SAT8801 / RS8801 - MIPS OR ARM?

[babayaga]

Hi! I've been so tempted lately to try and code a firmware tool for bluray drives, in this case a pioneer, my goal yesterday with no background was to dump my already uhd-friendly firmware (BDR-211), just to have some goal. At the moment i have managed to dump it, but i have some issues disassembling it, i wonder if its a mips core or a arm core used in the SAT8801 / RS8801 platform, from what i've read pioneer used mostly arm, but since my drive is a asus rebaged pioneer, you can never be sure, and thats probably why i had to probe so damn much to find the correct adress to read the firmware from too. well, anyway, any suggestion would be appreciated, oh btw, i use IDA

- Baba.

[qaz123]

How can I back up the firmware? Could you recommend a tool?

[misiozol]

Napisany przez babayaga

Hi! I've been so tempted lately to try and code a firmware tool for bluray drives, in this case a pioneer, my goal yesterday with no background was to dump my already uhd-friendly firmware (BDR-211), just to have some goal. At the moment i have managed to dump it, but i have some issues disassembling it, i wonder if its a mips core or a arm core used in the SAT8801 / RS8801 platform, from what i've read pioneer used mostly arm, but since my drive is a asus rebaged pioneer, you can never be sure, and thats probably why i had to probe so damn much to find the correct adress to read the firmware from too. well, anyway, any suggestion would be appreciated, oh btw, i use IDA

- Baba.

Problem is there is no source code for it no matter IC, everything is closed, IDA is good choice and i was there where u r now and did hit brick wall as well. U can try to write script that will brute force all addresses but dunno if its gonna work.

[inheavens]

I'm not entirely sure what specific features or end goal your firmware tool is meant to target. As far as I'm aware, Pioneer's firmware hasn't been fully decrypted or unpacked yet.
A while back, I spent time reverse-engineering the firmware on HL's (Hitachi-LG) MT1959 platform and hit some solid milestones. At this point, I can arbitrarily customize or port write strategies directly within the firmware and inject support for virtually any media covering common, obscure, consumer, enterprise, and archival-grade discs. My next step is fine-tuning the per-media laser parameters to push burn quality even further. I have a substantial stash of archival-grade media OEM'd by Sony and Mitsubishi for third-party brands; their physical quality is completely identical to retail discs, but at a tiny fraction of the price. Through my custom mods and strategy porting, I've gotten them burning flawlessly.
Still, getting firmware-level customization on Pioneer drives would undeniably be the holy grail. In my experience, Pioneer noticeably outperforms HL MT1959 drives in raw burn quality, consistency, and overall hardware longevity.

[inheavens]

Here's my first version already tested and verified via actual flashing.

[babayaga]

Napisany przez inheavens

Here's my first version already tested and verified via actual flashing.

very cool! My goal has shifted back and forth during the coding, i have made a nice flasher, im trying to downgrade the December 2022 firmware patched drives right now, but it isn't easy!

this is the main output in command prompt:

Optical drive research toolkit

Scanning for optical drives...

[1] E: PIONEER BD-RW BDR-XD06U (fw 1.12)

Only one optical drive detected: E: PIONEER BD-RW BDR-XD06U (fw 1.12) - using it.


Using drive: E:

Current flags: --force=off --nounlock=off
Enable --force (skip compatibility/ready checks)? [y/N]: n
Enable --nounlock (skip unlock step, for older drives)? [y/N]: n

Opened: \\.\E:

+------------------------------------------+
| DRIVE INFORMATION |
+------------------------------------------+
Drive : \\.\E: |
Vendor : PIONEER |
Model : BD-RW BDR-XD06U |
Firmware : 1.12 |
Type : CD/DVD/BD optical |
Removable : Yes |
SCSI ver : 0 |
Serial : NKDL005825JP |
Mfg Date : November 2014 (seq:0058) |
Country : China (market: JP) |
Platform : SAT 8B30ID69 |
Kernel : ID69 |
Buffer : 4000 KB |
Max read : 11080 KB/s (~73x CD) |
Max write : 11080 KB/s (~73x CD) |
Mech type : Other |
Write cap : CD-R=Y CD-RW=Y DVD-R=Y |
Disc : No disc (0x0000) |
+------------------------------------------+

Unknown command: gdkfj

DriveKit v1.0 - Optical Drive Research Toolkit
by cPix / Razor 1911 (c) 2026
================================================

Usage:
drivekit <command> <drive_letter> [options]

Identification:
info Full drive information with serial decode
inquiry Read drive vendor/model/firmware (alias: info)
discinfo Read and parse BD/DVD disc information
modelcheck Pioneer model lookup and internal model string
keycheck Show unlock key for connected drive
checkcompat Check drive against compatibility.json
probevendor Probe vendor opcodes 0xC0-0xFF
probeb0 Read/decode RS8801 buffer 0xB0
rawdump Raw READ BUFFER dump (--bufid 0xxx)

