MT1335 MX/WB unlocking

[gavingt]

Allow me to share my recent experiences -

After getting impatient waiting for my dremel bit to get here, I went ahead and did the soldering iron method. I decided to use unlockspi.exe to unlock rather than JungleFlasher, since I've read about the numerous problems in JF. I had no problem using JF and a PMT to get the drive into 0x72, but almost immediately encountered problems with unlockspi.exe. I would start digging when, randomly, the program would sound an alert noise and would say, "ATA Timout, status 2f. waiting for power cycle". This would force me to exit the program and re-start it before I could get back to the "Do what you have to do now" prompt. So this process repeated for a long time - I'd make a little progress and then be interrupted by the program and be forced to restart it.

I wouldn't even call what I did "melting" through the IC, it was more like gently pressing down and scraping at it. It seemed like the heat made the plastic more fragile, allowing gentle back-and-forth scrapes to shave off little bits of it. So I slowly dug away, inspecting the hole every few seconds with my eye and under a lens. But I never saw any hints of the traces. I kept digging, growing more and more worried, until I was probably half-way through the IC. To check if I'd screwed anything up, I took the drive out of vendor mode and tried ejecting. The drive motor would no longer eject the tray, so I figured I'd dug too far and probably missed the trace anyways. At this point, I gave up on unlockspi.exe and tried unlocking it in JF. I also stopped using the soldering iron, and instead tried poking around with a needle. Thinking I may have missed the trace, I started scraping around the outer edges of the hole. Instantly, JungleFlasher announced that my drive was unlocked. I was then able to flash it, although it failed on the verification step. I also used the trick that was posted earlier to fix the eject problem and it seemed to work, although the drive now ejects rather violently. Hopefully using 2 100 Ohm resistors in parallel doesn't cause any problems down the road.

Anyways, I'll check back tomorrow to indicate whether the drive actually works. I'm crossing my fingers here.

[mordock]

No, JF didn't make a full-dump at it's 86 version,
I am sure ther will be a new version from jungle team guys wich could correct actual bugs & make the full-dump possible !!

Wait & see, thanks for the hard work doing by Geremia, maximus & his team, team Jungle, team xecuter & c4eva !!!
You're heros guys 

Slimkey creates a dummy
press read on an unlocked drive for a full dump!

I've tried the solder method yesterday (just to try it), didn't go as deep as the other i did with the dremel method, Looked all fine, got 0x00, could read fine, but write verification failed (a bit similar as yours Illness)
Relocked it, unlocked it again, got status 0xBC, 0x3C and even another one i cant remember.

Drive worked for 5 mins with backups, then only play dvd, so it's f***ed, had to replace the pcb.

I'm sticking to the dremel, and the occasional re-intro and waiting times. Feels safer to me, one slight twist with the soldering iron got me deeper in the chip then a soft press with the dremel

Use a needle to drill, a small hole then scratch around it...thats how im doing it from now on

i went about 0.7mm deep with the 100ohm and 3.3V, but i was INCREDIBLY lucky not to hit any traces (i dont have any side effects played for an hour and everything is awesome), drilling with a needle gave me a bigger error margin.

I agree with you Mordock. The drilling with a thin tool increase the margin of error. Here I use a 2 mm drill until you start to see the wires and then I finished the job. So I feel safer.

another way to get the job done is to make a small hole at the coordinates then scratch around with the needle...thats how im doing it from now on

[asapreta]

I would start digging when, randomly, the program would sound an alert noise and would say, "ATA Timout, status 2f. waiting for power cycle". This would force me to exit the program and re-start it before I could get back to the "Do what you have to do now" prompt. So this process repeated for a long time - I'd make a little progress and then be interrupted by the program and be forced to restart it.

You need to drill a bit to the left from were you are when you got ATA RESET.

[faizy]

okay have come across a drive that got drilled too far and now the tray does not open ... i tried the method by riku and it fixes the tray(i used a total of 59 ohms on the resistance) ... but now the disc does not read ... the lens lights up then goes out .. seconds later again lights up trying to read the disc but the disc motor does not spin ... any ideas whats wrong here?

[the-green]

Hye guys, Mordock, about the needle, it looks to be a safe way for those who haven't a dremler like me !!
I want to tray this on my winbond 0225 drive, I have the DVD key if it won't work

But I had questions about this method
what about the 3.3V line ?? did you drill with the needle than you apply the 3.3V line occasionally or when you see the first line, you apply-it ?? how this work exactly
The 3.3V you have to apply-it on the needle(putted into the small whole) or directely into the whole ??

thanks for your answers guys

[FUTURA]

EJECT PROBLEM AND MOTOR LASER AFTER KAMIKAZE FAIL

I receive 2 boards damage from a bad kamikaze process, i change the MT chips with PRO KITS and the same problems persists, anyone know what components can be damage from the process?.

