LITEON 9504 0272 Kami, stock FW works, LT3 doesn't?

[LoneWolf913]

Got a drive labeled 9504 on the case, JF dumps as 0272 since it's on dash 15574 and has been updated by MS. Kamikaze unlocked, wrote LT3, originals and backups give either a white screen with Xbox 360 logo, or the standard 'Please put this into an Xbox console to play' error. Dash states 'Play DVD'. Flashed back to stock firmware and tested to ensure chip was good, and drive now reads retail games just fine. Tried a second drive, same issues, stock works, LT3 doesn't. Obviously not the lasers in any of these drives, or the unlocks, as they're running in other consoles just fine. This is the first 0272 I've done so maybe I missed a step, but I'm pretty sure I read and followed the JF tut to the letter.

JF Log:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

JungleFlasher 0.1.92 Beta (304)

Session Started Sat Sep 29 22:49:51 2012



This is a Wow 64 process running on 4 x 64 bit CPUs 

X360USB PRO detected, Version 0.18



Found 1 I/O Ports.

Found 1 Com Ports.

Found 10 windows drives C: D: E: F: G: H: I: J: K: L:

Found 2 CD/DVD drives F: G:



Drive is Slim Lite-On.. 



Key found in KeyDB at record (20 - Random4gbTrin)

Key is: 503A67C68FE96C87A163C79C79F07E4E

Key has been tested and verified, thanks C4eva ! 

Sending Vendor Intro to port 0x0000

Status 0x51

Re-sending Vendor Intro: 

....

Serial flash found with Status 0x72



Sending Device ID request to port 0x0000

Spi Status: 0x8C

Manufacturer ID: 0xEF

Device ID: 0x11

Flash Name:  Winbond/NEX(W25P20/NX25P20)

Flash Size:  262144 bytes



Sending Spi UnLock request to Port 0x0000

...............

Spi Status: 0x00

Sending Vendor Intro to port 0x0000



Serial flash found with Status 0x72



Sending Device ID request to port 0x0000

Spi Status: 0x00

Manufacturer ID: 0xEF

Device ID: 0x11

Flash Name:  Winbond/NEX(W25P20/NX25P20)

Flash Size:  262144 bytes

Loading firmware file C:\Users\Wolf\Desktop\Random4gbTrin\Lite-OFW.bin

MD5 hash:  6d9dc5fad0fb7e2c9bd5809e30128801

Drive key @ n/a 503A67C68FE96C87A163C79C79F07E4E

Firmware Osig: [PLDS    DG-16D4S        0272]

Firmware is:  Stock                           

Auto-Loading firmware file C:\Users\Wolf\Desktop\JungleFlasher v0.1.92 Beta (304)\firmware\LTPlus-0272-v3.0.bin

MD5 hash:  76b991307ddd5b2af581d0608e671b36

Genuine LT plus v3.0

Drive key @ n/a FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

Firmware Osig: [PLDS    DG-16D4S        0272]

Firmware is:  LT-Plus 3.0                     

Spoofing Target

DVD Key copied to target

Key Sector copied from Source to Target

Target is LT - ID strings not copied to Target





Getting Status from port 0x0000

SPi flash found with Status 0x72



Sending Chip Erase to Port 0x0000

Erasing:

Writing target buffer to flash

Writing Bank 0: ................

Writing Bank 1: ................

Writing Bank 2: ................

Writing Bank 3: ................

............

Flash Verification Test !

Reading Bank 0: ................

Reading Bank 1: ................

Reading Bank 2: ................

Reading Bank 3: ................

Dumped in 3771mS



Write verified OK !



Restoring sector 0x3E000.



Sending Sector Erase to Port 0x0000

Erasing: 0x3E000

Writing: 0x3E000 

............

Authorised !

................

Restore verified OK !

Drive is Slim Lite-On.. 



Key found in KeyDB at record (20 - Random4gbTrin)

Key is: 503A67C68FE96C87A163C79C79F07E4E

Key has been tested and verified, thanks C4eva ! 

Sending Vendor Intro to port 0x0000

Status 0x51

Re-sending Vendor Intro: 

....

Serial flash found with Status 0x72



Sending Device ID request to port 0x0000

Spi Status: 0x00

Manufacturer ID: 0xEF

Device ID: 0x11

Flash Name:  Winbond/NEX(W25P20/NX25P20)

Flash Size:  262144 bytes



Sending Spi Lock request to Port 0x0000

Spi Status: 0x8C

Sending Vendor Outro to port 0x0000

Drive is Slim Lite-On.. 



Key found in KeyDB at record (20 - Random4gbTrin)

Key is: 503A67C68FE96C87A163C79C79F07E4E

Key has been tested and verified, thanks C4eva ! 

Sending Vendor Outro to port 0x0000

Drive is Slim Lite-On.. 



Key found in KeyDB at record (20 - Random4gbTrin)

Key is: 503A67C68FE96C87A163C79C79F07E4E

Key has been tested and verified, thanks C4eva !

 

[jsinger47]

flashing 0272 isn't really any different than others, so its not likely you messed up

however, i always like using the full dump as source (try that if you haven't)

if all else fails, give BraveH43's Slim Play DVD fix thread a shot

 

[TilVl]

Man that's odds, jf log looks good. I would say change the wires but originals work, on stock. I can only suggest making sure everything is plugged in snug and reflash lt making sure to outro a few times.

Sent from my SGH-T839 using Tapatalk 2

 

[jsinger47]

Man that's odds, jf log looks good. I would say change the wires but originals work, on stock. I can only suggest making sure everything is plugged in snug and reflash lt making sure to outro a few times.

Sent from my SGH-T839 using Tapatalk 2

For future reference, the extra outros were only needed on replacement pcbs, not originals.

