Hej456

MT8520 Blu-ray Discussion :: RE: MT8520 Blu-ray firmware reverse engineering

Gradius — Sat, 27 Feb 2010 15:30:45 GMT

Author: Gradius
Subject: Re: MT8520 Blu-ray firmware reverse engineering
Posted: Sat Feb 27, 2010 4:30 pm (GMT 1)

"I don't have the player yet and I cannot find those photos about BDP-83."

"I need to know the IC type for Flash EEPROM too, so I can choose the proper universal programmer for both."

Gradius

MT8520 Blu-ray Discussion :: RE: MT8520 Blu-ray firmware reverse engineering

new_age — Wed, 24 Feb 2010 19:39:00 GMT

Author: new_age
Subject: Re: MT8520 Blu-ray firmware reverse engineering
Posted: Wed Feb 24, 2010 8:39 pm (GMT 1)

"I was thinking to desoldering TSOP EEPROM and put in on universal programmer to rip all the contents"

Ehm. If you don't have a player. Then from what?

MT8520 Blu-ray Discussion :: RE: MT8520 Blu-ray firmware reverse engineering

Gradius — Wed, 24 Feb 2010 19:24:07 GMT

Author: Gradius
Subject: Re: MT8520 Blu-ray firmware reverse engineering
Posted: Wed Feb 24, 2010 8:24 pm (GMT 1)

LOL, I cannot, like I said before, I don't have the player.

MT8520 Blu-ray Discussion :: RE: MT8520 Blu-ray firmware reverse engineering

new_age — Wed, 24 Feb 2010 11:12:51 GMT

Author: new_age
Subject: Re: MT8520 Blu-ray firmware reverse engineering
Posted: Wed Feb 24, 2010 12:12 pm (GMT 1)

Search for 8pin small ic. You'll find the sflash.
Usually cfEon (25F80).

MT8520 Blu-ray Discussion :: RE: MT8520 Blu-ray firmware reverse engineering

Gradius — Tue, 23 Feb 2010 21:58:31 GMT

Author: Gradius
Subject: Re: MT8520 Blu-ray firmware reverse engineering
Posted: Tue Feb 23, 2010 10:58 pm (GMT 1)

What's the Serial EEPROM IC (type) ?

If is inside on MT852x it will be hard to get access to it.

I need to know the IC type for Flash EEPROM too, so I can choose the proper universal programmer for both.

MT8520 Blu-ray Discussion :: RE: MT8520 Blu-ray firmware reverse engineering

new_age — Tue, 23 Feb 2010 18:29:11 GMT

Author: new_age
Subject: Re: MT8520 Blu-ray firmware reverse engineering
Posted: Tue Feb 23, 2010 7:29 pm (GMT 1)

MT85xx

serial flash (NOR) content:

0: encrypted boot loader (when chip starts it decrypts its contents to dram 0 address and starts it): this decompress NAND content into dram and then starts it
1: some kind of NOR and NAND upgrader code from USB
2: encrypted data (maybe keys)
3: main firmware config data

NAND flash content:
0: compressed main code parts, compressed data parts (message table, font(s), images, icons)
1: FAT formatted data space for BD

The firmware update contains: NOR (bootloader + unknown upgrade code) and NAND parts (compressed code and data)

MT8520 Blu-ray Discussion :: RE: MT8520 Blu-ray firmware reverse engineering

Gradius — Tue, 23 Feb 2010 18:15:07 GMT

Author: Gradius
Subject: Re: MT8520 Blu-ray firmware reverse engineering
Posted: Tue Feb 23, 2010 7:15 pm (GMT 1)

I found the photo here:
http://vtbsd.net/bdp83/IMG_2632.JPG

But it sucks completly, I cannot read the Flash IC at all!

I only know (from photo) is a Hynix TSOP 48-pin.

MT8520 Blu-ray Discussion :: RE: MT8520 Blu-ray firmware reverse engineering

Gradius — Tue, 23 Feb 2010 17:41:47 GMT

Author: Gradius
Subject: Re: MT8520 Blu-ray firmware reverse engineering
Posted: Tue Feb 23, 2010 6:41 pm (GMT 1)

new_age @ Tue Feb 23, 2010 2:37 pm wrote:

Are you talking about the serial flash in the MT85xx board?

No, the regular one (not serial eeprom).

On Serial EEPROM it should contains only the keys for Blu-ray.

Which IC is the Flash EEPROM? I don't have the player yet and I cannot find those photos about BDP-83.

MT8520 Blu-ray Discussion :: RE: MT8520 Blu-ray firmware reverse engineering

new_age — Tue, 23 Feb 2010 17:37:59 GMT

Author: new_age
Subject: Re: MT8520 Blu-ray firmware reverse engineering
Posted: Tue Feb 23, 2010 6:37 pm (GMT 1)

Are you talking about the serial flash in the MT85xx board?

MT8520 Blu-ray Discussion :: RE: MT8520 Blu-ray firmware reverse engineering

Gradius — Tue, 23 Feb 2010 17:24:38 GMT

Author: Gradius
Subject: Re: MT8520 Blu-ray firmware reverse engineering
Posted: Tue Feb 23, 2010 6:24 pm (GMT 1)

Well, I like practical things, I was thinking to desoldering TSOP EEPROM and put in on universal programmer to rip all the contents, will I have it unencrypted ?

I guess the firmware inside is still encrypted, to avoid such means, or I'm wrong?

Gradius

MT8520 Blu-ray Discussion :: RE: MT8520 Blu-ray firmware reverse engineering

Gradius — Tue, 23 Feb 2010 17:11:40 GMT

Author: Gradius
Subject: Re: MT8520 Blu-ray firmware reverse engineering
Posted: Tue Feb 23, 2010 6:11 pm (GMT 1)

That modchip just fool the firmware via I2C believing the region match with the disc on unit.