-
Notifications
You must be signed in to change notification settings - Fork 2
/
Copy pathDVRFlash.cpp
1630 lines (1454 loc) · 41.9 KB
/
DVRFlash.cpp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/**
** DVRFlash (based on fPLScsi)
**
** Our own little replacement of the Pioneer DVR-1xx Flasher :þ
**
**/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <math.h>
#include "getopt.h"
#include "plscsi.h"
// Define our msleep function
#ifdef _WIN32
#include <Windows.h>
#define msleep(msecs) Sleep(msecs)
#else
#include <unistd.h>
#define msleep(msecs) usleep(1000*msecs)
#endif
#if __APPLE__
#include <inttypes.h>
#define u8 uint8_t
#define u16 uint16_t
#define u32 uint32_t
#else // ! __APPLE__
#ifndef u8
#define u8 unsigned char
#endif
#ifndef u16
#define u16 unsigned short
#endif
#ifndef u32
#define u32 unsigned long
#endif
#endif // __APPLE__
// Scsi parameters
#define SENSE_LENGTH 0xE /* offsetof SK ASC ASCQ < xE */
#define MAX_SECONDS 300 /* negative means max */
// Some fixes for windows
#if (_WIN32 || __MSDOS__)
#define NULL_FD fopen("NUL", "w")
#else
#define NULL_FD fopen("/dev/null", "w")
#endif
#define MAX_SIZE 0x00200000 // Maximum Firmware file size
#define FIRM_SIZE 0x00100000 // Standard Firmware size (Gen & Kern)
#define A09F_SIZE 0x00128000 // Minnimum DVR 109+ Firmware size
#define MODE_SIZE 0x00000100 // Switch mode buffer size + temporary buffer
#define A06K_SIZE 0x00010000 // DVR 106+ Kernel size
#define A09K_SIZE 0x00020000 // DVR 109+ Kernel size
#define NAME_SIZE 256 // We were a bit short on firmware & device name size
#define MAX_CDB_SIZE 16
// Firmware types
#define FTYPE_UNDEFINED 0
#define FTYPE_KERNEL 1
#define FTYPE_NORMAL 2
// Universal 106/107/108/K12 Key
#define UNIVERSAL_KEY 0x9A782361
// DVR109 Keys
#define ADV109_KEY 0x51B7DAC2
#define GEN109_KEY 0x5C6A8FE9
#define ASUS09_KEY 0x2BD55699
#define ASUSNL_KEY 0x9CE45EF6
#define DATA09_KEY 0x150000B0
#define MEDION_KEY 0xD1A2ED86
#define OEMEXT_KEY UNIVERSAL_KEY
#define OEMINT_KEY 0x1B0000B0
// Handy macro for exiting. xbuffer or fd = NULL is no problemo
// (except for lousy Visual C++, that will CRASH on fd = NULL!!!!)
#define FREE_BUFFERS {free(fbuffer[0]); free(fbuffer[1]); free(mbuffer);}
#define ERR_EXIT {FREE_BUFFERS; if (fd != NULL) fclose(fd); scsiClose(scsi); fflush(stdin); exit(1);}
// Fixed 1.1: The infamous Linux/DOS stdin fix
#define FLUSHER {while(getchar() != 0x0A);}
// Drive indentification
typedef struct
{
char Desc[25];
char Rev[5];
char Date[9];
char Maker[10];
} Drive_ID;
typedef struct // 2.1: Added Kernel & Normal Sizes for larger 109 sizes.
