ASIC7 table

[bsys]

hi,

I just wanna a help to find the type7 dct4 phones unlock table.

I know the table for type2 and 5 from dct4nck.exe:
table 2: 4A, 33, etc. (16 byte)
table 5: 54, A1, etc (16 byte)
table 7: missing

In Mados calculator flash:

table 2: 4A, 33, etc. (8 byte only)
table 5: 54, A1, etc (8 byte only)
table 7: 9C, 7D, etc. (8 byte only), if I right??

In dct4nck the all 16 bytes are used to calculate unlock codes (with several XOR func.), however in MADos the other 8 bytes cant be found. Is that uses other (shorter) algo? Unfortunately I cannot understand the arm code.

Anybody can help me with a hint? Dont say to reverse it!!!

Maybe put the 8 bytes from MADOS table 7 to dct4nck algo, and brutforcing the other 8 bytes to reach the same unlock code as other type 7 codecalculators. (with the same box-serial of course).

[g3gg0]

try XORing the first 8 bytes with the second 8 bytes..
and u will see why...

[bsys]

Thanks mate!

I can see it, now