Possible to downgrade Pioneer BDR-XS07UHD from 1.02 to 1.01?

[mediacable]

After the upgrade from 1.01 to 1.02 every once in a blue moon, before LibreDrive is loaded, certain 4k discs will always give the following errors upon reading that did not happen on firmware version 1.01:

Linux dmesg output when a disc is inserted:

Code: Select all

[Wed Mar 29 16:24:58 2023] sr 6:0:0:0: [sr1] tag#0 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s
[Wed Mar 29 16:24:58 2023] sr 6:0:0:0: [sr1] tag#0 Sense Key : Illegal Request [current]
[Wed Mar 29 16:24:58 2023] sr 6:0:0:0: [sr1] tag#0 Add. Sense: Logical block address out of range
[Wed Mar 29 16:24:58 2023] sr 6:0:0:0: [sr1] tag#0 CDB: Read(10) 28 00 02 6c 6a bc 00 00 02 00 00 00
[Wed Mar 29 16:24:58 2023] critical target error, dev sr1, sector 162638576 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2

With the error being: Logical block address out of range

this repeats a few times and then the disc is recognized by MakeMKV.

After LibreDrive is loaded, I try to make an ISO backup using ddrescue and it'll consistently fail around 95 % of the way with IO errors about uncorrectable errors for the rest of the session.

If I run a ddrescue again it'll fail at the exact same position and both ISO images get the same md5sum.

The same disc run through the ASUS-BW-16D1HT and LG BP50NB40 does not give the same logical block address out of range errors and the ddescue attempts complete without error on each drive. The completed ISO on these drives have the same md5sum as the supposedly broken ISO from the Pioneer on firmware 1.02, so it appears the Pioneer is actually reading correctly despite the false errors and this appears to be a problem with the new Pioneer firmware or something possibly with LibreDrive?

My BluRay backup procedure is to remove bus encryption with MakeMKV LibreDrive, use ddrescue to backup the disk, and then create a par2 file from the ISO, as to how I found this out. This only happens with 4k discs, not regular BluRays or DVDs.

I noticed that just today (Mar-29th) Pioneer now has 1.03 firmware available - has anyone tested this, or is it possible to downgrade using MakeMKV's sdf flasher (since Pioneer's flasher doesn't let you downgrade)?

The latest 4k disc to do this is the new Shout Factory Exorcist III 4k disc, although it's happened to quite a few others since I upgraded to 1.02. I'll try to compile a list.

[Billycar11]

You ruined your drive for now it will need to be flashed down when the developer releases a way to do it.
Guys stop updating your firmware on products where we are using exploits the manufacturers are always trying to patch those.
viewtopic.php?f=19&t=30383

[mediacable]

The 1.0.2 upgrade was done when that firmware was released months ago after others confirmed no issue, unfortunately.

1.0.2 doesn't prevent the drive from working, it just complicates my backup procedure and limits the usefulness of the drive for the way I use it.

Thank you for the link to that discussion though with Mike, I'll bookmark it, keep tabs on it and hopefully downgrade will be possible soon!

[RibShark]

Late reply, but you can enable force-downgrading on the official flashing tool by changing the byte at 0x9F89 in the EXE from 0x00 to 0x01. This allowed me to flash from 1.02 firmware back to 1.01. No idea if this works with "patched" firmwares from December 2022 onwards, my guess is that it doesn't otherwise it would have been found already; not willing to test it myself.

[MartyMcNuts]

Late reply, but you can enable force-downgrading on the official flashing tool by changing the byte at 0x9F89 in the EXE from 0x00 to 0x01. This allowed me to flash from 1.02 firmware back to 1.01. No idea if this works with "patched" firmwares from December 2022 onwards, my guess is that it doesn't otherwise it would have been found already; not willing to test it myself.

Nope. Doesn't work with the newer firmware versions. Tried that already.

[RibShark]

Late reply, but you can enable force-downgrading on the official flashing tool by changing the byte at 0x9F89 in the EXE from 0x00 to 0x01. This allowed me to flash from 1.02 firmware back to 1.01. No idea if this works with "patched" firmwares from December 2022 onwards, my guess is that it doesn't otherwise it would have been found already; not willing to test it myself.

Nope. Doesn't work with the newer firmware versions. Tried that already.

Thanks for confirming. I'm trying to do some reversing myself on the firmware but the entire thing seems encrypted based on the entropy. Though using a READ BUFFER command while the drive is in Kernel mode seems to give me back the same encrypted-looking firmware so maybe not? Very unsure what instruction set is even being used by these Renesas ICs.