BP50NB40 (SVC NB40, MT1959) - rawflash says "Done successfully" but firmware stays at 1.03, tray dead

[powerbot]

Hello Marty,

I'm trying to recover an LG BP50NB40 drive and I'm out of ideas.

Drive information

* Model: HL-DT-ST BD-RE BP50NB40
* SVC: NB40
* Manufacture date: December 2016
* Original firmware: 1.00
* Platform: MT1959

What happened

1. Read original firmware successfully.
2. Flashed BP50NB40 NB50 1.03 MK successfully.
3. Tried to convert to BP60.
4. BP60 write appeared to succeed, but MakeMKV still reported BP50NB40 firmware 1.03.
5. I mistakenly ran Recovery afterwards.
6. Since then, the tray no longer works.

Current symptoms

* Windows detects the drive normally.
* MakeMKV detects the drive normally.
* Firmware version is always reported as 1.03.
* Pressing the eject button only flashes the LED about 10 times.
* The tray motor never moves.

LibreDrive information

Platform: MT1959

Firmware type: Patched (microcode access re-enabled)

Firmware version: 1.03

GUI Recovery

I tried Recovery with:

BP50NB40-NB40-1.00-Clean.bin

The GUI finishes in about 2 seconds with no error, but nothing changes.

Command line test

Command:

sdftool64.exe --all-yes -d G: rawflash -i "BP50NB40-NB40-1.00-Clean.bin"

Output:

Reading input file BP50NB40-NB40-1.00-Clean.bin

Flashing flags = 0x0

Current Drive ID: HL-DT-ST_BD-RE_BP50NB40_1.03_212005070917_MZ1H12D4814

Ready to write drive flash memory.

Operation started: Sending flash image to drive

100% Operation finished

Operation started: Programming flash

100% Operation finished

Done successfully

After unplugging and reconnecting

* Firmware is still 1.03
* Tray still does not move
* LED flashes only
* No motor activity

Additional diagnostics

Command:

sdftool64.exe -d G: dump auto -o C:\dump

Result:

dump_user_HL-DT-ST_BD-RE_BP50NB40_1.03_212005070917_MZ1H12D4814.tar

Only a 70 KB user dump is produced.

Command:

sdftool64.exe -d G: dump full -o C:\dump

Result:

Error: full dump is disabled in this firmware version

My questions:

1. Is there a recovery procedure specific to MT1959 / NB40?
2. Is the bootloader likely damaged?
3. Should I try rawflash with boot=MT1959 Boot BUP1 or any other flags?
4. Or does this indicate a hardware failure?

I can run any additional diagnostic commands or provide more information if needed.

Thank you very much.

[powerbot]

Additional test results:

I also tested the command line tool.

```
sdftool64.exe --all-yes -d G: rawflash -i "BP50NB40-NB40-1.00-Clean.bin"
```

The command completed with:

* Sending flash image to drive
* Programming flash
* Done successfully

However, after disconnecting and reconnecting the USB cable:

* Firmware is still reported as 1.03
* The tray still does not move
* Only the LED flashes approximately 10 times
* No motor activity at all

I also ran:

```
sdftool64.exe -d G: dump auto -o C:\dump
```

Result:

```
dump_user_HL-DT-ST_BD-RE_BP50NB40_1.03_212005070917_MZ1H12D4814.tar
```

(Only a 70 KB user dump was created.)

And:

```
sdftool64.exe -d G: dump full -o C:\dump
```

Result:

```
Error: full dump is disabled in this firmware version
```

[Billycar11]

Hello Marty,

I'm trying to recover an LG BP50NB40 drive and I'm out of ideas.

Drive information

* Model: HL-DT-ST BD-RE BP50NB40
* SVC: NB40
* Manufacture date: December 2016
* Original firmware: 1.00
* Platform: MT1959

What happened

1. Read original firmware successfully.
2. Flashed BP50NB40 NB50 1.03 MK successfully.
3. Tried to convert to BP60.
4. BP60 write appeared to succeed, but MakeMKV still reported BP50NB40 firmware 1.03.
5. I mistakenly ran Recovery afterwards.
6. Since then, the tray no longer works.

Current symptoms

* Windows detects the drive normally.
* MakeMKV detects the drive normally.
* Firmware version is always reported as 1.03.
* Pressing the eject button only flashes the LED about 10 times.
* The tray motor never moves.

LibreDrive information

Platform: MT1959

Firmware type: Patched (microcode access re-enabled)

Firmware version: 1.03

GUI Recovery

I tried Recovery with:

BP50NB40-NB40-1.00-Clean.bin

The GUI finishes in about 2 seconds with no error, but nothing changes.

