So, who knows how the hell to modify firmware?

yukichigai

Diamond Member
Apr 23, 2003
6,404
0
0
After doing a little research for a post in the "CD-r to DVD-r" thread I have now become intrigued by the possibility that Sanyo's HD-Burn format might be readable by DVD drives with a firmware modification. So intrigued, in fact, that I am eager to see if I might be able to hack some firmware to get it to do that. (Eventually the firmware in my XBox's DVD Drive, but first things first) The only problem is that I have no clue where to start. I've never tried to modify firmware, so I dunno what's involved.

So what does it take to hack firmware? And/or do you know/are you someone who'd be up to the task?
 

yukichigai

Diamond Member
Apr 23, 2003
6,404
0
0
Okay, now where can one find the information on how to interpret that hex code? I can program assembly code, I just need to know what language the firmware uses.
 

harrkev

Senior member
May 10, 2004
659
0
71
Here is what you will need (in an ideal world)...

1) Firmware (duh)
2) Detailed technical information. This includes details about the processor, as well as the register information for the hardware being controlled.
3) A dis-assembler.
4) loads and loads of time.

This is what you need to do a "proper" hack. This means that you take apart the code, understand what it does, and change whatever you want to.

If you do NOT have all of this, then you might be able to change a couple of values here and there. Change a branche insturction to a no-op or branch-always. Change a hard-coded value.

But, in any case, if you are capable of doing it, then you would already know all of this. The learning curve is pretty steep.
 

yukichigai

Diamond Member
Apr 23, 2003
6,404
0
0
Originally posted by: harrkev
Here is what you will need (in an ideal world)...

1) Firmware (duh)
2) Detailed technical information. This includes details about the processor, as well as the register information for the hardware being controlled.
3) A dis-assembler.
4) loads and loads of time.

This is what you need to do a "proper" hack. This means that you take apart the code, understand what it does, and change whatever you want to.

If you do NOT have all of this, then you might be able to change a couple of values here and there. Change a branche insturction to a no-op or branch-always. Change a hard-coded value.

But, in any case, if you are capable of doing it, then you would already know all of this. The learning curve is pretty steep.
I'm a CS major; I'll probably learn this eventually. Might as well start now.

Now I just need to know where one could get such things.
 

CTho9305

Elite Member
Jul 26, 2000
9,214
1
81
The biggest problem is going to be finding enough information about the various hardware components. Companies don't tend to like giving it away, esp. without an NDA.
 

helpme

Diamond Member
Feb 6, 2000
3,090
0
0
Originally posted by: yukichigai
After doing a little research for a post in the "CD-r to DVD-r" thread I have now become intrigued by the possibility that Sanyo's HD-Burn format might be readable by DVD drives with a firmware modification. So intrigued, in fact, that I am eager to see if I might be able to hack some firmware to get it to do that. (Eventually the firmware in my XBox's DVD Drive, but first things first) The only problem is that I have no clue where to start. I've never tried to modify firmware, so I dunno what's involved.

So what does it take to hack firmware? And/or do you know/are you someone who'd be up to the task?

This does not sound like an easy task without all the dev documentation. You'd basically be telling the optical sensor to operate differently, identify which disks are HD-Burn, process the data etc.

You might be able to find some information about the drive by using the model number... But failing that, you might have to open it and ID the chips yourself. It'd be pretty tough if the company doesn't give you any block diagrams or documentation. You don't even know how the device communicates internally, so it'd be pretty tough to just start modifying the existing code.
 

Bassyhead

Diamond Member
Nov 19, 2001
4,545
0
0
It's not going to be easy. Modifying someone else's code is hard enough. Modifying something with no documentation on anything is much harder.
 

ArjSiv

Member
Apr 6, 2005
37
0
0
I'm a firmware developer.

You'll most likely also need some proprietary tools to actually load the code onto the drive. Some types of hardware require you to have a hardware security device ( like a security dongle ) in order to actually load onto it.
 

aka1nas

Diamond Member
Aug 30, 2001
4,335
1
0
Originally posted by: ArjSiv
I'm a firmware developer.

You'll most likely also need some proprietary tools to actually load the code onto the drive. Some types of hardware require you to have a hardware security device ( like a security dongle ) in order to actually load onto it.


For a regular consumer level optical drive, the flashing process probably isn't quite that secure as many are made to be flashed by end users. Its understanding the firmware and successfulyl modifying it that are more difficult.
 

FrankSchwab

Senior member
Nov 8, 2002
218
0
0
I'm also a firmware engineer.

Sometimes, the only way progress can occur is to have someone ignore the knowledgeable greybeards who say something "can't be done", and try to do it anyway.

This isn't one of those times. I've done firmware for 20 years, and I'd guess that I have a better chance of winning the lottery than making this work. Your chances are even lower.

Modify tables in the Firmware? Possible, if you have the right knowledge, insight, software, and equipment. You can generally look at a hex dump and find data tables easily, if you have the knowledge and experience to know what a data table is, and have looked at enough memory dumps to intuitively know what they look like.

Modify code in the firmware? Unlikely. I've patched Windows executables before, to bypass date checks in time-limited demos or remove limitations related to whether one is running a Server or Workstation version of an OS. The only way to do that is with a debugger that'll single step assembly without any source code, but it's possible. Fortunately, Microsoft always used to include Debug.exe with everything back to at least DOS 2.x.

