DriveKit 1.0 Pioneer optical drive research toolkit :)

[babayaga]

DriveKit v1.0 — Pioneer Firmware Research Toolkit (Testers Wanted!)
Hi everyone!

I've been working on DriveKit, a small Windows command-line toolkit for researching Pioneer Blu-ray drive firmware, including firmware dumping, encryption/decryption, live firmware analysis, and experimental flashing/crossflashing.

After quite a bit of reverse engineering, I've released the current version on GitHub and would love to see how its research functions behave on other Pioneer drives.

So far, DriveKit has only been tested on my own three drives: BDR-211M, BDR-XD07U, and BDR-XD08U.

What I'd like people to test
I'm particularly interested in results from:

b0probe --0xB0 address-space diagnostic

b0scankey — Attempts to extract the internal Pioneer model identifier and firmware unlock key directly from live firmware.

b0dumpfw — Dumps the live firmware and extracts the Kernel and Normal regions.

Other diagnostic/research commands — Especially on Pioneer models I haven't tested myself.

Successful results are great, but failures and unexpected output are equally interesting! Different models and firmware generations may behave differently, and that's exactly what I'd like to investigate.

Please include your drive model, firmware version, and relevant command output when reporting results. Check logs for serial numbers or other unique identifiers before posting them publicly.

IMPORTANT — Flashing warning
DriveKit also supports firmware flashing and crossflashing, including post-cutoff to pre-cutoff downgrades, which I've successfully performed on my own hardware.

However, DriveKit deliberately bypasses the normal firmware compatibility and safety checks. This means it can potentially flash completely incompatible firmware (in case you are unsure about the firmware and if its the one you actually need) and permanently brick your drive.

I strongly discourage anyone from using the flashing functions unless they fully understand what they're doing and the risks involved. If you're considering a flash or crossflash, please discuss your exact drive and firmware combination with me first, and look at the userguide included with the exe, or github repo. There are quite a few flash commands in drivekit, and the ONLY one that should be used is

drivekit flash driveletter --file kernel --file2 normal (--patch for downgrading post to pre cutoff).

For now, I'm primarily looking for people willing to help test the research and diagnostic functions, not experimental flashing. I'm not that scared of flashing with it at all to be honest, but you really need to know exactly what firmware you need, not just guess, that can go wrong! That being said, i've managed to get out of all soft bricks that the drives have thrown at me for quite some time =)

(compiled EXE, readme and userguide - could be more extensive but its not)
https://mega.nz/folder/skNVTLAT#jlxH29zxBANHGZlwyv6CLw

Github repo:
https://github.com/babayaga40/DriveKit

From the day i started this project, I've kept more or less a diary in the github readme, and for those interested in hardware reseearch i would recommened reading it, even though it's a bit long and technical

Thanks to anyone willing to give it a try! I'm especially curious to see what the live firmware analysis reveals on other Pioneer models. Also remember, some drive commands enter kernel mode, and the drive must therefor be power cycled for a 30 second interval to get back on it's feet


cPix / Razor 1911

PS: I'm not trying to become a player in the flash toolkit war that has been around for a few weeks/months now, my work is open source, free to use by anyone, i have had great help with this project, all the proper greetings and credits are posted in the readme file, and i suggest you read at least that (bottom on the script). I'm far from finished with my toolkit and will be adding features and fun in the weeks to come, flashing is done more or less, but there are SO much undiscovered fun hiding behind each encrypted and non encrypted byte

[Yethidran]

hi buddy, i have 2 sets of original verbatim 43888 pioneer ud04 drives that cant read anything other than audio cds. i have practically broken up that useless verbatim casing and taken out the drives. what i wonder is, if anyone can reverse engineer the ud03 firmware to read uhds? then i could be your beta tester for these 2 drives. the original ud04 drives with the original ud04 firmware might be the issue. flashing up from original ud02 drives or original ud03 drives to become a ud04 works fine. i have cleaned the laserheads numerous times already.
and i also have a pioneer bdr-209xjb drive that i have bricked when i was testing out hardware family change flashing. that can also be used as a guinea pig for testing purposes.