{
char Serial[17];
char Interface[5];
int Generation;
char Kernel_Type[9];
char Normal_Type[9];
int Kernel_Size;
int Normal_Size;
char Kernel_Rev[5];
} Extra_ID;
// Global variables, set to static to avoid name confusion, e.g. with stat()
static int opt_verbose = 0;
static int opt_debug = 0;
static int opt_yes = 0;
static int stat = 0;
static u8 *mbuffer = NULL;
static u8 cdb[MAX_CDB_SIZE] = {0};
static Scsi *scsi;
static u32 seed = 0; // For the 103/104 downgrade
/* Print the diclaimer */
int printDisclaimer()
{
char c;
puts(" DISCLAIMER");
puts("");
puts("THIS PROGRAM IS PROVIDED \"AS IS\" WITHOUT WARRANTY OF ANY KIND,");
puts("EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,");
puts("THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A");
puts("PARTICULAR PURPOSE.");
puts("");
puts("THE ENTIRE RISK AS TO THE ABILITY OF THIS PROGRAM TO FLASH A");
puts("PIONEER OR COMPATIBLE DVR DRIVE IS WITH YOU. SHOULD THE");
puts("PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY");
puts("SERVICING, REPAIR OR CORRECTION.");
puts("");
puts("THIS PROGRAM IS NOT ENDORSED BY PIONEER CORPORATION OR ANY");
puts("COMPANY RESELLING PIONEER EQUIPMENT AS THEIR OWN BRAND");
puts("");
puts("IF YOU UNDERSTAND THE RISKS ASSOCIATED WITH THIS PROGRAM AND");
puts("DISCHARGE BOTH THE AUTHOR AND PIONEER CORPORATION FROM ANY");
puts("DAMAGE OCCURING AS THE RESULT OF ITS USE, PLEASE INDICATE SO");
puts("BY ANSWERING THE FOLLOWING QUESTION:");
puts("");
puts("Do you understand and agree to the statement above (y/n)?");
fflush(stdin);
if (opt_yes)
c='y';
else
{
c = (char) getchar();
FLUSHER;
}
if ((c!='y') && (c!='Y'))
{
fprintf(stderr, "Operation cancelled by user.\n");
return -1;
}
puts("");
return 0;
}
/* The handy ones, IN BIG ENDIAN MODE THIS TIME!!!*/
u32 readlong(u8* buffer, u32 addr)
{
return ((((u32)buffer[addr+0])<<24) + (((u32)buffer[addr+1])<<16) +
(((u32)buffer[addr+2])<<8) + ((u32)buffer[addr+3]));
}
void writelong(u8* buffer, u32 addr, u32 value)
{
buffer[addr] = (u8)(value>>24);
buffer[addr+1] = (u8)(value>>16);
buffer[addr+2] = (u8)(value>>8);
buffer[addr+3] = (u8)value;
}
/* Display a nice countdown */
void countdown(unsigned int secs)
{
int t, i;
for (t=secs; t>0; t--)
{
for (i=0; i<(((int)log10((float)secs))-((int)log10((float)t))); i++)
printf(" ");
printf("%d", t);
fflush(stdout);
msleep(1000);
for (i=0; i<(1+(int)log10((float)secs)); i++)
{
printf("\x8");
fflush(stdout);
}
}
printf("OK.\n");
}
/* Print Sense status and errors */
u32 getSense(Scsi *scsi, char* errmsg = NULL)
{
// Sense variables
u32 s = 0xFFFFFFFF;
char sense[20];
int stat = scsiGetSense(scsi, sense, SENSE_LENGTH, SENSE_LENGTH);
if ((stat != SENSE_LENGTH) || (sense[0] < 0x70) || (sense[0] > 0x71))
{
if (errmsg)
{
if (opt_yes)
printf("ERROR - %s (No Sense)\n", errmsg);
else
fprintf(stderr, "%s (No Sense)\n", errmsg);
}
return s;
}
s = ((sense[2]&0x0F)<<16) + (sense[12]<<8) + sense[13];
if (errmsg)
{
if(opt_yes)
printf("ERROR - %s (Sense: %02X %02X %02X)\n", errmsg,
(s>>16)&0xFF, (s>>8)&0xFF, s&0xFF);
else
fprintf(stderr, "%s (Sense: %02X %02X %02X)\n", errmsg,
(s>>16)&0xFF, (s>>8)&0xFF, s&0xFF);
}
return s;
}
