Restore a Faulty MOSC

This procedure was used to restore a V6 MOSC that was damaged while extracting the card with MKFind.
I received an errormessage, telling me that the extraction couldn't be completed.
From that moment on, my card seemed unusable as it wouldn't accept any editing anymore, because the UA was incorrect.
The standard MKF UA extraction procedure also failed, so another way had to be found.

This procedure will show you how to retrieve the UA, in case a similar accident happened to your card.
There is one condition though: you need to know your original Primary MK00 on Seca provider 00.

Let's start with the log that was retrieved from the card after the accident.
This is the (slightly modified) MKF logfile.
I have printed some special comments in RED.

[GeneralInfo]
SoftVer=(C)SECA->1994-->1999**V6.
ATR=3B F7 11 00 01 40 96 60 60 06 0E 6C B6 D6
UAhex=xx xx xx xx
UAdec=xxx.xxx.xxx
SuppProv=0000000000001111 <- 4 Providers

[00 00]
Name=SECA
SECAStartup=FF FF FF FF FF FF FF FF 94 00 <- This is not a valid Startup record*
ActivationDate=xx-x-xx
PrimaryKeys= F0 F0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF
Notice that there are 2 keys MK00 (F0) in Provider 00.
* For a list of valid Seca Startup Records, please click here.

[00 19]
Name=CANAL DIGITAAL
Date=30/11/2001
PPUA=xx xx xx xx
Region=00

[00 50] Extra added Provider
Name= Notice that this Provider has no name
Date=00/00/1990
PPUA=00 00 00 00
Region=00
PBM=00 00 00 00 00 00 00 00
PrimaryKeys=FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

[00 51] Extra added Provider
Name= Notice that this Provider has no name
Date=00/00/1990
PPUA=00 00 00 00
Region=00

[Card Records]
Pr: Index= Record - Description
00: 00 01= F0 FF FF FF FF FF FF FF FF 94 00 80 - Primary Key 00 Fault!!
00: 00 02= 00 xx xx xx xx xx xx xx xx xx xx E0 - SECA PPV Record
00: 00 03= F0 FF FF FF FF FF FF FF FF 94 00 80 - Primary Key 00
00: 00 04= FB xx xx xx xx xx xx xx xx xx xx D0 - PPV Credit Record
00: 00 05= 50 FF FF FF FF FF FF FF FF 99 00 C0 - Secondary Key 00
01: 00 06= F0 FF FF FF FF FF FF FF FF A9 00 81 - Primary Key 00
01: 00 07= 50 FF FF FF FF FF FF FF FF 2F 00 C1 - Secondary Key 00
01: 00 08= F2 FF FF FF FF FF FF FF FF A1 00 81 - Primary Key 02
01: 00 09= 52 FF FF FF FF FF FF FF FF B2 00 C1 - Secondary Key 02
01: 00 0A= F3 FF FF FF FF FF FF FF FF 2F 00 81 - Primary Key 03
01: 00 0B= 53 FF FF FF FF FF FF FF FF D6 00 C1 - Secondary Key 03
01: 00 0C= 51 FF FF FF FF FF FF FF FF 6A 00 C1 - Secondary Key 01
00: 00 0D= 02 xx xx xx xx 00 00 00 00 00 00 E0 - Activation Date
01: 00 0E= 51 FF FF FF FF FF FF FF FF 97 00 81 - Primary Key 01
01: 00 0F= 5C FF FF FF FF FF FF FF FF 73 00 81 - Primary Key 0C
01: 00 10= 5D FF FF FF FF FF FF FF FF F8 00 81 - Primary Key 0D
01: 00 11= 5E FF FF FF FF FF FF FF FF 6A 00 81 - Primary Key 0E
00: 00 49= FB xx xx xx xx xx xx xx xx xx xx D0 - PPV Credit Record
00: 00 92= FB xx xx xx xx xx xx xx xx xx xx D0 - PPV Credit Record
00: 00 DB= FB xx xx xx xx xx xx xx xx xx xx D0 - PPV Credit Record
00: 01 24= FB xx xx xx xx xx xx xx xx xx xx D0 - PPV Credit Record

Notice that in this log, Index 00 01 contains a primary key 00.
This is incorrect as Index 00 01 should allways contain the Seca Startup Record.