Flashing:
unlock Pioneer service mode unlock (auto session token)
flashfw Flash kernel+firmware (--file kernel --file2 normal)
autoflash Auto-detect and flash from firmware\ folder
resetnormal Attempt to exit kernel/service mode
triggerkernel Trigger kernel mode via READ BUFFER 0xB0
brutekey Try all known Pioneer unlock keys
sendcdb Send raw SCSI CDB to drive

Other:
about About DriveKit and credits

Options:
--file name Kernel firmware file
--file2 name Normal firmware file
--file3 name Second normal firmware pass (post-cutoff drives)
--bufid 0xF4 Buffer ID for rawdump (default 0xF4)
--force Skip compatibility checks
--nounlock Skip unlock step
--key 0x5CF2E094 Override unlock key

Examples:
drivekit info G
drivekit unlock G
drivekit flashfw G --file S9330360.102 --file2 S9330361.101 --nounlock
drivekit rawdump G --bufid 0xB0
drivekit sendcdb G 3B 05 FF 00 00 00 00 01 00 00

Note: Always eject disc before unlock/flash. Run as Administrator.

--------------------------
This is the latest output when trying to downgrade, but it isn't working


=== FLASH FIRMWARE ===

Do you want to dump current firmware before flashing? [Y/n]: n
Do you want to proceed with flashing? [y/N]: y

Checking no disc...
No disc - OK

File : S8B30690_patched.bin
Size : 0x11200 bytes (full file including header)
WARN : SAT 8801 not found in header
Type : Kernel confirmed
Drive : ID=0x8B30 HW=SAT 8B30ID6
Firmware : HW=SAT 8B30
Platform : SAT 8B30ID6 -> SAT 8B30 (crossflash allowed)
Drive ID : compatible (0x8B30 vs 0x8B30)

[DBG] Using 0xA0: XD05BK2/XV5 key=00000000
[DBG] Key was zero, using derived 0x08A98AF2
Payload : XD05BK2/XV5 + key

[DBG] 0xF1 pre-read: 4E 4B 44 4C (serial/normal)
[0a/3] Checking drive ready...
READY

[1/3] Unlock (key 0x08A98AF2)...
Payload: 58 44 30 35 42 4B 32 2F 58 56 35 20 20 20 20 00 F2 8A A9 08
String : "XD05BK2/XV5 "

Standard unlock failed - trying post-cutoff mode sweep...
Post-cutoff unlock GOOD (mode=0x01 bufID=0x00)
Pre-flash: skipping reads (post-cutoff service mode)

[2/3] Sending kernel (0x8000 chunks, 70144 bytes)...
70144 / 70144 bytes
Done.

[2c/3] Sending firmware (S8B30691_patched.bin)...
[DBG] g_unlock_mode=0x01 bufID=0x00
Type : Normal confirmed
1922560 / 1922560 bytes
Done.

[2d/3] Execution trigger...
0xF1 after firmware send: 00 00 00 00
Using current 0xF1 as trigger payload
Trigger mode=5 bufID=0xFF len=256: GOOD
Status: GOOD

[2a/3] Waiting for flash to complete...
GET EVENT 160/160
TUR 1/300: skey=00 ASC=00 Flash complete - drive ready!


[3/3] Verifying flash...
Mode : KERNEL MODE (unexpected!)
Platform :
0xA0+90h : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
TUR : READY

Run: drivekit inquiry G to confirm firmware version.

[babayaga]

I also made this firmware browser a few days ago, im going to upload it soon, i hope that the community can join in and update it as time goes on, what firmware has UHD, and so on, it uses a online sql database, so everyone can sync and add/edit stuff when they have time

https://mega.nz/file/xgc3lCRC#wj-YBp...JS2uKt7mqn_8-I

[misiozol]

Napisany przez babayaga

I also made this firmware browser a few days ago, im going to upload it soon, i hope that the community can join in and update it as time goes on, what firmware has UHD, and so on, it uses a online sql database, so everyone can sync and add/edit stuff when they have time

https://mega.nz/file/xgc3lCRC#wj-YBp...JS2uKt7mqn_8-I

Maybe its a good idea for this to be as a separate topic, then I can do a sticky in main.

If you make new thread I will stick it up the top.

[babayaga]

Napisany przez misiozol

Maybe its a good idea for this to be as a separate topic, then I can do a sticky in main.

If you make new thread I will stick it up the top.

Wow, that sounds great! Just going to finish the linux version to go with it! Thanks a lot =)

[inheavens]

I have made some great new progress on modding and developing custom firmware for HL (Hitachi-LG) optical writers. The tool I built now supports both the MT1939 and MT1959 platforms. It can modify the main binary area;specifically allowing full customization of the firmware version block. This means I can compile a completely bespoke firmware build, renaming the drive identifier, model name, and version number to whatever I like
;From my comparative analysis, the firmware structures of the MT1939 and MT1959 are virtually identical; the primary difference lies in the checksum validation ranges across sections. Because the MT1959 spawned countless OEM variants, its integrity check boundaries are actually narrower and more lenient. In contrast, the MT1939 enforces noticeably stricter checksum coverage.
At this point, a single drive can flawlessly burn virtually every recordable disc registered on the Blu-ray Disc Association (BDA) database. It also provides seamless compatibility with third-party OEM media manufactured by Sony or Mitsubishi/Verbatim. Even proprietary discs restricted to dedicated enterprise or archival machines (such as Amethyst or Primera units) burn with outstanding quality.