[Yethidran]

okie, i downloaded your drive kit, but i dont know how to run command line stuff sadly. i clicked install but it doesnt open up at all. but thanks buddy. i guess yours and heisenbergs (couldnt run his kit too) kits are also using command line thingy's.. i will stick to mattjacksons flasher. cheers buddy.

[Yethidran]

i am using windows 11 pro. intel core i9 9900k coffee lake with native sgx installed.

[babayaga]

hi buddy, i have 2 sets of original verbatim 43888 pioneer ud04 drives that cant read anything other than audio cds. i have practically broken up that useless verbatim casing and taken out the drives. what i wonder is, if anyone can reverse engineer the ud03 firmware to read uhds? then i could be your beta tester for these 2 drives. the original ud04 drives with the original ud04 firmware might be the issue. flashing up from original ud02 drives or original ud03 drives to become a ud04 works fine. i have cleaned the laserheads numerous times already.
and i also have a pioneer bdr-209xjb drive that i have bricked when i was testing out hardware family change flashing. that can also be used as a guinea pig for testing purposes.

You must place the drivekit.exe somewhere on your PC, a folder you can easily get to. Then open a command prompt in windows (just search for it, you'll find it). If you have a bricked drive, maybe i can help you, I have flashed drives that should not work, but did But you have to run the program in a Command Prompt (DOS). Open bdrflash (or something equal) and you'll see your drive letter. run these commands and copy the text here:
drivekit info DRIVELETTER
drivekit b0scankey
Copy all text and paste it here, it should look like this:

C:\Firmware>drivekit b0scankey D
Opened: \\.\D:

+------------------------------------------+
| DRIVE INFORMATION |
+------------------------------------------+
Drive : \\.\D: |
Vendor : PIONEER |
Model : BD-RW BDR-XD07U |
Firmware : 1.06 |
FW Date : 24/10/09 |
AACS ver : 19 (0x13) |
Type : CD/DVD/BD optical |
Removable : Yes |
SCSI ver : 0 |
Serial : xxxx |
Mfg Date : April 2019 (seq:0072) |
Country : China (market: JP) |
Platform : SAT 8D31ID05 |
Kernel : ID05 |
Buffer : 4000 KB |
Max read : 11080 KB/s (~73x CD) |
Max write : 11080 KB/s (~73x CD) |
Mech type : Other |
Write cap : CD-R=Y CD-RW=Y DVD-R=Y |
Disc : No disc (0x0000) |
+------------------------------------------+

=== B0SCANKEY — 0xB0 live key extraction ===

Generation: POST-CUTOFF (offset 0xA5AAAA, 0xB0 from 0x100000)

WRITE BUFFER 0x41 offset=0xA5AAAA: GOOD
0xB0 ACCESSIBLE! Streaming to b0scankey_dump.bin...
Base[0..7]: 7A 07 00 00 04 00 07 80
Dumped 0x358000 bytes...
Reached cap — stopping stream.

Total dumped: 0x360000 bytes to b0scankey_dump.bin

Scanning Normal region for key pattern...
Normal[0..15]: 50 49 4F 4E 45 45 52 20 42 44 52 2D 42 44 53 37 (PIONEER OK)


+--------------------------------------------------+
| B0SCANKEY — LIVE FIRMWARE IDENTIFICATION |
+--------------------------------------------------+
Physical drive : BDR-XD07U
Internal model identifier : PIONEER BDR-BDS7
Internal model source : Normal +0x000000
Platform : SAT 8D31
Kernel ID : ID05
Firmware revision : 1.06

Keyed handler matches : 1
Key bytes offset in Normal : 0x3BFEC
Reject branch variant : 10-byte
Unlock key (wire order) : B1 27 8A FF
Unlock key (LE DWORD) : 0xFF8A27B1

Cross-check : MISMATCH
Key-table value : 0x6123789A

=== B0SCANKEY DONE ===

Good luck!

[Yethidran]

Sorry buddy, i tried, but i failed.. i really am a "Noob" with this "Command Line Thingy" . DriveKit folder is on my desktop itself, but cant run it at all. it keeps closing up within a micro second. no way of running it or writing command lines into it.

[babayaga]

Sorry buddy, i tried, but i failed.. i really am a "Noob" with this "Command Line Thingy" . DriveKit folder is on my desktop itself, but cant run it at all. it keeps closing up within a micro second. no way of running it or writing command lines into it.

