Yeah, you might be able to eliminate the chip. But looking at the images from my post #445, the resistors runing in series coming from pin 5,6&7 are 1k ohm (ie. R228), which I didn't find on the GDR-8163b at all. So when you find these points on the LG xdrive, you may still need these parts. I hope you can get one of these xdrive, as I'm curious as to where these connections go.


menelik,
I popped in a 74HC14 & used a diode to drop the input voltage, and tested away. I found that I needed to increase the resistor-cap values to get it to work (270Kohm & 10uF worked great) . Then I went back to my 74HCT14, tried different dvd-Rs, ritek G04, ritek G05, maxell, princo dvd-rw, verbatim cdrw, with this resistor-cap values. It worked very well with all the disks.

I'm going to change my pictures to use this resistor-cap combo now. I believe its a more robust solution to the problem.

I also tried some original game disks and could only get it to say "game" in eVox after the first eject. THis is really not a problem since you can still play the game apon boot-up & rip the dvd within dvd2xbox. My solution is really a hack to get this drive to work. We found it to be the simplest solution for the problem. Looking back at all the data read from my original thompson, it would require a uController or a more complex circuit to give the xbox the signals it wants. Basically, what I have works, but it is definitely not perfect.

Do you think the Dangerous Brothers could patch the firmware to read at 16X rather than 4X?

They seemed to have patched RPC1 on the 8163B last July; do you really think that it would be that difficult a change to unlock the drive speed?

Is it likely to be just a couple of bytes/bits in the firmware that limits the drive speed?


cheers,
Bourkie

First, it would be much harder to change the speed than to change the region locks. The reason is that the xbox firmware is encrypted, and regular dvd-rom firmware is not.

Second, most firmware hackers, including the Dangerous Brothers don't want to get on M$'s bad side. They don't want to be sued. So,you would have to find a firmware hacker with encryption experience who is willing to put a few hundred man hours into hacking the firmware with no pay for their services, and the risk of being sued by M$.

Are we 100% sure it is encrypted? Is the binary completely difference to the one in the 8163B?

If it is encrypted is has to be hardware encrypted (e.g. SHA1) does it not?

I am sure the firmware encryption is slightly easier than the 2048-bit RSA key used for the games!

I am willing to have a crack at decrypting it if anyone else cares to join in?!

After all decryption for the purpose of inter-operability is perfectly legal here in Australia, and I believe that is also the case for the US - see Lexmark vs Static Control Components (SCC)!


cheers,
Bourkie

Yes, I'm back for one last post. Yes, I made some mistakes -- I am human after all. Yes, Tiros, the mod can be done without an inverter or anything. Yes, menelik, I was wrong about the 5V (in my defense, a lot less was known about any of this then than is known now, so it was easier to get confused about exactly what was what).
Feel free to point at me and laugh or whatever if it makes you feel better somehow, just don't expect me to give a crap. Personally, I only ever viewed my earlier work as prototypical, investigative probing. I don't know why it has been taken as if it was a finished (or even nearly finished) product. Sorry if I seemed to represent it as such.
Now, however, I am finished. Here are the points. All but eject, which I'm assuming everyone agrees is fine as per the markings on the circuit board itself (most recently illustrated by truBB in post 489 and kind of incidentally by menelik in 491).

Recent experience has led me to believe that our naming of these signals is a bit misleading, but I'll stick with it for want of anything better, except that I can't remember which is which of the tray signals anymore (or at least not right now). Pin numbers are based on looking into the socket on an Xbox DVD drive and counting from left to right, top row then bottom row
1 2 3 4 5 6
7 8 9 10 11 12
From left to right in the pic, the points are "ready" (pink circle, pin 9), tray signal 1(in? out? who knows? pin 3 anyway, yellow circle), unconnected pin in SD-616T mod that I'll call "valid" (pin 10, blue circle), tray signal 2 (pin 4, red circle).
On the 8050L, all these have a 1k resistor between the connector for the yellow wires cable and the controller chip. Those resistors aren't present on the 8163B (presumably because these signals aren't connected to the outside world in an unmodified 8163B). I installed my own 1k resistors by tacking one end of the resistor to each point and then connecting the signal wire to the other end of the resistor. I'm pretty sure it will work without them, but I wouldn't recommend leaving them out -- they must be there for good reason in the 8050L.
Finally, here are the pins on the controller chip that each of these points is connected to
ready/pink - pin 50
tray 1/yellow - pin 49
valid/blue - pin 52
tray 2/red - pin 65

wenid did the first step, trubb the second and so on....the only mistake is to talk about mistakes.

