Jump to content
IGNORED

SACD Ripping using an Oppo or Pioneer? Yes, it's true!


ted_b

Recommended Posts

12 minutes ago, Phthalocyanine said:

The stuff I see in the service manuals (like this from the S590 Service Manual) has somewhat scared me because it shows typical Sony hyper-security lockdowns.

But I also remember googling around that people have figured out how to get around these.

So I'm sure you will prevail.

 

Yes I've been somewhat scared by that service manual stuff too, and it may end up much harder than I am anticipating, however there are as you said many instances of folks successfully replacing the optical drive in both Blu-ray players, and PS3 or PS4 game systems, so it's not impossible.

no-mqa-sm.jpg

Boycott HDtracks

Boycott Lenbrook

Boycott Warner Music Group

Link to comment
19 minutes ago, Phthalocyanine said:

One member @[email protected] had the BDP-485 (the model from the previous year) which did not work, which makes sense because it was probably like the S480/S580, which does not work .

***

[email protected]:

The front tray did not open after powering on my Sony BDP-S485 with the USB drive containing the Autoscript folder inserted. Anything I did wrong? or S485 is not compatible?

***

Me:

The Sony BDP-S485 is a model I did not previously know about.

From its service manual, it’s a Sony Blu-Ray player model with SACD and Karaoke from 2011-2012 marketed in China, Singapore, Thailand, and  Russia,

@Phthalocyanine

You have good memory. I still have the S485 for daily use and have a BX59 for SACD ripping using your superb guide. I could test the S485 if anyone can point me to the proper scripts.

Link to comment
14 hours ago, MikeyFresh said:

That is interesting, especially since many parts suppliers list the replacement optical drive mechanism as the same for all of these units over many years, currently the part they will send you is a BPX-10 for a wide range of models listed as compatible, including an S185

Concerning this and what @Nexus3 has been pursuing by comparing the common Sony BD drive units  -- the question (in my non-programmer way of saying it) is where does the "secret sauce" for reading SACDs reside in these optical units?  If you disassemble a computer optical drive you see it is a combination of (1) the optical drive pick-up (laser and sled assembly) and (2) some motors and (3) a circuit board. 

 

Where does the special ability to read SACD reside in the Sony models -- in a special laser assembly or in some special chip or instructions in the circuit board.  If the special sauce is in a chip or a circuit board independent of the basic Sony BD optical unit (which appears common to both SACD and non-SACD models) then this could explain why the same basic Sony BD optical unit can be used in both SACD and non-SACD models).

 

In other words, the secret sauce may be in a separate chip or circuit board not the common Sony BD optical unit.

Link to comment
3 hours ago, Phthalocyanine said:

As I recall, it read the redbook CD layer of SACD hybrids and would shown "unknown disc" for non-hybrids.

This is a problem.  Unless the disc is mouted as SACD, you cannot read anything (encrypted or decrypted) from the SACD layer.

 

3 hours ago, Phthalocyanine said:

But when it came to running sacd_extract_160 this is what I always got:

 

sh: mknod: not found
[0]: install_modules: mknod/insmod filed
[0]: Can not install modules

This means the essential command for sacd_read kernel module called mknod is missing on the player or is at a non-standard location.  You need to get it from somewhere or find it on the player.  

Link to comment
5 minutes ago, mindset said:

Unless the disc is mounted as SACD, you cannot read anything (encrypted or decrypted) from the SACD layer.

Indeed.  And it is not surprising that the Sony player software cannot do this because this model, the BDP-S185, is not advertised as being able to play SACD.

 

But the question is can one get this player to mount the disc as a SACD through the mediatek/Linux commands?

 

9 minutes ago, mindset said:

This means the essential command for sacd_read kernel module called mknod is missing on the player or is at a non-standard location.  You need to get it from somewhere or find it on the player.  

Very interesting.  But how would one begin to get mknod from somewhere?  Alternatively, could you suggest a Linux search command I could run through telnet on the player to look for mknod on the player?

