Wii.DVD.Drive.Serial.Tool.for.LINUX.inklusive.Shematics-IND
Nom :
Autre information :
Wii DVD Drive Serial Tool
by Erant
Usage of the program:
The DVD Tool usage is fairly simple, to read from memory, type
./dvdtool -s-r
So, if you wanted to read 0x40 bytes from 0x8000 (main memory start), you'd type
./dvdtool -s 0x40 -r 0x8000
The file argument is an optional argument for reading, if no valid file is specified,
the output is a formatted output to stdout. The -s argument is also an optional argument,
not specifying it will assume a default of 0x20 bytes.
To write to memory, you'd use a similar syntax
./dvdtool -s-w
The only difference is the last argument, it can take a file or a formatted array.
In either case, the -s option is again optional, not specifying it will assume
the size of the array, or the size of the file.
An example to write an array to 0x8100:
./dvdtool -w 0x8100 "0xFF,0x0,0xFF,0x0" will write {0xFF,0x0,0xFF,0x0} to 0x8100.
The insert code command is slightly more complicated, you need a compiled and assembled
binary to insert. Code execution starts at 0x408000, which is in extra RAM. Code size limit
is estimated at roughly 8kb, so enough for pretty much anything. You need to pre-pend your code
with a NOP instruction, and append it with an 'RTS' instruction, to resume normal code execution.
An example of some code you could assemble and insert:
NOP
MOV 0xFF, D0
MOV 0x8000, A0
MOV D0, (A0)
RTS
This will write the value 0xFF to 0x8000. You can again check proper execution by performing a read operation.If the application returns a 'write error' after code injection, your code has crashed the interrupt thread of the DVD drive, and it'll need either a power cycle or reboot. Syntax of the code inject is easy enough,
./dvdtool -i code.bin
(A sample, compiled program called code.bin is included, it's source is also included. Run it, and check for 0xEA, 0xEA at 0x8001 for correct functioning).
Making the datacable
In order to make the datacable, you need only a few basic items. A DB-25 connector, two diodes, and some cable. Connect the diodes in reverse (so, PC ---|<--- Wii) to the DB-25 connector, to pins 1 and 14. Just connect some wires to pins 18 and 11, these will be the GND and output wires. The other two dioded wires are clock and input. Now, open your Wii, remove the DVD drive, and turn it over. Look for the following pattern near IC3001:
- 1 -
2 3 4
- 5 6
3 is SBO1 (Output)
4 is SBT1 (CLK)
6 is SBI1 (Input)
With the numbers being pads, and - being nothing. Now, solder the wire from pin 1 to pad 4 (CLK line). Pin 14 goes to pad 6, and pin 11 goes to pad 3. Just find a suitable place to attach the wire from pin 18, which is GND. (Placing the board so you can read the writing on IC3001, look at connector P3001, the rightmost pad is GND and the third from the right is GND). Check your solder connections with a multimeter, then close up your Wii, and issue the ./dvdtool -r 0x8000 command in root mode. If you see hexadecimal numbers, congratulations! If you don't, check the proper functioning of your cable, wether or not you're in root mode, and if the parport0 and ppdev drivers are properly installed.
dvdtool.conf
Contains only two things, the second line is the command write delay, the delay after a command is written, and should probably be left alone. The first is the bit read/write delay, the delay done after a bit is written or read. In standby mode (orange led), this is pretty safe at 50, but for ON mode (green led), should be set to 100 or higher, to avoid sync errors.
Debugging
If you're getting out of sync errors every now and again, make sure your Wii is in stand by mode (orange LED, higher transfer rates), or adjust the timing settings in dvdtool.conf, or try adding a 47pF capacitor to GND to your clock line. (At the Wii side). The code is also still fairly crude, so if you encounter any bugs, please give them to me.