Congratulations wenid,

I have 4 8163Bs here ready to test this all out... off to Jaycar for some cheap 1k0s :-)

cheers,
Bourkie

P.S. I reckon these will fetch AUS$90 each here in Melbourne ($55 + old Xbox drive profit for 15 mins work!)

All perfect, however one last question:

On the 8050L, does the eject signal also have a 1k0 resistor between the connector and the point on the board?


cheers,
Bourkie

Now that's what I'm talkin about!
Great work, wenid!

Those 1k resistors are there to protect against the (possible) voltage mismatch between the 3.3 drive supply and the 3.3 xbox logic supply. As long as the supplies are within .6 volts of each other (and they really oughta or something is wrong), they will not forward bias protection diodes on xbox main board and are unnecessary. They can't hurt though.


Menlik,
I was suggesting the HC(t)14 would be better due to the long rise time on the "created" ready signal. Since the true signal is now found it doesn't matter.

can anyone confirm that the ready signal from wenids image works right? tried that before and got no response, maybe my drive is broken.

Cool. I'll try these tonight.

I've read all the pages and ordered my one LG GDR-8163B. Now I see that the work is almost done for me, thanks guys.
truBB could you let us now if it works. And could you tell me if you stuck to your schematics from your earlier post. Can I use your schematics and wenid's points?
I ask this because in the picture of menelik I believe to see an other configuration.

@rutgerius

my picture was different because we didnt now how the get all the signals we need without technical addons. if wenid is right we wont need those addons anymore - wait for trubb to confirm that.

So you mean no difficult schematics, just 4 solder points and that's it...
That would be the best xbox-mod-news ever.

Have you seen both firmwares?, ofcourse i can be wrong but i'm pretty sure they have exactly the same encryption, just look at it an you can see large pieces of code that are exactly the same(such as the beginning).

Maby it's only an adressline shift or something, probably not something big because otherwise it would probably consume too much resources.

The brothers were able to crack the 8163b firmware so i'm sure they can tell us how to "read" the image because the standard way of looking at it doesn't seem to work.

Ofcourse m$ can't sue anybody if there's an anounimous firmware post in some p2p network.

Hey Wenid, knew you would be back, the question im burning to ask is "did you do a retrace or did you just look for the signals?"
100 points and a for the man!!

p.s. it's probably not a good idea to mass mail the brothers, or is it? , normally they crack fw's if there's enough animo for it

The brothers have said no to repeatedly over hacking the samsung firmware, I don't think they will feel any different with this issue.

How about we ask the Brothers to 'limit' the original 8163B firmware to 4X max. speed!


That way we can probably work out what to do with the 8050 firmware with a hex editor and a few minutes!


cheers,
Bourkie

Ok, no hacking from their side, but maby a small tip how they managed to read the lg8163b firmware?, that would probably be enough for our needs.
(and maby some simple info like witch decompiler they used or what processor is used in the drive)

Well, their email address is publicly available. tdb@rpc1.org

If you would like to ask them, feel free. I would expect a no or no responce myself.

They may give you a hint, but that is about it.

No-go. Wenid, could you check those connections again?



For me, pin 49 goes to this orange point, not the yellow as you pointed out. I tried that too, but still nothing. All the others seem to be labeled correctly.





Pin 49, front side of ucontroller




Also, are you sure that all these four signals go thru 1Kohm resistors? I only found 3 per the front side of the 8050L pictures:


Then again, I don't have the drive to check it.

