XboxHacker BBS
 
*
Welcome, Guest. Please login or register.
Did you miss your activation email?
May 26, 2013, 02:09:41 AM


Login with username, password and session length


Pages: « 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 »
  Print  
Author Topic: New BenQ drive found DG-16D2S FW 74850C  (Read 196522 times)
Arakon
Administrator
Xbox Hacker
*****
Posts: 6925


View Profile
« Reply #140 on: August 03, 2008, 12:38:08 PM »

c4e doesn't usually mess with chips, but firmware flash. although it might require an addon chip for an external firmware if the internal one really isn't flashable, though.
Logged

I do NOT give support by email, PM, ICQ or whatever. Anyone annoying me that way will have his balls removed. With a rusty butterknife. Slowly. And I'll enjoy doing it.
Schtrom
Master Hacker
****
Posts: 155


View Profile
« Reply #141 on: August 04, 2008, 05:16:00 AM »

I hope this helps in testing the new drive. Only tested a few cdbs under DOS 6.22. At least the TS-H943A does respond to the inquiry listed in the examples. Type cdb.exe for usage.

Download-Link:
http://rapidshare.com/files/134730184/cdb.exe.html

Thanks to TMF for support!
Logged

Wanna do real programming? Try MASM!
MODFREAKz
Master Hacker
****
Posts: 440



View Profile
« Reply #142 on: August 05, 2008, 07:06:15 AM »

*Update*

Pinout v1.1
MT1309E & MT1319L chipset


Logged

Geremia
Xbox Hacker
*****
Posts: 600


View Profile
« Reply #143 on: August 05, 2008, 11:26:15 AM »

i've not found any vendor specific ATA command in Benq fw

i've scanned ata commands (thanks to Schtrom for the dosflash sources), here are the supported by the DG-16D2S

08, A0, A1, E0, E1, E5, FC(this is vendor specific)

don't know which, probably E5 or FC, but after that the motor spins every second.

I've also bruted the parameters of ATA command 0x80 (the one used by dosflash and mtkflash)....ATA register "1F3"=2A is the standard for other MTK chips and does not work, but 2B, 2D, 2E are recognized.....but i had a bricked drive after 2E Sad
I hope to reasume it while bruting parameters Smiley
Logged
Geremia
Xbox Hacker
*****
Posts: 600


View Profile
« Reply #144 on: August 07, 2008, 02:03:05 PM »

Well, the patent says about a "path" to the host that can be IDE or SIO, tells about a download module, a check module and an erase module which can "erase embedded memory upon an erase_trigger signal".

Not sure if this erase_trigger is in fact the MTK "command of death" i sent, but it takes quite long to complete so is most supposed, and interesting is that after this cmd the status reg is 0x72, like all known MTK chips with embedded ram and external SPI (which are not already supported by any dos app like MTKflash or dosflash).
But the patent says also about a check module to allow/disallow embedded memory read/write to/from host, these checks can be against memory empty, memory writed with a pattern or just a crc check over all memory.
So, let me do some speculation:

- the 2E parameter triggered the erase module to erase all firmware
- the 2E parameter triggered an erase of the fw CRC, the fw could not boot cause of CRC fail, check module could allow memory access...but i/we don't know how to access flash of a MTK drive with 0x72 status.

BTW, this dead drive does not boot from an external SPI flash.
Logged
tech25
Newbie
*
Posts: 1


View Profile
« Reply #145 on: August 07, 2008, 04:29:35 PM »

tryed serial interface with MT1319L and MTK Tool 1.31
software make some communication with mcu,
result is: unknown flash
so this MTK Tool cant handle with MT1319L, i think this sw is made for mcu with external flash.
so probably theres way.. need datasheet.. Sad
The link that n00bpwner360 suggested for MTKPatcher is old
The newest version is this
Code:
http://newage.mpeg4-players.info/mt1389/tools/MT1389_Flasher_0.5.2.0.7z
Give it a try with this version
A good schematic for the cable is here
Code:
http://www.pioneerfaq.info/images/InstrukcjaEnglish_img_0.jpg
Code:
http://www.pioneerfaq.info/images/P3170367-liten.JPG

I have had a modded MTKTool version for some "persistent" DVD players...
I am not sure if it actually helps, but i'll have a look..

