SACD Ripping using an Oppo or Pioneer? Yes, it's true!

[Phthalocyanine]

@Dick Darlington

Getting the Oppo to work with telnet opens up so many doors for trouble-shooting.  Great work!

Did you do any local USB drive ripping on the Oppo using telnet?

The common wisdom on the thread had been that the Oppo did not work with the telnet method.

Your universal telnet USB drive script will be extremely useful for testing out other possible SACD ripper BD players.

By the way, I have never seen the scrolling letters on my Sony.  I always assumed it just doesn’t work on that model.  I never noticed the display set to all zeroes, either.  But I’ll look for it in the future.

[Dick Darlington]

4 hours ago, Phthalocyanine said:

@Dick Darlington

 

 

Getting the Oppo to work with telnet opens up so many doors for trouble-shooting.  Great work!

Did you do any local USB drive ripping on the Oppo using telnet?

The common wisdom on the thread had been that the Oppo did not work with the telnet method.

Your universal telnet USB drive script will be extremely useful for testing out other possible SACD ripper BD players.

By the way, I have never seen the scrolling letters on my Sony.  I always assumed it just doesn’t work on that model.  I never noticed the display set to all zeroes, either.  But I’ll look for it in the future.

@Phthalocyanine Ha I expect it’s always worked by virtue of an earlier contributor but some people like me tried it with a different AutoScript ... possibly one changed to work with the Panasonics ... and then “I tried with the Panisonic script with no success” became “oppos can’t do it” LOL. In fact I’m inclined to suspect that the so-called discrepancy in the script I started with for the Sony *may* have been due to it being toggled back to “inetd” for Oppo compatibly at some point. 

 

And no I stopped at confirming that I could manually ? sacd_extract in server mode and then rip from the Mac.

 

That said it seems the Oppo has an advantage for Mac users that prefer to rip locally. Unlike the Sony, the Oppo supports ExFAT in addition to FAT32. And unlike NTFS, ExFAT is supported on BOTH macOS and Windows 10. AFAIK there is no 4GB file size limit under ExFAT.  So to use a metaphor near and dear to my heart — fine ? and great ? —  for persons having a direct-to-USB-stick orientation, I would say that the Oppo pairs well with the Mac oriented and the Sony complements the Windows folks. Of course none of that applies to ripping over the network which is what I prefer.  

[wanthalf]

Wow! So great you found out! I always wished to telnet to the Oppo and have a look around. How did you find out? Just trial&error? I also wonder who found the CLI_app commands and how? There is surely more of them, I guess.

 

I have been one of those stating that telnet does not work on the Oppo (if not the first one) because that was my conclusion. I tried first with the Pioneer scripts and failed. Then I found the Oppo scripts without the telnet and they worked. I tried adding the call to the telnet daemon and they failed as well. So I came to the conclusion there is either no telnet daemon or it is located in a different path. But without any telnet connection one can hardly look around for the telnet daemon. And I supposed there was some reason why the telnet daemon call was removed in the Oppo scripts. So I just asked in the forum and there was no answer and I gave up. I don't have time to hack around, but I always wondered who found all of this and how. The inetd might be found by trial&error, but the CLI_app codes cannot be guessed without some internal documentation.

[wanthalf]

7 hours ago, Dick Darlington said:

The caveat here is that Apple decided to protect us all from ourselves and took the telnet client away from us in High Sierra so you will need to find a PuTTY like alternative for your Mac first if you want to go down that path. 

 

... e.g. using macports. They will turn any Mac into a complete GNU/BSD distro, so you can easilly install anything.

 

(Or homebrew, if still alive...)

[Dick Darlington]

12 hours ago, wanthalf said:

Wow! So great you found out! I always wished to telnet to the Oppo and have a look around. How did you find out? Just trial&error?

 

Well after spinning around trying to get the Sony working until I noticed my script said inetd instead of telnetd as it was presented in a post I just went on a hunch that whomever put it out on Dropbox might have changed it for a reason. One that predated the Sony discovery. So I gave it a try and you could have knocked me over with a feather when I saw that ABCDEFG start to scroll lol. I just figured I came late to the party that everyone else was already enjoying. 

 

12 hours ago, wanthalf said:

I also wonder who found the CLI_app commands and how? There is surely more of them, I guess.

...

The inetd might be found by trial&error, but the CLI_app codes cannot be guessed without some internal documentation.