I looked at the pics again, to track down these traces. I feel like some kind of forensic scientist looking at these pics for hours... Wenid or NE1 else who has this xdrive 8050L drive, does this look like where the serial line runs to (pin3 on ucontroller) ?? Sure looks like it:

Bottom side:




Top side:

that yellow ready point never worked for me too

Oops. You're right. It is in fact the orange point that I'm using. I dunno how I manged to circle the wrong one.


Well I don't know what to tell you. With these points and 1k resistors (plus eject) it's working perfectly for me.


Yes, I'm sure. The resistor for the "valid" signal is elsewhere. My 8050L is now reassembled and I don't really want to dismantle it again just to re-find the location of this one resistor.

Ready is the pink one

sorry for that, typo, meant the pink one.....all those colors...just too many for my brain

just took a closer look on your pics and saw that pink is 'serial data' and blue is 'ready'. got to try that.

Hey

Has anybody written a detailed tutorial on using a Gdr-8163b in the xbox?

thanbks

dont think so. they still have to figure out what to do with some of the points i think

OK !! I tried that but no succes...Does anybody can tell my what did I did wrong ?

OK !! I tried that but no succes...Does anybody can tell my what did I did wrong ?


These signals go thru 1Kohm resistors execpt for EJECT.

patx, I think you got pins 5 & 7 swapped. Read carefully what wenid said:






I double checked my connections today w/ a DMM, and still no-go. When I boot into evox, it tells me that the tray is "OPEN". Thus, determining that tray_in or tray_out is incorrectly wired. Looking more into the signal traces, I really think that either TRAY_IN or TRAY_OUT is not correct. The picture below shows that TRAY_IN goes thru a complicated path to get to pin65. Is it really pin65?



Wenid, is there anyway that you can take a few snapshots of your setup?

Another typo, menelik ?

Pink = ready
Blue = serial

Thankx truBB, I tried with the wires 5 & 7 swapped but no go anyway.. same as U... evox tells me that the tray is"open".
What if we use the tray_in, tray_out & eject points from your post #489 the READY & DATA from Wenid's one ??Will it work ??

@trubb

im swapping all colors ..this happens when you drink too much and try to write.
anyway, trubb, did you try to swap the tray signals? maybe they're just swapped - but im sure you tried that. maybe you could post the voltages of those points, this should lead us to the right way. moreover you got a nice oscope, why dont you use it

btw, i dont wanna command you, i just ont have the equipment right here.

Unfortunately, I don't have an o-scope (I used my brother's). Yeah, I tried swapping it, but really, its a shot in the dark. I'd prefer to have the drive in hand, so I can check it myself. Well, that comes to thinking, NE1 with one of these LG drives willing to sell it?

This is really excellent! I've followed along so far and I am having the same problem as everyone else with the tray signals. I too am wondering about point '65' - all the other points are 49, 50 and 52 - these are all close together what about 51? Could anybody with a scope please check?

Keep up the great work all - Wenid this couldn't have been done without someone willing to take the time and effort to do what you did for this hack!!

What a great mod for ~$20.00!

As I posted before by using truBB's points on front & Wenid ones on back I HAVE IT RUNNING LIKE AN ORIGINAL DRIVE !!! ... just 4 wires and a 1k ohm resistor on the CD_RDY wire. The xbox even boot with the eject button !!! I played originals, backups, muzik, dvds ... everything works fine !!!!

Apparently it's not working with CD-Rs can you confirm this please?

By the way : congratulations to all of you who worked on this project, we now have a wonderfull alternative to the XBOX DVD drives. Also congratulations to the people of the french website http://gueux.be who worked hard with your contribution on this topic

A tutorial on this manipulation is also available but in french.

Thank you all

I confirm no CD-R in this drive, it wont even try to read it... and i had some trouble with recent originals games like "MechAssault 2" ... it's freezing on the loading screen in evox. But with "007 agent under fire" it runs #1 ...

