Drive Kit 1.0 - pioneer flasher

[babayaga]

I've made a flasher for pioneer drives, basically i'ts a easy mod, problem is having all the current firmwares for crossflashing. Im not going to release the firmwares, as long as im not allowed to, but i want this project to be open source and can be further upgraded, and also ported to linux, even though i have used windows heavily in the development, this is the about information about the flasher, i can share code with people that are interessted in actually helping out coding. I also have autoflash function, but still its not, because im afraid of bricking drives, so there are a few questions before flashing actually commence. This is the about file, contact me if you want to be developing for it, and that we can make it open source in time!

Code: Select all

C:\firmware>drivekit about

 ▄▀▄▄▄▄                                           ▀▄▀▄▄ ▄█▄▀         ▄▀▄▄
     ███■██▄▀               ▄                         █▓██ █▓██    ■▄   █▓█▐
  ▄▄■▐░██ █▓█▌▀▀▀▄▄▄▄▄▄■▄██▀▄ ▀▀▄▀▀▀▄▄▄▄▀▀▀▄▄▄▀▀▀▄▄▄▄▄▐░██ █░█▌▄■██▀ ▄▄▄▐░█▌▄▀▀▀
     █▒██ ████ ▀▄▄▄  ▄▄  ▄▄▄▄ ▄▀▄■ ▀▄▄▄  ▄▀▄▄▄▄▄▀      █▒██■█▒█  ▄▄▄▄ ▄▄▄█▒██▄▄▀
     █▓██ ██▓▌ █▓█■▄██▓█ ▌▓▌█ █▓██ █▓█▌ █▓▓▓██▓█▌      █▓███▓█▌  █▓██ ▄███▓█████
     █▓██ ██▓█ █▓████▓▓█ █▓█▐ █▓█▌ █▓██ ▌▓█▌  █▓█     ▐ ▓███▓██▓█   █▓█▐   ■█▓██  ▄
     █░██ ██░█ █░██  ▀▀■ █░██ █░█▐ █░█ ▌█░██▄▄██▀ ▀    █░████░▌  █░██   ▐▌░█▐
     █▒██ ██▒█ █▒█▐      █▒█▄ █▒██ █▒██ ▐▒██           █▒██■█▒█  █▒██    █▒█▐
    ▐▐▒█▐ ██▒ ▌█▒█■     ▐▌▒██ █▒██■█▒█▐ █▒█▐▄■▄▄ ▄    ▐▐▒██ █▒█▌ █▒█■   ▐█▒▒█▄
     █▓██ ██▓█ █▓██      █▓█▀ ▀████▓█▀ ▀████▀█      █▓██ █▓██ █▓██    ▀██▓█▓█
  ▄▄ █▓██ ██▓█ ▄█▀▄▀ ▄▄▄ ▀▀▀▀ ▄ ▀▄▀▀▀ ▄▄▄ ▀▀▄▀▀▀ ▄▄▄▄▄ ▀▄▀▀ ▀■■▀  ▀▀▀ ▄▄▄▄ ▀▀▀▀▀■
     ▐▒██ ██▒█ ▄▄▄▄▄▀   ▀▀▀▀▀▀ ▀▄▄▄▀▀▀   ▀▀▄▄▄▀▀▀     ▀▄▄▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀    ▀▀▀▀▀▀
     █░██ ██░▌ Drive Kit v1.0           cPix / Razor 1911 (c) 2026
     █░██■██▀  Optical drive research toolkit
    ▄▀▀▀▀▀▀▄

=== ABOUT DRIVEKIT ===

  DriveKit is an optical drive research toolkit focused on
  Pioneer BD optical drives. It allows firmware flashing,
  drive identification, SCSI command probing and firmware
  analysis of Pioneer BD-R/BD-RE drives.