Command line test

Command:

sdftool64.exe --all-yes -d G: rawflash -i "BP50NB40-NB40-1.00-Clean.bin"

Output:

Reading input file BP50NB40-NB40-1.00-Clean.bin

Flashing flags = 0x0

Current Drive ID: HL-DT-ST_BD-RE_BP50NB40_1.03_212005070917_MZ1H12D4814

Ready to write drive flash memory.

Operation started: Sending flash image to drive

100% Operation finished

Operation started: Programming flash

100% Operation finished

Done successfully

After unplugging and reconnecting

* Firmware is still 1.03
* Tray still does not move
* LED flashes only
* No motor activity

Additional diagnostics

Command:

sdftool64.exe -d G: dump auto -o C:\dump

Result:

dump_user_HL-DT-ST_BD-RE_BP50NB40_1.03_212005070917_MZ1H12D4814.tar

Only a 70 KB user dump is produced.

Command:

sdftool64.exe -d G: dump full -o C:\dump

Result:

Error: full dump is disabled in this firmware version

My questions:

1. Is there a recovery procedure specific to MT1959 / NB40?
2. Is the bootloader likely damaged?
3. Should I try rawflash with boot=MT1959 Boot BUP1 or any other flags?
4. Or does this indicate a hardware failure?

I can run any additional diagnostic commands or provide more information if needed.

Thank you very much.

Your drive was to old you need nb50/nb52
Recover with the old nb40 fw
Leave the drive unplugged untill you do the longer it's on with the wrong fw the more likely it is to be dead

[Sayaka]

Leave the drive unplugged untill you do the longer it's on with the wrong fw the more likely it is to be dead

Quoting this because it's important.

Recover with the old nb40 fw

That's what they did and it failed, apparently :

I tried Recovery with:

BP50NB40-NB40-1.00-Clean.bin

The GUI finishes in about 2 seconds with no error, but nothing changes.

I would suggest trying this (Billy, please feel free to correct me if I'm wrong) :

Code: Select all

sdftool64.exe --all-yes -d G: rawflash nocheck,boot="MT1959 Boot BUP3" -i "BP50NB40-NB40-1.00-Clean.bin"

[powerbot]

Thank you.

My drive identifies itself as:

mtk:19:59:BUP1

Wouldn't boot="MT1959 Boot BUP3" be for a different hardware revision?

Should I use BUP1 instead, or should I wait for Billy's recommendation?

[Sayaka]

You should use the boot ID of the firmware you want to replace, not the boot ID of the firmware you want to flash or the boot ID "of the drive" (this last one is the one that will likely be in the firmware dump if you do a firmware dump, for example).

When I read the boot ID of the firmware you wish to replace (BP50NB40 NB50 1.03 MK), at offset 0x3000 (you can check this by opening the bin file of this firmware you flashed, such as DE_LG_BP50NB40-NB50_1.03_MK.bin, with a hex editor), it says "MT1959 Boot BUP3".

So, it is very likely that "MT1959 Boot BUP3" is the boot code you should use for this command.

The worst case scenario with your situation if the wrong boot code is used, is likely that the flash will just fail with an error message, and in that case you can (and should) try the same command with "MT1959 Boot BUP1".

EDIT : if none of those two work, try doing a

Code: Select all

sdftool64.exe --all-yes -d G: rawflash "main,nowait,nocheck,boot=MT1959 Boot BUP3" -i "BP50NB40-NB40-1.00-Clean.bin"

and if that doesn't work a

Code: Select all

sdftool64.exe --all-yes -d G: rawflash "main,nowait,nocheck,boot=MT1959 Boot BUP1" -i "BP50NB40-NB40-1.00-Clean.bin"

instead. These are kind of the "ultimate recovery" commands for this drive.

For those, note the quotes around the entire command line argument and not just the boot ID.

If none of these work then this issue would be outside my range of knowledge, but I think your drive would likely be done for.

EDIT 2 : And to clarify, I was asking Billy for confirmation not because I was unsure about which boot ID you should be trying first, but because I was unsure if it was best to try rawflash nocheck,boot="[boot ID]" first or do the full recovery command rawflash "main,nowait,nocheck,boot=[boot ID]" right away.

[powerbot]

You should use the boot ID of the firmware you want to replace, not the boot ID of the firmware you want to flash or the boot ID "of the drive" (this last one is the one that will likely be in the firmware dump if you do a firmware dump, for example).

