Volume ID firmware patch for PX-B920SA/GGW-H20*/GGC-H20*

[kkloster21]

I got the patch to work! TomZ, you were right - I needed to run wine as root. in order to be able to do that i had to change the owner of wine and i was hesitant to do that because the common advice is that you should never run wine as root. but i did and it worked, and the patch has worked beautifully. I can get the VUKs now straight from aacskeys. Thanks Oopho2ei for the great patch and TomZ for your help with getting it going in linux! look for some new keys in the VUK thread ;)

[Oopho2ei]

I got the patch to work! TomZ, you were right - I needed to run wine as root. in order to be able to do that i had to change the owner of wine and i was hesitant to do that because the common advice is that you should never run wine as root. but i did and it worked, and the patch has worked beautifully. I can get the VUKs now straight from aacskeys. Thanks Oopho2ei for the great patch and TomZ for your help with getting it going in linux! look for some new keys in the VUK thread ;)
I am happy to read the patch works well for you. Regarding the issues you had with wine i would recommend you try to find a configuration which can run in user mode (maybe you need to update the device access rights with udev or whatever you use). Everything you download from the internet is potentially hostile and this update you ran as root could have trashed both your linux installation and your drive. :rolleyes:

If you encounter any problems reading new discs (MKBv10 or higher) with the patched firmware please report back so we can fix it.

And again i am not the only one who contributed to this patch so don't thank only me. :)

[kkloster21]

I don't run wine regularly - i installed it only for the purpose of patching my blu-ray drive. i've already changed ownership of wine back to regular user and executing that patch file was the only command i performed with wine using sudo or while it was under root ownership.

as far as encountering problems with new discs, i've had problems playing some of the discs that i've already gotten VUKs for, but i'm pretty sure that it's an issue with mplayer and or my audio codecs/sound card configuration. i'm not sure how i'll know that the problem is due to the patched firmware.

I saw that you said "we" when you talked about uploading the patch but I never saw you mention any other names of people who worked on the patch with you. Again, a big thanks to Oopho2ei and anyone else who worked on these drive patches!

[Oopho2ei]

as far as encountering problems with new discs, i've had problems playing some of the discs that i've already gotten VUKs for, but i'm pretty sure that it's an issue with mplayer and or my audio codecs/sound card configuration. i'm not sure how i'll know that the problem is due to the patched firmware.
Yeah i am having those problems sometimes too. It often helps to set a lot of parameters on the start of mplayer (eg. mplayer -demuxer lavf -ac ffeac3 -fps 24000/1001 -aid 5 ...). There is a linux version of tsmuxer which you can use to scan the container. I once had to patch mplayer so it would recognize the audio id to get English sound. Those are all playback issues (which will be fixed soon by the mplayer development team) and it's not related to the volume id. If the volume id is wrong then the resulting volume unique key is wrong and the "decrypted" blue ray content is all random garbage.

The only exception is currently BD+: There is currently no program which can decrypt a BD+ protected disc in linux but we are working on that. So if you are having problems playing back those discs it's not a problem with mplayer. You should be able to playback the movie for a few seconds and then mplayer is likely to crash. :)

[Oopho2ei]

A new patched firmware (version 04) for the drives GGW-H20N and GGW-H20L is available now.

[TomZ]

Oopho2ei> What is the update for ?

kkloster> Very happy to read the update was successfull !
you can try to use this flag with mplayer to help flawlessly video decoding (with dual-core) :
-lavdopts threads=2:skiploopfilter=all or -lavdopts threads=2:fast:skiploopfilter=all
check the cpu usage with top

bye

[Oopho2ei]

Oopho2ei> What is the update for ?
It's the same volume id patch for a more recent firmware released by LG. If you don't have any problems then you don't have to update. I would announce any change in the patch we apply. :)

[TomZ]

Ok, i think i will not apply this update as it doesn't seem to be necessary for my drive for now ;)

[TomZ]

This week-end i've just patched another LG drive under linux with wine. One more time, it has worked like a charm (new firmaware, version 04).
Thx...

[Wimpy]

I also confirm that flashing YL04 under Wine works, although I grabbed the MFC42.dll from the cab file below.

http://activex.microsoft.com/controls/vc/mfc42.cab

[frogman]

GGC-H20L version 1.03 firmware for LG Dual Drive unit BluRay / HDDVD upgrade from 1.02 ---1.03 was eazy peeze.

