LibreDrive for Pioneer drives

[Coopervid]

Forget it.

[Woodstock]

If you feel it is possible, why have you not done it?

For the "average user", replacing the soldered-on chip to make it so that you can copy UHD disks seems excessive, but, if you're not an "average user", there is nothing preventing you from doing it.

[Billycar11]

Woodstock made it sound like in his last post that someone has already confirmed that desoldering and replacing chip works which is why I was open to doing it, my point was that its not a skills gap for me.

Is it confirmed that the renesas R8j32740fp42 has firmware?

I have not heard of many vendors putting firmware inside the main MCU as it normally increases the cost of production significantly.

Xbox 360 designers did this after they were compromised and the cost became worth it: https://youtu.be/U7VwtOrwceo?t=342

Would Pioneer do this? They are not custom vendor with too much chip design capability right? They buy mostly off the shelf parts like everyone else. The renesas chip, the motor control IC, everything else is off the shelf. Maybe the renesas chip had built in feature for flash (if confirmed that it has the flash)

Found this (looks like someone here probably took these pics): https://imgur.com/a/jMDrp0V

If you scroll all the way to the bottom pics you will see IC402 which is that AR15F6 chip. Looks like flash chip?

Anyway has someone already tried swapping chips with an old drive to see if it works?

How about reversing the flash program to see why it refuses to accept old firmware?

I'm not sure what holds the fw the 128 pin chip or the other one you mentioned.

Me and Marty tried some stuff with the flashers it always results in a soft brick we assume it's something like LG did with a downgrade check in the fw before it will flash as even if you force it to flash the drive soft bricks the only way is if someone knows how to decrypt the fw and can understand what's in it or like you say and off board programer but again do we need to put unencrypted fw on it? We don't have any of that

[snowkitten]

Hi
Is it possible for me to enable UHD reading on my drive, as i can see i have the old firmware... If i put in an UHD disk it just after a while tell me there is no disk.

Drive Information
OS device name: /dev/sr0
Manufacturer: PIONEER
Product: BD-RW BDR-XD05
Revision: 3.10
Serial number: ...
Firmware date: 2017-06-22
Bus encryption flags: 1B
Highest AACS version: 63

LibreDrive Information
Status: Enabled
Drive platform: RS8232
Firmware name: PIONEER BDR-XD05
Firmware type: Original (unpatched)
Firmware version: 3.10/ID34
DVD all regions: Yes
BD raw data read: Yes
BD raw metadata read: Yes
Unrestricted read speed: Yes

No disc inserted

Thanks in advance.

[boogiewoogie16787]

If you feel it is possible, why have you not done it?

For the "average user", replacing the soldered-on chip to make it so that you can copy UHD disks seems excessive, but, if you're not an "average user", there is nothing preventing you from doing it.

It would be nice to have some avenue to rescue new Pioneer drives and if this is possible then thats cool. If no one has actually successfully done it then fine thats understandable but Woodstock said in his original message, "If you replaced the chips, you could do it, but how many people want to desolder/solder chips?"

Look I need two things: A diagram of which chip to take off and the make/model of the programmer used to reprogram the chip. I can then do it.

Well the way he/she phrased it sounds like someone has done it and confirmed working. Have they or haven't they? If they have great, point me to a diagram/link and then i'll buy a drive and do it.

And if this method does work than you guys got yourself another small business opportunity: Reprogramming chips by mail. People can send you chips and you can flash them.

[boogiewoogie16787]

Ah very interesting! Thank you for the additional information!

I'm not sure what holds the fw the 128 pin chip or the other one you mentioned.

Because I am crazy, I was considering maybe getting a bad drive off of ebay, taking that AR15F6 off and sending it to one of these places:

https://diy-optics.com/products/laser-i ... on-service

https://www.outermost-tech.com/portal/t ... psulation/

Just putting these links out there in case anyone else is also crazy.

Not sure if we would get enough resolution but it would give us a good indication of if the chip is flash or not.

If the Renesas is a multi chip module (which if it does hold flash it could be) then maybe theres an opportunity to do another hack like the Kamikaze hack done on the 360.

Me and Marty tried some stuff with the flashers it always results in a soft brick we assume it's something like LG did with a downgrade check in the fw before it will flash as even if you force it to flash the drive soft bricks the only way is if someone knows how to decrypt the fw and can understand what's in it or like you say and off board programer but again do we need to put unencrypted fw on it? We don't have any of that

Sounds really cool! Thats awesome that you guys tried! I've been reading about decompilation but i've been focused on trying to help decompile old video games. My C knowledge is rusty from my CS days and I do Angular/Python coding at my job so its hard to master low level stuff unless I sacrifice all my free time. Its really hard so I appreciate the efforts you guys have dome!

Have you seen scanlime's videos discussing how she is reversing a Samsung Blueray drive? Her goal is not to break the encryption but to repurpose the drive for an art project. Still it goes into interesting techniques on making sense of firmware files, its 8 years old but still relevant: https://youtu.be/UTUYl-2g-r4?t=281

I really like how she loaded the firmware file into Photoshop of all tools and it allowed her to gather many insights into the structure of the file.

[Billycar11]

Ah very interesting! Thank you for the additional information!

I'm not sure what holds the fw the 128 pin chip or the other one you mentioned.

Because I am crazy, I was considering maybe getting a bad drive off of ebay, taking that AR15F6 off and sending it to one of these places:

https://diy-optics.com/products/laser-i ... on-service

https://www.outermost-tech.com/portal/t ... psulation/

Just putting these links out there in case anyone else is also crazy.

Not sure if we would get enough resolution but it would give us a good indication of if the chip is flash or not.

If the Renesas is a multi chip module (which if it does hold flash it could be) then maybe theres an opportunity to do another hack like the Kamikaze hack done on the 360.

Me and Marty tried some stuff with the flashers it always results in a soft brick we assume it's something like LG did with a downgrade check in the fw before it will flash as even if you force it to flash the drive soft bricks the only way is if someone knows how to decrypt the fw and can understand what's in it or like you say and off board programer but again do we need to put unencrypted fw on it? We don't have any of that

Sounds really cool! Thats awesome that you guys tried! I've been reading about decompilation but i've been focused on trying to help decompile old video games. My C knowledge is rusty from my CS days and I do Angular/Python coding at my job so its hard to master low level stuff unless I sacrifice all my free time. Its really hard so I appreciate the efforts you guys have dome!

Have you seen scanlime's videos discussing how she is reversing a Samsung Blueray drive? Her goal is not to break the encryption but to repurpose the drive for an art project. Still it goes into interesting techniques on making sense of firmware files, its 8 years old but still relevant: https://youtu.be/UTUYl-2g-r4?t=281

I really like how she loaded the firmware file into Photoshop of all tools and it allowed her to gather many insights into the structure of the file.

No never seen it but I put it on my watch list.

I don't see the decaping service doing any good

You never know when pioneers with old fw will no longer be available if you don't have one get a 212v ud04 or 03 and just email me for the flasher for now those can all still be flashed those are the last retail ones that can.

If you want the latest gen the only option is me Marty or asmcom.