info and clean it off. You can click on the camera icon to
read the cards info, and you will get information like the CAM ID,
IRD#, USW etc.. You can also read the card’s eprom by clicking on the
magnifying glass icon.

EXPERT INSTRUCTIONS, THIS SOFTWARE IS DANGEROUS TO

USE AND NOT FOR THE NEWBIE TO PLAY AROUND WITH

M or M2

This program is used for cards with no ATR or cards that are not
responding in WT30 or WT41. The way these programs work is they keep
on trying to glitch the card until they can get an ATR. This program
can either fix your card or make it worse than when you started, that’s
why it is not recommended.

To use these programs you have to be in PURE DOS. Once in pure DOS
load up the file by using the proper DOS commands. The card has to be
in the unlooper when you start the program. Once it starts working it
can keep on working until you get an ATR or you stop it by pressing
ESC. There have been reports of people leaving it on for over a week
before it has worked. I am not sure how true that is, but if you have
an extra computer, you can try it.

Good Luck using it.