 

[LoneWolf913]

flashing 0272 isn't really any different than others, so its not likely you messed up

however, i always like using the full dump as source (try that if you haven't)

if all else fails, give BraveH43's Slim Play DVD fix thread a shot

Thanks Joe, remembered seeing that thread but for some reason didn't think of it right away. Will give that a try and see what happens. Have already tried both Dummy.bin and full Lite-OFW as my source files to rule out any possible oddities with either of those.

Edit: Tried about five or six so far, none let LT3 read games, going to finish the list for fun but I really don't see any of them helping. Feels like a fault with the firmware itself, but I can't understand how since I know people use it with no issues.

 

[LoneWolf913]

Well, it's not the firmware either, just did an 0272 for a customer today, same exact process, worked 100% first try. Looks like a stubborn console on this one..any of the pros out there want to look at it and see if they can figure out why it won't work when flashed?

 

[15432]

0272 slims have the disabled FCRT so it shows "PlayDVD" only if DVDKey is invalid.
Also the firmware file could be damaged

 

[LoneWolf913]

0272 slims have the disabled FCRT so it shows "PlayDVD" only if DVDKey is invalid.
Also the firmware file could be damaged

Redownloaded LT3 to remove that possibility, same behavior with a fresh copy. Original firmware works fine as well so not like the stock FW is corrupted. Are you sure on the FCRT bit, as that would lead me to believe I could drop an 0401 or 0225 in there with the proper DVD key and have it work, something I thought was impossible.

 

[sarah1331]

Redownloaded LT3 to remove that possibility, same behavior with a fresh copy. Original firmware works fine as well so not like the stock FW is corrupted. Are you sure on the FCRT bit, as that would lead me to believe I could drop an 0401 or 0225 in there with the proper DVD key and have it work, something I thought was impossible.

Try the 0225u fw for them rare cases you get a mislabeled 0225

I know you dumped 0272 but hey worth a shot

 

[LoneWolf913]

Try the 0225u fw for them rare cases you get a mislabeled 0225

I know you dumped 0272 but hey worth a shot

Sending Sector Erase to Port 0x0000
Erasing: 0x3E000
Writing: 0x3E000 
............
Authorisation Failed!
Restore Verify Failed !

Got that when I wrote 225u, still didn't work. Flashing back to 0272 stock works, re-trying 0272 LT3 one more time..

 

[15432]

Please upload the working original dump. Maybe it has some difference from standard 0272 FW. I can create the CFW based on any D4S dump

 

[LoneWolf913]

Please upload the working original dump. Maybe it has some difference from standard 0272 FW. I can create the CFW based on any D4S dump

PM'd original drive FW to you. Thanks!

 

[15432]

Spoofed! 0272u ver detected
1F block is from 9504 drive. This drive was updated on the factory

 

[LoneWolf913]

Spoofed! 0272u ver detected
1F block is from 9504 drive. This drive was updated on the factory

Worked perfectly, many thanks. Has anyone at Team Jungle been notified to add support/FW files to the next release?

 

[15432]

Worked perfectly, many thanks. Has anyone at Team Jungle been notified to add support/FW files to the next release?

No. I tried to report about some bugs in JF (bad zero serial support), specific firmwares (long 3F data block) and other things but always no answer :cool2:

 

[ChuckyIT]

dear 15432, I've the same problem, and I've see that you are able to solve...

unluckly i've not the complete dump of firmware.

on label i have 9504 and inside is a 0272 (from factory)...

is possible to get a working firmware? tnx!!

 

[Oggy]

Geremia posted a while back about any unique info found in Slim drives, it's all on XBH, I read it again the other day.

This is 2 minutes work in a hex editor.

 

[sarah1331]

Geremia posted a while back about any unique info found in Slim drives, it's all on XBH, I read it again the other day.

This is 2 minutes work in a hex editor.

I know you have had this argument lots of times but I can only remember when he says

You can rebuild your serials area (and hope they matches the stickers), you can guess the 1FF80 area, but you can't rebuild the 0x10 bytes at 0x2AFF0, unless you have a dummy with the whole dvdkeyarea

I know it's a bit copy and paste but

realtime checks (fw hash-style check)
9504/0272: 2A000-2AFFF, 1F000-1FFFF, 3D000-3EFFF are skipped, you can change any bit here without "play dvd problem"
0225,0401,1071: whole fw is checked, change 1 bit anywhere, you'll get "play dvd" (some times for 1 bit change only)

dvdkeyarea:
all slim fw has dvdkeyarea 2A000-2AFEF, dvdkey is stored there, difference for 0225,401,1071 is an encryption, but still 0xFF0 wide area for ALL slims.

0x10 byte crapkey
2AFF0-2AFFF is a 0x10 byte unique per drive, drive itself does not do anything with it, it does not create it from somethign else.
The only few things the drive can do with these 0x10 bytes are: 1) dump them 2) reflash them 3) hash calc as for any other bit in the fw during fw hash check (9504,0271 skips them see previous notes)

The console does not check these 0x10 bytes every boot, i only saw 1 time the console dumping these bytes: prior to spi lock the 0272

This should be enought to understand the "play dvd problem": realtime check fail, aka fw hash fail


So really all he says is you can rebuild a 9504 0272

Unless you heard something Maby share with us and we will all know a solution to rebuild our slims without a dummy

 

[Oggy]

Why persist in asking? If I wanted to release something, I'd choose to do it.

Gone are the times I appease the needs of sceners.

Anyway, last I knew, this was 0272.

 

[sarah1331]

Yes it is I didn't want to "rub you up" am sorry it's not my intention and persistent am not I haven't got the need of such a fix

It would be good to have in the arsenal if you get me