The Firmware Page

READ the medialist supplied by Pioneer!!

If you want to know something, you have to put more self-effort into it.


http://wwwbsc.pioneer.co.jp/product-e/i ... 02r_e.html
http://wwwbsc.pioneer.co.jp/product-e/i ... 03r_e.html

Not to be disrespectful, but then again a classic reply of certain kind of people. Anyway, as is implicit in my posts I knew very well the list that Pioneer provides, what I want to know is if DVRFlash permits you to burn other brands, since the firmware that Pioneer provides incorpores new DVD-R (etc, for that matter) brands at 16x speed with each new release, I figured if DVRFlash has this capability too with the difference that you can burn brans currently "banned" by Pioneer, like the Taiwanese ones (as far as I have read). Thanks

Your answer to this query was posted in this same thread just a few posts previously

Ok, updating means that I get the "latest" firmware, that could involve that my drive can make new things, so if these new things are the same that the ones Pioneer provides with its firmware (that is, theres not changing in the "behavior of the firmware") then if I can get the latest firmware from Pioneer it would make no difference than executing DVRFlash?? Sorry but I really thought that DVRFlash lets you make more things like for example changing to multiregion, I call this changing behavior... Anyway, it seems that the list is the same Pioneer provides, I just wanted to clarify the terms.

I'm unsuccessful so far in flashing a Pioneer 110D.
The unit was bought new as an upgrade.
Using Terminal and the 2 unstuffed exe files in the same directory, closely following the instructions with DVRFlash 2.2 (several times) I get this result:

dyld: ./DVRFlash can't open library: /usr/lib/libstdc++.6.dylib (No such file or directory, errno = 2)
Trace/BPT trap

I admit I'm very new to OSX (and Unix).
Anyone know what I need to do now
(G4 Sawtooth 400, MacOS 10.2.8)
Thanks,

What was the exact commandline used?

cd Desktop/DVRFlash

then:

./DVRFlash -vf PIONEER RB100011.139 RB100111.139

(It's the only optical drive.)

Has anyone tried to use DVRFlash and the super force command to update a DVR-111/111D?

lol
What would that give? 111 burners are not supported yet!

Thanks for this

Great work!

I just want to let you know there may be a bug on the software.

I tried version 2.2 on Fedora Core 4 kernel 2.6.16-2108 ( i can not remember the exact reversion but ends with 108)

I just try to run it, see if it can detect my ASUS 1608P2S, it did.

BUT, the program did not exit properly.

it did return to prompt but the program still exist (zombie) in memory and consume 90% of cpu time.

i have to do "kill -9" to turn it of.

I am not a guru on programing anymore, but from college i learn it looks might be problems with :
1. exit code
2. child process has become an orphan

I hope that's help.

This should be:
cd ~/Desktop/DVRFlash
The "~" is a shortcut for your personal home directory, where your personal Desktop (and it's content) then can be found.

@lasvagas

Buffalo has just release the 819 firmware for the Pioneer 111 with both a kernal and normal file. DVRFlash V2.2 rejects the 111...

I have Buffalo's XL516FB firmware (A0412540.819, A0412541.819).

I am willing to test a revised version of DVRFlash...

Regards,
B-H

be patient

Any estimate when there will be the update to handle the dvr-111d?

I just bought one of these for my Mac and what was sent was a unit built in February so it has the 1.06 firmware. The latest is 1.23. So that's why I am asking now about this. Or am I better off not worring about this and should just leave well enough alone even if the flasher is updated? After all it does seem to be working ok as is so far the little I've tried to burn with it.

would leave it as it is, unless you want to crossflash

hey i have a dvr 104 1.30 and upgdvd didnt work for me and then i found this. umm i managed to open dvrflash.exe in command promt and then im lost there..i keep typing in

DVRFlash -vf F: R4100103.141 but nothing is happening. im suppose to type in the file i want to upgrade to right? thanks..