Thank-you
PS.
I'm off to buy some BD+ disc in the morning. Oopho2ei any title you think might help the "open source project out just post your wish list. I was looking over the list myself. I was hoping to find the Forth of July "Independence Day by Fox, but I didn't see it in the list? Is it a BD+ Title.

edit: 2008.mar.11 Independence Day BD+ off to the store.

[evdberg]

Did anybody try to do this firmware update using Parallels? Or would it be better to use Bootcamp? Or is there a native firmware upgrade tool for OS-X?

[Oopho2ei]

Did anybody try to do this firmware update using Parallels? Or would it be better to use Bootcamp?
I suggest that everyone who tries to update the drive firmware should use a (temporary) windows installation. Maybe you can setup VMware with scsi/atapi passthrough enabled if you don't want to create a separate windows partition. This should always work (theoretically). I haven't tested it though.

Or is there a native firmware upgrade tool for OS-X?
Not that i know of.

[evdberg]

The reason I asked is that when I use the drive in Parallels, the VM session gets really slow. So I wonder if somebody successfully upgraded his drive using Parallels.

[raymondtrudeau]

hi is there a patch for liteon drives? thank you

[ggking7]

Which one of these patch-able drives would you guys recommend? Is there a clear winner?

[jpoet]

A new patched firmware (version 04) for the drives GGW-H20N and GGW-H20L is available now.

I just bought a GGW-H20L. Looks like the firmware is up to version 05. Once again, the new version is suppose to improve it's writing algorithm.

John

P.S. Thanks to everyone for their hard work!

[loo3aem3ON]

I can't edit the first posting so here are the updates:

Patched firmware for GGW-H20N: GGWH20N version XL05 (http://uploaded.to/?id=9degpr)
Patched firmware for GGW-H20L: GGWH20L version YL05 (http://uploaded.to/?id=fdfl6w)

[ggking7]

I'm having trouble patching my GGW-H20L in linux via wine. I'm running wine as root (which is generally not a good idea), and the only way the patch program will detect the drive is if I mount it. It won't patch in that state though because it tells me to remove the disc. Does anyone know how to fix this?

[ggking7]

Fixed this by changing the /dev/cdrom link from /dev/hda to /dev/sr0.

[loo3aem3ON]

Thanks for your replies. I've tried to read the number with a patched drive (cmd AD handler is modified) and for format code 81h i get:
Fixed format, current; Sense key: Illegal Request
Additional sense: Cannot read medium - incompatible format

format code 82h:
Fixed format, current; Sense key: Illegal Request
Additional sense: Invalid field in cdb
Sense Key Specific: Error in Command byte 7

I can't tell if the results would be any different after successful authentication.
I remember that i had the same results when i tried it with BD-ROM's and HD-DVD's, however i got a (somehow wrong looking) MediaID when using a non-AACS protected BD-RE. The MediaID should be present on recordables while the Volume ID is not.

However, i can't reproduce this behavior right know and i don't know why, the only thing i changed is that i have the patched YL05 firmware and that this time i misused aacskeys instead of DumpVID :confused:. Now i always get sense code 5/6F/00 - Authentication Failure.

I have also tested it now using my good old MKBv1 HD-DVD drive with aacs authentication and in that case (and using the XBox hack) i got in both cases 5/6F/01 - Key not present.

I've just tried a recordable media and i get a good looking media id but again no Pre-recorded Media Serial Number (as expected) and no volume id (as expected). So it looks to me the patch is working fine. The PMSN is optional according to the aacs specification and it seems it's not present?

[sl1pkn07]

hello

i have a (new) LG GGC-H20L, this firmware is now necesary for dumping BD discs?

the dumpHD 0.60 make me error

The given Host Certficate / Private Key has been revoked by your drive.

[loo3aem3ON]

i have a (new) LG GGC-H20L, this firmware is now necesary for dumping BD discs?
No it's not required if you can authenticate properly. The certificates used for authentication can be revoked. A patched drive doesn't require authentication and will grant you access to protected data on the disc (volume id etc) in any case. If you have no idea of what i am trying to tell you should better use AnyDVD-HD.

[sl1pkn07]

i'm linux user. Anydvd-hd not works for me

[Doom9]

@sl1pkn07: the first post in the DumpHD thread links to detailed instructions on how DumpHD is to be used. I just added a few words about the aacsbypass (patched firmware) and use on Linux.

[kaldi]

Is there anywhere to discuss other firmwares being hacked, make requests, or figure out how to help?