 

Yes absolutely. Where most of that stuff in the scripts that make this work came from I’d love to know! And then there’s the sacd_extract binary that has source and a really smart developer behind it but alas it is a mysterious black box to me. I tried googling for info on the CLI / AutoScript stuff and came up with zilch. Only hits I got were from this and the myriad similar forums on this topic. Ah well. 

file

[wanthalf]

I'm probably already losing my mind... found the flash disk I used last time, checked the scripts and the call to inetd is there! Started my Oppo with the flash drive and... the telnet connection works! What am I presenting here about the not-working telnet on Oppo all the time? Sorry to everyone for confusion, but I am completely puzzled myself. (Oh, and the telnet in the macports distribution is temporarily broken, but that is not my fault anymore, I swear! A bad day...)

 

Anyway, I always wondered why there are two scripts with different names and the same contents. It just doesn't make sense. So, removing the "Autoscript.TSS" breaks things, but removing the "Autoscript" makes no difference. So, the Oppo obviously only uses the first script. What is the purpose of the second one? Is it for non-Oppo players?

 

The system seems to be a standard Linux armv7 environment. Some 320MB RAM, plenty of free space when idle. I have not found much interesting there yet, but I will have a look as soon as I find more time. Maybe we can find some clues about the system and the scripts? There must be some parser or interpreter of the scripts somewhere - probably just some undecipherable compiled binary, though. I am not really experienced in reverse-engineering, unfortunately.

 

[Gregavi]

On 2/26/2018 at 11:52 PM, captainbrent said:

 this method cannot be used for ripping Bluray Audio's, only SACD's!

True, but there is a way of ripping Blu-Ray Audio (or video). I do it all the time.

[David_B]

Does your method separate out "tracks" or "chapters" from the Blu Ray? I have also done it using a blu-ray ripper, but the audio always comes out as one very long track.

[Tipo450s]

I use this for ripping Bluray audio and DVD audio.....works like a charm:

 

http://dvdae.com/

[Fitzcaraldo215]

1 hour ago, Tipo450s said:

I use this for ripping Bluray audio and DVD audio.....works like a charm:

 

http://dvdae.com/

Right.  There are also Xrecode3 and Audiomuxer.  All 3 will extract hirez FLACs, one per chapter, from unlocked Bluray ISOs or MKVs, also DVDs.

 

Now back to SACD ripping.

[Tipo450s]

Is it against protocol to give feedback if someone asks a question?.....don't want to fall foul of the powers that be.

[Dick Darlington]

7 hours ago, wanthalf said:

I'm probably already losing my mind... found the flash disk I used last time, checked the scripts and the call to inetd is there! Started my Oppo with the flash drive and... the telnet connection works!

 

? GOOD LORD!  Are you saying you went back to the very same flash drive that you made the original attempt with, and tried again without any modifications and it worked?  That’s crazy and even more puzzling than my similar mind-losing experience!

 

This morning I looked at my original “Telnet method” subfolder from which my flash drive was built. I noticed that for whatever reason the files both had a .txt extension, e.g. AutoScript.TSS.txt, which was not the case in my other variant folders. So until I read this post my theory was that I had either downloaded improperly named files, or done it to myself after the fact and that’s why it didn’t work last year.  But now a fog of mass insanity induced by a malicious alien race orbiting the ? at the time seems as good an explanation as any. ??‍♂️ 

 

PS:  My therapist?‍?has just had a weekly slot become available.  

[dtblair]

I have the Sony BDP-S790 and have been attempting to get the SACD ripping working. 

I have a MBR USB drive (fat32) with the Autoscript folder and 3 files recommended for Sony (including the Telnet code modification)

1. Booting up with the USB in the player does not open the drive

2.  Attempts to connect through the cmd (.\extract_sacd -i 10.0.0.76:2002 -P -I) or the iso2dsd interface fail to connect.

3.  I can Telnet into the Sony (only using the IP address, no port) but don't quite understand the command or file structure to get very far.  I login in as Root and get a ~# prompt.  I and can change directory to /bin/sh but am denied access to /usr/sbin.  Would there be a default password?

 

Don't know where to go from here.  I would be willing to just try ripping to the USB drive but don't quite understand how to execute that.

 

 

[Phthalocyanine]

So the Sony BDP-S790 works too!

I was cautiously optimistic that it would (as part of the 2012 model line as is the S590), but nice to get a confirmation.

If you have root access and a telnet connection you can rip.

I've PM-ed dtblair with instructions on how to proceed using local ripping.

[ted_b]

@Phthalocyanine from whom did you get a BDP-S790 ripping confirmation (I assume not Dtblair, he hasn't got anything working)?  I added your BDP-S590 discovery to the first post, but don't want to add anything more until you confirm.