I suggest to not to update to 1.41 but 1.40, because 1.41 has some minor issues. Just please read the DVRFLASH readme. Put DVRFlash and the firmware file in the same folder, navigate to that folder and enter an appropriate command on the commandline... There should be always an output, even by only running dvrflash alone.

hello, when a version who supports the DVR-112?

When there is someone who could adapt and update DVRFlash to support newer models.

DVR 2.2 says "Drive Not Supported".

Will doing an -ff work? not work? or turn it into a brick?

Current command:

./DVRFlash -vf PIONEER A0812001.129

Why do I want to burn? Want to burn 1.29 RPC-1 Firmware. I don't want to go buy a second drive for my machine...but will if I can't update my drive...

Parallels isn't letting me update firmware (Parallels 3.0) The command:

UPR111D.EXE in parallels returns

/// ODD Firmware Update Utility Ver2.37A

Available target is not found.

I've read FAQs. Call me dumb.

DVRFlash does not support the 111 drive

Hello.

In advance I'll apologise if this isn't the correct thread, but I thought as this program was the closest thing to what I'm looking for, it'd be the right place for this post.

I've got some Pioneer BDC and BDR drives and I wish to be able to flash alterations to their firmware to them.

I know Agent Smith's tool doesn't support them, but I'm assuming that the Pioneer flash system is the same across most of their drives, so it'd be a fair bet that they'd be using the same code base on the newer drives.

That said, short of having to delve into the drives firmware to re-invent the wheel just to do another flasher, is anyone on here willing to divulge the current flashing process to the DVR series of Pioneer drives?

Before I get the usual replies: I already have the full firmware extracted from the devices (Kernel and Normal) for each. I've disassembled the flasher specific codes in both segments, but I really don't want to mess about with the entire rigmarole of determining the flashing procedure if I can avoid it, so hence the post here.

Thanks in advance.

Hello all.

Thanks to those few who sent me a PM with their suggestions.

I have managed to extract the entire low level flash sequence from the within each firmware image and there appears to be a standard microcode update function via the standard SPC-2 WriteBuffer command.

Although, it appears that the drive needs to be switched into 'kernel' mode in order to do this, as the 'normal' command handler forks to a different set of routines.

Mode/Type when set to 0xff appears to be what does the switch to kernel mode (and there is also what appears to be a backdoor entry via a vendor specific command, forked from the 'normal' handler via 0xf0).

That said, there is obviously some obfuscation contained therein, as there appears to be four variations of microcode file types "SCRK", SCRN", "DESK" and "DESN". Where DES == DEScrambled, SCR == SCRambled and "K" is Kernel and "N" is Normal.

I've also pulled a couple of values that appear to be checked in the main switch from Normal to Kernel modes, which I assume are some kind of key/seed value?

Sound familiar to anyone? Or am I looking at a completely new beast here?

Please, if someone else who does have some info knows anything, especially if this sounds a lot like the DVR series, I'd love to hear it!

de1c1de.

Hi all,

Well, it transpires that Agent Smiths' Flasher is nothing more than a hack of the official Pioneer flasher, so no surprises there.

There are significant differences in the modus used for flashing the new BDx series of drives, based on the R8J.

The Kernel switch is controlled via the same mechanism, though and it responds to the new BDx key, as follows: 0x--------. It also still supports the Pioneer master key, which was: 0x9a782361.

There is a new format for packed (vs. plane) files which incorporate the changes in my post above. The scrambling is rudimentary and the checksum is nothing more than a 32bit addition across the first 256 bytes of each 64k page.

In the end, I used an exploit to grab the IP and just uploaded and then called my own flasher code from SRAM, bypassing all the checks and balances.

In future, for all those who want to release tools: Please, release "your" code so that others can continue you work when you eventually abandon it. No one wants to re-invent the wheel and let's face it, reverse-engineering is not exactly rocket science, it's more a waste of time.

Hope this info helps someone else at some point.

de1c1de.

Edit: Removed primary key; as it could be used to identify a specific drive.