The Firmware Page

Hi,

I bought a Matshita BD-MLT UJ-225S (PATA) drive off eBay. The drive came with firmware Q110 with a date of "07/27/07ZF2Q +"...ironically it has a manufaturing date of April 2009, but such an old firmware.

Being one that likes to have the latest & greatest firmware, I found a Sony firmware update for the Matshita BD-MLT UJ-225S Q111, but it's detecting that my drive is not a Sony one even though the drive name matches.
http://vcl.vaio.sony.co.jp/download/EP0000145205.html (Use Google to translate)

I was wondering if the embedded firmware updater (UpDate_UJ225_Q111.exe) could be hacked or disassembled in order to extract the firmware file...then maybe one day Ala42's tools migh be updated to support the UJ-225S drives.

FWIW, I'm not overly concerned with RPC1 right now...I just want update my firmware.

Thanks

This is still a request.

You should know to follow the request rules first...

Apologies, here's the requested info. (MODERATOR PLEASE MOVE TO APPROPRIATE THREAD)

Drive: Matshita UJ-225S PATA (generic bought off eBay...no original firmware link)
Laptop: Dell Precision M6300 running Windows 7
Requests:
1. Backup existing Q110 firmware if possible
2. Somehow modify flash updater to cross flash stock Sony Matshita UJ-225S Q111 firmware
http://vcl.vaio.sony.co.jp/download/EP0000145205.html

Just wanted to update everyone that I was able to cross-flash my UJ-225S with the Sony UJ-225S Q113.
http://vcl.vaio.sony.co.jp/download/EP0000228581.html
http://dlv.update.sony.net/pub/vaio/dow ... 228581.exe

Let's just say that:
My original firmware (bought from eBay):
MATSHITABD-MLT UJ-225S Q11007/27/07ZF2Q

Sony updater's NEW drive ID:
MATSHITABD-MLT UJ-225S Q11307/28/08LF4E

Sony updater's OLD drive ID's:
MATSHITABD-MLT UJ-225S Q11205/08/08LF4C
MATSHITABD-MLT UJ-225S Q11101/09/08LF2Z
MATSHITABD-MLT UJ-225S Q11006/01/07LF2H

The trick was to use a combination of TraceSPTI (to see what was being queried), WinDbg (breakpoint on kernel32!DeviceIoControl) and WinHex (RAM editor) to change one of the *OLD* ones to match my drive's ID (if you try it, you'll see why I have NEW/OLD in caps). I'm burning a BD-RE now, so hopefully I didn't brick my drive.

Hahaha, the Q113 firmware update worked great! I burned a 33GB Blu-Ray protected ISO to 50GB BD-RE DL and was able to play it back with PowerDVD.

Now it should be able to support the cheaper LTH media! Thanks Sony!

So now that there is process to cross-flash between Matshita OEM's, this will probably work for other drives that Sony sells like the UJ-220S too.

Moderator - Please consider moving this to the "Firmware Flashing Help" forum?

moved as requested - Puma

"Blue-Ray protected ISO" ???

I burned an ISO that I made using AnyDVD-HD with the "Keep Protection (Blu-Ray, HD-DVD)" checkbox selected. I just needed something to burn and that was the easiest thing I had laying around.

Grrr...I just read the changelog a little closer and it appears that the UJ-225S can only "read" LTH media, not burn it.

Ah....

I would never buy an Matshita based drive for burning purposes. They just plain suck.

any step-by-step instructions or the firmware you updated your drive with in the end please?
my uj225s just ruined two BD-50 DL discs and I am not happy with that at all. (((

I'm not sure of the exact order of this, but this is kind of what I did. You'll have to be really patient/persistent with the breakpoints (i.e. continuing to the next breakpoint hit).

1. Install and run WinHex...I think you'll need a valid serial in order to use the RAM Editor.

2. Install and run WinDbg and set the Symbol File Path (CTRL+S) to http://msdl.microsoft.com/download/symbols

3. Open the Sony firmware updater and attach to it with WinDbg.

4. Set a breakpoint on "kernel32!DeviceIoControl". This function gets called each time it queries your drives for their ID string. You can monitor TraceSPTI's log file to see the drive ID queries happening in real-time.

5. Now go back to the firmware updater GUI and click ok to all the question prompts. Essentially when WinDbg hits the breakpoint, you're going to step and open the firmware updater's entire memory within WinHex's RAM Editor. What you're looking for are the strings "NEW" or "OLD" in all caps...these are the valid Sony ID's that the firmware updater will upgrade from.



6. Eventually/hopefully you'll find the "NEW" or "OLD" strings and also the drive ID strings I listed above. What you need to do is change one of the "OLD" strings to match the drive ID string that your drive is returning.

Be very careful editing the RAM...you should just replace the characters within the space of the existing strings.

Once you change it and are ready to resume, press F5 to continue to the next breakpoint. The firmware updater should eventually display the dialog box to flash your drive. Just continue from there and you should be able to crossflash.

Also once you do get it to crossflash, you should be able to flash any future Sony updates w/o all these steps since your drive will look like a Sony UJ-225S.

Good luck!

I highly recommend BD-RE's. I got a few Panasonic 50GB ones off eBay for a decent price (~$13/each).

Normally I agree, but there aren't too many PATA Blu-Ray burners around.

