Topic: Liteon 83850-v2 and Liteon 93450 DVD Key Can Now Be Dumped? (Read 1193 times)

staveone · « **Reply #60 on:** November 30, 2009, 06:54:00 AM »

thanks caster,thought thats what i read a long time ago but still why no stock firmware, was it not possible to get a full dump using decapping?

xbox360sexual · « **Reply #61 on:** November 30, 2009, 06:58:00 AM »

Surprised noone has explained what's actually happening here.

I'm guessing that as the mtkflash and spi chip share the same 3.3v pin, we're disconnecting it and running it at 1.8v, which is enough for the mtkflash to work, but not enough for the spi chip to function, and thus we get FFF (blank chip), then we force it back to 3.3v and we get a read?

ccfman2004 · « **Reply #62 on:** November 30, 2009, 07:02:00 AM »

I just hope an easier method comes along to dump the new lite-on keys as I got a nice 93450 sitting in my CoD MW2 Super Elite.

Aldanga · « **Reply #63 on:** November 30, 2009, 07:02:00 AM »

QUOTE(caster420 @ Nov 30 2009, 05:43 AM)

Incorrect. The firmware is encrypted. The key and a few other sectors arn't, so decryption isnt required to obtain it.

Caster.

It seems I misunderstood. Thanks for correcting me.

QUOTE(caster420 @ Nov 30 2009, 07:23 AM)

The firmware which iXtreme has been based off of and other related dumps of the firmware which were kept private were done by decapping the controller and dumping the flash with a programmer. It was not done by this method and has only just come into existence.

Caster.

Unless I misunderstand, Iriez said in the thread on XBH that decapping was not done and this method was used previously by C4E and company to hack the original LiteOn.

joeyddr · « **Reply #64 on:** November 30, 2009, 07:03:00 AM »

QUOTE(xbox360sexual @ Nov 30 2009, 08:58 AM)

Surprised noone has explained what's actually happening here.

I'm guessing that as the mtkflash and spi chip share the same 3.3v pin, we're disconnecting it and running it at 1.8v, which is enough for the mtkflash to work, but not enough for the spi chip to function, and thus we get FFF (blank chip), then we force it back to 3.3v and we get a read?

since it thinks the spi is blank it forces it into a vendor mode where we can read it correctly after powering up the spi... so basically yes.

green360 · « **Reply #65 on:** November 30, 2009, 07:55:00 AM »

well done people I hope it will be soon an easier method to dump the whole liteon's firmware & why not without soldernig any thing in the pcb like it was with liteon 74850c (dump your liteon 74 key for free)

but it still a great job

Celerion · « **Reply #66 on:** November 30, 2009, 08:03:00 AM »

QUOTE(iglitare @ Nov 30 2009, 01:03 PM)

I can´t see any method at NDS or Nagra2 neither.

There are certain things that are unhackable.

OT: Nagra 2 Cards have been fully dumped several times. E.g. Digital+ and Premiere where both open for years. Now they have switched to Nagra 3 and until today there is no known way to dump the card. But well: Both NDS and Nagra 3 can be watched using Cardsharing :-) There is always a way...

In theory everything is hackable, it's just a question of time and resources. But yes sometimes the needed time and resources exceed the possibilities.

Ranger72 · « **Reply #67 on:** November 30, 2009, 08:52:00 AM »

I dumped a few of the 8xxxx V2 and 9xxxx drives I got laying around here. Going to wait for LT before I actually flash them though.

Great thanks to all involved.

megamania2004 · « **Reply #68 on:** November 30, 2009, 08:55:00 AM »

QUOTE(Celerion @ Nov 30 2009, 04:03 PM)

OT: Nagra 2 Cards have been fully dumped several times. E.g. Digital+ and Premiere where both open for years. Now they have switched to Nagra 3 and until today there is no known way to dump the card. But well: Both NDS and Nagra 3 can be watched using Cardsharing :-) There is always a way...

In theory everything is hackable, it's just a question of time and resources. But yes sometimes the needed time and resources exceed the possibilities.

QUOTE(Ranger72 @ Nov 30 2009, 04:52 PM)

I dumped a few of the 8xxxx V2 and 9xxxx drives I got laying around here. Going to wait for LT before I actually flash them though.

Great thanks to all involved.

how do you get the keys!

tul18 · « **Reply #69 on:** November 30, 2009, 08:56:00 AM »

is right about time for someone to make a good and simple tutorial for a damm noob like me xD

This post has been edited by tul18: Nov 30 2009, 04:56 PM

ccfman2004 · « **Reply #70 on:** November 30, 2009, 08:57:00 AM »

QUOTE(megamania2004 @ Nov 30 2009, 04:55 PM)

how do you get the keys!

Try opening the firmware dump in JungleFlasher.

Ranger72 · « **Reply #71 on:** November 30, 2009, 09:02:00 AM »

QUOTE(ccfman2004 @ Nov 30 2009, 10:57 AM)

Try opening the firmware dump in JungleFlasher.

Indeed. Open it as TARGET.

Toddler · « **Reply #72 on:** November 30, 2009, 09:12:00 AM »

QUOTE(Aldanga @ Nov 30 2009, 08:02 AM)

Unless I misunderstand, Iriez said in the thread on XBH that decapping was not done and this method was used previously by C4E and company to hack the original LiteOn.

That's how I read it as well, that the firmware dump was never the result of decapping and electron scanning, etc. He's the cheerleader for "we've got to keep things secret" and then he goes and drops that info? Why he would reveal that, as well as the progress being made on alternate key extraction methods, is pretty curious.

Latest method from XBH:

QUOTE

No pin lifting or epoxy removing needed anymore! Just solder anything on the back according to this picture.
Also if you got status 0x52 instead of 0x72 with the "1,8V-method" this should do it. I already dumped 4 drives with this method without any issues.

-switch in pos 1
-power drive
-start Dosflash --> SPI should get recognized with status 0x72
-put switch in pos 2
-click "read"

unsolder anything and reconnect the lines that have been cut.

(IMG:http://img413.imageshack.us/img413/5963/loboard.jpg)

Looks about as complicated as the original BenQ mod, I've still got the switch lying around somewhere. (IMG:style_emoticons/default/smile.gif)

This post has been edited by Toddler: Nov 30 2009, 05:34 PM

RMF · « **Reply #73 on:** November 30, 2009, 09:40:00 AM »

This is great news if it means that we'll soon see the stock firmware for the liteons become freely available as I'd love to be able flash my 360 back to stock. I'm done with modding now.

BoNg420 · « **Reply #74 on:** November 30, 2009, 09:56:00 AM »

This was posted on XBH
by MRA

QUOTE

No pin lifting or epoxy removing needed anymore! Just solder anything on the back according to this picture.
Also if you got status 0x52 instead of 0x72 with the "1,8V-method" this should do it. I already dumped 4 drives with this method without any issues.

-switch in pos 1
-power drive
-start Dosflash --> SPI should get recognized with status 0x72
-put switch in pos 2
-click "read"

unsolder anything and reconnect the lines that have been cut.

(IMG:http://img413.imageshack.us/img413/5963/loboard.jpg)

Oops didnt see that it was posted already, but I'm sure if everyone waits a simpler process will be shown, or maybe this is as simple as it will get.

This post has been edited by BoNg420: Nov 30 2009, 05:57 PM

Author Topic: Liteon 83850-v2 and Liteon 93450 DVD Key Can Now Be Dumped? (Read 1193 times)