[loo3aem3ON]

Is there anywhere to discuss other firmwares being hacked, make requests, or figure out how to help?
Either in the current thread or in this (https://forum.doom9.org/showthread.php?t=144838) one.

[lchiu7]

Just to get my head around this. I also have a GGC-H20L drive in which the given Host Certficate / Private Key has been revoked by the drive.

Not a problem I thought. Either the discs own have published keys or I can use dumpvid and PowerDVD7 (OEM which came with my drive) to get the keys. And it's not like there is an increasing number of HD-DVD titles coming onto the marketplace!

That works fine for BluRay discs - alas the OEM version of PDVD7 that comes with the drive cannot play HD-DVD's (strange since it is a dual format drive) so I can't use dumpvid.

So I guess I have to flash the drive? Not sure which firmware the drive has and no idea how to find out but I suspect given the drive was purchased middle of last year. it's 1.02 so I need the 1.02 firmware hack?

I also downloaded 1.03 from LG's site in case the flashing doesn't work so I can get the drive back to a normal conditio (I hope)

Does this sound like the right strategy?

Thanks

[edit]

OK - tried to patch the drive (Vista) and the patch program can't find the drive. The dropdown list is empty?

Are you supposed to patch the drive when it's in safe mode? I know the drive is there - I use it all the time!

[update]

I think I need to do more experimenting before posting!

Got the drive into safe mode and this time the patch found the drive. But not sure (and too late to check now) if it was because the drive had firmware 1.03 already (not 1.02) and I was using the wrong patch.

Anyway the patch worked and now aacskeys also works and dumpvid no longer required

So I am pretty satisfied now

[KenD00]

The firmwares you can find in this thread and the new (http://forum.doom9.org/showthread.php?t=144838) thread are not patches for the existing firmware on your drive but patched complete firmwares, you can grab the latest one and use it just like you would use the original firmware from the vendor.

:rolleyes:

[lchiu7]

The firmwares you can find in this thread and the new (http://forum.doom9.org/showthread.php?t=144838) thread are not patches for the existing firmware on your drive but patched complete firmwares, you can grab the latest one and use it just like you would use the original firmware from the vendor.

:rolleyes:

I see. Then not entirely sure why the patching didn't work at first - could not find a drive until I rebooted my machine and set the drive into safe mode.

Anyway all is fine now so appreciate all the great work done by folks to free us from the DRM shackles:thanks:

[loo3aem3ON]

Then not entirely sure why the patching didn't work at first - could not find a drive until I rebooted my machine and set the drive into safe mode.
I was told it's possible to flash the drive with the firmware of a different model when in safe mode. Please double check that you downloaded the right firmware for your drive model. It should detect the drive in windows even when not in safe mode. If it doesn't something is wrong and you should report this here.

[lchiu7]

I was told it's possible to flash the drive with the firmware of a different model when in safe mode. Please double check that you downloaded the right firmware for your drive model. It should detect the drive in windows even when not in safe mode. If it doesn't something is wrong and you should report this here.

I can't really repeat the process (since the drive is correctly flashed) but when I tried both flash images as posted on this thread, they came up with not finding the drive. And I am 100% sure I had the right flash files.

It was only after I booted up in safe mode that the flash files found the drive and I was able to update the firmware. Could just be quirk on my machine - not sure really.

Just happy that it all worked out fine in the end.

[gringo5]

Hi,

I think I trashed my GGC-H20L. Tried to apply the 1.03 patch from doom9-forum with the patching-tool under wine. It does 'something' for about 20 secs and then fails with:
Code:
>Updating was failed. Please repeat that. (Error data = 70 00 >04 00 00 00 00 10 0A 00 00 00 8F 81 00 00 00 00 00 00 00 00 >00 00 )

After the failed process it's blue light flashes in a constant rythm.
After a restart it makes no 'bios'-noise and no light - it always identifies itself (in Gentoo Linux and the flashing prog) as
Code:
>D: HL-DT-ST BDDVDRW GGC-H20N COR4

At the end I've tried in windoze: same error as mentioned above.
I've tried all available versions 1.02/1.03 of official and patched firmware. No success.
However I can bring it into so called 'safe-mode' if I hold the 'eject'-button at startup - it changes nothing though (besides it gets the drive blinking again).

Has anyone had something like this? Do I have to trash it - oh man, it is still brand new :´(
Any help much appreciated!