When I read the boot ID of the firmware you wish to replace (BP50NB40 NB50 1.03 MK), at offset 0x3000 (you can check this by opening the bin file of this firmware you flashed, such as DE_LG_BP50NB40-NB50_1.03_MK.bin, with a hex editor), it says "MT1959 Boot BUP3".

So, it is very likely that "MT1959 Boot BUP3" is the boot code you should use for this command.

The worst case scenario with your situation if the wrong boot code is used, is likely that the flash will just fail with an error message, and in that case you can (and should) try the same command with "MT1959 Boot BUP1".

EDIT : if none of those two work, try doing a

Code: Select all

sdftool64.exe --all-yes -d G: rawflash "main,nowait,nocheck,boot=MT1959 Boot BUP3" -i "BP50NB40-NB40-1.00-Clean.bin"

and if that doesn't work a

Code: Select all

sdftool64.exe --all-yes -d G: rawflash "main,nowait,nocheck,boot=MT1959 Boot BUP1" -i "BP50NB40-NB40-1.00-Clean.bin"

instead. These are kind of the "ultimate recovery" commands for this drive.

For those, note the quotes around the entire command line argument and not just the boot ID.

If none of these work then this issue would be outside my range of knowledge, but I think your drive would likely be done for.

EDIT 2 : And to clarify, I was asking Billy for confirmation not because I was unsure about which boot ID you should be trying first, but because I was unsure if it was best to try rawflash nocheck,boot="[boot ID]" first or do the full recovery command rawflash "main,nowait,nocheck,boot=[boot ID]" right away.

I now realize that when I first tried to move from BP50NB40-NB50-1.03MK to BP60NB10, I used WRITE instead of the RECOVERY procedure.

After that, the drive still identifies as BP50NB40 1.03, but the tray and motors are completely inactive.

I would suggest trying this (Billy, please feel free to correct me if I'm wrong) :
Code: Select all

sdftool64.exe --all-yes -d G: rawflash nocheck,boot="MT1959 Boot BUP3" -i "BP50NB40-NB40-1.00-Clean.bin"

Does this suggest that the drive is stuck in a mismatched boot/main firmware state?

Since the NB50 1.03 MK firmware appears to contain "MT1959 Boot BUP3" at offset 0x3000, would Sayaka's suggested command using boot="MT1959 Boot BUP3" be the correct first recovery attempt?

Also, if rawflash reports "Done successfully" but the drive still reports 1.03 after USB reconnect, does that imply the image was written to a non-active region, or that the boot context was wrong?

[Sayaka]

Perhaps I should provide a more thorough explanation.

As far as I know, it could very well be that no one is 100% sure what these commands will do in a case like this. It doesn't exactly happen every minute, after all (do a forum search for "nocheck" if you'd like to see : there are only 3 pages of results, and many of them are quotes and therefore duplicates). The whole rawflash "main,nowait,nocheck,boot=" thing was first posted by the author of MakeMKV here : viewtopic.php?p=96645#p96645. Please take a moment to read the first reply to mike admin as well.

I believe that what rawflash boot actually does is use a "fake" boot ID. Now, the original idea in the above thread was to use the boot ID of the firmware you want to flash. However, as it turns out, that doesn't seem to work : in this thread, it was the boot ID of the firmware that was supposed to be replaced that ended up working. People have used the "wrong" boot ID for crossflashing BP50NB40s, for example, and it worked. I've tested it myself many times on BP55EB40s.

The problem here, as I said, is that you are in a situation that is unusual compared to normal flashing or normal crossflashing. I suggested trying the boot ID of the firmware you want to replace first and foremost because logically, that's what has the highest probability of working. If you want to be 100% on the "official procedure for a case like this" side, I have to admit that mike admin's and Marty's default advice for a case like this would likely be to try MT1959 Boot BUP1 first and then MT1959 Boot BUP3, because it's the default procedure ("right" boot ID first, then "wrong" boot ID). Be aware, however, that in this case MT1959 Boot BUP1 is very likely to fail, and in fact it is very much possible that your drive is already "dead" and none of the four commands I suggested will work.

As for nocheck, it might be helpful because the tray doesn't respond. If the drive would normally have rejected the command due to an unresponsive tray, nocheck should hopefully bypass that.

I have no idea what nowait does, myself, but it seems to always be included with the "full recovery" command.

Also, if rawflash reports "Done successfully" but the drive still reports 1.03 after USB reconnect, does that imply the image was written to a non-active region, or that the boot context was wrong?