The card was left in this state after an incomplete extraction, using MKFind 4.3.
MKF returned an error message, indicating that the extraction could not be completed.

So now the hunting can start..... we need to search for the data that should be on the card.
Luckily, the log option in MKF was turned on while extracting the card, so there was something to search in: a log file of about 27Kb in size.

In the MKF.INI I found the MK00 that belonged to this card.
And in an older log file I even found the backdoor key of the card.
So these are 2 very good reasons to never throw away your old log files, nor your MKF.INI files. Always save them, in case your worst nightmare comes through.

OK then, on with the restoration of your card:
- go to the settings menu
- enter the System key (Primary MK00 of Provider 00) in the appropriate field
- select Key index 00

> Ik ga er nu vanuit dat je de MK00 primair seca WEL kent! !
> Geef die in bij settings onder System key, en zet de key-index op 00.

> Je kunt in theorie dan natuurlijk ook de alom bekende 0E key van provider 0019 naar record 0001 proberen te schrijven:

> Info> Schrijf PK0E primair provider 0019:
> Ins> C1 38 01 8E 09 AA AA AA AA AA AA AA 82 00
> Rep> 90 02

> Ins> C1 3C 0F 0F 00
> Rep> 90 04

> Ins> C1 3A 00 00 10
> Rep> 3A z1 z2 z3 z4 z5 z6 z7 z8 00 FF FF FF FF FF FF FF 90 00

> Ins> C1 5A 01 0E 08
> Rep> 5A c1 c2 c3 c4 c5 c6 c7 c8 90 00

> Ins> C1 3C 01 0E 18 z1 z2 z3 z4 z5 z6 z7 z8 AA AA AA AA AA AA AA 82 c1 c2 c3 c4 c5 c6 c7 c8 (HIER GEEN AUTOSIG! !!!)
> Rep> 90 00

> In theorie moet dit lukken waarmee de kopie key MK00 primair seca uit record 0001 verdwijnt en wordt vervangen door kopie PK0E primair van prov 0019.

> Vervolgens verwijder je PK0E, die ga je nu verliezen middels een dan toch hopelijk weer werkend commando over MK00 primair seca.

> Delete key 0E:
> Ins> C1 40 00 00 0E 24 00 19 10 5E 82 autosig
> Rep> 90 00
Comment: INDEX 00 01 verdwenen (Gecontroleerd via Get records)

> Ins> C1 40 00 00 0E 24 00 19 10 5E 82 autosig
> Rep> 90 00
Comment: INDEX 00 11 verdwenen (Gecontroleerd via Get records)

> Hiermede zou dan record 0001 weer vrij moeten komen!

> Dan herstel startup-record:
> Ins> C1 40 00 00 15 B0 01 00 00 00 00 00 00 00 00 80 00 82 autosig
> Rep> 90 00
Comment: StartupRecord op INDEX 00 01 weer terug (Gecontroleerd via Get records)

> Nu moet je bij provider 0019 key 0E nog even terugschrijven:
> Info> Codeer 0E key (plain): xx xx xx xx xx xx xx xx (bekende key)
over MK00 primair seca "00" f1 f2 f3 f4 f5 f6 f7 f8 (gecrypt)

> Ins> C1 40 00 00 16 24 00 19 90 5E f1 f2 f3 f4 f5 f6 f7 f8 82 autosig
> Rep> 90 00

> En tenslotte:

> Info> wis tijdelijke provider 00 50:
> Ins> C1 40 00 00 0C 25 00 50 82 autosig
> Rep> 90 19
> Info> de provider is verwijderd.

> Info> wis tijdelijke provider 00 51:
> Ins> C1 40 00 00 0C 25 00 51 82 autosig
> Rep> 90 19
> Info> de provider is verwijderd.

> Ik hoop dat dit lukt!!!!

Tot zover de doc van KCPlus
Met zo'n doc kan er toch bijna niets meer fout gaan!!!

Ik heb deze doc letterlijk gevolgd na bestudering van diverse log- en docfiles.
En weet nu ook waarom er wat gedaan is.

Hierna een extractie gedaan met MKF4.3 zonder problemen.
Kaart werkt weer als vanouds ook de AU is OKE.

Ik heb C1 3A 00 00 10 gebruikt hoewel in andere docs ook wel geschreven wordt over C1 3A 00 00 10.
Dit werkte perfekt.