Drive Kit 1.0 - pioneer flasher

[babayaga]

I've made a flasher for pioneer drives, basically i'ts a easy mod, problem is having all the current firmwares for crossflashing. Im not going to release the firmwares, as long as im not allowed to, but i want this project to be open source and can be further upgraded, and also ported to linux, even though i have used windows heavily in the development, this is the about information about the flasher, i can share code with people that are interessted in actually helping out coding. I also have autoflash function, but still its not, because im afraid of bricking drives, so there are a few questions before flashing actually commence. This is the about file, contact me if you want to be developing for it, and that we can make it open source in time!

Code: Select all

C:\firmware>drivekit about

 ▄▀▄▄▄▄                                           ▀▄▀▄▄ ▄█▄▀         ▄▀▄▄
     ███■██▄▀               ▄                         █▓██ █▓██    ■▄   █▓█▐
  ▄▄■▐░██ █▓█▌▀▀▀▄▄▄▄▄▄■▄██▀▄ ▀▀▄▀▀▀▄▄▄▄▀▀▀▄▄▄▀▀▀▄▄▄▄▄▐░██ █░█▌▄■██▀ ▄▄▄▐░█▌▄▀▀▀
     █▒██ ████ ▀▄▄▄  ▄▄  ▄▄▄▄ ▄▀▄■ ▀▄▄▄  ▄▀▄▄▄▄▄▀      █▒██■█▒█  ▄▄▄▄ ▄▄▄█▒██▄▄▀
     █▓██ ██▓▌ █▓█■▄██▓█ ▌▓▌█ █▓██ █▓█▌ █▓▓▓██▓█▌      █▓███▓█▌  █▓██ ▄███▓█████
     █▓██ ██▓█ █▓████▓▓█ █▓█▐ █▓█▌ █▓██ ▌▓█▌  █▓█     ▐ ▓███▓██▓█   █▓█▐   ■█▓██  ▄
     █░██ ██░█ █░██  ▀▀■ █░██ █░█▐ █░█ ▌█░██▄▄██▀ ▀    █░████░▌  █░██   ▐▌░█▐
     █▒██ ██▒█ █▒█▐      █▒█▄ █▒██ █▒██ ▐▒██           █▒██■█▒█  █▒██    █▒█▐
    ▐▐▒█▐ ██▒ ▌█▒█■     ▐▌▒██ █▒██■█▒█▐ █▒█▐▄■▄▄ ▄    ▐▐▒██ █▒█▌ █▒█■   ▐█▒▒█▄
     █▓██ ██▓█ █▓██      █▓█▀ ▀████▓█▀ ▀████▀█      █▓██ █▓██ █▓██    ▀██▓█▓█
  ▄▄ █▓██ ██▓█ ▄█▀▄▀ ▄▄▄ ▀▀▀▀ ▄ ▀▄▀▀▀ ▄▄▄ ▀▀▄▀▀▀ ▄▄▄▄▄ ▀▄▀▀ ▀■■▀  ▀▀▀ ▄▄▄▄ ▀▀▀▀▀■
     ▐▒██ ██▒█ ▄▄▄▄▄▀   ▀▀▀▀▀▀ ▀▄▄▄▀▀▀   ▀▀▄▄▄▀▀▀     ▀▄▄▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀    ▀▀▀▀▀▀
     █░██ ██░▌ Drive Kit v1.0           cPix / Razor 1911 (c) 2026
     █░██■██▀  Optical drive research toolkit
    ▄▀▀▀▀▀▀▄

=== ABOUT DRIVEKIT ===

  DriveKit is an optical drive research toolkit focused on
  Pioneer BD optical drives. It allows firmware flashing,
  drive identification, SCSI command probing and firmware
  analysis of Pioneer BD-R/BD-RE drives.

  Research & Development
  ----------------------
  The flash protocol was reverse engineered by capturing
  USB traffic between BDRFlash and Pioneer drives using
  Wireshark/USBPcap. Key findings include:

  - WRITE BUFFER mode=4 bufID=0xFF unlock sequence
  - Model string + key payload format
  - READ BUFFER 0xB0 kernel mode trigger bug
  - Drive family compatibility groups
  - Serial number manufacture date/country decode
    (full country table vs BDRFlash hardcoded China)

  Tools Used
  ----------
  Wireshark + USBPcap  - USB traffic capture
  IDA Pro + Hex-Rays   - BDRFlash reverse engineering
  hrtng IDA plugin     - Decompilation assistance
  x64dbg               - Dynamic analysis and debugging
  MSVC (cl.exe)        - Compilation

  Credits
  -------
  blackened2687        - BDRFlash / AutoFlasher author
                         Pioneer flash protocol pioneer :)
  MakeMKV community    - Drive testing and research
  rpc1dev              - DVRFlash open source reference

  Hardware Research
  -----------------
  Pioneer BD drives use the Renesas R8J32740 optical drive
  controller (confirmed via BDR-XD08 teardown). Firmware
  decompilation confirmed ARM Thumb-2 (ARMv6) instruction
  set compiled with GNU C++. No public datasheet exists for
  this custom Pioneer/Renesas OEM chip family. DriveKit is
  believed to be the first tool to document the R8J32740
  memory map and peripheral register layout through firmware
  analysis (ROM at 0xFF000000, peripherals at 0xFFFF1000).

