<?xml version="1.0" encoding="utf-8"?>
<feed xmlns="http://www.w3.org/2005/Atom">
	<title type="html"><![CDATA[Redump Forum — Firmware hacking for reading GD-ROMs]]></title>
	<link rel="self" href="http://forum.redump.org/feed/atom/topic/45670/" />
	<updated>2022-09-27T00:45:49Z</updated>
	<generator version="1.4.4">PunBB</generator>
	<id>http://forum.redump.org/topic/45670/firmware-hacking-for-reading-gdroms/</id>
		<entry>
			<title type="html"><![CDATA[Re: Firmware hacking for reading GD-ROMs]]></title>
			<link rel="alternate" href="http://forum.redump.org/post/104039/#p104039" />
			<content type="html"><![CDATA[<div class="quotebox"><cite>Myria wrote:</cite><blockquote><p>* If a disk’s first TOC has no B0 entry, the TOC has a sufficiently small A2 entry, and the TOC’s own timestamps in sub-Q use positive encoding (00:00:00 start rather than 99:59:74 end) fake that there is a B0 entry around 08:00:00 or so.</p></blockquote></div><p>There are usually no TOC B0 entries on 99% of the CD&#039;s. I saw them only on some multisession pressed CD&#039;s. From what I know it&#039;s used for CD-R.</p><br /><div class="quotebox"><cite>Myria wrote:</cite><blockquote><p>This allows dumping the “PRODUCED BY SEGA ENTERPRISES” area—yes, that area is actually readable in CD audio mode.&nbsp; (It uses SafeDisc 2-like weak sectors.)</p></blockquote></div><p>Can you elaborate? I never heard of &quot;weak sectors&quot; before.</p>]]></content>
			<author>
				<name><![CDATA[superg]]></name>
				<uri>http://forum.redump.org/user/62921/</uri>
			</author>
			<updated>2022-09-27T00:45:49Z</updated>
			<id>http://forum.redump.org/post/104039/#p104039</id>
		</entry>
		<entry>
			<title type="html"><![CDATA[Re: Firmware hacking for reading GD-ROMs]]></title>
			<link rel="alternate" href="http://forum.redump.org/post/103455/#p103455" />
			<content type="html"><![CDATA[<div class="quotebox"><cite>Myria wrote:</cite><blockquote><p>Has there been consideration to hack CD burner firmware to dump Dreamcast disks?&nbsp; I don’t think it’s all that difficult, assuming that the laser unit is capable of reading the high density area at all and the firmware is hackable.</p></blockquote></div><p>There was some brief discussion on this subject a while back (at <a href="http://forum.redump.org/topic/29341/thoughts-on-reverse-engineering-firmware-to-enable-scrambled-reads/">http://forum.redump.org/topic/29341/tho … led-reads/</a>). Well, not exactly this subject, but the general idea of modifying a firmware to enable scrambled reads. I think if someone made it far enough to hack the TOC to enable scrambled reads and similar, the rest of this could probably be done as well.</p><p>I very briefly did some work on reverse engineering the firmware from an old Samsung DVD-/+RW drive. But, I&#039;m absolutely awful at reverse engineering, and I&#039;ve never done assembly in 8501 or ARM or many of the ISAs that are prominent in optical drive controllers, so it was very much an uphill battle.</p><p>But, I still think it&#039;s likely a reasonable approach to enabling better drive support for a lot of dumping tasks. It will require someone with a nice mix of knowledge on RE and optical disc technology, and a lot of free time, and I don&#039;t think there are a lot of folks around that meet all of those criteria, though.</p>]]></content>
			<author>
				<name><![CDATA[scsi_wuzzy]]></name>
				<uri>http://forum.redump.org/user/62440/</uri>
			</author>
			<updated>2022-08-23T01:42:13Z</updated>
			<id>http://forum.redump.org/post/103455/#p103455</id>
		</entry>
		<entry>
			<title type="html"><![CDATA[Re: Firmware hacking for reading GD-ROMs]]></title>
			<link rel="alternate" href="http://forum.redump.org/post/103414/#p103414" />
			<content type="html"><![CDATA[<p>It sounds like you might be the foremost expert on this subject, so ... if it&#039;s ever going to happen will probably be you doing it.</p><p>If you go for it, good luck! Easier Dreamcast dumping would be awesome!</p>]]></content>
			<author>
				<name><![CDATA[user7]]></name>
				<uri>http://forum.redump.org/user/6888/</uri>
			</author>
			<updated>2022-08-21T00:03:51Z</updated>
			<id>http://forum.redump.org/post/103414/#p103414</id>
		</entry>
		<entry>
			<title type="html"><![CDATA[Firmware hacking for reading GD-ROMs]]></title>
			<link rel="alternate" href="http://forum.redump.org/post/103354/#p103354" />
			<content type="html"><![CDATA[<p>Has there been consideration to hack CD burner firmware to dump Dreamcast disks?&nbsp; I don’t think it’s all that difficult, assuming that the laser unit is capable of reading the high density area at all and the firmware is hackable.</p><p>These are the patches that’d be needed:</p><p>* If a disk’s first TOC has no B0 entry, the TOC has a sufficiently small A2 entry, and the TOC’s own timestamps in sub-Q use positive encoding (00:00:00 start rather than 99:59:74 end) fake that there is a B0 entry around 08:00:00 or so.</p><p>* If that condition is met, modify all MSF&lt;-&gt;LBA conversions to consider 9x:xx:xx to be positive 90 minutes instead for standing for negative. Likewise, don’t reject invalid BCD ten-minute encodings like C2:00:00.</p><p>* When seeking, adjust the calculation of where to move the laser head if past 08:00:00 according to the higher density.</p><p>* Allow CD audio read command on data tracks.&nbsp; This is useful anyway, and some drives already allow this.</p><p>* Don’t reject out-of-bounds read requests.&nbsp; This allows dumping the “PRODUCED BY SEGA ENTERPRISES” area—yes, that area is actually readable in CD audio mode.&nbsp; (It uses SafeDisc 2-like weak sectors.)</p><p>With these changes, it’s likely that you could stick a GD-ROM into the hacked drive and Windows will browse to the high density file area automatically.</p>]]></content>
			<author>
				<name><![CDATA[Myria]]></name>
				<uri>http://forum.redump.org/user/62646/</uri>
			</author>
			<updated>2022-08-18T00:37:02Z</updated>
			<id>http://forum.redump.org/post/103354/#p103354</id>
		</entry>
</feed>
