|
Geremia
|
 |
« on: November 27, 2009, 07:05:23 PM » |
|
Again i've heard around big words about secret preservation in the name of the scene life, requesting a little sacrifice in $.
There is a guy that owns a topsecret way to dump drive fw, and i'm not going to reveal, cause it's something he should do, not me.
I'm sure i would have been able to discover myself, and i'm sure he would have been able to discover himself without my hints, why not, but i'm sure too that someone else can do it the same way.
I've spent a lot of time reversing the 7xxx fw to find an alternative solution, but now some flashed 93450 appeared on the mod market (lame 7xxx spoofed as 93450, probably you great modder don't have the mkt scrambling/descrambling app to change the original inquiry) with epoxy removed and reapplied (great security, i'm sure MS can't see it).
So, i'm sure the scene prefers to pay a MSproof modding to help the scene(rs), but if anyone wants to do some experiment and find the secret by himself, i'm happy to share something from my pocket, i'm sure someone with no $ in mind can report back some interesting result.
As you know, liteons have embedded spi flash, it's an MX25L2005 and a winbond in some cases.
during powerup, the spi is read by the mmtk internal flash controller, descrambled and copied to an internal sram. This sram is then connected to address and data pins of the 8051 core, which will start executing the code.
The mtk checkmodule checks for the first 0x200 bytes of spi flash, if are blank (all FF), the vendormode is full enabled with an ata status 72 and you can access the spi flash (and dosflash can read/write).
If the first 0x200 bytes are not blank, you can enter vendormode but you can't access the spi flash (status 52).
What i tried times ago, was to mess with the pins of the mtk chip to find a way to disable the spi flash during powerup, cause in many cases of spi imlementation, if the spi flash does not pull down MISO pin, the spi master reads all FF (lifting one pin makes an old psp battery pandorized, same principle).
The problem is that the embedded spi flash pins are not present outside of the mtk chip, except vcc and ground which are shared with other internal stuff).
Use some imagination, and feel free to do what you want with your discovery.
|
|
|
|
« Last Edit: November 27, 2009, 07:36:43 PM by Geremia »
|
Logged
|
|
|
|
|
fail
|
|
« Reply #1 on: November 27, 2009, 07:58:56 PM » |
|
I have seen 1 of those pcb with removed and reapplied glue. I suppose the magic pins are 100, 101, 102 ...  Let's give it a try ... |
|
|
|
|
Logged
|
|
|
|
|
rolf2
|
|
« Reply #2 on: November 27, 2009, 08:10:33 PM » |
|
I have seen 1 of those pcb with removed and reapplied glue.
I suppose the magic pins are 100, 101, 102 ...
Let's give it a try ...
very plausible   |
|
|
|
|
Logged
|
|
|
|
|
fail
|
|
« Reply #3 on: November 27, 2009, 08:37:39 PM » |
|
Ok, let's get started ... Step 1 (lifting spi power pins):  Now it's time to search for a proper erase command. |
|
|
|
|
Logged
|
|
|
|
|
fail
|
|
« Reply #4 on: November 27, 2009, 08:50:38 PM » |
|
1.8 volt is no involved from what i see on mx25l2005 datasheet ... My bad !
|
|
|
|
|
Logged
|
|
|
|
|
le_uberfry
|
|
« Reply #5 on: November 27, 2009, 09:19:37 PM » |
|
.
|
|
|
|
« Last Edit: November 28, 2009, 11:20:14 AM by le_uberfry »
|
Logged
|
I had a blast at the party yesterday!
Oh wait, what you mean you weren't invited? It was in your mouth and everyone came!
|
|
|
|
glaze83
|
|
« Reply #6 on: November 27, 2009, 10:30:07 PM » |
|
I'm pretty sure the external flash was tested in the early days and nothing came of it.
Could we not wire up a blank spi to the pins the internal spi are going and lift the chips vcc pin? That would make the mtk chip boot up using the blank flash chip and go into complete vendor, then we could flip a switch and go back to the internal and read that?
|
|
|
|
|
Logged
|
|
|
|
|
Arakon
|
|
« Reply #7 on: November 28, 2009, 03:11:25 AM » |
|
I'm pretty sure VCC is also used for the mtk chip itself, so if you lift it, it'll also disable the controller.. or they're linked internally, in which case lifting that one vcc pin wouldn't make a difference.