  DriveKit v1.0 - cPix / Razor 1911 (c) 2026
  Optical drive research toolkit


                        /\
   Razor 1911   /__\   Since 1985
                      /\  /\
                    /__\/__\
C:\firmware>

as i said, at this point its closed source because there are legal issues around this, but do pioneer really care anymore?

these are all commands it takes at the moment, but remember, its a lot of debug commands which doesn't make this util EASY for newbies.

Code: Select all

Usage:
  drivekit <command> <drive_letter> [options]

Commands:
  inquiry       Read drive identity
  driveinfo     Full drive feature probe and profile list
  bdread        Query MMC feature 0x010C (BD Read)
  modepage      Dump mode page 0x2A (drive capabilities)
  probef0       Probe READ BUFFER IDs 0xF0-0xFF
  rawdump       Raw READ BUFFER dump
  combinedump   Dump 0xF4+0xFE into one combined file
  findsigs      Scan a file for firmware signatures
  unlock        Pioneer RS8801 service mode unlock
  resetdrive    Reset an unresponsive SATA drive
  probevendor   Probe vendor opcodes 0xC0-0xFF
  mt1959        HLDS/LG MT1959 probe
  discinfo      Read and parse BD/DVD disc information
  discstruct    READ DISC STRUCTURE (0xAD)
  probeb0       Read/decode RS8801 buffer 0xB0
  modelcheck    Pioneer model lookup
  keycheck      Vendor unlock key lookup
  probewb       Probe WRITE BUFFER modes/lengths for unlock
  brutekey      Try all known Pioneer keys to find correct one
  extract       Extract firmware blobs from BDRFlash.exe
  getresource   Extract kernel resources 131/132 from BDRFlash.exe
  autoflash     Auto-detect and flash firmware from firmware\ folder
                (detects Pioneer firmware by content, any filename)
  flashfw       Flash kernel+firmware to drive (NO disc!)
  sendfirmware  Send main firmware image (bufID=0xF0)
  triggerkernel Single READ 0xB0 trigger to enter kernel mode
  dumpfw        Trigger kernel mode and dump firmware (disc required)
  checkfw       Check drive firmware against drives.json database
  fwversion     Build BDRFlash-style firmware version string
  resetnormal   Return drive from kernel mode to normal mode
  about         About DriveKit and credits

Options:
  --bufid 0xF4  Buffer ID for rawdump (default 0xF4)
  --file  name  Output filename override

Examples:
  drivekit inquiry G
  drivekit unlock G
  drivekit brutekey G
  drivekit rawdump G --bufid 0xF4
  drivekit probef0 G
  drivekit findsigs firmware.bin

Note: Run as Administrator for drive access.

best regards,
babayaga.

sharpening the blade since 1985...

[tomty89]

I feel like some people might not like it for the fact that the development involved reverse engineering BDRFlash...

[babayaga]

I feel like some people might not like it for the fact that the development involved reverse engineering BDRFlash...

Yes, that i understand, but its freeware. im not releasing naything, and i got most cdbs from offical upgrades..

[tomty89]

I hope that this wouldn't sound offensive but I can't help but want to ask: in terms of like "layman interest" (i.e. getting a Pioneer drive crossflashed), is there currently any advantage of using this over BDRFlash? Or, does it aim at gaining one/some (e.g. "breakthrough" regarding post Dec 2022 firmware)? Or is it (going to be) more like a "universal tool that consist of a part that reimplements BDRFlash (with firmware "auto selection" -- a.k.a. autoflash?)"?

P.S. I guess what I was really trying to say is, it seems to me that the goal / focus of this project is unclear, but it's just the "judgemental reflex" of my brain got triggered, so don't mind me...

---

By the way, I just saw:

extract Extract firmware blobs from BDRFlash.exe
getresource Extract kernel resources 131/132 from BDRFlash.exe

I don't think BDRFlash.exe has any firmware / kernel embedded?

[babayaga]

I hope that this wouldn't sound offensive but I can't help but want to ask: in terms of like "layman interest" (i.e. getting a Pioneer drive crossflashed), is there currently any advantage of using this over BDRFlash? Or, does it aim at gaining one/some (e.g. "breakthrough" regarding post Dec 2022 firmware)? Or is it (going to be) more like a "universal tool that consist of a part that reimplements BDRFlash (with firmware "auto selection" -- a.k.a. autoflash?)"?

