Beware that in Dejan's sim scan the 2 hour version can ruin your card!!!!
Most newer cards are limited to 65536 (0000-FFFFh) a38 runnings or less.
The 2 hour option will probably bang the card more than those times (70% change)...
Use option F5-F3 and wait the same 2 hours (a little less) with 10Mhz crystal and the last 4 bytes will be "brute-forced" on the PC without attacking the card...
I usually get the first 12 bytes before B000h attacks but I've seen some going above C000h and one a little above D000... I always limit to F000 to compensate for the times the program aborts and looses the tries it already got. It saves every 100h (or is it 200h? must re-look at the HD light)... so... for 100h you'll loose an average of 07f (127) tries that you have to take in account... pluse the number of times the a38 has been run by the phone... F000 is a fair limit... F800 (the default) is too high...
About the brute-force part... takes 22h average on my 700Mhz PIII laptop and cpu *IS* a factor.<br />Get yourself a PIV 1.7G or something and you'll do it really fast...
And run the program on DOS, not on a windows shell... it's much more stable and a bit faster.
Hope I helped <img src="smile.gif" border="0">