  Research & Development
  ----------------------
  The flash protocol was reverse engineered by capturing
  USB traffic between BDRFlash and Pioneer drives using
  Wireshark/USBPcap. Key findings include:

  - WRITE BUFFER mode=4 bufID=0xFF unlock sequence
  - Model string + key payload format
  - READ BUFFER 0xB0 kernel mode trigger bug
  - Drive family compatibility groups
  - Serial number manufacture date/country decode
    (full country table vs BDRFlash hardcoded China)

  Tools Used
  ----------
  Wireshark + USBPcap  - USB traffic capture
  IDA Pro + Hex-Rays   - BDRFlash reverse engineering
  hrtng IDA plugin     - Decompilation assistance
  x64dbg               - Dynamic analysis and debugging
  MSVC (cl.exe)        - Compilation

  Credits
  -------
  blackened2687        - BDRFlash / AutoFlasher author
                         Pioneer flash protocol pioneer :)
  MakeMKV community    - Drive testing and research
  rpc1dev              - DVRFlash open source reference

  Hardware Research
  -----------------
  Pioneer BD drives use the Renesas R8J32740 optical drive
  controller (confirmed via BDR-XD08 teardown). Firmware
  decompilation confirmed ARM Thumb-2 (ARMv6) instruction
  set compiled with GNU C++. No public datasheet exists for
  this custom Pioneer/Renesas OEM chip family. DriveKit is
  believed to be the first tool to document the R8J32740
  memory map and peripheral register layout through firmware
  analysis (ROM at 0xFF000000, peripherals at 0xFFFF1000).

  DriveKit v1.0 - cPix / Razor 1911 (c) 2026
  Optical drive research toolkit


                        /\
   Razor 1911   /__\   Since 1985
                      /\  /\
                    /__\/__\
C:\firmware>

as i said, at this point its closed source because there are legal issues around this, but do pioneer really care anymore?

these are all commands it takes at the moment, but remember, its a lot of debug commands which doesn't make this util EASY for newbies.

Code: Select all

Usage:
  drivekit <command> <drive_letter> [options]

Commands:
  inquiry       Read drive identity
  driveinfo     Full drive feature probe and profile list
  bdread        Query MMC feature 0x010C (BD Read)
  modepage      Dump mode page 0x2A (drive capabilities)
  probef0       Probe READ BUFFER IDs 0xF0-0xFF
  rawdump       Raw READ BUFFER dump
  combinedump   Dump 0xF4+0xFE into one combined file
  findsigs      Scan a file for firmware signatures
  unlock        Pioneer RS8801 service mode unlock
  resetdrive    Reset an unresponsive SATA drive
  probevendor   Probe vendor opcodes 0xC0-0xFF
  mt1959        HLDS/LG MT1959 probe
  discinfo      Read and parse BD/DVD disc information
  discstruct    READ DISC STRUCTURE (0xAD)
  probeb0       Read/decode RS8801 buffer 0xB0
  modelcheck    Pioneer model lookup
  keycheck      Vendor unlock key lookup
  probewb       Probe WRITE BUFFER modes/lengths for unlock
  brutekey      Try all known Pioneer keys to find correct one
  extract       Extract firmware blobs from BDRFlash.exe
  getresource   Extract kernel resources 131/132 from BDRFlash.exe
  autoflash     Auto-detect and flash firmware from firmware\ folder
                (detects Pioneer firmware by content, any filename)
  flashfw       Flash kernel+firmware to drive (NO disc!)
  sendfirmware  Send main firmware image (bufID=0xF0)
  triggerkernel Single READ 0xB0 trigger to enter kernel mode
  dumpfw        Trigger kernel mode and dump firmware (disc required)
  checkfw       Check drive firmware against drives.json database
  fwversion     Build BDRFlash-style firmware version string
  resetnormal   Return drive from kernel mode to normal mode
  about         About DriveKit and credits

Options:
  --bufid 0xF4  Buffer ID for rawdump (default 0xF4)
  --file  name  Output filename override

Examples:
  drivekit inquiry G
  drivekit unlock G
  drivekit brutekey G
  drivekit rawdump G --bufid 0xF4
  drivekit probef0 G
  drivekit findsigs firmware.bin

Note: Run as Administrator for drive access.

best regards,
babayaga.

sharpening the blade since 1985...

[tomty89]

I feel like some people might not like it for the fact that the development involved reverse engineering BDRFlash...

[babayaga]

I feel like some people might not like it for the fact that the development involved reverse engineering BDRFlash...

Yes, that i understand, but its freeware. im not releasing naything, and i got most cdbs from offical upgrades..