It implies that something went wrong and the flash failed. More than that, I do not know. The firmware experts might know.

If you're tired of waiting and want to follow the official procedure instead of what I think has the highest probability of working (and you might be right, I am a self-taught computer tech person with some flashing experience trying to find the most logical answer, but I am by no means a "firmware expert"), feel free to try "main,nowait,nocheck,boot=MT1959 Boot BUP1" first and then "main,nowait,nocheck,boot=MT1959 Boot BUP3".

If you decide to go through with any of the flashing steps, please let us know whether it worked, and which command worked.

EDIT : And if you're wondering why I suggested nocheck,boot instead of the full main,nowait,nocheck,boot command at first, it's because it's literally what worked for an unresponsive drive in a previous topic, with the "wrong" boot ID no less. It *was* for a special case of a slim drive crossflashed to desktop drive firmware though.

[powerbot]

Perhaps I should provide a more thorough explanation.

As far as I know, it could very well be that no one is 100% sure what these commands will do in a case like this. It doesn't exactly happen every minute, after all (do a forum search for "nocheck" if you'd like to see : there are only 3 pages of results, and many of them are quotes and therefore duplicates). The whole rawflash "main,nowait,nocheck,boot=" thing was first posted by the author of MakeMKV here : viewtopic.php?p=96645#p96645. Please take a moment to read the first reply to mike admin as well.

I believe that what rawflash boot actually does is use a "fake" boot ID. Now, the original idea in the above thread was to use the boot ID of the firmware you want to flash. However, as it turns out, that doesn't seem to work : in this thread, it was the boot ID of the firmware that was supposed to be replaced that ended up working. People have used the "wrong" boot ID for crossflashing BP50NB40s, for example, and it worked. I've tested it myself many times on BP55EB40s.

The problem here, as I said, is that you are in a situation that is unusual compared to normal flashing or normal crossflashing. I suggested trying the boot ID of the firmware you want to replace first and foremost because logically, that's what has the highest probability of working. If you want to be 100% on the "official procedure for a case like this" side, I have to admit that mike admin's and Marty's default advice for a case like this would likely be to try MT1959 Boot BUP1 first and then MT1959 Boot BUP3, because it's the default procedure ("right" boot ID first, then "wrong" boot ID). Be aware, however, that in this case MT1959 Boot BUP1 is very likely to fail, and in fact it is very much possible that your drive is already "dead" and none of the four commands I suggested will work.

As for nocheck, it might be helpful because the tray doesn't respond. If the drive would normally have rejected the command due to an unresponsive tray, nocheck should hopefully bypass that.

I have no idea what nowait does, myself, but it seems to always be included with the "full recovery" command.

Also, if rawflash reports "Done successfully" but the drive still reports 1.03 after USB reconnect, does that imply the image was written to a non-active region, or that the boot context was wrong?

It implies that something went wrong and the flash failed. More than that, I do not know. The firmware experts might know.

If you're tired of waiting and want to follow the official procedure instead of what I think has the highest probability of working (and you might be right, I am a self-taught computer tech person with some flashing experience trying to find the most logical answer, but I am by no means a "firmware expert"), feel free to try "main,nowait,nocheck,boot=MT1959 Boot BUP1" first and then "main,nowait,nocheck,boot=MT1959 Boot BUP3".

If you decide to go through with any of the flashing steps, please let us know whether it worked, and which command worked.

EDIT : And if you're wondering why I suggested nocheck,boot instead of the full main,nowait,nocheck,boot command at first, it's because it's literally what worked for an unresponsive drive in a previous topic, with the "wrong" boot ID no less. It *was* for a special case of a slim drive crossflashed to desktop drive firmware though.

Thank you, Billy and Sayaka, for your help.

I would like to make one last recovery attempt, but before I do, I'd like to confirm the correct procedure.

When you said "Recover with the old NB40 firmware", were you referring to the SDFtool GUI Recovery procedure, or to the rawflash recovery command:

rawflash "main,nowait,nocheck,boot=..."

Also, for my specific case, which boot ID sequence would you recommend?

1. MT1959 Boot BUP1 first, then BUP3 (the default procedure), or

2. MT1959 Boot BUP3 first, then BUP1 (because the current wrong firmware appears to use BUP3).

I'd like to follow the procedure you recommend before making what will probably be my final recovery attempt.

Thank you very much.

[Sayaka]

I would recommend sending a Private Message to either MartyMcNuts or Billycar11 at this point, as I cannot provide further assistance. I've just sent you a PM so hopefully that should enable your ability to use PMs if that was still "blocked".