 

21 minutes ago, mindset said:

By the way, I recently found a way to obtain more details about the SoC on the player. 

Great work!

Link to comment
10 hours ago, Phthalocyanine said:

In other words, the secret sauce may be in a separate chip or circuit board not the common Sony BD optical unit.

 

Thus I very likely will have to disassemble the replacement part I have, extract the laser pick-up assembly portion, and transplant it into the existing drive mechanism, assuming the new part is fully swappable with the existing.

 

Also assuming that's the only thing wrong with it in the first place, apparently the laser can be rendered inoperable by a bad electrolytic capacitor in the power supply, which is easy to see and fix. I'm very much hoping it is something stupid easy like that and I don't have to take apart the disc drive at all.

no-mqa-sm.jpg

Boycott HDtracks

Boycott Lenbrook

Boycott Warner Music Group

Link to comment
10 hours ago, mindset said:

Here is what I got from players I have:

 

BDP-S390: MT8551KAAG

BDP-S590: MT8560EAAG

BDP-S1100: MT8552DAAU

BDP-S5100: MT8560EAAG

BDP-S6200: MT8580DJAG

BDP-S6500: MT8580DJAG

BDP-S6700: MT8580DJAG

 

So that right there is actual proof this exploit is not necessarily limited to machines with the MT8560 and 8580 SoC then, no?

no-mqa-sm.jpg

Boycott HDtracks

Boycott Lenbrook

Boycott Warner Music Group

Link to comment
10 hours ago, mindset said:

I managed to make BDP-S1100 to switch to the SACD layer by modifying the bdpprog program, and could read raw encrypted data from the SACD layer.  However, I couldn't get decrypted data using sacd_extract_160 (got gabled data with lots of warnings)

Now the BDP-S1100 should react like the BDP-S185 in the sense that they are both Sony players that do not play SACD in model years where there are models that do and both of them respond to the exploit.

 

But it seems that one can get farther with the S1100.  As you noted and as I can confirm with my own experience, one can start ripping with the S110 (even one not subject to the modification you mention above) but nothing actually gets ripped.  Sacd_extract_160 at least starts to run and then runs into problems.  Whereas with the 185 one encounters the missing mknod thing.

 

Here's my result with my S1100

 

~ # cd /mnt/sdc/AutoScriptSACD/

/mnt/sdc/AutoScriptSACD # ./sacd_extract_160 -I

mknod: /dev/sacd_read: File exists

insmod: can't insert '/tmp/fileU7Qkda': File exists

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

[0]: convert_string(): Conversion not supported. Charsets: ISO646-JP -> UTF-8

Processing [Arthur Rubinstein - Chopin Ballades.iso] (1/1)..

Link to comment
21 hours ago, loadam59 said:

I did my first sacd iso rip from the s7200 without any change at the first time !!

I did it over wifi at 0.4 MB/s

Congratulations! The interesting thing is the really SLOW WiFi rip - I also had a few on my S790.

Does this happen only in  SLEEP mode on your S7200?

 

 

10 hours ago, mindset said:

By the way, I recently found a way to obtain more details about the SoC on the player.

 

Method to obtain the SoC type:

  1. telnet to the player.
  2. cliprog
  3. Enter drv.bonding.g
  4. CTRL+C
  5. dmesg
  6. SoC type is displayed with other interesting info

Some players are missing the dmesg command. In that case you need to get it from somewhere.

 

Out of your keyboard this reads as beeing a piece of cake 😋. I ran into the following obstacles on my Pioneer 170 & Sony 790:

 

The Sony refuses on cliprog:

cliprog
 open cli device OK!
Enter drv.bonding.g
Cannot do ioctl to device!

