The Firmware Page

It is currently Tue Dec 23, 2014 1:06 am


Post new topic This topic is locked, you cannot edit posts or make further replies.  [ 216 posts ]  Go to page 1, 2, 3, 4, 5 ... 9  Next
Author Message
 PostPosted: Sun Sep 02, 2007 6:44 pm 
Firmware Patcher

Joined: Wed Aug 01, 2007 11:28 pm
Posts: 21
Hi,

I'm starting this thread to see if there would be interest is volunteering samples of the standard firmware revisions found on Matshita UJ-8xx drives in Macs.

There are several reasons why having a copy of the firmware available might be useful. For example as a base for region free patches or other patches such as autoreset, bitsetting, or to restore an earlier standard revision.

I've written a very basic utility that I hope can extract a relevant region of the drive's address space. It's not user friendly, needs you to use the terminal and have development tools such as 'gcc' and 'make' installed. Familiarity with some basic unix shell commands is also useful. If you don't know what these things are I don't think it is worth finding out just to try this out.

My idea is that a couple of people with each firmware revision take a sample from their drive - the file will be about 4MB. Upload it to a file hosting site and either post the link here or PM it to me, adding a public comment here to say you've sent it and quoting the firmware revision. Once a couple of people have sent a given revision there's no need for more.

One reason why you might not want to publicly post the link (or do this at all) is that the image taken from the drive is not exactly a firmware image. The 'firmware' would be the same for everybody with a given revision. However the image that the utility would extract is hopefully the firmware plus some other things. That might include information such as your drive's serial number and the history of region changes that have been made to the drive. Although that information does not interest me I ask that the contents of the dump not be changed - to allow for checking of internal checksums.

Assuming that there are some responses I'd make the resulting firmware public (only the firmware parts, no personal information of course). Somebody, myself or somebody else, may then be able a utility available to flash the firmware or make changes for things like region free. However there is no guarantee that me or anybody else will do that - this is just an attempt to get the original firmware available.

Along with the utility to dump the firmware I've also included an example program to (de)obfuscate the firmware as it is supplied to the drive during a flash.

I have been meaning to make more information about the Matshitas available since I made some RPC1 firmwares - but I haven't really been able to make time for that. The example should give the minimal information needed, although it isn't a wonderful example program. However I think somebody experienced in patching drive firmwares and wanting to start to work with these drives would find it helpful. I may be able to add some more description to this thread later.

The archive link:

http://rapidshare.com/files/52925201/ma ... y.zip.html

Example of how the firmware dump should work:

ben11s-computer:~ ben11$ cd Desktop
ben11s-computer:~/Desktop ben11$ unzip matshita_memory.zip
ben11s-computer:~/Desktop ben11$ cd matshita_memory
ben11s-computer:~/Desktop/matshita_memory ben11$ make
gcc -g -Wall -W -o dump mscsi.c dump.c \
-framework IOKit -framework CoreFoundation
ben11s-computer:~/Desktop/matshita_memory ben11$ ./dump
compiled at Sep 1 2007 12:00:00
Appear to have a matshita at device index 0: MATSHITADVD-R UJ-857 HAEA
Reading a portion of the memory of the drive, assuming 32 bit address space
Finished reading drive memory
read memory from device 0, saved in matshita-dump-0.dat

In this case the dump file is 'matshita-dump-0.dat'. You could compress that if you like, before uploading.

An example of the obfuscation scheme used to send the firmware for flash can be
found by looking at the source file 'example_obfuscate.c' in the archive above. It is not part of the dump utility.

The following firmware are already available: DAM5, GAND, GEND, GFND, GGND,
HAEA, HBEA, KBVB, KCVB so there is no need to try to extract those.

The dump utility may or may not work for your drive - if you find it does not then thank you for trying it.

I do not think there is any particular danger in using the dump utility. Any conceivable problem should be fixed by restarting the machine - there is no flash involved. But use is at your own risk.

Thanks!


Top
 Profile  
 
 PostPosted: Sun Sep 02, 2007 7:43 pm 
Fresh meat

Joined: Tue Apr 24, 2007 7:29 pm
Posts: 18
Simply "congrats"!