/* Display a Progression Bar */
void progressBar(float current = 0.0, float max = 100.0)
{
static int c; // We need this variable to keep its value between calls
// Progression bar
char percent[] = "|============|============|============|============|";
if (current == 0.0)
{
printf ("0%% 25%% 50%% 75%% 100%%\n");
c = 0;
putchar (percent[c++]);
fflush (stdout);
}
else
{
while ((current / max) > ((float) c / (sizeof (percent) - 1)))
{
putchar (percent[c++]);
fflush (stdout);
}
if (current >= max)
printf("\n");
}
}
// We could probably use macros, but it's fast enough as it is
u8 pseudoRandom()
{
seed = ((((seed&0xFFFF)*0x41C6) + ((seed>>16)*0x4E6D))<<16) + ((seed&0xFFFF)*0x4E6D) + 0x3039;
return ((u8)(seed>>16));
}
u8 pseudoRandom2()
{
seed = ((((seed&0xFFFF)*0x41C6) + ((seed>>16)*0x4E6D))<<16) + ((seed&0xFFFF)*0x4E6D) + 0x3039;
return ((u8)(((seed>>16)&0x7FFF)%0x100));
}
/* Enable DVR-103/104 downgrade */
int Downgrade()
{
u8* dbuffer = NULL;
int i = 0;
u32 s = 0;
int match = 0;
if (opt_verbose)
printf(" DVR-103/104 downgrade:\n");
if ( (dbuffer = (u8*) calloc(0x400, 1)) == NULL )
{
if(opt_yes)
printf (" ERROR - Could not allocate downgrade buffer\n");
else
fprintf (stderr, " Could not allocate downgrade buffer\n");
return -1;
}
// 3B 01 F3 00 00 00 00 00 00 00 - Reset key
memset(cdb,0x00,MAX_CDB_SIZE);
cdb[0] = 0x3B; // Write Buffer
cdb[1] = 0x01;
cdb[2] = 0xF3;
// 1.4: Write buffer command HAS a data out phase, even an empty one!
stat = scsiSay(scsi, (char*) cdb, 10, (char*) dbuffer, 0x00, X2_DATA_OUT);
if (stat)
{
getSense(scsi, " Unlock - Reset");
free (dbuffer);
return 1; // 1.4: this probably means drive is not downgrade protected.
}
// 3C 01 F2 00 00 00 00 04 00 00 - Read pseudorandom data
memset(cdb,0x00,MAX_CDB_SIZE);
cdb[0] = 0x3C; // Read Buffer
cdb[1] = 0x01;
cdb[2] = 0xF2;
cdb[7] = 0x04; // Retrieve $400 bytes of data, including the key
stat = scsiSay(scsi, (char*) cdb, 10, (char*) dbuffer, 0x400, X1_DATA_IN);
if (stat)
{ // Stat has to be right this time
getSense(scsi, " Read seeded data");
free (dbuffer);
return -1;
}
// Get a seed match on first 4 bytes. Eventhough we don't know it for sure,
// there's a 99.9999% chance these first 4 bytes never get modified.
// Also, there is mathematically no chance that different seeds can generate
// the same starting 4 byte sequence, so we're pretty safe here too.
// Even if the worst should happen, running DVRFlash again should do the trick ;)
if (opt_verbose)
printf(" Attempting to find seed...\n");
// lookups rarely produce elegant code...
match = 0;
for (s=0; s<0x10000; s++)
{ // Try the 65536 possible seeds
seed = s;
for (i=0;i<4;i++)
{
if (dbuffer[i] != pseudoRandom())
break;
if (i == 3)
match = -1;
}
if (match)
break;
}
if (!match)
{
if(opt_yes)
printf(" ERROR - Could not find seed!\n");
else
fprintf(stderr, " Could not find seed!\n");
free (dbuffer);
return -1;
}
if (opt_verbose)
printf(" Found seed: %04X ;)\n", (unsigned int)s);
// Generate the 1 extra pseudorandom value and fill response buffer with it
seed = s;
for (i=0; i<0x400; i++)
// We need to re-generate 0x400 pseudo random values to get to that one response