And complains also on the "borrowed dmseg" (the shared library was included in the same directory btw):

./dmesg: error while loading shared libraries: libncursesw.so.6: cannot open shared object file: No such file or directory

 

 

On the Pioneer the situation is similar, though I had to copy the cliprog from the Sony.

cd /mnt/rootfs_normal/usr/local/bin
cp cliprog /mnt/sd*/

The rest of the story is the same ...

 

@mindset, any recommendations are als always welcome!

 

Now I am going to add your findings to the Google SACD-Ripping spreadsheet.

Link to comment

More details on my experiments with the S1100, now that I'm remembering more about doing this a while back.

 

The initial attempts with SACD hybrids were as follows, which reflect that the player has loaded the redbook CD layer and there is no way using the player controls to switch to the SACD layer:

 

/mnt/sda/AutoScriptSACD # ./sacd_extract_160 -I

libsacdread: Not a ScarletBook disc!

libsacdread: Can't read Master TOC.

 

So what I did next was load a SACD-R, which obviously has no redbook CD layer, but also has no pit information or encryption, and I got the result from my previous post, in which sacd_extract_160 appears to start the ripping process but then aborts.

Link to comment
11 hours ago, Phthalocyanine said:

But the question is can one get this player to mount the disc as a SACD through the mediatek/Linux commands?

I am not aware of any easy way like that.  The only way I could find was to modify the bdpprog program, which is very tedious.  You need to disassemble the program, analyze it to find the layer selection portion, and modify that part to force the player to select the SACD layer.

 

11 hours ago, Phthalocyanine said:

Very interesting.  But how would one begin to get mknod from somewhere?  Alternatively, could you suggest a Linux search command I could run through telnet on the player to look for mknod on the player?

mknod is a standard Linux command and should be at /bin/mknod

Link to comment
1 hour ago, Nexus3 said:

 


./dmesg: error while loading shared libraries: libncursesw.so.6: cannot open shared object file: No such file or directory

 

This is a common problem of borrowing a program from other machine.  You copied the program but not its dependencies. You can try copying libraries it complains about that it might not go anywhere. 

 

 

Sony refuses on cliprog:

cliprog
 open cli device OK!
Enter drv.bonding.g
Cannot do ioctl to device!

Do not enter "Enter".

 
Link to comment

What comes afterwards offers even greater informational value IMHO - a featureset of the SoC, not necessarily what the player can really do:


 

Quote

 

Pioneer:


------------------------------
                 ROM:    |x
                  TZ:    |x
                AACS:   v|
                              ---------
              DivXHT:    |x
           DivXUltra:    |x
              DivXHD:    |x
                SACD:   v|
         DolbyTrueHD:   v|
               DTSHD:   v|
             3DVideo:   v|
           DolbyDDCO:   v|
            DivXPlus:   v|
                              ---------
      DolbyHeadphone:    |x
     DolbyPLIiIixIiz:    |x
             DolbyEX:    |x
    DolbyDigitalPlus:   v|
       DolbyVSpeaker:    |x
    DTSSurdSensation:    |x
        Multichannel:   v|
            DVDAudio:    |x
           Playready:   v|
                  RM:    |x
               WMDRM:    |x
           CinemaNow:    |x
             Netflix:    |x
         Macrovision:   v|
         YahooWidget:    |x
             Browser:   v|
               AVCHD:   v|
      AdobeFlashLite:   v|
            Rhapsody:    |x
                NTFS:   v|
                              ---------
              2ndARM:    |x
            DolbyAAC:   v|
                 WMV:   v|
         HomeTheater:    |x
                 WMA:   v|
                HDCD:    |x
                              ---------
        H264_Encoder:    |x
             HDMI_RX:    |x
         InternalDIR:    |x
           AACPLUSv1:   v|
           AACPLUSv2:   v|
        SmoothStream:    |x
                              ---------
            L2 cache:   v|
------------------------------
 


 

 


 

Quote

 

Sony:


------------------------------
                 ROM:    |x
                  TZ:    |x
                AACS:   v|
                              ---------
              DivXHT:    |x
           DivXUltra:    |x
              DivXHD:    |x
                SACD:   v|
         DolbyTrueHD:   v|
               DTSHD:   v|
             3DVideo:   v|
           DolbyDDCO:   v|
            DivXPlus:    |x
                              ---------
      DolbyHeadphone:   v|
     DolbyPLIiIixIiz:   v|
             DolbyEX:    |x
    DolbyDigitalPlus:   v|
       DolbyVSpeaker:   v|
    DTSSurdSensation:    |x
        Multichannel:   v|
            DVDAudio:   v|
           Playready:   v|
                  RM:    |x
               WMDRM:   v|
           CinemaNow:   v|
             Netflix:   v|
         Macrovision:   v|
         YahooWidget:   v|
             Browser:   v|
               AVCHD:   v|
      AdobeFlashLite:   v|
            Rhapsody:   v|
                NTFS:   v|
                              ---------
              2ndARM:    |x
            DolbyAAC:   v|
           AACPLUSv1:   v|
           AACPLUSv2:   v|
         HomeTheater:   v|
                HDCD:   v|
                              ---------
                 WMA:   v|
                 WMV:   v|
        H264_Encoder:   v|
             HDMI_RX:   v|
             DUAL_TX:   v|
     2D3D_Conversion:   v|
         InternalDIR:   v|
     TransportStream:   v|
                              ---------
            L2 cache:   v|
------------------------------
 

 

 

Maybe the entry (v=valid ?),


SACD:   v|

 

is also relevant on the low-end models, besides the optical drive unit and the firmware settings.

Link to comment
1 hour ago, Nexus3 said:

Thank you @mindset - sometimes persistency pays out.🤑



 

If you are interested, try "ls" in the cliprog program.  You will get a list of commands in dmesg.  For a list of subcommands you can just enter the command name like "drv" or "drv.bonding".  There are lots of different commands you can play with including a few related to SACD.

 

 

Link to comment

 

28 minutes ago, mindset said:

There are lots of different commands you can play with ... like "drv" or "drv.bonding". 

 

Hello @mindset, your timing couldn't be better. 😄

 

I was in contact with @klassikmann, to have his great "autorip sub-script" optimized and turned into something REALLY "stand-alonish".

 

On 3/9/2018 at 7:24 PM, klassikmann said:

Scenario 2: No network connection i.e. no telnet
Contents of AutoScript:
#MTKAT 0.xx script
CLI(CLI_exec echo root::0:0:root,,,:/root:/bin/sh >/etc/passwd)
SLEEPMS(3000)
CLI(CLI_app.vfdmg.b clear_msg)
CLI(CLI_app.vfdmg.b scroll_msg start)
SLEEPMS(5000)
CLI(CLI_exec cp /mnt/sda1/AutoScript/sacd_extract_160 /)
CLI(CLI_exec insmod /lib/modules/2.6.35/BDP/splitter.ko)
CLI(CLI_exec /sacd_extract_160 -S &)
CLI(CLI_drv.ir.rx.sq 0xaf000)
CLI(CLI_exec /bin/sh /mnt/sda1/AutoScript/mysh.sh)
CLI(CLI_drv.ir.rx.sq 0xaf000)

 

Explanation:
This script is very similar to the first. At the end the drawer opens, you insert the SACD, a shell-script (mysh.sh) to rip the SACD will be executed, and finally the drawer opens. The resulting ISO can be found in the AutoScript directory.

 

Contents of mysh.sh:
sleep 50
cd /mnt/sda1/AutoScript
./sacd_extract_160 -I -i 127.0.0.1:2002

 

Explanation:
Wait for 50 seconds, time enough to change the music settings (If anybody is aware about a solution to change the music settings inside AutoScript, please let me know) as described already. Then the client will be executed. 127.0.0.1 is the IP address of the localhost, which is a valid IP address even no network connection is available.

