jungle flasher user guide 06 march 2009

Upload: didibus

Post on 07-Apr-2018

225 views

Category:

Documents


0 download

TRANSCRIPT

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    1/72

    JungleFlasher(0.1.51 beta)

    Basic User Guide v1.4b

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    2/72

    Page 2 of 72

    Introduction

    Jungle Flasher is developed by Team Jungle in an effort to bring all 360 DVD-Drive flashingfunctions together in one easy to use Win32 Application.

    Jungle Flasher provides several functions that up until now where carried by several differentapps in both Dos and Win32.

    The first tab you will see is the FirmwareTool32 tab. In this window you can load f/w files,Jungle Flasher will parse the files and identify the f/w type and display relevant information, likethe all important DVD key and OSIG strings etc. On the Target sub-tab, it will also conduct MD5

    hash checking of iXtreme files to confirm authenticity etc. With both source and target files

    loaded the relevant source data and be transferred to the Target ( a.k.a. Spoofed ), which canthen be flashed to the target drive.

    The next tab is DVDKey32, this tab is used to extract info from Lite-On the un-dump-able drive.All, unique information is extracted: Drive Key, Unique Inquiry and Identify strings and Driveserial information. This info is all stored in 1 easy to use file, Dummy.bin , this is a 256kb file

    that mimics the approximate structure of a Benq f/w file and is automatically loaded to thesource sub-tab in the FirmwareTool32 Tab. Jungle Flasher v0.1.51b also brings the uniquefeature of dumping Dummy.bin from iXtreme flashed LiteOn Drives over S -ATA alone .

    There is also a facility to create a dummy.bin from previously extract files , although, freshextractions should be completed where possible. Every effort has been made to make the key

    extraction as reliable as possible, with multiple dumps with comparison to account for theslightest chance that the serial data could become corrupt.

    The Third tab is MTKFlash32. You can use this tab to Unlock Benq and Samsung drives and thendump the current flash for use in the source sub-tab in Firmwaretool32 tab. You can also erase

    a Lite-on in preparation for flashing. All 3 drives can be flashed in this tab.

    The last tab is Hitachi. This is on its own as it is flashed in the different way to the MTK baseddrives above. Hitachi Is flashed as a Live drive, on a sector by sector basis . This revision of

    Jungle Flasher now incorporates full read / write access of Hitachi DVD Drives.

    Jungle Flasher is intended to be rich in information giving as much relevant and useful info as ispossible. On the DVDKey32 and MTKFlash32 tabs, all IO and COM port information is detected

    and displayed as well as drive and device properties for the currently selected drive.

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    3/72

    Page 3 of 72

    Pre requisites

    If using a VIA 6421x PCI Sata card, it is advisable to remove the drivers from the\Windows\System 32\Drivers\ directory as they do not handle erased LiteOns very well

    at all, causing the infamous LiteOn + VIA Freeze

    You must install PortIO32

    net framework 2.0 Or later for Windows XP machines I believe you need .netframework 3.5 SP1 on Windows Vista Machines

    Jungleflasher Firmware Pack (vital for Hitachi Drives)

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    4/72

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    5/72

    Page 5 of 72

    Obtaining key/Inquiry/Identify and Dummy.bin from iXtreme flashed LiteOnDrives

    For this method, we still need to power on the drive with t he half open tray

    If using a 360 to power the drive this method can be tricky to accomplish.

    You need to power on the drive with Eject status closed but Tray Half Open To do this usingan Xbox 360 as Power source, eject the DVD drive, then, press eject to close the tray. Now thisis the important part you MUST remove the DVD power plug from the DVD Drive BEFORE it

    closes fully.

    Wait for a few seconds and replace the power plug into the DVD drive taking extreme cautionto plug the plug the right way around once done, the drive is now powered, console thinks its

    closed but it is in fact half open.

    Using a Connectivity Kit / Xtractor to power the drive

    The easiest way to do this is to use manual eject before powering the drive, to manual ejectsimply push this slider along until Tray is released

    Then, pull the tray out fully and push half way back in. Now, hook it up to the PC usingConnectivity Kit and Sata and power on.

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    6/72

    Page 6 of 72

    Now, with the eject status set, Open Jungleflasher, you will be presented with the WelcomeScreen

    After a few seconds the main window will load.