P.S. I guess what I was really trying to say is, it seems to me that the goal / focus of this project is unclear, but it's just the "judgemental reflex" of my brain got triggered, so don't mind me...

---

By the way, I just saw:

extract Extract firmware blobs from BDRFlash.exe
getresource Extract kernel resources 131/132 from BDRFlash.exe

I don't think BDRFlash.exe has any firmware / kernel embedded?

[keydb_helper]

Pioneer BD drives use the Renesas R8J32740 optical drive
controller (confirmed via BDR-XD08 teardown). Firmware
decompilation confirmed ARM Thumb-2 (ARMv6) instruction
set compiled with GNU C++.

Your project sounds interesting babayaga but I'm not sure about this reference to ARMv6.

As I mentioned in May, my own experience reverse engineering and writing code for the R8J32740 has exclusively involved a variant of the H8S instruction set:

Hey babayaga, the modern Pioneer drives use a Renesas/Hitachi ISA. I'm not sure of the exact variant but it is pretty close to the H8S/2600.

IDA Pro can be used as a disassembler and there are out of tree plugins for Ghidra. If you'd like to use GNU binutils or GCC, the h8300s architecture is a solid choice for both (dis)assembly and compilation.

Is there a secondary ARMv6 chip within the Renesas SoC?

[babayaga]

Pioneer BD drives use the Renesas R8J32740 optical drive
controller (confirmed via BDR-XD08 teardown). Firmware
decompilation confirmed ARM Thumb-2 (ARMv6) instruction
set compiled with GNU C++.

Your project sounds interesting babayaga but I'm not sure about this reference to ARMv6.

As I mentioned in May, my own experience reverse engineering and writing code for the R8J32740 has exclusively involved a variant of the H8S instruction set:

Hey babayaga, the modern Pioneer drives use a Renesas/Hitachi ISA. I'm not sure of the exact variant but it is pretty close to the H8S/2600.

IDA Pro can be used as a disassembler and there are out of tree plugins for Ghidra. If you'd like to use GNU binutils or GCC, the h8300s architecture is a solid choice for both (dis)assembly and compilation.

Is there a secondary ARMv6 chip within the Renesas SoC?

There was a external rom decamped hat confirmed this, but it can ha been used before, i don' know, Im only doing is project because i didn't go on holiday to day, i spent my money on a wEW TV I will still use bilicar fir then new drives and i know he has put al ot of money info this, I'm hot cheap. More than you saw i was looking for newer drivers with locked drives, i only want to probe the shit out of those drives and see what i can find there are a nuvh of vendor modes on the pioneer, i want to know what it is! That's the whole story. I am a assembler programmer and a i have a good knowledge of electronics, so it shohouldnæt be that hard.
Thee

[babayaga]

I hope that this wouldn't sound offensive but I can't help but want to ask: in terms of like "layman interest" (i.e. getting a Pioneer drive crossflashed), is there currently any advantage of using this over BDRFlash? Or, does it aim at gaining one/some (e.g. "breakthrough" regarding post Dec 2022 firmware)? Or is it (going to be) more like a "universal tool that consist of a part that reimplements BDRFlash (with firmware "auto selection" -- a.k.a. autoflash?)"?

P.S. I guess what I was really trying to say is, it seems to me that the goal / focus of this project is unclear, but it's just the "judgemental reflex" of my brain got triggered, so don't mind me...

---

By the way, I just saw:

extract Extract firmware blobs from BDRFlash.exe
getresource Extract kernel resources 131/132 from BDRFlash.exe

I don't think BDRFlash.exe has any firmware / kernel embedded?

You are right, there are no firmware og kernel embedded, i just had to search. The version i posted here on the forum is v1, and it contains tons of useless functions i used when i was debugging and trying to figure stuff out. I was a bit shocked that pioneer firmware is not patched or done anything with, but that they have a number of firmwares that are UHD compatible, and can be crossflashed. My goal is the same as billy, to flash a "new" drive, but not for money, i do this for fun. Im over half way coding a flasher for linux as well.

[babayaga]

Pioneer BD drives use the Renesas R8J32740 optical drive
controller (confirmed via BDR-XD08 teardown). Firmware
decompilation confirmed ARM Thumb-2 (ARMv6) instruction
set compiled with GNU C++.

Your project sounds interesting babayaga but I'm not sure about this reference to ARMv6.

As I mentioned in May, my own experience reverse engineering and writing code for the R8J32740 has exclusively involved a variant of the H8S instruction set:

Hey babayaga, the modern Pioneer drives use a Renesas/Hitachi ISA. I'm not sure of the exact variant but it is pretty close to the H8S/2600.

IDA Pro can be used as a disassembler and there are out of tree plugins for Ghidra. If you'd like to use GNU binutils or GCC, the h8300s architecture is a solid choice for both (dis)assembly and compilation.

Is there a secondary ARMv6 chip within the Renesas SoC?

seems to be armv6 thumb 2