[loo3aem3ON]

I think I trashed my GGC-H20L. Tried to apply the 1.03 patch from doom9-forum with the patching-tool under wine. It does 'something' for about 20 secs and then fails with:
Double check that you downloaded the correct firmware. Look at the drive cover for the model/version string. Is the drive empty? Watch the blinking closely and see if you can identify a pattern (e.g. does it blink like 10 times and then there is a pause?). Has the drive been flashed before?

Otherwise unplug the drive and leave it. If you get the identification string (HL-DT-ST BD...) some commands are still executed properly and the drive is not dead. I'll see if i can get you an expert.

[gringo5]

Double check that you downloaded the correct firmware. Look at the drive cover for the model/version string. Is the drive empty? Watch the blinking closely and see if you can identify a pattern (e.g. does it blink like 10 times and then there is a pause?). Has the drive been flashed before?

The firmware matches the drive string on the box. But I will check on the drive cover itself to be sure.
The drive is empty.
There is a blinking pattern and it may actually be like -10times/pause- . But I will check that, too.
The drive has never been flashed before for my knowledge - it's right out of the box. And it was version 1.03 at the start.

[ala42]

After the failed process it's blue light flashes in a constant rythm.
After a restart it makes no 'bios'-noise and no light - it always identifies itself (in Gentoo Linux and the flashing prog) as
Code:
>D: HL-DT-ST BDDVDRW GGC-H20N COR4

LG drives automatically enter safe mode when the firmware checksum is not correct. The firmware CORE part takes over control, this is why you see the COR4 revision code. Possible reasons are:
- the flash rom is defective, which is quite unlikely
- your SATA controller or driver corrupts the firmware while uploading, which was seen with NVidea controllers and drivers before
- the firmware file you downloaded is corrupt

Starting with the last point is the easiest. Get the original firmware from http://au.lgservice.com and flash it from windows in windows safe mode.

In case this does not help, which SATA controller and driver do you use ? If your motherboard also has a different controller, try to use that.

[gringo5]

Thanks for the help!

I've been very busy with work this week so please pardon the delay. I have little time right now, so I will give detailed info later (if necessary).

- the flash rom is defective, which is quite unlikely
- your SATA controller or driver corrupts the firmware while uploading, which was seen with NVidea controllers and drivers before
- the firmware file you downloaded is corrupt
(...)
In case this does not help, which SATA controller and driver do you use ? If your motherboard also has a different controller, try to use that


I can definitely confirm that I'm using one nvidia chipset. I've tried on windows, with the same behaviour - but the windows pc I used actually might had a nvidia chipset as well.
I've somehow not seen the info in this thread, that points out, that nvidia controllers corrupt the bios.
I have a spare controller with a via chipset. I will try that on the weekend.
I'm 95% sure the downloaded firmware is sane.

[c3apollyon]

Any idea when/if there will be a patch for the LG GBW-H20L series? I'm not sure how similar it is to the GGW, etc. on here and wouldn't want to misapply the patch but I'm more than tired about the "revoked" message I get whenever I try to play my legit BDs in Linux.

[kaldi]

Is anyone working on a firmware hack for the Pioneer BDC-202? The firmware binary is pretty easy to get out of the latest update (http://www.pioneerelectronics.com/PUSA/Support/BusinessProducts/Blu-rayDisc+DVDWriters/Blu-rayDiscWriters/ci.BDC-202.Support?tab=B) but I don't really know what to do with it to bypass authentication? Anybody have any suggestions?

[ala42]

Any idea when/if there will be a patch for the LG GBW-H20L series? I'm not sure how similar it is to the GGW, etc. on here and wouldn't want to misapply the patch but I'm more than tired about the "revoked" message I get whenever I try to play my legit BDs in Linux.
A GBW-H20L uses the same hardware as a GGW-H20L. You can crossflash to a GGW-H20L firmware, instructions are here (http://club.cdfreaks.com/f142/lg-blu-ray-crossflash-ggw-h20l-gbw-h20l-be06lu10-be06lu11-260811/#post2187421). You will get better bluray media support and the HDDVD read feature. Crossflashing voids your warranty.

[loo3aem3ON]

Is anyone working on a firmware hack for the Pioneer BDC-202?
I don't have such a drive so development and testing are difficult. You are the first to ask for a firmware patch for that particular model.

I don't really know what to do with it to bypass authentication? Anybody have any suggestions?
1. find out the instruction set
2. locate the command 0xAD handler (format code 0x80)
3. find the conditional jump which checks if properly authenticated
4. make your modifications so the volume id is always sent (even if not authenticated)
5. locate the checksum of the firmware image and adjust it
6. update the firmware and test

hint: Look for the error codes which are sent by the drive. If your request for the volume id is denied it's: "5/6F/02" which means "COPY PROTECTION KEY EXCHANGE FAILURE – KEY NOT ESTABLISHED."