    Now, click the DVDKey32 Tab

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    7/72

    Page 7 of 72

    Select Correct I/O port (check for drive propeties in Drive Properties section) it should reportas PLDS DG-16D2S(unless spoofed), you can choose to dump dummy.bin only as opposed to all

    4 files (Key, Inquiry, Identify and dummy.bin)

    Then, simply click Dummy from iXtreme

    Save as prompted, and proceed from Page 12

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    8/72

    Page 8 of 72

    Using DVDKey32 to obtain key/inquiry/identify/dummy.bin

    If using a 360 to power the drive this method can be tricky to accomplish.

    You need to power on the drive with Eject status closed but Tray Half Open To do this usingan Xbox 360 as Power source, eject the DVD drive, then, press eject to close the tray. Now thisis the important part you MUST remove the DVD power plug from the DVD Drive BEFORE it

    closes fully.

    Wait for a few seconds and replace the power plug into the DVD drive taking extreme cautionto plug the plug the right way around once done, the drive is now powered, console thinks its

    closed but it is in fact half open.

    Check Drive Properties for PLDS DG-16D2S

    Using a Connectivity Kit / Xtractor to power the drive

    The easiest way to do this is to use manual eject before powering the drive, to manual ejectsimply push this slider along until Tray is released

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    9/72

    Page 9 of 72

    Then, pull the tray out fully and push half way back in. Now, hook it up to the PC usingConnectivity Kit and Sata and power on.

    With the correct eject/tray status we can run DVDKey32 either from Command Line, or asdepicted below in JungleFlasher.

    Open JungleFlasher, you will be presented with the Welcome Screen

    After a few seconds the main window will load.

    As you are using DVDKey32 to obtain data, select DVDKey32 Tab

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    10/72

    Page 10 of 72

    Select Correct I/O port (check for drive propeties in Drive Properties section) and COM portand insert probe / spear into R707 via, optionally, choose to dump dummy.bin only as opposed

    to all 4 files (Key, Inquiry, Identify and dummy.bin)

    Good status on Probe / Spear has LED showing.

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    11/72

    Page 11 of 72

    Now, click Get Key, Create Dummy.bin, Open as Source

    Providing serial connection was good, DVDKey32 will dump the key 6 times and compare eachdump then prompt you to save key.bin, inquiry.bin, identify.bin and dummy.bin.

    Of course, should you have enabled th e Dummy.bin Only option you will only be promptedto save Dummy.bin.

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    12/72

    Page 12 of 72

    Although extracting the key 6 times increases chances of correct keybeing obtained and checks are carried out on validility There is only

    one way to know for sure the key is GOOD.

    You should, where possible, spoof the data into a different drive andtest to see it works BEFORE erasing the LiteOn Drive

    There is no harm in running DVDKey32 multiple times, increasing thenumber of key extractions.

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    13/72

    Page 13 of 72

    JungleFlasher will then prompt you asking if you would like to auto-load iXtreme for LiteOnDrives. You must have installed the JungleFlasher Firmware Pack into the same directory as

    JungleFlasher.exe if you wish to benefit from this feature.

    Click Yes to auto load iXtreme 1.51 for LiteOn into the Target Buffer , JungleFlasher will alsoload your previously dumped Dummy.bin as Source Firmware. Then, copy data from source to

    target automatically

    Just verify Source data reports as it should, DVDKey32 Extract with OSIG of PLDS DG-16D2Swith the same key you dumped (check log for reference).

    Now, verify unique Source Data matches that in Target Buffer and click save to file if you wishto backup your Hacked firmware.

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    14/72

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    15/72

    Page 15 of 72

    The Next step is to ERASE the drive, its vitally important you

    only do this once you KNOW you are ready and have read thetutorial, in full, to understand the risks

    IMPORTANT!!!!!Sending the erase command to the LiteOn using VIA chipsets with drivers

    installed poses the potential risk of the system locking up due to the VIA chipsetpolling the erased LiteOn and not liking the response!!!!!!!

    Please see Appendix (Page 62) and follow instructions to remove Drivers.

    You should, where possible spoof the data into a different drive andtest to see it works BEFORE erasing the LiteOn Drive

    There is no harm in running DVDKey32 multiple times, increasing thenumber of key extractions.