And? Who needs PATA burners these days even more when they are crappy MatSHITas??

People like me who have gotten shafted by Dell's Mobile Precision M6300 laptop design...

Let's just agree to disagree.

I've been trying to reproduce what you did with the UJ-220S (got mine with my asus laptop, won't even read any BRD, and of course no fw upgrade available)... But there are no "OLD" and "NEW" idents in ram when opening the updater with WinHex. All I can find is a reference to the new fw (MATSHITABD-MLT UJ-220S 1.05090728PCC 220BSX1 000200F400310007) and one to what appears to be a response to a challenge to my drive (MATSHITABD-MLT UJ-220S 1.0007121300)... but I can't manage to get it to acknowledge my drive as a correct one :
- tried to rewrite my ident in ram with the (supposed) correct one
- tried to rewrite the correct one with mine

=> no go... Has someone ever attempted this with a UJ-220S ?

edit : tried with EP0000203289 available from sony JP, it's the latest fw I've managed to find.

1. Make sure you have some drive letters after your optical drive. Easiest way is to install something like Virtual Clone Drive and change the drive letter to be after your current optical drive's letter. That way you hit the breakpoint a couple times.

2. I didn't hack the response from the drive's ID query. Not sure if I got lucky with WinDbg and stepping into/out-of functions, but if you *repeatedly* open WinHex's RAM editor on the flash program's "entire memory", you will eventually find the "NEW" and "OLD" strings in memory. What you need to do is edit one of the "OLD" entries (it appears to be an array of valid drive ID strings) to match your current drive's ID string.

Got that, and I opened the ram each time the breakpoint was hit... but no luck finding NEW and OLD. That's really starting to [*oops*] me off!

edit : and btw, i am able to find the new/old strings with the UJ225 updater, so I'm assuming I'm doing this right...

I think the problem is that Matshita uses two types of flasher programs for their drives (see the attached figure below).

The method described by tqhoang seems to only work with the type of flasher used by drives such as UJ-225 (the ones with the Down Load icon type). The more common type of flasher used by the UJ-220 (and most other Matshita drives) behaves quite differently when you try to flash a drive with it, so it perhaps needs a different breakpoint

Yep that's most likely the case, but not sure about the breakpoint issue... Using TraceSPTI, it seems it's the only method called to send inquiry to the drive. And yet, there's no trace in ram of valid strings id from which the updater would agree to upgrade. Curse you matSHITa.

tqhoang, could you upload the firmware you flashed your drive with to rapidshare or some other fileserver?
it seems a bit doubtful it is possible to accomplish what you have.
many thanks!

The file tqhoang used is the standard Sony flasher, as per the links included in this thread?!! You don't seem to really understand what tqhoang has done at all ... He hasn't modified the Sony flasher at all. What he did is to modify some values directly in the RAM memory of his computer while the Sony flasher program was running, in order to trick it in thinking that the drive he has is a Sony OEM one, so that the flashing operation is allowed to continue...

There's nothing to share, other than the method he used, which is very clever ... so things are not as simple as modifying a file - no file is modified at all - if you want to crossflash you would need to go through the method described step by step and do all the changes yourself. This is quite advanced stuff, so if you don't understand 101% exactly what you're doing, how a debugger works and accessing the RAM memory with a HEX Editor, then better forget about it ... if by mistake you modify the wrong thing in the RAM memory that could have very serious consequences!

and it's doubtful you've even started to understand what he did... seriously go back to HEXedit 101...

komorka - What 'cvs' said is correct. There is no patched firmware. I just happened to stumble upon the loophole.

--

CoinCoin88 - Are you stepping after you hit the last breakpoint? If they did things logically in the flasher application, what I would expect is it to:
- for each optical device
- make the kernel device I/O call (this is where the breakpoint hits)
- store the device ID string into an array
- loop through both lists of your device ID strings and a whitelist of Sony device ID strings
- if it matches, then break and show the upgrade dialog box

I'm not sure what are the previous Sony UJ-220S firmware versions other than v1.04 and v1.05, but perhaps you can try to search for "1.04" or "1.04080723" if you use the v1.05 firmware updater?

If I get the time this week, I'll try to run the UJ-220S firmware updater and see if I can find the right spot to trick it...no promises though since I've got lots of things on my "honey do list"...

This is what I've got in terms of existing UJ-220 firmwares (I've uploaded them all on mediafire for convenience):

http://www.mediafire.com/?5pt3q87nfn2sgz0

cvs - Thanks for the firmwares. Do you happen to have any Sony UJ-225 firmwares other than the Q111 and Q113?

CoinCoin88 - I ran the UJ-220 firmware flasher and see what you mean. What I did find was my current drive's ID string in memory at a certain point. What I did find in plain text was "CommonFwHeader", so I'm wondering if the flasher is just checking the few bytes before "MATSHITABD-MLT UJ-220S <version>" string.

Could you post a clean TraceSPTI log (requires 32-bit OS) of the UJ-220 flasher querying your drives? I want to see what your full drive ID string is.

You might need to rename your flasher executable with an 8.3 filename.
Here's my tweaked SptiHook.ini settings:
[Scope]
Hook=WinBType,DVDInfo,UJ220104,UJ220105,UJ225111,UJ225113
[Trace]
NonSPTI=Yes