EDIT: might be useful for further analysis of the dumps:
http://rapidshare.com/files/52997709/mn103.zip.html


Top
 Profile  
 
 PostPosted: Mon Sep 03, 2007 9:03 pm 
Fresh meat

Joined: Sat Jul 22, 2006 1:02 pm
Posts: 13
Sent you a dump of this drive
Model: MATSHITADVD-R UJ-857E
Revision: ZA0E


Top
 Profile  
 
 PostPosted: Mon Sep 03, 2007 9:45 pm 
Firmware Patcher

Joined: Wed Aug 01, 2007 11:28 pm
Posts: 21
Hi,

Thanks Hiroyuki, and also the person who sent me the DBN7. That's much appreciated!

In fact I have several PMs - I haven't been checking them regularly; it might make me seem a little slow in getting back to you. Sorry about that. :)


Top
 Profile  
 
 PostPosted: Mon Sep 03, 2007 11:21 pm 
Professional Poster

Joined: Sat Nov 06, 2004 10:43 pm
Posts: 50
Sent you a dump of the ZB0E revision of the UJ-857E. Same model as Hiroyuki, slightly different firmware.


Top
 Profile  
 
 PostPosted: Tue Sep 04, 2007 7:11 am 
New Member

Joined: Tue Sep 04, 2007 6:27 am
Posts: 2
Sent you the dump of the MATSHITADVD-R UJ-846 (Revision : FB2U)

thks!


Top
 Profile  
 
 PostPosted: Tue Sep 04, 2007 8:24 am 
Rookie

Joined: Tue Sep 04, 2007 8:10 am
Posts: 6
Hi,

I've got a MATSHITA DVD-R UJ-85J with a FCQA firmware on a Intel iMac 24"
I can't make the dump
Code:
iMac:~  zito$ cd Desktop/
iMac:~/Desktop  zito$ unzip matshita_memory.zip
Archive:  matshita_memory.zip
   creating: matshita_memory/
  inflating: matshita_memory/dump.c 
  inflating: matshita_memory/example_obfuscate.c 
  inflating: matshita_memory/Makefile 
  inflating: matshita_memory/mscsi.c 
  inflating: matshita_memory/xscsi.h 
iMac:~/Desktop  zito$ cd matshita_memory
iMac:~/Desktop/matshita_memory  zito$ make gcc -g -Wall -W -o dump mscsi.c dump.c \
>  -framework IOKit -framework CoreFoundation
make: invalid option -- g
Usage: make [options] [target] ...
Options:
  -b, -m                      Ignored for compatibility.
  -B, --always-make           Unconditionally make all targets.
  -C DIRECTORY, --directory=DIRECTORY
                              Change to DIRECTORY before doing anything.
  -d                          Print lots of debugging information.
  --debug[=FLAGS]             Print various types of debugging information.
  -e, --environment-overrides
                              Environment variables override makefiles.
  -f FILE, --file=FILE, --makefile=FILE
                              Read FILE as a makefile.
  -h, --help                  Print this message and exit.
  -i, --ignore-errors         Ignore errors from commands.
  -I DIRECTORY, --include-dir=DIRECTORY
                              Search DIRECTORY for included makefiles.
  -j [N], --jobs[=N]          Allow N jobs at once; infinite jobs with no arg.
  -k, --keep-going            Keep going when some targets can't be made.
  -l [N], --load-average[=N], --max-load[=N]
                              Don't start multiple jobs unless load is below N.
  -n, --just-print, --dry-run, --recon
                              Don't actually run any commands; just print them.
  -o FILE, --old-file=FILE, --assume-old=FILE
                              Consider FILE to be very old and don't remake it.
  -p, --print-data-base       Print make's internal database.
  -q, --question              Run no commands; exit status says if up to date.
  -r, --no-builtin-rules      Disable the built-in implicit rules.
  -R, --no-builtin-variables  Disable the built-in variable settings.
  -s, --silent, --quiet       Don't echo commands.
  -S, --no-keep-going, --stop
                              Turns off -k.
  -t, --touch                 Touch targets instead of remaking them.
  -v, --version               Print the version number of make and exit.
  -w, --print-directory       Print the current directory.
  --no-print-directory        Turn off -w, even if it was turned on implicitly.
  -W FILE, --what-if=FILE, --new-file=FILE, --assume-new=FILE
                              Consider FILE to be infinitely new.
  --warn-undefined-variables  Warn when an undefined variable is referenced.
  -N OPTION, --NeXT-option=OPTION
                              Turn on value of NeXT OPTION.

This program built for powerpc-apple-darwin8.0
Report bugs to <bug-make@gnu.org>
iMac:~/Desktop/matshita_memory  zito$

Did I done something wrong ? Is it working only on PPC ?


Top
 Profile  
 
 PostPosted: Tue Sep 04, 2007 8:27 am 
Fresh meat

Joined: Mon Nov 25, 2002 2:35 am
Posts: 18
Hi. I'm looking for the UJ-85J FCQA or forward firmware...
Does someone can send it to ben11 please ?

Also, does somebody tried to upgrade the drive (not this's one articulary) with a most recent firmware revision? it's working ?

Thanks in advance


Top
 Profile  
 
 PostPosted: Tue Sep 04, 2007 8:39 am 
Fresh meat

Joined: Sat Jul 22, 2006 1:02 pm
Posts: 13
zito wrote:
Hi,

I've got a MATSHITA DVD-R UJ-85J with a FCQA firmware on a Intel iMac 24"
I can't make the dump
Code:
iMac:~  zito$ cd Desktop/
iMac:~/Desktop  zito$ unzip matshita_memory.zip
Archive:  matshita_memory.zip
   creating: matshita_memory/
  inflating: matshita_memory/dump.c 
  inflating: matshita_memory/example_obfuscate.c 
  inflating: matshita_memory/Makefile 
  inflating: matshita_memory/mscsi.c 
  inflating: matshita_memory/xscsi.h 
iMac:~/Desktop  zito$ cd matshita_memory
iMac:~/Desktop/matshita_memory  zito$ make gcc -g -Wall -W -o dump mscsi.c dump.c \
>  -framework IOKit -framework CoreFoundation
make: invalid option -- g
Usage: make [options] [target] ...
Options:
  -b, -m                      Ignored for compatibility.
  -B, --always-make           Unconditionally make all targets.
  -C DIRECTORY, --directory=DIRECTORY
                              Change to DIRECTORY before doing anything.
  -d                          Print lots of debugging information.
  --debug[=FLAGS]             Print various types of debugging information.
  -e, --environment-overrides
                              Environment variables override makefiles.
  -f FILE, --file=FILE, --makefile=FILE
                              Read FILE as a makefile.
  -h, --help                  Print this message and exit.
  -i, --ignore-errors         Ignore errors from commands.
  -I DIRECTORY, --include-dir=DIRECTORY
                              Search DIRECTORY for included makefiles.
  -j [N], --jobs[=N]          Allow N jobs at once; infinite jobs with no arg.
  -k, --keep-going            Keep going when some targets can't be made.
  -l [N], --load-average[=N], --max-load[=N]
                              Don't start multiple jobs unless load is below N.
  -n, --just-print, --dry-run, --recon
                              Don't actually run any commands; just print them.
  -o FILE, --old-file=FILE, --assume-old=FILE
                              Consider FILE to be very old and don't remake it.
  -p, --print-data-base       Print make's internal database.
  -q, --question              Run no commands; exit status says if up to date.
  -r, --no-builtin-rules      Disable the built-in implicit rules.
  -R, --no-builtin-variables  Disable the built-in variable settings.
  -s, --silent, --quiet       Don't echo commands.
  -S, --no-keep-going, --stop
                              Turns off -k.
  -t, --touch                 Touch targets instead of remaking them.
  -v, --version               Print the version number of make and exit.
  -w, --print-directory       Print the current directory.
  --no-print-directory        Turn off -w, even if it was turned on implicitly.
  -W FILE, --what-if=FILE, --new-file=FILE, --assume-new=FILE
                              Consider FILE to be infinitely new.
  --warn-undefined-variables  Warn when an undefined variable is referenced.
  -N OPTION, --NeXT-option=OPTION
                              Turn on value of NeXT OPTION.

This program built for powerpc-apple-darwin8.0
Report bugs to <bug-make@gnu.org>
iMac:~/Desktop/matshita_memory  zito$

Did I done something wrong ? Is it working only on PPC ?


Hmm... try removing the / and put everything on one line.... (shouldn't make any difference, but did it for me...) what version of gcc/xcode you have?
Worked fine on my intel mbp 2.2GHz


Top
 Profile  
 
 PostPosted: Tue Sep 04, 2007 8:45 am 
Professional Poster

Joined: Sat Nov 06, 2004 10:43 pm
Posts: 50
Just type "make" in the command line. It's enough to compile the code.


Top
 Profile  
 
 PostPosted: Tue Sep 04, 2007 8:55 am 
Rookie

Joined: Tue Sep 04, 2007 8:10 am
Posts: 6
Thanks for your help Hiroyuki and El Bacho
Unfortunately it's still not working...

Code:
iMac:~/Desktop/matshita_memory zito$ make gcc -g -Wall -W -o dump mscsi.c dump.c -framework IOKit -framework CoreFoundation
make: invalid option -- g

I'm using Xcode.app 2.4 and i686-apple-darwin8-gcc-4.0.1

Code:
iMac:~/Desktop/matshita_memory zito$ make
make: Nothing to be done for `default'.


Top
 Profile  
 
 PostPosted: Tue Sep 04, 2007 9:35 am 
Fresh meat

Joined: Sat Jul 22, 2006 1:02 pm
Posts: 13
can you give me the output of gcc -v


Top
 Profile  
 
 PostPosted: Tue Sep 04, 2007 9:41 am 
Rookie

Joined: Tue Sep 04, 2007 8:10 am
Posts: 6
Code:
iMac:~/Desktop/matshita_memory zito$ gcc -v
Using built-in specs.
Target: i686-apple-darwin8
Configured with: /private/var/tmp/gcc/gcc-5363.obj~28/src/configure --disable-checking -enable-werror --prefix=/usr --mandir=/share/man --enable-languages=c,objc,c++,obj-c++ --program-transform-name=/^[cg][^.-]*$/s/$/-4.0/ --with-gxx-include-dir=/include/c++/4.0.0 --with-slibdir=/usr/lib --build=powerpc-apple-darwin8 --with-arch=nocona --with-tune=generic --program-prefix= --host=i686-apple-darwin8 --target=i686-apple-darwin8
Thread model: posix
gcc version 4.0.1 (Apple Computer, Inc. build 5363)


I'm downloading the latest Xcode (2.5 Developer Preview 8M2540a)
and I'll try again...


Last edited by zito on Tue Sep 04, 2007 9:49 am, edited 1 time in total.

Top
 Profile  
 
 PostPosted: Tue Sep 04, 2007 9:44 am 
Fresh meat

Joined: Sat Jul 22, 2006 1:02 pm
Posts: 13
ehh... no "make" in front of gcc that should do the trick


Top
 Profile  
 
 PostPosted: Tue Sep 04, 2007 9:59 am 
Rookie

Joined: Tue Sep 04, 2007 8:10 am
Posts: 6
Ok with no "make" I obtain a 44 Ko dump file and no further indications in the terminal
Code:
iMac:~/Desktop/matshita_memory zito$ gcc -g -Wall -W -o dump mscsi.c dump.c -framework IOKit -framework CoreFoundation
iMac:~/Desktop/matshita_memory zito$


Here is the dump file, zipped : http://www.sendspace.com/file/7rgr3x

Thanks again Hiroyuki


Top
 Profile  
 
 PostPosted: Tue Sep 04, 2007 10:03 am 
Fresh meat

Joined: Sat Jul 22, 2006 1:02 pm
Posts: 13
That seems correct... then you run just type ./dump and it will give you an appx 4MB file which you can upload to ben11


Top
 Profile  
 
 PostPosted: Tue Sep 04, 2007 10:16 am 
Rookie

Joined: Tue Sep 04, 2007 8:10 am
Posts: 6
MATSHITADVD-R UJ-85J FCQA : http://www.sendspace.com/file/2xx9nb


Top
 Profile  
 
 PostPosted: Tue Sep 04, 2007 11:04 am 
New Member

Joined: Tue Sep 04, 2007 10:55 am
Posts: 1
MATSHITA DVD-R UJ-846, Revision FM3J :
http://www.sendspace.com/file/zt6l25 (bzip2 file, use bunzip2 to uncompress)


Top
 Profile  
 
 PostPosted: Tue Sep 04, 2007 11:18 am 
Fresh meat

Joined: Sat Jul 22, 2006 1:02 pm
Posts: 13
It would be nice, if you get time, to post some more info on the obfuscation of the firmwares - my C-skills aren't so strong so just looking at the (mostly) uncommented code doesn't provide much for me.


Top
 Profile  
 
 PostPosted: Tue Sep 04, 2007 12:21 pm 
Fresh meat

Joined: Sat Jul 22, 2006 1:02 pm
Posts: 13
Mod, can you guys make this a sticky thread? I think it is quite important to the future of this sub-forum


Top
 Profile  
 
 PostPosted: Tue Sep 04, 2007 2:36 pm 
Fresh meat

Joined: Tue Apr 24, 2007 7:29 pm
Posts: 18
A) to compile the program, simply type "make" into the terminal. "make" will read the "makefile", and hence execute "gcc" to produce the "dump" utility.

B) to execute the "dump" utility, it is necessary you type "./dump" into the terminal. otherwise, the OSX-built in "dump" utility will be executed (located in /sbin/dump).

C) if you cannot read the source code about the obfuscation - hell, what do you want more ??? it wont read nicer if he rewrote it in visualbasic.


Top
 Profile  
 
 PostPosted: Tue Sep 04, 2007 2:43 pm 
Fresh meat

Joined: Sat Jul 22, 2006 1:02 pm
Posts: 13
Hendrix wrote:
A) to compile the program, simply type "make" into the terminal. "make" will read the "makefile", and hence execute "gcc" to produce the "dump" utility.

B) to execute the "dump" utility, it is necessary you type "./dump" into the terminal. otherwise, the OSX-built in "dump" utility will be executed (located in /sbin/dump).

C) if you cannot read the source code about the obfuscation - hell, what do you want more ??? it wont read nicer if he rewrote it in visualbasic.


A: didn't work for the guy i helped, so I just used the contents of the makefile

C: I just wanted it a little more commented, no need to get all worked up about this... and it was a request not a requirement (I know some C, but i don't know basic... so that wouldn't help at all.. your technical docs were kinda interesting reading though hendrix)


end note... Not all people are as competent as you are hendrix, so please don't bash us for not having the knowledge you posess... I personally am here to learn - hopefully i can provide something to the community too.


Top
 Profile  
 
 PostPosted: Tue Sep 04, 2007 3:01 pm 
Fresh meat

Joined: Tue Apr 24, 2007 7:29 pm
Posts: 18
A) he typed: "make gcc -g -Wall -W -o dump mscsi.c dump.c \
> -framework IOKit -framework CoreFoundation"

while is was supposed to type just "make"

C) there is no "technique", it is just shuffling bits around and xor'ing them. HOW TO GUESS this encryption - that is a miracle. So far only two people on earth were able to do this.


Top
 Profile  
 
 PostPosted: Tue Sep 04, 2007 3:19 pm 
Fresh meat

Joined: Sat Jul 22, 2006 1:02 pm
Posts: 13
I know that, but he did try just make too..

Anyways, he got it working, so no need to argue over that ^^

And for the XOR and shuffeling bits part... XORing usually leaves quite visible traces; so quite often there is no need to guess - I would recommend Bruce Schneiers books on this topic; bitshifting though, might be a bit more tricky (haven't read up too much on that).

No matter how easy or difficult this may be, I think ben has done us all a great favor!


Top
 Profile  
 
 PostPosted: Tue Sep 04, 2007 3:41 pm 
Fresh meat

Joined: Tue Apr 24, 2007 7:29 pm
Posts: 18
it is all about guessing how the random number generator works AND how the feedback is implemented. i'm not sure whether mr schneier will help with that (does he tell how to attack an unknown cipher?)
additionally, this is not a known/chosen-plaintext attack, but some kind of unknown-but-similar-plaintext attack (with varying keys).

the encryption itself is (always in stream ciphers) done via XOR. however, using a good RNG will leave you with no "visible traces".

I fear you are left with no real "tools" to break this, but your (own) brain.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic This topic is locked, you cannot edit posts or make further replies.  [ 216 posts ]  Go to page 1, 2, 3, 4, 5 ... 9  Next


Who is online

Users browsing this forum: Exabot [Bot] and 1 guest


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
Style based on FI Subice by phpBBservice.nl