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    16/72

    Page 16 of 72

    Erasing a LiteOn PLDS DG-16D2S

    PLEASE READ THE WARNINGS ABOVEOnce you erase the drive, there is NO GOING BACK

    Click the MTKFlash32 Tab

    Verify I/O Port is correct and click Lite-On Erase

    JungleFlasher will warn of the importance of having a verified Good Drive Key

    Please Note, the only way to know 100% that a key is good, is to flash a different drive andtest BEFORE sending erase command

    Click Yes if you wish to Proceed

    JungleFlasher will present you with another warning

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    17/72

    Page 17 of 72

    Read this carefully, in most cases JungleFlasher wil return a Running Log similar to this: Wehave had 0xD0 / 0x80 / 0xF2 / 0xD1 and all worked fine

    After pressing yes and during the sequence of dots shown below, Power Off / On drive ONCE

    Hopefully you will see good Flash Chip Properties and Status 0x72 (2 known SPi Chips forLiteOns, Winbond and MXIC) Winbond Shown, drive will appear in Vendor Mode under Drive

    Properties

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    18/72

    Page 18 of 72

    Drive is now in Vendor mode (0x72)

    Click the Write button to write Target Buffer to the drive

    Write Verified OK ! in Running Log signals good write.

    Now send an Outro to the drive.

    This will release a drive from Vendor Mode and send ATA Reset to the Drive. It then sends aninquiry command to the drive.

    This will save you power cycling the drive and then changing port away and change it backagain, with the click of a button, drive will reset itself and JungleFlasher will send an inquirycommand to the drive. If successfully flashed the drive should Inquire correctly and display

    drive properties.

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    19/72

    Page 19 of 72

    Samsung (TS-H943) MS25 /MS28

    OverviewThe steps to modifying / restoring a Samsung Drive follow the basic outline of:

    Unlocking the Drive (MS28 or Xtreme 4.0+ Firmwares)

    Reading the Original firmware

    Patching Key into hacked Firmware

    Writing Drive

    The tutorial will state multiple unlock methods, once drive is Unlocked / In Vendor Mode(0x70) you should proceed to the next step of reading the firmware from the drive.

    Now, we can proceed to modifying the drive.

    Power drive with it connected to PC via SATA then open JungleFlasher.exe. You will bepresented with the Welcome screen

    After a few seconds it will proceed to the Application itself.

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    20/72

    Page 20 of 72

    Unlocking the drive

    Before we can do anything to the drive, it must be in vendor mode (status 0x70)

    All Unlocking is taken place under the MTKFlash32 tab

    Please note, unmodified Samsung MS25s have no FirmGuard therefore do not need an unlock

    method to be applied, simply click Intro / DeviceID and check flash chip properties for status0x70

    Stock MS28s (Unmodified)

    There are 2 methods of unlock for Stock Drives, the first, is Sammy-Un-Lock

    Select correct I/O Port (check for TS-H943 in Drive Properties) and click Sammy-Un-Lock

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    21/72

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    22/72

    Page 22 of 72

    Xtreme 4.0 -> iXtreme 1.4 Unlock using Activate.iso

    For this you need the Activate.iso found in the upper right hand corner of the MTKFlash32 Tab ,burnt to Dual Layer + R Media (this is vital for later firmwares). Simply burn it with no

    layerbreak settings, with all data present on first Layer, IMGBurn 2.4.2.0 will do this fine justselect the ISO and confirm you want to burn to a large capacity disc with all data present on L0

    (Layer 0)

    Once burned, simply place it in your Samsung drive while connected to the PC, wait 30 secondsand run Jungleflasher.

    Click MTKFlash32 tab

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    23/72

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    24/72

    Page 24 of 72

    DeviceID Unlock / Vcc Trick (VIA/Nforce only) Stock + Modified Drives

    This method has only really been tested on VIA (no drivers, or 530c drivers) and Nforce Chipsets,although there is no harm In trying on others, this method works on Hacked and Stock Drives.

    Load JungleFlasher, and select MTKFlash32 Tab

    Select correct I/O Port (check for TS-H943 in Drive Properties) and click Intro / Device ID

    JungleFlasher will prompt you with instructions

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    25/72

    Page 25 of 72

    Click Yes the Running Log will display something similar to this

    When .Are appearing, do as previously instructed by JungleFlasher. Power off the drive,then, within 1 second power it back on.

    The drive should be in Vendor mode (0x70) now and return good flash chip properties, you cancheck in the Running Log or Flash Chip Properties, The drive should also show as In Vendor

    Mode in Drive Properties

    Once we have the drive in Vendor mode (status 0x70 with good flash chip properties) we canread / write / erase the firmware.

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    26/72

    Page 26 of 72

    Reading the Firmware from the drive

    Now, we would like to read the firmware from the drive first, so select read

    Again, watch the Running Log for constant status updates

    Firmware reading:

    Once the firmware has been successfully read, JungleFlasher will prompt you to save it

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    27/72

    Page 27 of 72

    Once saved, JungleFlasher will then prompt you asking if you would like to auto-load iXtremefor Samsung Drives. You must have installed the JungleFlasher Firmware Pack into the same

    directory as JungleFlasher.exe if you wish to benefit from this feature.

    Click Yes to auto load iXtreme 1.51 for Samsung into the Target Buffer , JungleFlasher will alsoload your previously dumped Sam-OFW.bin as Source Firmware. Then, copy data from Source

    to Target automatically

    Just verify Source data reports as it should, OSIG of TSSTcorpDVD-Rom TS-H943 with a key withno multiple FF/00/ 77 bytes

    Now, verify unique Source Data matches that in Target Buffer and click save to file if you wishto backup your Hacked firmware.

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    28/72

    Page 28 of 72

    To generate a firmware file based on whats currently in Target Buffer click, Save to File

    Jungleflasher will ask you where to save the generated firmware and what you want to name it,and then you can proceed to write the firmware to the drive

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    29/72

    Page 29 of 72

    Writing Firmware to the drive

    To write the firmware, as long as drive is still unlocked we just click MTKFlash32 tab

    Verfify you have good flash chip properties still

    Then, click Write

    Write Command, will erase and flash all 4 banks in turn, then read back flash and verify

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    30/72

    Page 30 of 72

    A series of 16 ..s are it , writing the 16 sectors of each bank (4 banks, 0/1/2/3)

    After writing all 64 sectors, signaled by 64 dots (16 dots across 4 banks) JungleFlasher will verifywhat it wrote by reading back and comparing against Target Buffer. So, what we really want to

    see is Write Verified OK!

    Ok, now you have flashed your Samsung Drive successfully, should you not get Write VerifiedOK! Please ask for support in the JungleFlasher support channel, found at irc.efnet.net channel

    #JungleFlasher

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    31/72

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    32/72

    Page 32 of 72

    Unlocking the drive

    Before we can do anything to the drive, it must be in vendor mode (status 0x73), the majorityof the unlock methods are found under MTKFlash32 tab , with the exception of Half Open Tray

    unlock, please read on for more details on the unlock methods.

    Half Open Tray Unlock for iXtreme 1.5+

    If using a 360 to power the drive this method can be tricky to accomplish as the 360 likes toclose the DVD Drive after powering it on.

    You need to power on the drive with the Tray Half Open To do this using an Xbox 360 asPower source, eject the DVD drive and then remove the power lead from the Drive

    Close the tray half way and plug the DVD Drive power cable back into the drive, being VERYcautious to ensure the plug is the right way around.

    Using a Connectivity Kit / Xtractor to power the drive

    The easiest way to do this is to simply use the eject button on your connectivity kit to eject thedrive tray, power off the connectivity kit, push the tray half in and power back on the

    connectivity kit.

    Ok, now we half the half open tray, we navigate to MTKFlash32 tab if you havent already.

    Click Intro / DeviceID

    If tray status is correct, drive should return good Flash Chip Properties showing status 0x73,Drive Properties should show Drive In Vendor Mode

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    33/72

    Page 33 of 72

    Once drive is in Vendor Mode , you can proceed with Reading the Drives Firmware

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    34/72

    Page 34 of 72

    BenQ-Un-Lock Stock/ iXtreme 1.1 -> 1.41 / Xtreme Firmwares Only

    Please note, BenQ-Un-Lock WILL NOTwork on drives that have iXtreme 1.5 firmware on them(please use VCC Trick or Half Open Tray)

    Connect your BenQ drive up via sata to your PC, power on, and run JungleFlasher.

    You will be presented with the Welcome Screen shown below.

    After a few seconds you will be taken to the main application

    Click the MTKFlash32 Tab

    Then, select correct I/O Port by verifying PBDS VAD6038 shows in Drive Properties and clickBenQ-Un-Lock

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    35/72

    Page 35 of 72

    JungleFlasher will send the Magic Keys to unlock the drive and should return this message inthe Running Log. JungleFlasher has also sent the Intro command to the drive

    The drive should be in Vendor mode (0x73) now and return good flash chip properties, you cancheck in the Running Log, Drive Properties or Flash Chip Properties.

    Once drive is in Vendor Mode , you can proceed with Reading the Drives Firmware

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    36/72

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    37/72

    Page 37 of 72

    Click Yes the Running Log will display something similar to this

    When .are appearing, do as previously instructed by JungleFlasher. Power off the drive,then within 1 second power it back on.

    The drive should be in Vendor mode (0x73) now and return good flash chip properties, you cancheck in the Running Log or Flash Chip Properties, Drive properties should display Drive in

    Vendor Mode

    Once drive is in Vendor Mode , you can proceed with Reading the Drives Firmware

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    38/72

    Page 38 of 72

    Reading the Firmware from the drive

    Now, we would like to read the firmware from the drive first, so select read

    Check the Running Log and you will see it reading the firmware from the drive

    Once the firmware has been read JungleFlasher will prompt you to save the firmware. Name itwhat you wish and select directory path of your choice and click Save

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    39/72

    Page 39 of 72

    Once saved, JungleFlasher will then prompt you asking if you would like to auto- load iXtremefor BenQ Drives. You must have installed the JungleFlasher Firmware Pack into the same

    directory as JungleFlasher.exe if you wish to benefit from this feature.

    Click Yes to auto load iXtreme 1.51 for BenQ into the Target Buffer , JungleFlasher will also loadyour previously dumped BenQ-OFW.bin as Source Firmware. Then, copy data from Source to

    Target automatically

    Just verify Source data reports as it should, OSIG of VAD 6038 with a key with no multipleFF/00/77 bytes

    Now, verify unique Source Data matches that in Target Buffer and click save to file if you wishto backup your Hacked firmware.

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    40/72

    Page 40 of 72

    .

    You can now save the Target Buffer to file by clicking Save to File

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    41/72

    Page 41 of 72

    Writing Firmware to the drive

    To write the firmware, as long as drive is still unlocked we just click MTKFlash32 tab

    Verfify you have good flash chip properties still

    Then, click Write

    Write Command, will send Chip Erase prior to writing and then proceed to write the 4 banks of the firmware (banks 0/1/2/3)

    A series of 16 ..s are it , writing the 16 sectors of each bank (4 banks, 0/1/2/3)

    After writing all 64 sectors, signaled by 64 dots (16 dots across 4 banks) JungleFlasher will verifywhat it wrote by reading back and comparing against Target Buffer what we really want to see

    is Write Verified OK!

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    42/72

    Page 42 of 72

    Now send an Outro to the drive.

    This will release a drive from Vendor Mode and send ATA Reset to the Drive. It then sends aninquiry command to the drive.

    This will save you power cycling the drive and then changing port away and change it backagai n, with the click of a button, drive will reset itself and JungleFlasher will send an inquirycommand to the drive. If successfully flashed the drive should Inquire correctly and display

    drive properties

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    43/72

    Page 43 of 72

    Hitachi GDR-3120L

    Rom Versions 32/36/40/46/47/58/59/78/79

    Overview

    Hitachi drives are completely different in the way and which they are modded. We modifyHitachis on a sector by sector basis.

    JungleFlasher can be used over Windows API, or, use PortIO

    PortIO functionality was added mainly for VIA 6421 Sata users who removed drivers to hack theLiteOn drives without freezing. However, it works well for non-VIA users.

    As usual hitachi needs to be in ModeB , not particularly for a drive letter but also most dumpand flash commands require it

    You can flash you drive over PortIO without a drive letter, if say you have no Via driversinstalled, however , this stillrequires ModeB to be set

    VIA users with no drivers, must either install drivers, or, utilise PortIO you will not beassigned a drive letter in windows with no drivers!!!