It's supposed to do that when you try running it in windows, you need to enter the dos command prompt, first you can try, is click the windows button and R - then type the command CMD and hit enter, then you should be in dos, if you are in discord i can maybe try and help you in real time, i think that would be best, espscially if you want to flash, my tool isn't made to be easy either, it's intended to be a huge tool kit

[gwhitcombe71]

If you are in discord i can maybe try and help you in real time, i think that would be best, espscially if you want to flash, my tool isn't made to be easy either, it's intended to be a huge tool kit

babayaga mate, fair enough on the discord offer, but reckon id just get him to try running it as admin first or sticking it in a folder with no spaces in the path... thats usually whats tripping up noobs with these cmd tools, not the tool itself. had the same bother years back trying to flash a router, turned out to be summat daft like that

[jinx100]

Here's some output from my BDR-X13UBK. I've removed repeats of the info output and the ASCII graphics.

Code: Select all

From MakeMKV:

Drive Information
OS device name: F:
Manufacturer: PIONEER
Product: BD-RW BDR-X13
Revision: 1.04
Serial number: ############
Firmware date: 2023-08-01
Bus encryption flags: 1B
Highest AACS version: 81

LibreDrive Information
Status: Enabled
Drive platform: RS9400
Firmware name: PIONEER BDR-213T
Firmware type: Original (unpatched)
Firmware version: 1.04/ID56
DVD all regions: Yes
BD raw data read: Yes
BD raw metadata read: Yes
Unrestricted read speed: Yes

No disc inserted

--------------------

PS C:\Programs\DriveKit> C:\Programs\DriveKit\drivekit.exe info F


  +------------------------------------------+
  |  DRIVE INFORMATION                       |
  +------------------------------------------+
  Drive     : \\.\F:                      |
  Vendor    : PIONEER                     |
  Model     : BD-RW   BDR-X13             |
  Firmware  : 1.04                        |
  FW Date   : 23/08/01                    |
  AACS ver  : 27 (0x1B)                   |
  Type      : CD/DVD/BD optical           |
  Removable : Yes                         |
  SCSI ver  : 0                           |
  Serial    : ############                |
  Mfg Date  : May 2004 (seq:3012)         |
  Country   : China                       |
  Platform  : SAT 9400ID56                |
  Kernel    : ID56                        |
  Buffer    : 4000 KB                     |
  Max read  : 22160 KB/s (~147x CD)       |
  Max write : 22160 KB/s (~147x CD)       |
  Mech type : Other                       |
  Write cap : CD-R=Y CD-RW=Y DVD-R=Y      |
  Disc      : No disc (0x0000)            |
  +------------------------------------------+

=== INQUIRY ===

  Vendor   : PIONEER
  Model    : BD-RW   BDR-X13
  Firmware : 1.04
  Type     : CD/DVD/BD optical
  Removable: Yes

-------------------------------------------------------

PS C:\Programs\DriveKit> C:\Programs\DriveKit\drivekit.exe b0probe F

=== B0PROBE — 0xB0 address-space diagnostic ===

  Generation : POST-CUTOFF

  Enabling 0xB0 access...
  GET EVENT STATUS mask=0x5A : OK
  GET EVENT STATUS mask=0x58 : OK
  GET EVENT STATUS mask=0x50 : OK
  GET EVENT STATUS mask=0x40 : OK
  WRITE BUFFER 0x41 : OK
  READ BUFFER 0xF4  : OK

  Probing (sequential walk from 0x100000):
  Address / label                                       Status     First 16 bytes
  ----------------------------------------------------------------------
  0x100000  base (dump file offset 0x000000)          DATA
      7A 07 00 00 04 00 07 80 01 41 07 07 7A 00 00 00
  0x300000  expect: zeros/gap before kernel           all-00                 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x400000  kernel start (dump file 0x300000)         DATA                   7A 07 00 00 80 00 1A 80 01 00 6B A0 00 00 01 40
  0x408000  kernel+0x8000                             DATA                   6D F4 79 37 00 38 0F 83 0F 94 0F A5 0F F0 79 10
  0x410000  Normal start (dump file 0x310000)         DATA                   50 49 4F 4E 45 45 52 20 42 44 52 2D 32 31 33 54
  0x418000  Normal+0x8000                             DATA                   FC 01 17 50 72 78 0D 06 79 0C 00 20 19 0C 7A 02
  0x440000  Normal+0x30000                            DATA                   02 CE 6E 78 00 24 47 18 A8 10 47 14 6E 78 00 24
  0x448000  Normal+0x38000 (near key 0x3BCE6)         DATA                   6F F3 00 02 69 75 0D 5A 79 1A 00 05 0F B0 1A 91