P.S. Found it..
There you go..
Code:
http://rapidshare.com/files/135656088/MtkTool235_mod.rar.html
« Last Edit: August 07, 2008, 04:33:53 PM by tech25 » Logged
bradsystem
Newbie
*
Posts: 7


View Profile
« Reply #146 on: August 09, 2008, 11:08:14 AM »

hi tech25: here are results from Flasher New Age,

setting 57600baud:
2008.08.09. 17:57:30.654   ---BEGIN---
2008.08.09. 17:57:30.654   Using:
2008.08.09. 17:57:30.654     TMT1389FlashThreads library v0.2.0
2008.08.09. 17:57:30.654     TMT1389Firmware library v0.5.3
2008.08.09. 17:57:30.654   COM1 (115200 bps) opened.
2008.08.09. 17:57:30.654   Configure player for speed...
2008.08.09. 17:57:30.654   COM1 closed.
2008.08.09. 17:57:30.670   COM1 (57600 bps) opened.
2008.08.09. 17:57:30.670   Detecting flash...
2008.08.09. 17:57:31.029   Flash type: Parallel
2008.08.09. 17:57:31.561   Flash type: Parallel
2008.08.09. 17:57:32.092   Unknown flash! (Vendor: 0xF8 Id1: 0xF8 Id2: 0xFF) (Type: New)
2008.08.09. 17:57:32.092   Reading...
2008.08.09. 17:57:32.107   Done.
2008.08.09. 17:57:32.107   Elapsed time: 00:00:00.016
2008.08.09. 17:57:32.107   Average reading speed: 0 bps
2008.08.09. 17:57:32.107   File saved.
2008.08.09. 17:57:32.107   COM1 closed.
2008.08.09. 17:57:32.279   Firmware error: Too small file
2008.08.09. 17:57:32.279   ---END---

once readed as:
2008.08.09. 17:57:32.092   Unknown flash! (Vendor: 0xF8 Id1: 0xFC Id2: 0xFF) (Type: New)

setting 115200baud:
2008.08.09. 18:02:27.455   ---BEGIN---
2008.08.09. 18:02:27.455   Using:
2008.08.09. 18:02:27.455     TMT1389FlashThreads library v0.2.0
2008.08.09. 18:02:27.455     TMT1389Firmware library v0.5.3
2008.08.09. 18:02:27.455   COM1 (115200 bps) opened.
2008.08.09. 18:02:27.455   Configure player for speed...
2008.08.09. 18:02:27.455   COM1 closed.
2008.08.09. 18:02:27.455   COM1 (115200 bps) opened.
2008.08.09. 18:02:27.455   Detecting flash...
2008.08.09. 18:02:27.846   Flash type: Serial
2008.08.09. 18:02:27.877   Flash type: Serial
2008.08.09. 18:02:27.893   Unknown flash! (Id1: 0xFF Id2: 0xFF Id3: 0xFF)
2008.08.09. 18:02:27.909   Reading...
2008.08.09. 18:02:27.909   Done.
2008.08.09. 18:02:27.909   Elapsed time: 00:00:00.000
2008.08.09. 18:02:27.909   Average reading speed: 0 bps
2008.08.09. 18:02:27.909   File saved.
2008.08.09. 18:02:27.909   COM1 closed.
2008.08.09. 18:02:28.096   Firmware error: Too small file
2008.08.09. 18:02:28.112   ---END---

MTKTool log:
LOG: Start to backup
LOG: Init Rs232 ...
LOG: Flash Type - Unknown Flash Type
LOG: Reading ...

but doesnt read anything.. just led blinking(RX,TX) when detecting flash type, then stop..
Logged
noob6969
Hacker
***
Posts: 64


View Profile
« Reply #147 on: August 09, 2008, 09:04:04 PM »

hi tech25: here are results from Flasher New Age,

setting 57600baud:

2
2008.08.09. 17:57:32.279   Firmware error: Too small file
2008.08.09. 17:57:32.279   ---END---


MTKTool log:
LOG: Start to backup
LOG: Init Rs232 ...
LOG: Flash Type - Unknown Flash Type
LOG: Reading ...

but doesnt read anything.. just led blinking(RX,TX) when detecting flash type, then stop..

is there anything at all in the "firmware error file"?

maybe a CRC result from the firmware? blind guess..... Just the patent refers to a word that verifies the memory after programming.
Logged
evll_panda
Newbie
*
Posts: 1


View Profile
« Reply #148 on: August 10, 2008, 11:56:50 AM »

I swapped my RROD 360 for a replacement and got this Drive Sad ! If anyone wants to swap for an older version of 360 PM me and let me know I will pay for shipping for both packages in the U.S. Thanks
Logged
marceloreisfreire
Newbie
*
Posts: 4


View Profile
« Reply #149 on: August 11, 2008, 11:29:14 AM »

Is there a way to update the LiteOn 16D2S Drive for PC...
see this http://us.liteonit.com/us/index.php?option=com_content&task=view&id=225&Itemid=99&limit=1&limitstart=2...

Well, if we use the programming used by this software that updates the drive on your PC, could not drive to update the same model (16D2S) which is in XBOX360?