[gringo5]

Hi,
I've tested a few things.
First, the blinking pattern after a failed flashing try is 7times/pause.
I've tried with several computers always using my pci-sata controller card from de-lock with a via vt6421 chipset. Tried in safe-mode and normal windows mode. Always failes with above error message.
All tested computers had nforce chipsets onboard (if this matters somehow) - should I try on a non nforce system?
The firmware is definitely right and the drive is definitely a ggc-h20l.
Anything I could do?

[ala42]

Try to use a onboard SATA controller of an Intel chipset. Disable SATA RAID mode.

[ltooz_audis]

I loaded the firmware patch 1.03 for my GGC-H20L successfully, but is there a signature or a way to read the firmware to see the difference between the original & the patched one? I think mine is "poisoned" when I tried the "CHOCOLATE" (MKBv10) and "MADAGASCAR 2" (MKBv12) blu-ray.

[loo3aem3ON]

is there a signature or a way to read the firmware to see the difference between the original & the patched one?
The patched firmware differs by 5 bytes from the original firmware (3 instructions and 2 bytes checksum). The drives verifies the checksum before starting the update process.
I think mine is "poisoned" when I tried the "CHOCOLATE" (MKBv10) and "MADAGASCAR 2" (MKBv12) blu-ray.
The firmware updates mainly overwrite the executable code stored in the drive with a newer version. The drive memory is bigger than 2MB. Some memory sections are dedicated to hold data (like the drive certificate, the updated data structure of host certificate revocations, etc..) only which are left unchanged by the firmware updates.
What the SlySoft people mean by a drive being poisoned is that the host certificate AnyDVD-HD sends to the drive to authenticate has been revoked. The drive knows that (gets poisoned) by storing some data structures from the latest Blu-Ray discs which contain revocation information.
The software your drive is executing now has been modified to allow access to protected contents (volume id, etc.) without authentication. If you don't have to authenticate then you don't need to worry about revocation.

[kaldi]

Unfortunately, I think I'm really out of my league with firmware hacking. I've found the instruction set (I think) to be for the Hitachi H8S/2600. I can't find an IDE that has that instruction set in it, though, and I haven't figured out how to integrate an instruction set into an IDE. And I'm not really sure where to initiate in to the firmware binary if I was going to go through it by hand... Any other suggestions? Which type of conditional branch do other firmwares use in this situation?
I really want to thank loo3aem3ON for being so helpful and involved in so many of the BD projects here. I'm really impressed with his dedication.

[loo3aem3ON]

I've found the instruction set (I think) to be for the Hitachi H8S/2600.
The contents of the file "S1003581.107" (written by BDC202_FW107EU.EXE) looks very random (no visible pattern, high entropy) so it's very likely encrypted or packed. The firmware is transmitted to the drive in it's plain form (decrypted/unpacked). Could you please try TraceSPTI, BusHound or whatever you prefer to record the data passed to the windows api during a firmware update? The packets which carry the raw firmware are usually very long compared to the rest.

[gringo5]

I've tried things on a intel sata controller in safe mode with raid-mode disabled. So I think I have to put up with that my drive is garbage :|

[ala42]

@gringo5: read your PM.

[ltooz_audis]

The patched firmware differs by
The software your drive is executing now has been modified to allow access to protected contents (volume id, etc.) without authentication. If you don't have to authenticate then you don't need to worry about revocation.
You're right on the dot.... I tried the "BODY OF LIES" today, which HDdump reported MKBv12, AnyDVD 6.5.2.6 works fine. The speed is great. Thanks guys.....

Safemode
http://i184.photobucket.com/albums/x193/Bmle06/BLURAYnHD/ggch20l_safemode.jpg

FIRMWARE UPDATE WITH ORIGINAL
http://i184.photobucket.com/albums/x193/Bmle06/BLURAYnHD/ggch20l_update.jpg

Put back in safe mode and update with the patch and finally
MKBv12 with 17Mb/sec transfer rate.

http://i184.photobucket.com/albums/x193/Bmle06/BLURAYnHD/AnyDVD_bodyoflies.jpg

Since the drive was "poisoned", I would like to thank all for the "Antidote"....

:thanks::thanks::thanks: