Print

[langnao]

QUOTE(spydermixx @ Nov 6 2006, 05:46 PM)

right now i have a hitachi 46dh.  I should be getting a sammy drive in the next few weeks from the BST part of the forums but being a fairly impatient person I would prefer to fix the hitachi so it works sooner rather than later  (IMG:style_emoticons/default/biggrin.gif)

i just about nearly slapped myself when i realised to flash the hitachi with samsung info id need to know sectors to flash.  the worst part is i can only contemplate the replacement mobo originally came with a samsung drive as the seller is somewhat unresponsive and I have had to go by his auction history on ebay to find what other replacement parts he sold.

what i might do is when i come home from work and have more time is to try "upgrading" my hitachi to a 59 to see if that sorts it. im not holding out much hope for it though to be perfectly honest.

Best is to restore the firmware to original state where it is unstealth and do the respective modification. Then encrypt and then flash sector 9002000 & 9003D000, both sector where the drive model appears.

The troublesome part is applying back garyopa firmware. As you had changed the drive model, the original back script will not work. You had to modified the script. There are a number of ways to do it. Either you modify the respective firmwares in the FWPACK or you enter those commands to change the drive model yourself and run the modified flashing script that contains only the flashing routines for your specific drive model (minus off the checking of the drive model)

[myfranco]

----------Hitachi v32,v46,v47 to Hitachi v59 to avoid E66 Error----------------(Parts 2,5,6,7 are taken from Gayopa)
From what i understood to avoid E66 error , this is what we need to do:

1-Assuming we have a flashed v32 , v46 , v47 with stealth , we first un-stealth the firmware

2-firm e orig.bin orig-e.bin <---- Encrypt the untouched original firmware
47flash Driveletter orig-e.bin 90033000 1000 <--- Flash back the READ part, to unstealth the firmware

3-Restore the drive to its original Firmware.We have now the original firmware without any modification.

4-We flash the drive with Garyopa 2.3.Until this point we have a working drive but giving E66 error

5-Hexediting the original firmware :
starting at >2030 (2 bytes) backwards version becomes "95"
starting at >20D4 (2 bytes) forewards version becomes "59"
starting at >20DE (8 bytes) ver. build date becomes "06/01/24"

The second part of the firmware:
starting at >3D49E (2 bytes) forewards version becomes "59"
starting at >3D4A8 (8 bytes) ver. build date becomes "06/01/24"
starting at >3D51C (2 bytes) backwards version becomes "95

6-After hexediting we encrypt the firmware:
firm e orig.bin orig-e.bin and rename to fake59.bin

7- 47flash H fake59.bin 90002000 1000 <---- Flash the first changed sector
    47flash H fake59.bin 9003D000 1000 <---- Flash the second changed sector

That is how it has to be ,right?

To me ,we need to flash the drive before changing v32,v46,v47 to v59.Since we don't touch any flashed sector during the modification,that would not have any effect on the firmware.
Flashing the drive after the modifications might have different effects,i think.


@Langnao why flashing the drive before modifications? We can flash the drive first then we can make those modifications.In that case,there won't be any need to change Garyopa's flashing script.

This post has been edited by myfranco: Nov 6 2006, 02:27 PM

[langnao]

QUOTE(myfranco @ Nov 6 2006, 08:41 PM)

----------Hitachi v32,v46,v47 to Hitachi v59 to avoid E66 Error----------------
From what i understood to avoid E66 error , this is what we need to do:

1-Assuming we have a flashed v32 , v46 , v47 with stealth , we first un-stealth the firmware

2-firm e orig.bin orig-e.bin <---- Encrypt the untouched original firmware
47flash Driveletter orig-e.bin 90033000 1000 <--- Flash back the READ part, to unstealth the firmware

3-Restore the drive to its original Firmware.We have now the original firmware without any modification.

4-We flash the drive with Garyopa 2.3.Until this point we have a working drive but giving E66 error

5-Hexediting the original firmware :
starting at >2030 (2 bytes) backwards version becomes "95"
starting at >20D4 (2 bytes) forewards version becomes "59"
starting at >20DE (8 bytes) ver. build date becomes "06/01/24"

The second part of the firmware:
starting at >3D49E (2 bytes) forewards version becomes "59"
starting at >3D4A8 (8 bytes) ver. build date becomes "06/01/24"
starting at >3D51C (2 bytes) backwards version becomes "95

6-After hexediting we encrypt the firmware:
firm e orig.bin orig-e.bin and rename to fake59.bin

7- 47flash H fake59.bin 90002000 1000 <---- Flash the first changed sector
    47flash H fake59.bin 9003D000 1000 <---- Flash the second changed sector

That is how it has to be ,right?

To me ,we need to flash the drive before changing v32,v46,v47 to v59.Since we don't touch any flashed sector during the modification,that would not have any effect on the firmware.
Flashing the drive after the modifications might have different effects,i think.
@Langnao why flashing the drive before modifications? We can flash the drive first then we can make those modifications.In that case,there won't be any need to change Garyopa's flashing script.

Running the restore.bat will restore everything back to original which include unstealth ,etc. garyopa mentioned that the method recommended was tested on unstealth firmware and thus it is better to unstealth it. Based on your steps, step 2, you unstealth the drive then step 4 u run the script to flash the drive which will stealth it again. Also, each time before running the modified firmware, it is better to run the restore.bat which will restore everything to default cos u only unstealth in step 2, but other things like Security Sector Read,  Media Detect, etc was still there ...

This post has been edited by langnao: Nov 6 2006, 02:29 PM

[myfranco]

Yeah you're right.After flashing the drive we better un-stealth it again so that it won't be any problem.

And actually,after the step 2 and 3 ,we would have original firmware.After step 4 we need to un-stealth it again.
When i mean original.bin , i mean the very first original.bin

This post has been edited by myfranco: Nov 6 2006, 02:35 PM

[langnao]

One method you can try to make it more automated is to modified the firmware pack that comes with FWPACK.RAR.

E.g if your drive is 47, modified the 2 files 47_23.BIN and 47_23S.BIN accordingly to reflect the new drive. Assuming you are running flash23s.bat cos if you are running flash16s.bat, you have to modify the 47_16.BIN and 47_16S.BIN instead.

Then open flash23s.bat, go and find under :FLASH47, just below it, enter these 2 lines,

47flash %1 xtrm-e.bin 90002000 1000
47flash %1 xtrm-e.bin 9003D000 1000

Everything is pretty much intact. Not much modification to flash23s.bat script. The script first check for the version of your drive from the firmware dump of your drive. It will detect as 47(assume). Then it proceed to prepare the mod. firmware to flash for your drive. Since we had modified the firmware in the FWPACK.RAR to reflect the new drive model, these steps are automated. It will proceed to the script portion for 47 and starts flashing. The first 2 lines are the command to modified the drive model, then it will proceed with the rest of the modification ...

[myfranco]

@Langnao that's pretty automated.Good thinking.
What i want to know is can we make the FW stealth after everything is finished?
Garyopa mentioned that must be un-stealth to do those mods.In that case , after restoring , flashing , un-stealthing and modifing we can stealt the firmware.Would there be any problem with that?

[langnao]

QUOTE(myfranco @ Nov 6 2006, 09:03 PM)

Yeah you're right.After flashing the drive we better un-stealth it again so that it won't be any problem.

And actually,after the step 2 and 3 ,we would have original firmware.After step 4 we need to un-stealth it again.
When i mean original.bin , i mean the very first original.bin

Another way if you don't have to redo everything, remove steps 3 & 4. And then ended with stealth the firmware back after you had completed everything. Thus in summary, first you unstealth as in step 2. Then you proceed to step 5 where you do all the necessary changes to change the drive model and then step 6 where you encrypt the changes and then step 7 where u flash back to drive. Then you have to stealth back the drive. But to stealth the drive, you need to prepare the respective firmware that comes with the FWPACK.RAR and alot of the steps that were listed in the flash23s.bat ...

QUOTE(myfranco @ Nov 6 2006, 09:23 PM)

@Langnao that's pretty automated.Good thinking.
What i want to know is can we make the FW stealth after everything is finished?
Garyopa mentioned that must be un-stealth to do those mods.In that case , after restoring , flashing , un-stealthing and modifing we can stealt the firmware.Would there be any problem with that?

That's why the first method is better cos when running garyopa script, after the 9 modifications, eg Xtreme Custom Code,  Master Checksum ,etc. It ended with doing FW STEALTH DATA/CODE and FW STEALTH HACK ...

The only troublesome part is modifying the firmware in FWPACK.RAR.

[myfranco]

Ok i got it.When everything is done , we would have a modified and non stealth firmware which DOES NOT give E66 error.However,the firmware would be non stealth right?

firm e garyopaFW.bin garyopaFW-e.bin (gave the name just to show which fw to be flashed)
47flash H garyopaFW-e.bin 90033000 1000   now the FW in the drive must be stealth

Is that so ? or do i need another thing to stealth it?

OR:

47flash H garyopaFW-e.bin 90005000 1000   FW STEALTH DATA/CODE
47flash H garyopaFW-e.bin 90033000 1000   FW STEALTH HACK

which of them?


And one more thing. I believe we are confused about this modification(to make it look like v59) for this modification we can use original.bin because those sectors are not flashed with garyopa , untouched.
Restoring the drive , flashing with Garyopa , un stealthing ,modifing the original fw to v59 , flashing v59 sectors to the drive then stealthing would be enough.In that case ,the last command must be this:
47flash H garyopaFW-e.bin 90005000 1000   FW STEALTH DATA/CODE
47flash H garyopaFW-e.bin 90033000 1000   FW STEALTH HACK


This post has been edited by myfranco: Nov 6 2006, 03:19 PM

[langnao]

QUOTE(myfranco @ Nov 6 2006, 09:39 PM)

Ok i got it.When everything is done , we would have a modified and non stealth firmware which DOES NOT give E66 error.However,the firmware would be non stealth right?

firm e garyopaFW.bin garyopaFW-e.bin (gave the name just to show which fw to be flashed)
47flash H garyopaFW-e.bin 90033000 1000   now the FW in the drive must be stealth

Is that so ? or do i need another thing to stealth it?

OR:

47flash H garyopaFW-e.bin 90005000 1000   FW STEALTH DATA/CODE
47flash H garyopaFW-e.bin 90033000 1000   FW STEALTH HACK

which of them?

No need to do 90005000 (FW STEALTH DATA/CODE) since it was not undone as only 90033000 FW STEALTH HACK was undone.

After you had completed everything, you will have to use 47_23S.bin, encrypt it and then flash the stealth portion back.

Eg.

firm e 47_23S.bin xtrm-es.bin
47flash %1 xtrm-es.bin 90033000 1000


You run all these yourself, you don't have any error checking like those in garyopa script thus hopefully all goes well ...

[myfranco]

@Langnao you got my point.You're right we don't need 90005000 thingy.
Thank you for your contribution.I'll think everything than will flash it.

[segaboys]

How do you know which version of Flash to use?

I have a V32 drive upgrade to V40

Which of the following do I use...

46FLASH.EXE
47FLASH.EXE
59FLASH.EXE


Thanks

[langnao]

QUOTE(segaboys @ Nov 6 2006, 10:16 PM)

How do you know which version of Flash to use?

I have a V32 drive upgrade to V40

Which of the following do I use...

46FLASH.EXE
47FLASH.EXE
59FLASH.EXE
Thanks

V40 goes to :FLASH4X of the script which is using 46FLASH.EXE to flash ...