pseudoRandom();
// Now we can retreive the response/unlock value, and fill our buffer with it
i = pseudoRandom2() ^ 0xFF;
memset(dbuffer, i, 0x400);
// 3B 01 F2 00 00 00 00 01 00 00 - Write $100 bytes of junk
memset(cdb,0x00,MAX_CDB_SIZE);
cdb[0] = 0x3B; // Write Buffer
cdb[1] = 0x01;
cdb[2] = 0xF2;
cdb[7] = 0x01;
stat = scsiSay(scsi, (char*) cdb, 10, (char*) dbuffer, 0x100, X2_DATA_OUT);
if (stat)
{
getSense(scsi, " Unlock - Step 1");
free (dbuffer);
return -1;
}
// 3B 01 F2 00 00 00 00 04 00 00 - Unlock
memset(cdb,0x00,MAX_CDB_SIZE);
cdb[0] = 0x3B; // Write Buffer
cdb[1] = 0x01;
cdb[2] = 0xF2;
cdb[7] = 0x04;
stat = scsiSay(scsi, (char*) cdb, 10, (char*) dbuffer, 0x400, X2_DATA_OUT);
if (stat)
{
getSense(scsi, " Unlock - Step 2");
free (dbuffer);
return -1;
}
free (dbuffer);
return 0;
}
int SetKernKey(char* buffer, long opt_key, int generation, char* dtype_id)
{
if (opt_key>0) // Force Key based on Option Entry
writelong((u8*)buffer,0x10,opt_key);
else if (!strncmp("PIO_ADV", dtype_id, 7)) // Pioneer A09
writelong((u8*)buffer,0x10,ADV109_KEY);
else if (!strncmp("GENERAL", dtype_id, 7)) // Pioneer 109
writelong((u8*)buffer,0x10,GEN109_KEY);
else if (!strncmp("ASUS ", dtype_id, 7)) // ASUS 1608P
writelong((u8*)buffer,0x10,ASUS09_KEY);
else if (!strncmp("ASUS_NL", dtype_id, 7)) // ASUS OEM 1608P
writelong((u8*)buffer,0x10,ASUSNL_KEY);
else if (!strncmp("PIODATA", dtype_id, 7)) // PioDATA 109
writelong((u8*)buffer,0x10,DATA09_KEY);
else if (!strncmp("MEDION ", dtype_id, 7)) // Medion 109
writelong((u8*)buffer,0x10,MEDION_KEY);
else if (!strncmp("OEM_EXT ", dtype_id, 8)) // Buffalo
writelong((u8*)buffer,0x10,OEMEXT_KEY);
else if (!strncmp("OEM_EXT2", dtype_id, 8)) // Buffalo2
writelong((u8*)buffer,0x10,OEMEXT_KEY);
else if (!strncmp("OEM_INT", dtype_id, 7)) // Buffalo3
writelong((u8*)buffer,0x10,OEMINT_KEY);
else if (!strncmp("APPLE ", dtype_id, 7)) // Fake Apple Brand
writelong((u8*)buffer,0x10,OEMEXT_KEY);
else if (!strncmp("ACER ", dtype_id, 7))
writelong((u8*)buffer,0x10,OEMEXT_KEY); // Fake Acer Brand
else if (!strncmp("SONYDT ", dtype_id, 7))
writelong((u8*)buffer,0x10,OEMEXT_KEY); // Fake SONY Brand
else
{
if(opt_yes)
printf("ERROR - Unsupported Drive Type %s\n", dtype_id);
else
fprintf(stderr,"Unsupported Drive Type %s\n", dtype_id);
return -1;
}
if ( (generation == 10 || generation == 11) && opt_key == 0 && (char)buffer[0x10] != (char)0x9A)
(char)buffer[0x10]++;
return 0;
}
// 2.1 - Added Kernel Type for DVR-109 Keys
int SetKern(char* buffer, long opt_key, int generation, char* dtype_id)
{
// Copy the Kernel data, including the key if required
switch(generation)
{
case 1: // DVR-103
strncpy(buffer, "PIONEER DVR-S301",16);
break;
case 3: // DVR-104
strncpy(buffer, "PIONEER DVD-R104",16);
break;
case 4: // DVR-105
strncpy(buffer, "PIONEER DVR-105",16);
break;
case 52: // DVR-K12
case 53: // DVR-K12D
case 6: // DVR-106
strncpy(buffer, "PIONEER DVR-106",16);
writelong((u8*)buffer,0x10,UNIVERSAL_KEY);
break;
case 54: // DVR-K13 (?)
case 7: // DVR-107
strncpy(buffer, "PIONEER DVR-107",16);
writelong((u8*)buffer,0x10,UNIVERSAL_KEY);
break;
case 8: // DVR-108
case 60: // DVR-K14 (?)