    Windows API Users, after setting ModeB, you must wait for hardware changes to bedetected (15 secs) If nothing is detected, click Refresh

    JungleFlasher uses a unique way of calculating the checksum of the firmware andJungleFlasher will also take over from the user as soon as possible to prevent user error, itsnot necessary to dump the drive to patch the firmware, JungleFlasher will dump before you

    try to do anything to the drive.

    JungleFlasher also incorporates a Stability Test prior to modifying the drive, as s afety isparamount.

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    44/72

    Page 44 of 72

    Setting ModeB

    Hook up your Hitachi Drive via sata, power ito, then open JungleFlasher and you will bepresented with the welcome screen

    Then, click the Hitachi GDR-3120 tab

    You will be presented with the dedicated Hitachi tab shown below (or similar to)

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    45/72

    Page 45 of 72

    Note the Hitachi Drive inquires on my I/O Port

    The drive needs to inquire on I/O port for Raw ModeB Commandb to work (this applies tospoofed drives also)

    Once it inquires, Click, send ModeB , you will be presented with the following message, itsadvised you do as it states as the ModeB button on Connectivity Kit, can cause issues

    Once done, click Ok

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    46/72

    Page 46 of 72

    The drive should now report as in ModeB

    Once ModeB is set, choose your method , PortIO or Win32

    Win32 users should seen similar to this under the Drive section

    PortIO users should see similar to this for the process

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    47/72

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    48/72

    Page 48 of 72

    Then, click Read to Source

    You should see something similar to below

    Once firmware is read, JungleFlasher will prompt you to save it.

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    49/72

    Page 49 of 72

    Upon saving the Firmware from the Drive, you can verify the key appears good and it reports asGDR 3120 (ROM Ver)

    The Running Log should also show this data.

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    50/72

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    51/72

    Page 51 of 72

    JungleFlasher should display a log similar to the one below.

    The Drive is now unlocked!

    V78 / V79

    Now, onto dumping the drive. With the V79 unlocked, or the v78 in ModeB We can now dumpthe drive using RAM Upload method

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    52/72

    Page 52 of 72

    So, click Read to Source

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    53/72

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    54/72

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    55/72

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    56/72

    Page 56 of 72

    It will prompt you to save it. Its heavily advised you do just in case.

    JungleFlasher wil l seemingly take control, dont worry, this is normal.

    If you view the log, you see that JungleFlasher has automatically loaded iXtreme 1.51, copied allyour data (key sector 90004000 isnt touched unless using flash keys).into iXtreme, and flashed

    a test sector for stability.

    The stability test should return as stable, if you, you will see this message.

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    57/72

    Page 57 of 72

    If you wish to proceed, click Y es

    Again, JungleFlasher will take over and you will see it flashing the sectors like below:

    Once finished, Jungleflasher will verify the firmware writeen to the drive and report back

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    58/72

    Page 58 of 72

    Restoring from Hacked Firmware

    As the title suggests, it is simply a reversal of flashing the Drive with Hacked Firmware.

    Again, JungleFlasher will depend on the JungleFlasher Firmware Pack being in the samedirectory as JungleFlasher.exe

    With the Drive in ModeB and unlocked (v79) simply select Restore Firmware from the FlashingOptions list

    Then, click Restore to Stock

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    59/72

    Page 59 of 72

    Jungleflasher will dump the Hacked Firmware from the drive, check key location and compareto the corresponding Original Firmware in the Firmware Pack

    JungleFlasher will take control throughout this.

    After its dumped and compared the firmware, It will flash a test sector. If this flashes ok, It willreport it has passed the Stability Test

    It should show as below

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    60/72

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    61/72

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    62/72

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    63/72

    Page 63 of 72

    Then, click Device Manager

    Navigate to SCSI and RAID Controllers and click the + sign to expand the list

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    64/72

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    65/72

    Page 65 of 72

    It should now show as the image below

    If so, reboot your PC

    Upon reboot, verify VIA 6421 still has a Yellow Exclamation Mark in Device Manager

    You have successfully removed VIA drivers from your machine

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    66/72

    Page 66 of 72

    Installing PortIO32

    PortIO32 is a driver and library which allows you to do low-level port IO from any programminglanguage which can use a DLL in Windows

    Simply double click PortIO32.exe found in the JungleFlasher package and wait

    Look for the confirmation message (image taken from Windows Vista)

    If you require .net framework, follow link / instructions here:http://www.microsoft.com/downloads/details.aspx?familyid=0856eacb-4362-4b0d-8edd-

    aab15c5e04f5&displaylang=en

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    67/72

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    68/72

    Page 68 of 72

    Manual Spoofing

    Hopefully the excellent key, OSIG and serial spoofing of FirmwareTool32 should satisfy yourneeds, but sometimes you need the manual method for whatever reason.

