Opened A Xbox To Find A Hitachi-lg Dvdrom, **MERGED TOPICS** Options

[skyhi]

If you're thinking you can just overwrite the mismatched block in the .exe we have with the correct block from the "real" firmware, I'm afraid you're out of luck. I've already tried that. I assume the .exe runs some sort of checksum on the ROM image.

It's been a long time since I played around with Hex editing but here's what I found:
There is some sort of cheksum - two of them in fact 16 bits wide.
The first one is at address 20A58 and the second one is at 20A5A

Once the mismatched block is over written with the correct code you must FIRST generate a Checksum-16 from addresses 20A98 through 6267F which will give you 'CF68'. This needs to be entered into addresses 20A5A and 20A5B.

Then another Checksum-16 needs to be generated from addresses 20A5A through 6267F which will give 'DAA7'. This needs to be entered into addresses 20A58 and 20A59

Happy editting!

Now onto better things - 16X's

This post has been edited by skyhi: Apr 22 2005, 05:54 PM

[sness54]

Thank you, skyhi, with your information, I have just reflash my LG with the original firmware.

Regards.

[truBB]

@skyhi,

the replaced code is cut from 4f80 to 4f93 from file: HitachiLG8050.bin

CODE

4f80 to 4f93
50 64 60 E7 64 E1 A6 67 7E 64 00 74 7E 66 20 70 7E 66 00 70

Right?
Or did you replace all the filler, because I didn't get the same crc16. I got: C30D.

[maximilian0017]

@skyhi,

the replaced code is cut from 4f80 to 4f93 from file: HitachiLG8050.bin

CODE

4f80 to 4f93
50 64 60 E7 64 E1 A6 67 7E 64 00 74 7E 66 20 70 7E 66 00 70

Right?
Or did you replace all the filler, because I didn't get the same crc16. I got: C30D.

You have to replace it including the filler, feom 4040h to 6040h

Works like a charm!!

Going to solder a little bit later tonight

[Jetset Willy]

Forgive a less gifted one, would it be possible to give a list of which code need to be entered at which address, the above kinda went over my head...
How about the cdr issue, is the final word that it won´t read cdr´s?

[TKramka]

Well, if everyone keeps up with the firmware hacking, then it might just read cdr's and go at 16x

[skyhi]

Yes - I did replace all the code in the flasher with the code that is in the HitachiLG8050.bin file. I used Hex Workshop 3.1 to do the editting and generating of the checksum. Glad to be of assistance as so many of you have already been!

[TKramka]

Now if we could only figure out what blocks CDR reading, To the Hex Editor!

[skyhi]

I have compared the code of the 8163B to the 8050L with the Hex Workshop and have found about 100 or so differences between them. I've actually saved all the differences into a folder and just need time (and help?) to go through them.

My next step was going to be trying to dissassemble the differences to see if something jumps out - it's been a while since I dug this deep into code - about 18 years!

I've found a dissassembler here: http://www.8052.com/


This post has been edited by skyhi: Apr 23 2005, 04:08 PM

[Tiros]

Sorry for the lack of info, been away past week.
Yes, I patched the DLD with checksum patch, similar to SkiHi, but I used the HP dos flasher.
DO NOT USE THE XBINS FLASHER IT IS NO GOOD!!

Even if you patch the DLD contained in the windows EXE, the drive will only partially flash and you will not get the "good" signals on the controller outputs. The drive WILL report 8050 after the win flash, but don't be fooled.

After a successful flash the drive activity LED becomes inverted, "ready" and other signals become active.

There are still a couple of issues with regard to RF/Servo controller. I recommend cutting 2 traces and adding jumper wire. I will try to get pics, @truebb you may want to compare pin 49 and 50 8050/8163 to see what I mean.

I have a small program that creates a DLD, using the 8050.bin file as input. This board does not seem to allow attachments.

[Tiros]

CDR doesn't work after the flash either.
I was hoping it was the RF/Servo circuit difference, but it's starting to look more and more like firmware related. The drive doesn't even spin up disk if it is CDR. The laser pops on briefly as if it's "testing" the disk first. Than it just sits there.

Based on what has been going on here so far, I wouldn't hold my breath waiting for someone to patch the firmware for this problem.

AGAIN, DON'T USE THE WINDOWS FLASHER!
EVEN WITH THE DLD PATCH IT DOES NOT WORK!

[Tiros]

Board error double posted...


@SkyHi
BTW it's not an 8052....that would be too easy.

This post has been edited by Tiros: Apr 23 2005, 04:42 PM

[maximilian0017]

]2.[/color][/b] Fully working 8163B. Tiros & wenid both have fully working drives, using exact copies of the firmware or at least firmwares binaries that are the same.
The points used are the same from 8050L which are:

[code]
8163B                              End of Cable      Description
Eject  ============================= pin4            Eject
TP126  ====1k resistor ============= pin6            Ready (uC pin50)
TP055  ====1k resistor ============= pin7            Tray_in (uC pin65)
TP128  ====1k resistor ============= pin5            Tray_out (uC pin49)

I did the following to get to the same point as Wenid and Tiros

1. Used this wiring with 1k resistors on all wires(even eject)
2. Modded the windows flasher as per Skyhi's earlyer post
3. Extracted the dld file from the modified windows flasher(20a58-62680)(269352 bytes in explorer/properties)
4. Put it on the hp dosdisk i made(see earlyer post)overwriting the standard dld file
5. Flashed

After throwing this together i tested for a while and it seems to work 100%, ofcourse without cd/16x support(but the reading is quite fast anyway)

Maby this is interesting to the people who don't want to read origionals and want cd/16x support:
Tiros mentioned the led in front of the drive, i was looking at the same thing earlyer, it doesn't go out after the drive spins down, so that could be a much better alternate ready signal without problems with spindown.
After the mod above it came apparent to me that the origional and the fully modded 8163b do spindown, but they keep the ready signal high.
This hasn't been tested yet, but maby someone wants to take a look at it.

[maximilian0017]

If i understand correctly the processor is a Panasonic AN32 series, there are special tools for programming and debugging.
There is no mention of any code compliance or compability, so this is going to be a tough one to take apart.
Don't really think that hexedit is going to help here....

[skyhi]

Perhaps what could be done is to patch in code from the 8163B and watch for changes - time consuming but should show something.