From what I can see obviously that can be programmed, therefore, uses the same model of a drive upgradable the PC and with certainty because they updated the firmware to insert the key of the drives that are replacing within the microsoft...
Logged
Geremia
Xbox Hacker
*****
Posts: 600


View Profile
« Reply #150 on: August 11, 2008, 01:15:35 PM »

There is not a PC drive with embedded flash, as far as i know

For all other stuff, feel free to buy a new console and do your tests and (if you like to partecipate)report back results, like the rest of us.
Logged
LittleJonny
Master Hacker
****
Posts: 120

Master Hacker


View Profile WWW
« Reply #151 on: August 11, 2008, 07:07:22 PM »

57600baud
2008.08.09. 17:57:32.092   Unknown flash! (Vendor: 0xF8 Id1: 0xF8 Id2: 0xFF) (Type: New)

57600baud?Huh
2008.08.09. 17:57:32.092   Unknown flash! (Vendor: 0xF8 Id1: 0xFC Id2: 0xFF) (Type: New)

115200baud:
2008.08.09. 18:02:27.893   Unknown flash! (Id1: 0xFF Id2: 0xFF Id3: 0xFF)


Reading your logs bradsystem, I see you get different results each time you change the baud setting...if you leave the baud setting the same do you get the same results?

Logged

Croydon Victoria Australia.  -Master Surface Mount Solderer.....bring on the too hard!
n00bpwner360
Xbox Hacker
*****
Posts: 615


View Profile
« Reply #152 on: August 12, 2008, 04:29:38 PM »

Using the modified USB mass storage drivers for Xbox360 DVDROM drives and getting the LiteOn recognized in Windows, has anyone tried these programs to see what they can get?

http://club.cdfreaks.com/f44/flash-utility-liteon-based-optical-drives-v2-2-4-a-190420/
http://club.cdfreaks.com/f44/eeprom-utility-liteon-sony-cd-dvd-writers-v4-0-0-new-112103/
http://club.cdfreaks.com/f44/flash-utility-liteon-based-optical-drives-v2-2-4-a-190420/
Logged

yeah lowering the default reading speed from 12x to let's say 5x, would really let GTA4 (or any of your games) benefit from way less popups and loading times.
Geremia
Xbox Hacker
*****
Posts: 600


View Profile
« Reply #153 on: August 12, 2008, 04:49:24 PM »

Tried some weeks ago.
This app works only on liteon fw, the 360 drive has a benq fw.
It just send an inquiry 12 00 00 00 80 40 and reads the flash ID into the extended inquiry response.
To dump uses CDB DF

but again, our drive has a benq fw, does not accept both this liteon specific CDBs.
I doubt that fw can be read or writed simply with a couple of atapi commands, or just with an uart app like the one for MT1389, the point here is not googling for a solution.

Logged
n00bpwner360
Xbox Hacker
*****
Posts: 615


View Profile
« Reply #154 on: August 12, 2008, 05:07:45 PM »

So this is basically, a BenQ drive with a LiteOn sticker on it?
Logged

yeah lowering the default reading speed from 12x to let's say 5x, would really let GTA4 (or any of your games) benefit from way less popups and loading times.
ImmortalZ
Member
**
Posts: 21


View Profile
« Reply #155 on: August 13, 2008, 04:38:45 AM »

LiteOn owns Benq's ODD business. So yeah.
Logged
Geremia
Xbox Hacker
*****
Posts: 600


View Profile
« Reply #156 on: August 13, 2008, 10:07:01 AM »

Just to exclude some other possibility:
I measured voltage on each pin of the MT1319 and MT1309, the only difference is pin GIO6. On Mt1319 seems phisically disconnected and measures about 1,4v, while on the asus 818 (MT1309) goes directly to sata power connector pin11, which is "reserved" and grounded inside standard sata power cables.
I pulled it high or low, connected the asus SPI flash on the liteon, seems to not care, at least this seems not a magic switch to boot from external spi flash, maybe it's used for other purposes, or maybe not at all.
Logged
Kyo13
Member
**
Posts: 14


View Profile
« Reply #157 on: August 14, 2008, 06:53:51 AM »

Posted by C4eva on IRC two hours ago :

<c4eva> the end is near for lite-on!

Smiley
Logged
Geremia
Xbox Hacker
*****
Posts: 600


View Profile
« Reply #158 on: August 14, 2008, 09:09:06 AM »

I'm sure, and i'm also sure that c4e knows much more about FD debug commands, which now seem more interesting than before
Logged
asapreta
Hacker
***
Posts: 92


View Profile
« Reply #159 on: August 14, 2008, 10:39:04 AM »

I think he has already finished it.

He told me yesterday morning to have it 90%.

My best guess is that the fw to be used will be somewhat like the iXtreme for BENQs we have now. The major concern now may be the tool to read and inject the firmware on the Lite-On's MTK Controller.

This may be where c4eva is focused now. Who is helping him with this?! Or is he still a one man army?
Logged
Pages: « 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 »
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.11 | SMF © 2006-2009, Simple Machines LLC

Valid XHTML 1.0! Valid CSS! Dilber MC Theme by HarzeM