[Phthalocyanine]

 

@ted_b

My apologies if I have jumped the gun in assuming that dtblair will get things working.

Yes do not add this model for the moment.

But what he has reported - that the exploit works to give him root access and telnet connection - is an excellent sign.

[dtblair]

Making progress.  Putting the USB in the front of the Sony didn't register in the root directories.  I put the USB in the back and it showed up in the /mnt/sdg1 directory.  I tried running the sacd_extract_160 and got errors:

 

insmod: can't insert '/tmp/fileToprF1': invalid module format
[0]: install_modules: mknod/insmod filed
rmmod: can't unload 'sacd_read': unknown symbol in module, or unknown parameter
[0]: Can not install modules

 

This is promising....

 

[Phthalocyanine]

Yes you are very close now.

Remember to change that setting in the Music settings before you enter the command to run sacd_extract_160.

 

[captainbrent]

9 hours ago, Gregavi said:

True, but there is a way of ripping Blu-Ray Audio (or video). I do it all the time.

Thank you but I'm well aware of that and was just pointing to the OP the limitations of using the Oppo for ripping.

[wanthalf]

So, I have dumped the contents of the Linux firmware from inside the Oppo and here are some observations:

 

1) As expected, the whole thing is managed and controlled by a single giant binary called "bdpprog". Just put it into google and you get the same information confirmed by people, who did some more detailed reverse-engineering of the Sony players. So, all the machines seem to be based both on the same hardware as well as software. Of course, this does not imply they will be identical, nor they will all be as easily usable to rip SACD (if at all). The people have obviously been trying to hack into the machine. I have not seen them to mention anything about the "AutoScript", but they tried other (and more difficult) ways. I have not studied their pages and results thoroughly, but maybe we could find more information there? Or maybe it is obsolete?

 

2) The mounting of the USB flashdisk is probably only done once on the device boot, by the init scripts. But that's nothing new...

 

3) The mounted device is statically limited just to the /dev/sda1, which means partition number 1 of the first drive only. I have wondered about the discussions about the need to have the USB flash disk made bootable or whatever... that did't make much sense to me. But I noticed one of my late microSD cards was formatted with a single partition assigned as number 4 (instead of 1) from the factory. I have no idea why. But if this also happens with the USB flash disks, that would explain the problems: this cannot be solved just by reformatting, the partition table must be changed. I suppose that the side effect of making the USB disks bootable is also changing the partition number back to 1. But the "bootable" capability is hardly of any importance by itself.

 

4) The path "/mnt/sda1/AutoScript/AutoScript.TSS" is hardcoded into the bdpprog binary. That means that this program is probably also reading and interpreting the scripts (it might also run some other program to do that, but it also contains the strings "CLI(CLI_" and "SLEEPMS(", which means it probably parses the script itself). Anyway, the other copy of "AutoScript" file is obviously useless, at least in the Oppo, as mentioned before.

 

And just one more experience I have mentioned before: turning "autoplay" off is not that crucial. I remember I forgot to do that the first time and as soon as I just stopped the automatic playback manually using the STOP button, the ripping just worked. (But, again, this is my Oppo experience and does not speak for other players.)

[Spike44]

Just bought a Sony BDP-S590 to rip some of my SACDs, but still can't get a telnet connection to the player. (.....Could not open connection to the host, on port 23: Connect failed) - ping is ok.

Who gives him the ability for a Telnet Connection? The autoscript files or is it the player himself?

Is the firmware revision important for this?

I hope, someone here can help me with my problem!
Otherwise, I'll throw the box out the window soon.

 

[dtblair]

In order to open the telnet connection on the Sony, you must first put install the USB w/ the AutoScript file on it.  I have discovered the following:

 

1. Being a Windows guy, I didn't realize that Unix/Linux was case sensitive regarding directories and files.  I had put a directory on my USB as Autoscript rather than AutoScript and it would not read.

2. I had done a hard reset on the Sony and tried to connect through Telnet and was refused.

3. Changed the directory to AutoScript and the Telnet connection was honored.  The AutoScript file contains a command to open the Telnet connection.

4. The Sony changes the directory name of the USB depending on the make of the thumb drive.  I have seen sda1, sdg1, and sdc1 as the names.