case 62: // DVR-K04 (?)
strncpy(buffer, "PIONEER DVR-108",16);
writelong((u8*)buffer,0x10,UNIVERSAL_KEY);
break;
case 9: // DVR-109
case 64: // DVR-K15
case 66: // DVR-K05
strncpy(buffer, "PIONEER DVR-109",16); // 2.1 - Key dependant on firmware type.
return SetKernKey(buffer, opt_key, generation, dtype_id);
break;
case 10: // DVR=110
case 11: // DVR-110D
strncpy(buffer, "PIONEER DVR-110",16); // 2.2 - Key dependant on firmware type.
if (!SetKernKey(buffer, opt_key, generation, dtype_id))
{
// (char)buffer[0x10]++;
return 0;
} else return -1;
break;
default:
if(opt_yes)
printf("ERROR - Spock gone crazy error\n");
else
fprintf(stderr,"Spock gone crazy error\n");
return -1;
break;
}
return 0;
}
/* 1.5: inquiry the drive up to 20 times until it reacts */
void TickleDrive(Scsi *scsi)
{
int i;
for (i = 0; i < 20; i++)
{
// just do something to make the drive react?.
memset(cdb,0x00,MAX_CDB_SIZE);
cdb[0] = 0x12; // Inquiry
cdb[4] = 0x60; // size
stat = scsiSay(scsi, (char*) cdb, 6, (char*) mbuffer, 0x60, X1_DATA_IN);
if (!stat) break;
msleep(100); // drive still not reacting, wait 0.1s and retry
}
}
/* ------------------------------------------------------------------------ */
/* DVD Detection routines (stolen from dvdzone ;þ) */
/* ------------------------------------------------------------------------ */
char *regionString(unsigned char m)
{
static char result[16];
int i;
int r;
m &= 0xff;
if (m == 0xff) return "none";
m = ~m;
i = 0;
for (r = 1; r <= 8; r++)
{
if (m & 1)
{
result[i++] = '0' + r;
m &= ~1;
if (!m) break;
result[i++] = '+';
}
m = m >> 1;
}
result[i] = 0;
return result;
}
/* ------------------------------------------------------------------------ */
int isDVD(Scsi *scsi)
{
int result;
memset(cdb,0x00,MAX_CDB_SIZE);
memset(mbuffer,0x00,MODE_SIZE);
// Use MODE_SENSE with page 2A (MMC2 Capabilities and Mechanical Status Page)
// sg devices on Linux doesn't seem to handle get configuration (but scd devices work)
cdb[0] = 0x5A; // Let's use mode 10 rather than mode 6
cdb[2] = 0x2A;
cdb[8] = 0xFF;
result = scsiSay(scsi, (char *) cdb, 10, (char *) mbuffer, 0xFF, X1_DATA_IN);
if (result < 0) return 0;
if (mbuffer[8] != 0x2A) return 0; // Security check: code page should be returned
// bit 3 of response byte 2 (+8) indicates DVD-ROM read capability
if (mbuffer[10] & 0x08)
return 1;
return 0;
}
/* ------------------------------------------------------------------------ */
int getInquiry(Scsi *scsi, char *vendor, char *model, char *revision)
{
INT result;
memset(cdb,0x00,MAX_CDB_SIZE);
cdb[0] = 0x12;
cdb[4] = 0x60;
result = scsiSay(scsi, (char *) cdb, 6, (char *) mbuffer, 0x60, X1_DATA_IN);
if ( result || (mbuffer[39] != '/') || (mbuffer[42] != '/') )
// We did not read 60 bytes or the date is not right - probably not a DVR
return 0;
memmove(vendor, mbuffer+8, 8); vendor[8] = 0;
memmove(model, mbuffer+8+8, 16); model[16] = 0;
memmove(revision, mbuffer+8+8+16, 4); revision[4] = 0;
return 1;
}
/* ------------------------------------------------------------------------ */
int getRPC(Scsi *scsi, char *buffer)
{
INT result;