You'd have to identify the processor used in the particular DVD drive you're interested in. Easy enough; read the markings on the back, and Google it. Find a disassembler for the instruction set used - google might find you one. Download the firmware from the drive. Don't know how? Neither do I. Best case, you find a utility that will do it for you; worse case, you have to desolder the flash chip on the board (or the processor, if the flash is internal) and stick it into a programmer to read it out. Worst case, the firmware is internal to the processor chip, and the security bits have been set keeping you from reading it out.

Use your disassembler to get an uncommented assembly listing of the code, say, 50,000 lines of assembler. That would be about 200K of assembled code, about right for the size of Flash I've seen on some drives. Identify functions, try to determine what they do, give them meaningful names. Try to identify how the hardware is configured based on how the firmware controls it - does OUT 0x100, 0x04 cause the head positioning circuitry to step, cause the motor to speed up/slow down, turn on an LED, or what? It would be best if you have the datasheets for all of the other chips on the board to help you guess here.

After 6 months of work, you'll probably have about a 60% complete, annotated listing. You can now probably start figuring out how the firmware reads data off the disk, and might be able to follow how it figures out what kind of disk is in the drive. You'll probably need all of the CD and DVD specification books (Red book, orange book, etc) to figure this out. You might be able to figure out what it will read from an HD-BURN disk. Then, you need to write all new code to parse the data structures and directory order on disk, and to correctly respond to commands from the host computer. And, you have to write it all correctly and perfectly, because you most probably don't have any way to run the code in a debugger.

You then run your code through a processor-specific assembler, create a Flash image, and program it into the drive. Turn the drive on, and see what happens.

Good luck

/frank

p.s. Your better bet is to get involved with some existing project that's hacking firmware on a commercially available project. For example, http://www.rockbox.org/ is a project that completely replaces the firmware in an Archos hard-disk based MP3 player. Getting your feet wet with something like this would get you started on the learning curve.
 

yukichigai

Diamond Member
Apr 23, 2003
6,404
0
0
Yyyyyyyyyup, I had a feeling it might be something that complex. Of course, reinterpreting assembler code is never easy. But I have a lot of free time, sometimes. And I do need something to do for Senior Projects.

Downloading the Firmware for the drives... it seems to me that would be as simple as acquiring a firmware update for the drive, unless the update just overwrites a portion of the firmware, rather than the whole thing. Or am I missing something?

Now if this turns out to be as complex as to require desoldering the chip from the drive -- in the case of the XBox that is -- then I don't see much point in continuing my efforts. The idea behind this little endeavor is to 1) allow the XBox to read HD-Burns, and 2) make sure it identifies them as DVDs, so the default XBox dashboard will play HD-Burn Video. (Basically, HD-Burned miniDVD) If such an upgrade would be unavailable to the general public... well, who's going to benefit from all the work I do? I'm sure I won't care much after 6+ months of effort.

Where can one find the Red/Orange/Fuschia/etc. Book specifications? I know the White Book specs require you to sign an NDA and pay through the nose....

As far as writing the HD-Burn interpreting code, that can probably be ported from some existing firmware, like on my Optorite drive. Unless firmware updates don't contain the entire firmware.

Thanks for the advice though. And the link. I've been trying to find an excuse to buy an iRiver; this may be it.
 
sale-70-410-exam    | Exam-200-125-pdf    | we-sale-70-410-exam    | hot-sale-70-410-exam    | Latest-exam-700-603-Dumps    | Dumps-98-363-exams-date    | Certs-200-125-date    | Dumps-300-075-exams-date    | hot-sale-book-C8010-726-book    | Hot-Sale-200-310-Exam    | Exam-Description-200-310-dumps?    | hot-sale-book-200-125-book    | Latest-Updated-300-209-Exam    | Dumps-210-260-exams-date    | Download-200-125-Exam-PDF    | Exam-Description-300-101-dumps    | Certs-300-101-date    | Hot-Sale-300-075-Exam    | Latest-exam-200-125-Dumps    | Exam-Description-200-125-dumps    | Latest-Updated-300-075-Exam    | hot-sale-book-210-260-book    | Dumps-200-901-exams-date    | Certs-200-901-date    | Latest-exam-1Z0-062-Dumps    | Hot-Sale-1Z0-062-Exam    | Certs-CSSLP-date    | 100%-Pass-70-383-Exams    | Latest-JN0-360-real-exam-questions    | 100%-Pass-4A0-100-Real-Exam-Questions    | Dumps-300-135-exams-date    | Passed-200-105-Tech-Exams    | Latest-Updated-200-310-Exam    | Download-300-070-Exam-PDF    | Hot-Sale-JN0-360-Exam    | 100%-Pass-JN0-360-Exams    | 100%-Pass-JN0-360-Real-Exam-Questions    | Dumps-JN0-360-exams-date    | Exam-Description-1Z0-876-dumps    | Latest-exam-1Z0-876-Dumps    | Dumps-HPE0-Y53-exams-date    | 2017-Latest-HPE0-Y53-Exam    | 100%-Pass-HPE0-Y53-Real-Exam-Questions    | Pass-4A0-100-Exam    | Latest-4A0-100-Questions    | Dumps-98-365-exams-date    | 2017-Latest-98-365-Exam    | 100%-Pass-VCS-254-Exams    | 2017-Latest-VCS-273-Exam    | Dumps-200-355-exams-date    | 2017-Latest-300-320-Exam    | Pass-300-101-Exam    | 100%-Pass-300-115-Exams    |
http://www.portvapes.co.uk/    | http://www.portvapes.co.uk/    |