Expected at 0x410000: 50 49 4F 4E 45 45 52 20  (PIONEER )
Expected at 0x44BCE6: D1 6C 92 A4               (key 0xA4926CD1)

=== B0PROBE DONE ===



PS C:\Programs\DriveKit> C:\Programs\DriveKit\drivekit.exe b0scankey F

=== B0SCANKEY — 0xB0 live key extraction ===

  Generation: POST-CUTOFF (offset 0xA5AAAA, 0xB0 from 0x100000)

  WRITE BUFFER 0x41 offset=0xA5AAAA: GOOD
  0xB0 ACCESSIBLE! Streaming to b0scankey_dump.bin...
  Base[0..7]: 7A 07 00 00 04 00 07 80
  Dumped 0x358000 bytes...
  Reached cap — stopping stream.

  Total dumped: 0x360000 bytes to b0scankey_dump.bin

  Scanning Normal region for key pattern...
  Normal[0..15]: 50 49 4F 4E 45 45 52 20 42 44 52 2D 32 31 33 54   (PIONEER OK)


  +--------------------------------------------------+
  |  B0SCANKEY — LIVE FIRMWARE IDENTIFICATION        |
  +--------------------------------------------------+
  Physical drive                : BDR-X13
  Internal model identifier     : PIONEER BDR-213T
  Internal model source         : Normal +0x000000
  Platform                      : SAT 9400
  Kernel ID                     : ID56
  Firmware revision             : 1.04

  Keyed handler matches         : 1
  Key bytes offset in Normal    : 0x3C052
  Reject branch variant         : 10-byte
  Unlock key (wire order)       : E8 80 47 C7
  Unlock key (LE DWORD)         : 0xC74780E8

  Cross-check                   : MISMATCH
  Key-table value               : 0x6123789A

=== B0SCANKEY DONE ===



PS C:\Users\ken> C:\Programs\DriveKit\drivekit.exe b0dumpfw F


=== B0DUMPFW — live Kernel + Normal firmware extraction ===

  Drive    : BDR-X13
  Kernel ID: ID56
  Platform : 9400
  FW rev   : 1.04
  Generation: POST-CUTOFF (offset 0xA5AAAA)

  Output prefix: pioneer_BDR-X13_ID56_9400_1.04

  WRITE BUFFER 0x41: GOOD
  0xB0 open! Streaming 4.9 MB to pioneer_BDR-X13_ID56_9400_1.04_raw.bin...
  Streamed 0x4D8000 / 0x4D9E00 bytes...
  Cap reached (0x4E0000 bytes).
  Raw dump: pioneer_BDR-X13_ID56_9400_1.04_raw.bin (5111808 bytes)

  Extracting pioneer_BDR-X13_ID56_9400_1.04_kernel.bin  (0x010000 bytes from offset 0x300000)...
    written.
  Extracting pioneer_BDR-X13_ID56_9400_1.04_normal.bin  (0x1C9E00 bytes from offset 0x310000)...
    Header: PIONEER  OK
    Model identifier (payload[0..15]): PIONEER BDR-213T
    written.
  Sidecar  : pioneer_BDR-X13_ID56_9400_1.04_info.txt

  +--------------------------------------------+
  |  B0DUMPFW RESULT                           |
  +--------------------------------------------+
  pioneer_BDR-X13_ID56_9400_1.04_kernel.bin
    64 KiB  (live B0 0x400000)
  pioneer_BDR-X13_ID56_9400_1.04_normal.bin
    1831 KiB  (live B0 0x410000)
  pioneer_BDR-X13_ID56_9400_1.04_raw.bin
    5111808 bytes  (full sequential dump)

=== B0DUMPFW DONE ===

Notice the "MISMATCH" in the scankey "CrossCheck".