 

Beware:
mysh.sh has to be UNIX-style textfile, i.e. end-of-line has to be coded by a single line-feed (\n); DOS-style textfiles are encoding end-of line as a two-character carriage-return + line-feed (\r\n). To avoid trouble I enclosed the mysh.sh to be copied as-is to the thumb device:

mysh.sh 73 B · 209 downloads

I assume that the reason for my problems in the beginning with the old firmware was the wrong encoded mysh.sh.
Btw. AutoScript can be either style.

 

Now we have my requested stand-alone scenario.

 

Assuming the drv.ir.rx.sq is the command sequence for "fake" internal infra-red code inputs via cliprog and 0xaf000 is the hex-code for the EJECT-button, shouldn't there also be hex-codes for other keys like "options" "directions keys" and the "enter key?

 

Our goal is to have the keybutton chain, normally entered via remote control to alter the SACD layer (via OSD menu), injected via the unix subscript and thus enabling a truly USB-stand-alone ripping solution for the Sony players - without any need for a PC, network or manual user inputs.

Link to comment
1 hour ago, Nexus3 said:

Assuming the drv.ir.rx.sq is the command sequence for "fake" internal infra-red code inputs via cliprog and 0xaf000 is the hex-code for the EJECT-button, shouldn't there also be hex-codes for other keys like "options" "directions keys" and the "enter key?

IR codes are associated with player functions in /etc/lircd.conf.  But I don't see 0xaf000.  

Link to comment
20 hours ago, Nexus3 said:

Congratulations! The interesting thing is the really SLOW WiFi rip - I also had a few on my S790.

Does this happen only in  SLEEP mode on your S7200?

 

S7200 only work for me in sleep mode. Wifi rip is really too slow, i reach 3 to 4 mb/s with a direct cable.

 

The Soc is a MT8580DJAG

 

Quote

-------------------
000000dc, 00000022, ffddb7c4, 00000202, 00000000,        0
IC Version: MT8580DJAG
MSB: 000000dc
LSB: 00000022
table1: ffddb7c4
table2: 000018fe
prot: 00000202
IPTV: 00000000
Byte28: 00000000
-------------------
MSB: 1101 - 1100
LSB: 0010 - 0010
  DivXHT    - 11
  DivXUltra - 01
  DivXHD    - 00
-------------------
------------------------------
                 ROM:     |x
                  TZ:     |x
                AACS:    v|
                  ---------
              DivXHT:     |x
           DivXUltra:     |x
              DivXHD:     |x
                SACD:    v|
         DolbyTrueHD:    v|
               DTSHD:    v|
             3DVideo:    v|
           DolbyDDCO:    v|
            DivXPlus:     |x
                  ---------
      DolbyHeadphone:    v|
     DolbyPLIiIixIiz:    v|
             DolbyEX:     |x
    DolbyDigitalPlus:    v|
       DolbyVSpeaker:    v|
    DTSSurdSensation:     |x
        Multichannel:    v|
            DVDAudio:    v|
           Playready:    v|
                  RM:     |x
               WMDRM:    v|
           CinemaNow:    v|
             Netflix:    v|
         Macrovision:    v|
         YahooWidget:    v|
             Browser:    v|
               AVCHD:    v|
      AdobeFlashLite:    v|
            Rhapsody:    v|
                NTFS:    v|
                  ---------
              2ndARM:     |x
            DolbyAAC:    v|
           AACPLUSv1:    v|
           AACPLUSv2:    v|
         HomeTheater:    v|
                HDCD:    v|
                  ---------
                 WMA:    v|
                 WMV:    v|
        H264_Encoder:     |x
             HDMI_RX:     |x
             DUAL_TX:     |x
     2D3D_Conversion:    v|
         InternalDIR:    v|
     TransportStream:     |x
                  ---------
            L2 cache:    v|
------------------------------

 

What do you think about the HDCD:    v|

Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now



×
×
  • Create New...