 

So far regarding the Sony BDP-S790, I am able to get into the root and manually attempt to start ripping with the sacd_extract_160 command.  Toggling the Music type apparently doesn't unload the disk.  No matter what I try in the setup, i get 

On 2/28/2018 at 6:33 PM, dtblair said:

insmod: can't insert '/tmp/fileToprF1': invalid module format
[0]: install_modules: mknod/insmod filed
rmmod: can't unload 'sacd_read': unknown symbol in module, or unknown parameter
[0]: Can not install modules

 

I would appreciate any info from someone who had run into this error and what they did to fix it.  Maybe the S790 never unmounts the disk

[dtblair]

From wanthalf's post

22 hours ago, wanthalf said:

4) The path "/mnt/sda1/AutoScript/AutoScript.TSS" is hardcoded into the bdpprog binary. That means that this program is probably also reading and interpreting the scripts (it might also run some other program to do that, but it also contains the strings "CLI(CLI_" and "SLEEPMS(", which means it probably parses the script itself). Anyway, the other copy of "AutoScript" file is obviously useless, at least in the Oppo, as mentioned before.

 I wonder if the Sony bdpprog binary is similar and is always looking for the sda1 directory?

[Dick Darlington]

6 hours ago, Spike44 said:

Just bought a Sony BDP-S590 to rip some of my SACDs, but still can't get a telnet connection to the player. (.....Could not open connection to the host, on port 23: Connect failed) - ping is ok.

Who gives him the ability for a Telnet Connection? The autoscript files or is it the player himself?

Is the firmware revision important for this?

I hope, someone here can help me with my problem!
Otherwise, I'll throw the box out the window soon.

 

 

@Spike44 Don't throw it out the window!  It will work great once you make it to the other side of the minefield.

 

Like @dtblair pointed out, it is important to be mindful of case sensitivity of file names, commands, and such given the Linux OS on the player.  That said, I am not certain if FAT32 fully supports case sensitivity because I can name the AutoScript folder, "autoscript" or "AutoSCRIPT" or whatever and it works as long as the AutoScript file is named correctly case-wise.  That may not be the case (no pun intended if I were to use NTFS).

 

Here's a few more things to try, keep in mind, and look at:

 

1. Always start with a freshly booted player.  Power it off and back on between attempts.  If the drive is properly formatted it will mount at /mnt/sda1 on the first insertion.  But if you remove it and reinsert it or a different drive it will mount as "sdb1" and so on.  So if you remove it and find and fix a problem with the drive and reinsert it before rebooting it probably won't work anyway.
2. If you hold off on inserting the flash drive until the player is fully booted then you can look for a few indicators that will help narrow down the problem.  If you're ?. 

• After you insert the flash drive look at the TV display and if it pops up a "USB device not supported" error message then you probably have a partition table or volume format problem.  Go directly to jail.  Do not pass Go.  Do not collect 200 quid. Confirm that it is an MBR partition scheme.  Confirm that the volume is formatted as FAT32 or NTFS and not ExFAT or something else.  Confirm that there is only one partition on the disk; no hidden system partitions that are likely to hose you.
• If it likes the USB drive then adjust your gaze to the players alphanumeric display.  The display should change to "0000" within a few seconds.  If it does not, then the AutoScript file failed to load.  The most likely reason is that you have recently angered the gods followed by "you screwed something up" as a close second.

1. (pretend this is 3). Since ping works and telnet doesn't, then you have mostly ruled out the "wrong ip" or network problem possibilities, but not entirely.  The other day -- a day that I was very much in the Goddesses favor BTW -- I too could ping but the telnet connection was refused although the "0000" was displayed as normal, leaving only "I screwed up" to sort out.  Turns out the dhcp assigned IP address had changed in the past day but something else was using the old IP.  That was just because I was too lazy to enter a static IP in my router for the play.

BTW, my player has firmware M12 R.0430, which is not the latest.

 

So take a look at the indicators in (2) above and see if that provides a clue that leads to the problem.

 

2 hours ago, dtblair said:

 

4. The Sony changes the directory name of the USB depending on the make of the thumb drive.  I have seen sda1, sdg1, and sdc1 as the names.

 

@dtblair I truly don't think the make of the thumb drive should have anything to do with the mount point designation.  AFAIK the first volume on the first partition of the first drive inserted will always mount as "sda1".  If you were to insert a second drive in the rear, it would be "sdb1".  Every time you insert a new drive or reinsert one of the others it will increment by another letter.  At least that's what I'm seeing.  I'm speaking of the S590 BTW.  Is it possible you were trying various things and removing and replacing the drive without rebooting?

[Scar972]

I've ripped over 70 SACD's using my  Pioneer BDP-80FD over the last year or so, my last successful rip was about three months ago. Just tried to rip a couple of SACD's and getting the dreaded sacd_extract.exe has stopped working message. Has anything changed over the last three months? Thanks!