[Pacote-san]

Hye guys, Mordock, about the needle, it looks to be a safe way for those who haven't a dremler like me !!
I want to tray this on my winbond 0225 drive, I have the DVD key if it won't work

But I had questions about this method
what about the 3.3V line ?? did you drill with the needle than you apply the 3.3V line occasionally or when you see the first line, you apply-it ?? how this work exactly
The 3.3V you have to apply-it on the needle(putted into the small whole) or directely into the whole ??

thanks for your answers guys

No need for the 3.3v

Either with dremel or any other solution

[Jrmc0]

Hi Geremia

Thank you, i have a question thou

couldn't we just short out pin 5 and pin 6 with a 100oh resistor and 3.3v???



Thanks

[gavingt]

I would start digging when, randomly, the program would sound an alert noise and would say, "ATA Timout, status 2f. waiting for power cycle". This would force me to exit the program and re-start it before I could get back to the "Do what you have to do now" prompt. So this process repeated for a long time - I'd make a little progress and then be interrupted by the program and be forced to restart it.

You need to drill a bit to the left from were you are when you got ATA RESET.

You were indeed correct. Actually, all I had to do was touch a needle to the southwest corner of the hole. It was weird, though, because the ATA Timeout errors were happening basically before I started drilling. All I had done was to scratch the lines onto the IC with the needle.

[tingedace]

It's loooking that using the soldernig iron is so dangerous & may damaged more wires than what we need

I am sorry, yesterday, I've read the new JF guide/tutos v1.4.3, Jungle Flasher can make a full-dump very easy, all what we have to do is to follow this tutorial from team jungle:
 
http://hotfile.com/dl/125980443/c03de4b/jftut1.4.3.rar.html

You may turn out to be right but I think it's too early to say which way is best. One guy claimed he's done 20 with the soldering iron method and all worked. I've only done one with soldering iron and it worked with no problems. And that was with melting for a further minute or so after the status had changed (little did I know that meant it was unlocked!), so going by that it seems quite resilient. But as I said, time will tell... 

[DARKFiB3R]

Hi Jrmc0
 
I have a question too.
 
Couldn't you have taken the time to read through this thread first, before asking a question that has been answered over and over?
 
Regardless of that, do you not think if it was that easy, people would have been doing that ages ago, rather than taking the huge risk that this method presents?
 
Honestly, it's like an insult to Geremias intelligence. And everybody else that has been working on it at that level.

[tingedace]

Hi Geremia

Thank you, i have a question thou

couldn't we just short out pin 5 and pin 6 with a 100oh resistor and 3.3v???

Thanks

<wavy hand> These are not the pins you are looking for.

[Jrmc0]

Hi Jrmc0
 
I have a question too.
 
Couldn't you have taken the time to read through this thread first, before asking a question that has been answered over and over?
 
Regardless of that, do you not think if it was that easy, people would have been doing that ages ago, rather than taking the huge risk that this method presents?
 
Honestly, it's like an insult to Geremias intelligence. And everybody else that has been working on it at that level.

Was just asking man

[Jrmc0]

Hi Geremia

Thank you, i have a question thou

couldn't we just short out pin 5 and pin 6 with a 100oh resistor and 3.3v???

Thanks

<wavy hand> These are not the pins you are looking for.


Thanks Man wish it was easyer

[Pacote-san]

Hi Jrmc0
 
I have a question too.
 
Couldn't you have taken the time to read through this thread first, before asking a question that has been answered over and over?
 
Regardless of that, do you not think if it was that easy, people would have been doing that ages ago, rather than taking the huge risk that this method presents?
 
Honestly, it's like an insult to Geremias intelligence. And everybody else that has been working on it at that level.

Was just asking man

A really dumb question BTW.....

[iLLNESS]

No, JF didn't make a full-dump at it's 86 version,
I am sure ther will be a new version from jungle team guys wich could correct actual bugs & make the full-dump possible !!

Wait & see, thanks for the hard work doing by Geremia, maximus & his team, team Jungle, team xecuter & c4eva !!!
You're heros guys 

Slimkey creates a dummy
press read on an unlocked drive for a full dump!

I've tried the solder method yesterday (just to try it), didn't go as deep as the other i did with the dremel method, Looked all fine, got 0x00, could read fine, but write verification failed (a bit similar as yours Illness)
Relocked it, unlocked it again, got status 0xBC, 0x3C and even another one i cant remember.

Drive worked for 5 mins with backups, then only play dvd, so it's f***ed, had to replace the pcb.

I'm sticking to the dremel, and the occasional re-intro and waiting times. Feels safer to me, one slight twist with the soldering iron got me deeper in the chip then a soft press with the dremel

weird that it worked at all

so you replaced the whole pcb and all is well now? im in the midst of doing the pro ic. hoping that the pcb isnt screwed but i doubt that.

speaking of which, anyone here have any pro ic's in canada or can ship to canada? seems stocks are low or out just about everywhere.

[the-green]

No need for the 3.3v

Either with dremel or any other solution

thanks man 

[xfreaks]

Thanks Geremia for the briliant idea... i just done 2unit winbond without any error.
i didnt even use a dremmel for digging. )

[tingedace]

Thanks Geremia for the briliant idea... i just done 2unit winbond without any error.
i didnt even use a dremmel for digging. )

Can you provide details please?

[morenomdz]

http://www.youtube.com/watch?v=mSq-7OAyuRs

Have Fun with the Samba Nuke Unlock.