CAREFULL >>>On the Gueux.be toturial the TR_IN & TR_OUT wires are swapped, use the picture from post #536 for better results<<<

FORGET MY LAST POST ... LOLLL .... I HAVE TO GO TO BED... I'm the one that swapped the wires at first!!! lolll !!!i didn't read very well i guest !!! sorry about that!!! great work GUEUX TEAM !!!

@patx

can you confirm that the ready function works fine? just wondering cause you used hfmdrv.

I have been watching this for the last few days and now got the drive working.
but i have used a different tray in point, but my drive board is a bit messed up after lots of soldering.

big thanks to all involved

@menelik



YES everything works fine exept that i don't have the"open" & "close" mention in EVOX. ( but "init","checking","games","video"... all appers) and for my part i soldered a 1k ohm resistor on all wires exept for EJECT.

http://gueux-forum.net/index.php?showtopic=56788

it is very good.
this drive works !!!!!!!!!!

Just a little adjustment to patx instruction. I found out that when using HFMDRV as ready point, the tray will not close when you power off your xbox. When using HFM as ready, the tray will close automatically as you power off the xbox with the tray left open. This is how it should be. Now everythings work great except for status in evox keep saying "init" when it is actually opened. If anyone has any idea how to fix that, we would have a 100% working drive. If not, im cool with it. Btw, I put 1K resistor for all my connection.

I'm still not really sure why my points are working in one drive but not in an(y)other, but there are some differences between the two drives so I thought I'd post this information here in case anyone can provide further insight. The working drive works perfectly, ie. it's indistinguishable from an 8050L -- all the right status reports come up exactly as with an 8050L drive, the tray auto-closes on power off etc.

Firstly, the working drive is older. The label on the case is stamped March 2004 whereas the other drive is January 2005. I found two markings on each circuit board that seem to be version numbers of some sort. One is on the component side under the audio output connector and the master/slave/cable select jumper. On the older, working drive this one reads 6870H-344AA. On the newer drive it's the same except it ends in AB instead of AA. The other version/revision number is on the other side of the board in the corner where there's sort of a gap at the end of all the connectors and jumpers.. On the working drive it reads
JD4 (GDR-8163B)
2004/02-02
On the newer drive the first line is the same but the second line is 2004/01-08.

Next, the firmware on each drive is slightly different. The working drive was flashed using my IDE flasher and the firmware as I extracted it from my 8050L. The newer drive was flashed with the .EXE from xbins. After extracting the ROM image from this .EXE I discovered that it does not exactly match the image I extracted from my 8050L. The difference would appear on the face of it to be unimportant, but I can't be sure. My image has 8KB of FF bytes from offset 0x4000 to 0x5FFF. The .EXE image has a repeating pattern 99 9B 9F 08. This pattern seems to be used as "filler" in other areas in both images (maybe it's some kind of jump instruction or NOP).

Finally, the working drive is the one I've been using for all my experimentation, so it's possible that it has been damaged in some way or that earlier experiments have altered its function in some way.

I'm kind of tempted to hook up the IDE flasher to one of these newer drives and flash my ROM image to it, but it's a pain to do and maybe the act of doing this has some side-effect I'm not aware of, so I'm not sure it would really prove anything unless the experiment fails.

XBoXMan,

Yes, use HFM, as its the cleaned signal of the HFMDRV. The small component nearby is the buffer for this trace.

Also, xboxman, did you try an original xbox dvd, and it comes up ok in eVox? According to the french tutorial, it comes up, but those pics are blurry! (Dude, use a tripod!)

wenid,
I did get my IDE-flasher from germany, but really havn't played with it much yet. I got in my linux box, compiled ctflasher, a little bumpy, but got it to work. I'm a bit unfamiliar in the next step. Did you unsolder the chip then place it into the flasher? Or did you solder a million wires? This is of course, for future reference, as this firmware has already been pulled.

I did this mod tonight and everything but the "Init" function is working. It skips right to game. Which really isn't a problem. I have tried orginals and backups both are working fine. I used the hfm point also closing on power off is that much closer to an orginal drive.

@truBB

I didn't try the orignal xbox drive as I don't have one