    Located in FirmwareTool32

    You need the firmware you wish to Spoof loaded into the target buffer

    Once loaded , Click Manual Spoofing

    Changing Drive Keys

    Here you can manually type a Drive Key It must be in Hex-Decimal format. It should ONLY

    EVERreally be used if you have your Drive Key in a text file or email.

    If you have a key.bin or Original Firmware you can save to key.bin as shown above in the Savekey to file section and use the Load key.bin option

    Just click load key.bin and navigate to your key.bin file, select it then it will automatically load itinto the Manual Spoof Window.

    Changing Drives OSIG (String ID)

    Simply select the drive you want your new drive to report to the console as, from the dropdown list and click OK.

    If Changing OSIG to a LiteOn PLDS DG-16D2S this will activate the LiteOn Barcode section of Manual Spoofing, please see below for instructions.

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    69/72

    Page 69 of 72

    Spoofing LiteOn Barcode into Inquiry String

    This is for Spoofing a drive in place of a LiteOn manually, once Drive Key is inserted, you willwant to spoof as PLDS DG-16D2S, next you want to load your identify.bin by clicking Load

    Inquiry.bin and navigating to Inquiry.bin , upon selecting it, JungleFlasher will load it into thewindow, now you can click OK to finish spoofing the firmware.

    If you dont have the Inquiry.bin file, JungleFlasher will let you manually type the barcode(located on the top of the LiteOn) into the cox, in the format of 17 Alpha-Numberic Characters

    followed by 3 spaces. You MUST include the spaces manually.

    e.g.

    D608CG82690600G2W___

    Then, click Ok to finish Spoofing the Firmware

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    70/72

    Page 70 of 72

    VIA Ports only & Include Non IDE ports

    Found under DVDKey32 tab,

    VIA Ports Only

    This feature suits those who have quirky onboard Sata Cntrollers ( SIL, JMicron) and a VIA6421PCI Sata Card.

    Checking the box removes all non-via sata ports, this will stop you trying to Inquire / DVDKey adrive on your non- via SATA/IDE ports. Some chipsets dont like the Inquiry and will hang the

    system.

    **NOTE** If you do not actually have any VIA ports, JungleFlasher will itself uncheck the boxand re-enable the non VIA ports

    Include non-IDE Ports

    This option allows you to scan port for contollers Classed as SCSIAdapter. Some newr chipsetuse the Class rather than hdc (aka IDE). However this will also show actual SCSI contoller whichare obviously of no use for flashing. Please avoid this fuction unless you know what you are

    doing.

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    71/72

    Page 71 of 72

    Registry Settings

    Only really for troubleshooting and debugging and should only be attempted by thoseconfident enough to play abut in the systems registry settings

    Click Start , click run, type regedit and press enterNavigate to HKEY_CURRENT_USER

    Click on JungleFlasher

    You will see something similar to this:

    Adview - Rememberswhether Advanced View was

    selected or not

    COMPort - Remembers lastCOM Port selected, number

    represents position in dropdown menu

    DoCom - Enumeratescomports, for debug use only

    DoDevID Will send Intro if drive reports as in Vendor

    Mode

    DoDrives - Enumerates driveletters, for debug use only

    DoIO - Enumerates I / Oports, for debug use only

    IOPort - Remembers last IOPort selected, number

    represents position in drop

    down menu

    Left - Remembers postion of JungleFlasher window (left

    hand side)

    Position No longer in use,was used in .026b release of

    JungleFlasher

    ScsiPorts - enumerateSCSIAdapter IO ports also

    (NON-IDE)

    Top - Remembers postion of JungleFlasher window (Top

    ViaPortsOnly - enumerateonly Via IO ports, for safety(Value 1) Lists all if removed

    or Value 0

  • 8/6/2019 Jungle Flasher User Guide 06 March 2009

    72/72