memset(cdb,0x00,MAX_CDB_SIZE);
cdb[0] = 0xA4;
cdb[9] = 0x08;
cdb[10] = 0x08;
// Needed for DVD Region Killer in Windows
buffer[6] = 0;
result = scsiSay(scsi, (char *) cdb, 12, (char *) buffer, 8, X1_DATA_IN);
if (result) return 0;
return 1;
}
/* ------------------------------------------------------------------------ */
void showRPC(Scsi *scsi)
{
char rpc_info[8];
static char *flagText[4] = {"Region not set", "Region set", "Last chance", "Locked"};
if(getRPC(scsi, rpc_info) && rpc_info[6])
{
printf(" Status : RPC-%lu (region locked)\n", ((unsigned long) rpc_info[6])+1);
if (rpc_info[6] == 1)
{
printf(" Region : %s\n", regionString(rpc_info[5]));
printf(" Changes : %lu region change%s remaining\n",(unsigned long) (rpc_info[4] & 0x07), ((rpc_info[4] & 0x07) > 1) ? "s" : "");
printf(" %lu vendor reset%s remaining\n",(unsigned long) ((rpc_info[4] >> 3) & 0x07), (((rpc_info[4] >> 3) & 0x07) >1) ? "s" : "");
printf(" state is '%s'\n\n", flagText[(rpc_info[4] >> 6) & 0x03]);
} else
{
printf(" Unknown RPC scheme\n");
printf(" (%02lx %02lx %02lx %02lx)\n\n", ((unsigned long) rpc_info[4]) & 0xff, ((unsigned long) rpc_info[5]) & 0xff,
((unsigned long) rpc_info[6]) & 0xff, ((unsigned long) rpc_info[7]) & 0xff );
}
} else
printf(" Status : RPC-1 (region free)\n\n");
}
/* ------------------------------------------------------------------------ */
int ProcessDevice(Scsi *scsi, char const *name)
{
char vendor[8+1];
char model[16+1];
char revision[4+1];
int ret = 1;
if (scsiOpen(scsi, name))
return 1; // We're scanning for all devices, so this can fail
// Windows queries fail without those
scsiLimitSense(scsi, SENSE_LENGTH);
scsiLimitSeconds(scsi, MAX_SECONDS, 0);
if ( (isDVD(scsi)) && (getInquiry(scsi, vendor, model, revision)) )
{
printf("\n");
printf(" Device : %s\n", name+((name[5]==':')?4:0));
printf(" Vendor : %s\n", vendor);
printf(" Model : %s\n", model);
printf(" Revision : %s\n\n", revision);
showRPC(scsi);
ret = 0;
}
scsiClose(scsi);
return ret;
}
/* Here we go! */
int main (int argc, char *argv[])
{
char devname[NAME_SIZE] = "\\\\.\\I:";
char fname[2][NAME_SIZE]; // firmware name(s)
int ftype[2] = {FTYPE_UNDEFINED, FTYPE_UNDEFINED};
size_t fsize[2] = {0 , 0};
int kern_id = -1;
int norm_id = -1;
u8 *fbuffer[2];
// ID variables
Drive_ID id;
Extra_ID idx;
// Flags
int detected = 1; // Number of DVR Devices (assume 1)
int opt_key = 0;
int opt_skip = 0;
int opt_error = 0; // getopt
int opt_force = 0;
int opt_kernel = 0; // Switch drive to kernel mode
int is_kernel = 0; // is drive in kernel mode?
int nb_firmwares = 0; // firmware file(s) provide
// General purpose
char strGen[5];
char str[80];
int i;
char c;
size_t read;
FILE *fd = NULL;
// Init
fflush(stdin);
fbuffer[0] = NULL;
fbuffer[1] = NULL;
mbuffer = NULL;
scsi = NULL;
while ((i = getopt (argc, argv, "bfhksvy01234567?")) != -1)
switch (i)
{
case 'y': // Pass 'Yes' to all prompts
opt_yes = -1;
break;
case 'v': // Print verbose messages
opt_verbose = -1;
break;
case 'f': // Force flashing
opt_force++;
break;
case 'k': // Kernel mode only
opt_kernel = -1;
break;
case 'b': // Debug mode (don't flash!)