Unless Philips/BENQ has been rather stupid about the design.
|
|
|
|
|
Logged
|
I do NOT give support by email, PM, ICQ or whatever. Anyone annoying me that way will have his balls removed. With a rusty butterknife. Slowly. And I'll enjoy doing it.
|
|
|
ciariello
Newbie
Posts: 6
|
|
« Reply #8 on: November 28, 2009, 04:06:47 AM » |
|
i lifted the 3.3v pin but it is still linked to 3,3v (i check with a multimeter)
if i power on the drive with lifted pin ...it works normally
|
|
|
|
|
Logged
|
|
|
|
|
jelle2503
|
|
« Reply #9 on: November 28, 2009, 04:30:03 AM » |
|
interesting,
but i wish i wasn't so stupid..
|
|
|
|
|
Logged
|
*
|
|
|
|
MODFREAKz
|
|
« Reply #10 on: November 28, 2009, 05:25:58 AM » |
|
Im very very pissed off about few people (no names). so I decided to release all personally discovered information and a way how to read the whole LiteOn firmware. Tomorrow is the day of days!! |
|
|
|
|
Logged
|
|
|
|
|
Schtrom
|
|
« Reply #11 on: November 28, 2009, 05:41:18 AM » |
|
It seems the XBH site is getting more interesting tomorrow. It's nice to see some more professional and technical hacking threads here again. Keep up the public discussion approach!
@Geremia and Modfreakz: Nice work guys! I think it was the right decision to share this info to more than a selected few!
|
|
|
|
|
Logged
|
Wanna do real programming? Try MASM!
|
|
|
|
glaze83
|
|
« Reply #12 on: November 28, 2009, 05:44:03 AM » |
|
I wish I'd seen that post before I spent the last few minutes searching ways of pulling CE high to disable the chip  I thought maybe bridging the 1.8 and 3.3 volt pins would drive it close to 5v and disable it -- but I'm sure that's wrong. Great work, I'll shut up and drool in anticipation now. |
|
|
|
|
Logged
|
|
|
|
ciariello
Newbie
Posts: 6
|
|
« Reply #13 on: November 28, 2009, 06:00:26 AM » |
|
Nice work...CONGRATULATIONS....the real soul of hacking....
|
|
|
|
|
Logged
|
|
|
|
|
crisdo98
|
|
« Reply #14 on: November 28, 2009, 07:09:38 AM » |
|
|
|
|
|
« Last Edit: November 28, 2009, 11:01:04 AM by crisdo98 »
|
Logged
|
|
|
|
|
centaur2
|
|
« Reply #15 on: November 28, 2009, 09:57:43 AM » |
|
Thanks guys, really appreciated! I am very excited to see how to extract the
whole LO firmware from one of the drives...
Keep up the great work!
|
|
|
|
|
Logged
|
|
|
|
|
damox
|
|
« Reply #16 on: November 28, 2009, 10:33:29 AM » |
|
Please, keep this thread along the lines of 'Research & Technical'.
Everyone's thanks etc is noted.
I'm sure others, like me, don't want to wake in the morning and see 1000's of posts saying thanks/conspiracy theories and have to sift through it.
I cant stress enough, if your post doesn't add relevant content to the thread, perhaps consider not posting it.
|
|
|
|
|
Logged
|
|
|
|
alexis
Newbie
Posts: 1
|
|
« Reply #17 on: November 28, 2009, 06:37:07 PM » |
|
|
|
|
|
|
Logged
|
|
|
|
|
Arakon
|
|
« Reply #18 on: November 28, 2009, 07:02:47 PM » |
|
Actually, seeing this post and your PM.. I'm going to f***ing kill you right away.
|
|
|
|
|
Logged
|
I do NOT give support by email, PM, ICQ or whatever. Anyone annoying me that way will have his balls removed. With a rusty butterknife. Slowly. And I'll enjoy doing it.
|
|
|
|
le_uberfry
|
|
« Reply #19 on: November 28, 2009, 10:25:11 PM » |
|
dai finocchio |
|
|
|
|
Logged
|
I had a blast at the party yesterday!
Oh wait, what you mean you weren't invited? It was in your mouth and everyone came!
|
|
|
|