Wii Disc Drive:
Chips:
IC1001 "[M]" "AN22023" "619P7002" (tqfp-48)
IC1002 "[M]" "41224" "616C5279" (probably a power switching / motor controller chip. - tqfp-65)
IC2001 "GC2-D1" "616P7300" (tqfp-144)
IC2003 "(underlined L) X9" "TDA" (6-pin package)
IC3001 Panasonic "Panasonic" "GC2R-D2A" "610U6MF7" (tqfp-100)
Ports:
P1001 Connects to laser/focus/read assembly
P1003 Connects to laser assembly movement motor
P1004 Connects to optical Disc detection subboard on "bottom" side
P2001 Connects to Wii motherboard Port P4 (via 32 pin flat cable)
P3001 Connects to Wii motherboard Port P8 (via 12-pin wire bundle cable)
Wii Mainboard Chips:
Chip listing:
U1: "(E)" "HOLLYWOOD" "©(M)'06Nintendo" "(ATI logo)" "(BroadOn logo)" "(NEC logo) JAPAN" "C10046F5-211-PN2-A" "0633KK01X" (video/IO chip, BGA/unknown 31x31mm)
U2: "(IBM logo)" "BROADWAY" "39X6735" "IBM9316" "BWYC-72914" "06340706V 14" "CANADA" (CPU, BGA/unknown 21x21mm)
U3: Samsung K4J52324QC-BC14 "SAMSUNG 631" "K4J52324QC-BC14" "EFEA75DX" (Memory!, BGA/unknown 14x11mm)
U3 (alternate): Quimonda "0638" "A" "HYB18H512321AFL14B" "HVV52176" (Memory chip, likely the same pinout and same/similar specs to the samsung chip)
U4: Sharp PQ070XH02Z "070XH02" "SHARP" "12H U6" (LDO voltage regulator, set at 1.8V - TO-263 package, 5 pins 10x8mm)
U5: "H8DU" (*tiny* 5-pin tsop-6 3x1.5mm)
U6: "AVE-RVL" "BU9055EKV" "629 145" (Audio/Video encoder/DAC tqfp-64 10x10mm)
U6 (alternate): "AVE-RVL A" "C8391" "0635EMM" (same package as previous chip)
U7: Mitsumi "616" "AMPAM" (Audio Amp, tsop-8 5x4mm)
U7 (alternate): No logo, "AMPAM" "6943" (same package as previous chip)
U8: MX "E062674-MG" "MX23L4005-24C1" "RTC-RVL A" "2S08802" (RTC, TSOP28 18x8mm)
U9: "JK0U" (Power-on-reset generator *tiny* 5-pin tsop-6 3x1.5mm)
U10: "JK0U" (Power-on-reset generator *tiny* 5-pin tsop-6 3x1.5mm)
U11:
U12:
U13:
U14: Samsung K9F4G08U0A "SAMSUNG 631" "K9F4G08U0A" "PCG1" "FHFL82GAU" (flash memory, tsop-48 18.5x12mm)
U14 (alternate): Hynix "KOR" KY27UF084G2M" "TPCB 647A" (flash memory, same package/pinout as samsung chip)
U15: Sanyo LV5043 "LV5043" "6SP0" (DC-DC Converter controller, ssop-30 10x5mm)
U16: Sanyo LV5043 "LV5043" "6SP0" (DC-DC Converter controller, ssop-30 10x5mm)
U17: Sanyo LV5043 "LV5043" "6SP0" (DC-DC Converter controller, ssop-30 10x5mm)
U18: "2901" "6M56" (tsop-14 5x4mm)
U19: Sharp PQ033DNA1ZPH "033DNA1" "SHARP" "H U7" (LDO regulator, 3.3V 1A, 4 pins 6x5mm)
U20:
U21:
U22: "H4" (*tiny* 5-pin tsop-6 3x1.5mm)
Ports:
P1 Gamecube memory cards port
P2 Rear fan power connector
P3 Disc slot LED port
P4 Disc drive port (see Wii console Disc Drive page)
P5 AV and "sensor bar" port
P6 Gamecube controller ports (all 4 of 'em)
P7 Battery port
P8 Disc drive port (see Wii console Disc Drive page)
P9 USB ports
P10 SD Card port. Marked "A0635D6"
P11 Power connector
P12 Bluetooth Daughtercard
P13 802.11 Wifi daughtercard
Crystals:
X1 "6373" "T 6276"
X1 (alternate) "27000" "K640Y"
X2 "32.768" "KDS0631" (32768Hz, RTC oscilator)