opt_debug = -1;
break;
case 's': // Skip disclaimer and other bugging stuff
opt_skip = -1;
break;
case '0': // Force Universal Key
opt_key = UNIVERSAL_KEY;
break;
case '1': // Force PIO_ADV - DVR-A09
opt_key = ADV109_KEY;
break;
case '2': // Force GENERAL - DVR-109
opt_key = GEN109_KEY;
break;
case '3': // Force ASUS 1608P
opt_key = ASUS09_KEY;
break;
case '4':
opt_key = ASUSNL_KEY;
break;
case '5': // Force PioDATA 109
opt_key = DATA09_KEY;
break;
case '6': // Force MEDION
opt_key = MEDION_KEY;
break;
case '7': // Force Buffalo
opt_key = OEMEXT_KEY;
break;
case '8': // Force OEM
opt_key = OEMINT_KEY;
break;
case 'h':
case '?':
default: // Unknown option
opt_error++;
break;
}
puts ("");
puts ("DVRFlash v2.2b: Pioneer DVR firmware flasher");
puts ("by Agent Smith, et al., November 2005");
puts ("");
if ( ((argc-optind) > 3) || opt_error)
{
puts ("usage: DVRFlash [-[f][k][s][v][y][#]] [device] [kernel] [general]");
puts ("Most features are autodetected, but if you want to specify options:");
puts ("If no device is given, DVRFlash will detect all DVR devices and exit");
puts ("");
puts (" -f : force flashing - required if converting or flashing Kernel");
puts (" -k : put drive in Kernel mode");
puts (" -s : silent-mode - don't display disclaimer");
puts (" -v : verbose-mode - display more detail about drive");
puts (" -y : yes-mode - respond 'Y' to all prompts");
puts (" STRONGLY NOT RECOMMENDED FOR NORMAL OPERATION");
puts (" -# : force alternate key for unknown DVR-109+ drives");
puts (" 0 = Universal Key (DVR-108)");
puts (" 1 = PIO-ADV");
puts (" 2 = GENERAL");
puts (" 3 = ASUS");
puts (" 4 = ASUS_NL");
puts (" 5 = PIODATA");
puts (" 6 = MEDION");
puts (" 7 = OEM_EXT");
puts (" 8 = OEM_INT");
puts (" -? or -h : display this help message.");
puts ("");
exit (1);
}
if (argv[optind] == NULL)
detected= 0;
// Who wants a disclaimer?
if ((!opt_skip) && (detected) && (printDisclaimer()))
ERR_EXIT;
// New 1.2 - Display how we were called - 2.1 - Hide if interaction bypass is used
if (!opt_yes)
{
printf("Commandline:\n ");
for (i=0; i<argc; i++)
printf("%s ", argv[i]);
printf("\n\n");
}
// Let's get started
scsi = newScsi();
if (!scsi)
{
strncpy(str, "Internal error: newScsi() returned NULL.\n",42);
if(opt_yes)
printf("ERROR - %s",str);
else
fprintf(stderr, str);
ERR_EXIT;
}
// First allocate our temporary buffer
if ((mbuffer = (u8*) calloc(MODE_SIZE, 1)) == NULL)
{
strncpy(str, "Could not allocate mode buffer\n", 31);
if(opt_yes)
printf ("Error - %s", str);
else
fprintf (stderr, str);
ERR_EXIT;
}
// New 1.6 - Call detection routine if no device is given
if (!detected)
{
memset(devname, 0, sizeof(devname));
printf("Device parameter was not given, detecting all DVR drives:\n");
// Need to disable stderr on device detection for windows
scsiSetErr(scsi, NULL_FD);
for ( ; ; )
{
if (scsiReadName(scsi, devname, sizeof(devname)) < 0) break;
if (!ProcessDevice(scsi, devname))
detected++;
}
scsiSetErr(scsi, stderr);
if (!opt_skip)
{
if (detected == 0)
printf("\n No DVR drive detected!\n");
else
{
printf("\nNow run DVRFlash again, from the command prompt, using\n");
printf("one of the device(s) listed above as first parameter\n");
}
// Take care of the stupid windows user who can't figure out what a commandline
// app is. If they double clicked, this'll keep the window open.
if ( !opt_yes )
{
printf("\nPress the Return key to exit\n");
FLUSHER;
}
}
FREE_BUFFERS;
exit(0);
}
// Copy device name
// Fixed 1.1 to allow both ASPI and SPTX on Windows
// Fixed 1.2 - Some people don't know UPPER-f...ing-CASE!!!