[inheavens]

I'm just an amateur enthusiast, and my day job keeps me quite busy. I'm planning to take a few days off during the upcoming National Day holiday (October 1st) to gradually package this into a finished software tool. I'll share my documentation with you once it's ready. In the meantime, would you mind sharing your development docs or thoughts with me as well
I have quite a large collection of Pioneer optical drives, including both consumer-grade and enterprise-grade models. My goal is to work on firmware dumping, cross-flashing, and modification for enterprise drives. This includes, but is not limited to, models like the BDX-PR1AME, BDX-PR1UAME, S09J, S09XLB, S12XLB, and BDR-PR1AME, as well as Pioneer OEM mechanisms made for Toshiba and Sharp recorders***8212;such as the BDR-L09FU (equivalent to BDR-209), BDR-L11 (BDR-211, pre-2018), BDX-L12, and BDR-L13 (equivalent to BDR-212 / BDR-213).

[inheavens]

The earlier bdrflash tool was already capable of cross-flashing most BDR-208, BDR-209, and BDR-212 drives, as long as you had firmware matching the respective hardware revision. All it took was editing the drive model name and hardware revision using a hex editor.
However, it still cannot cross-flash certain non-standard recorder drive mechanisms, nor can it dump firmware from them (such as the Sharp BDR-L12 and L13). In fact, these mechanisms are fully compatible with ImgBurn and support mainstream media MID lists. Additionally, it doesn't seem to support firmware dumping or cross-flashing for the BDR-107. If your software can dump firmware from these drive mechanisms and cross-flash them with standard Pioneer drive firmware, that would be fantastic.
I have a wide variety of drives available for testing, including:
Pioneer BDR-207, BDR-PR1AME (based on 207), BDR-208XLB, 208M
Green PCB: BDR-209BK, 209DBK, 209JBK, 209XLM, 209M, 209MBK
Blue PCB: BDR-209BK, 209JBK, 209XLM, 209JX
Blue PCB: BDR-211
Blue PCB: BDR-212XLB, 212BK
Enterprise & Archival drives: BDX-PR1AME, BDX-PR1UAME, BDX-PR1MDSL, BDE-PR1JAME, Epson BDE-PR1EP2, and more.

[inheavens]

I also have a wide variety of Blu-ray media on hand that can be used to test burn quality. Due to Pioneer's "black-box" nature, I have no way of deducing its MID-specific parameters, write power curves, or burning behaviors. However, I have noticed that burn quality varies significantly across different drive models and firmware versions.
I have virtually all commercially available and unreleased media listed on the Blu-ray Disc Association website, including but not limited to:
SONY-NQ1 (Amethystum version)
SONY-NT1, SONY-NT2
VERBAT-IMK (Made in Japan, Made in Taiwan)
MTBS-IMK (equivalent to VERBAT-IMK): single-sided Made in Japan, single-sided Made in Taiwan, and 200 GB double-sided Made in Taiwan (OEM by CMC Magnetics)
AMESTB-RT4 (single-sided)
AMESTB-RT5 (single-sided, manufactured by Amethystum, similar to RITEK-TL2 or CMCMAG-TIF)
AMESTB-RT5 (200 GB double-sided)
Panasonic PAN-RC4 (used in Hualu optical disc libraries)
Various types of BD-RE media

[Stingray]

Napisany przez inheavens

burn with outstanding quality.

Could you please explain, what do you mean. How you improved the record quality for all BD-R?

[babayaga]

Napisany przez inheavens

The earlier bdrflash tool was already capable of cross-flashing most BDR-208, BDR-209, and BDR-212 drives, as long as you had firmware matching the respective hardware revision. All it took was editing the drive model name and hardware revision using a hex editor.
However, it still cannot cross-flash certain non-standard recorder drive mechanisms, nor can it dump firmware from them (such as the Sharp BDR-L12 and L13). In fact, these mechanisms are fully compatible with ImgBurn and support mainstream media MID lists. Additionally, it doesn't seem to support firmware dumping or cross-flashing for the BDR-107. If your software can dump firmware from these drive mechanisms and cross-flash them with standard Pioneer drive firmware, that would be fantastic.
I have a wide variety of drives available for testing, including:
Pioneer BDR-207, BDR-PR1AME (based on 207), BDR-208XLB, 208M
Green PCB: BDR-209BK, 209DBK, 209JBK, 209XLM, 209M, 209MBK
Blue PCB: BDR-209BK, 209JBK, 209XLM, 209JX
Blue PCB: BDR-211
Blue PCB: BDR-212XLB, 212BK
Enterprise & Archival drives: BDX-PR1AME, BDX-PR1UAME, BDX-PR1MDSL, BDE-PR1JAME, Epson BDE-PR1EP2, and more.

Yes, downgrading and crossflashing those drives are usually not a problem, except if you end up on a post december 2022 firmware