It is possible to read into the lead-out (~13 sectors or so) on the same Blu-Ray Drives that support BEh (READ CD) with the CD-DA flag by using the vendor command to read into the cache. The command is as follows:
F1 06 xx xx xx xx yy yy yy yy
xx - address to read
yy - length of data to return
Whenever reading a sector of the drive with BEh, that sector and the sectors following it get put into the cache at location 0x00000000. Each sector in the cache is 0xB00 in length. By reading the last sector of the disc, the following lead out sectors will get put into the cache starting at the address 0x00000B00, allowing them to be read with the command. The data returned by the command is formatted as follows (presuming the sector was originally read with the BEh command with CD-DA flag, 001b subchannel bits, and C2 error reporting; I haven't tested with other flags):
0x000-0x92F - Main Channel (Scrambled)
0x930-0x98F - P-W Subchannel
0x990-0x99F - Q Subchannel
0x9A0-0x9A3 - (unknown)
0x9A4-0xAC9 - C2 Error Bits
0xACA-0xB00 - (unknown)
I am not sure what the unknowns are, but this should be enough to allow for full dumping of any CD with these drives: since they could already read into the lead-in and dump discs with a negative combined offset, this method of reading into the lead-out should allow discs with a positive combined offset to be dumped.
@Sarami: Please could you implement this into DiscImageCreator, it would enable dumping for a lot more people who lack Plextors!
PX-4824TA (offset +98), PX-755SA (offset +30), ASUS BW-16D1HT (offset +6)