[Bluenose]

QUOTE(langnao @ Nov 6 2006, 02:09 PM)

Yap if going to '59' doesn't work for u, most probably you are having a samsung drive originally.

It works for averian but his is modifying samsung to show hitachi model.

The first part is pretty must the same but the second part, I think,

hitach 0x20b6 - 0x20d5  to samsung 0x20b8 - 0x20d7
will be must better choice since it is 32byes like the first part.

averian copied a bit more for the hitachi at 0x20b3, 0x20b4 and 0x20b5 which happens to be '80 00 32'. On the samsung 0x20b5, 0x20b6 and 0x20b7 also happens to be  '80 00 32'. Thus I think 32 bytes are enough ...

For MS25:

Samsung 0x202e - 0x204d :
sm52    STTSocprVD-DOR MSTH-49A3 (ASCII)
736D353220202020535454536F63707256442D444F52204D5354482D34394133 (in hex)

Samsung 0x20b5 - 0x20d7 :
..2[...TSSTcorpDVD-ROM TS-H943Ams25 (ASCII)
8000325B00000054535354636F72704456442D524F4D2054532D48393433416D733235 (hex)

I can confirm that this method worked for me.  I have a samsung ms25 flashed to x42a working in box that had a hitachi 59dj that gave me e66 with the samsung (tried every fw possible).  I just hex edited the same lines from averian's post (thanks) with the ones from my orignal hitachi.bin into my x42a.bin.  I checked the bin with 360fwtoolbox and my key was all fffffffffffffff's so this might be something to look out for.  I have been on live and everything seems ok.

[averian]

Glad to be able to give something back, this board sure has helped me! langnao is right, I added a few duplicate bytes which should not cause any problems, but the cleaner version for reference is:

copy 0x202e - 0x204d from Hitachi 47DJ to Samsung 0x202e - 0x204d
copy 0x20b6 - 0x20d5 from Hitachi 47DJ to Samsung 0x20b8 - 0x20d7

[myfranco]

OK I'VE DONE IT !!!!

Story : Hitachi v59 got bricked with Birdy Flasher then we bought a Hitachi v47 , flashed and injected the key.It worked fine.After the fall update 360 was giving E66 Error since it was married with a hitachi v59 but there was v47 at that moment.

Solution :

1 - Flashed back to original Firmware (used restore.bat command in Garyopa 2.3 )

2 - Flashed with Garyopa 2.3 (thank you to Garyopa)

3 - Unstealthed the firmware with the encrypted original.bin :
47flash H orig-e.bin 90033000 1000 --->this is the very first original firmware.

4 - Hexedited original.bin and changed v47 information to v59 to make Xbox 360 return with the correct code:

QUOTE

starting at >2030 (2 bytes) backwards version becomes "95"
starting at >20D4 (2 bytes) forewards version becomes "59"
starting at >20DE (8 bytes) ver. build date becomes "06/01/24"

and the same change again at:

starting at >3D49E (2 bytes) forewards version becomes "59"
starting at >3D4A8 (8 bytes) ver. build date becomes "06/01/24"
starting at >3D51C (2 bytes) backwards version becomes "95"  taken from Garyopa

saved the bin file as fake59 then encrypted with Firmware Toolbox 1.2

5 - Again with Garyopa's X-LG folder:
47flash.exe H fake59.bin 90002000 1000 <---- Flash the first changed sector
     47flash.exe H fake59.bin 9003D000 1000 <---- Flash the second changed sector
(Where H is the drive letter)

Turned 360 off.Plugged all the cable and played Splinter Cell Double Agent  (IMG:style_emoticons/default/biggrin.gif)
I want to thank to Garyopa and Langnao for their great contribution.

I believe this solution be a sticky topic since all these people who swapped hitachi to hitachi or hitachi to samsung or vice versa would need it in case they get E66 error

This post has been edited by myfranco: Nov 6 2006, 07:28 PM