// Fixed 1.3 - On MacOS X, drive is selected by INQUIRY string.
if ( (strlen(argv[optind]) == 2) && (argv[optind][1] == ':') )
{ // Someone seems to be using a Windows drive letter, let's try the SPTX way
if ( (argv[optind][0] >= 'a') && (argv[optind][0] <= 'z') )
argv[optind][0] -= 0x20;
if ( (argv[optind][0] < 'A') || (argv[optind][0] > 'Z') )
{
// NB, we could have used a #ifdef SPTX here, but the less #ifdef, the
// more portable the code
strncpy(str, "Illegal device name: ", 22);
if(opt_yes)
printf("ERROR - %s%s\n", str, argv[optind]);
else
fprintf(stderr, "%s%s\n", str, argv[optind]);
ERR_EXIT;
}
strncpy (devname+4, argv[optind], 3);
}
else
strncpy (devname, argv[optind], NAME_SIZE);
devname[NAME_SIZE-1] = 0;
optind++;
// Copy firmware name(s)
for (i=0; i<(argc-optind); i++)
{
strncpy (fname[i], argv[optind+i], NAME_SIZE);
fname[i][NAME_SIZE-1] = 0; // 2.1.1 -- Bug Fix.
nb_firmwares++;
}
// calloc is handy to get everything set to 0
if ( ( (fbuffer[0] = (u8*) calloc(MAX_SIZE, 1)) == NULL) ||
( (fbuffer[1] = (u8*) calloc(MAX_SIZE, 1)) == NULL) )
{
strncpy(str, "Could not allocate buffers\n", 28);
if(opt_yes)
printf ("ERROR - %s", str);
else
fprintf (stderr, str);
ERR_EXIT;
}
for (i=0; i<nb_firmwares; i++)
{
if ((fd = fopen (fname[i], "rb")) == NULL)
{
if (opt_verbose)
perror ("fopen()");
strncpy(str, "Can't open firmware file '", 27);
if(opt_yes)
printf ("ERROR - %s%s'\n", str, fname[i]);
else
fprintf (stderr, "%s%s'\n", str, fname[i]);
ERR_EXIT;
}
// Read firmware
if (opt_verbose)
printf("Reading firmware '%s'...\n", fname[i]);
read = fread (fbuffer[i], 1, MAX_SIZE, fd);
if ((read > MAX_SIZE) || (read < A06K_SIZE)) // 2.1 - Just check if file size is within range.
{
if (opt_verbose)
perror ("fread()");
strncpy(str, "': Unexpected firmware size or read error\n", 43);
if(opt_yes)
printf("ERROR - '%s%s", fname[i], str);
else
fprintf(stderr, "'%s%s", fname[i], str);
}
if (!strncmp("Kernel", (char*)fbuffer[i]+0x110, 6))
{
ftype[i] = FTYPE_KERNEL;
fsize[i] = read;
}
else if (!strncmp("Normal", (char*)fbuffer[i]+0x110, 6))
{
ftype[i] = FTYPE_NORMAL;
fsize[i] = read;
}
else
{
strncpy(str, "': Invalid Pioneer firmware\n", 29);
if(opt_yes)
printf("ERROR - '%s%s", fname[i], str);
else
fprintf(stderr, "'%s%s", fname[i], str);
ERR_EXIT;
}
if (opt_verbose)
{
printf(" firmware is of %s type ", (ftype[i]==FTYPE_KERNEL)?"Kernel":"Normal");
printf("(%s %s)\n", (char*)fbuffer[i]+0x60, (char*)fbuffer[i]+0x90);
}
fclose (fd);
fd = NULL;
}
/*
* Let's talk
*/
if (scsiOpen(scsi, devname))
{
strncpy(str, "Could not open device ", 23);
if(opt_yes)
printf("ERROR - %s%s\n", str, devname);
else
fprintf(stderr, "%s%s\n", str, devname);
ERR_EXIT;
}
scsiLimitSense(scsi, SENSE_LENGTH);
scsiLimitSeconds(scsi, MAX_SECONDS, 0);
/*
* Standard Inquiry - Any device should answer that