Liteon 5005

Hello LVS!

Is it possible if you please list the steps needed to hack the 1091 version for 3-hour amd MV?

Please list steps in order that will help all of us who are newbees and eliminate further request of the same by others.

Thanks,

I got it to work. I have successfully removed the MV from a US LVW5005 manufactured in Oct 2004 with a starting serial number of 0102 and starting at FW 0091.

Here are the steps. I took the 0091 FW I DL'd from Liteon and did the following steps.


1. find "55 53 00 00 00 00 00 01 00 00 00 00" and replace with "55 53 00 00 00 00 00 01 00 00 00 01" for region 1 fw
2. change the value at 0x47 to old value + 1 ("b0" to "b1" ) for LVW5005
3. change the value at 0xEB to old value + 1 ("0d" to "0e" ) for LVW5005
4. burn to disc just like original FW upgrade and pop in drive.

Worked perfectly and I have confirmed MV is gone.

Now off to get the 3 hour mode.


Ok I tried the 3 hour mode per LVS and I crashed my system. It got to 94% and then said upgrade failed. On power off/on it just askes for CD. I stuck back in the hacked no MV 0091 version and it recovered fine. So I am back running, but no 3hour mode.

Here is what I did.

For 0xA7 I added 4 to 5c to get 60.
For 0xEB I added 4 to 0e to get 12.

Didn't work.

---

Last edited by brianp6621; 06-01-2005 at 11:18.

Did you replace "00 00 00 01 00 00 00 03 00 00 00 1B" with "00 00 00 01 00 00 00 03 00 00 00 1F" as well to enable 3 hour mode? E.g. see http://www.digitalfaq.com/reviews/liteon.htm?

I just bought the LV5005 yesterday (U.S., July Manf. Date), and have upgraded to the "official" 0091 firmware obtained through LiteOn's web-site.

I am interested in getting the 3 hr recording mode, but as far as I can tell, no one has ever successfully done this yet for the post April 5005 models...and I've scoured the web for several hours.

Of everywhere I've looked...this thread looks to show the most promise though.

I haven't done any hex editing in a loooongg time, but I might give it a go here, and try and modify the 0091 firmware based on brianp's and lvs' combined information.

I'll let you know how it pans out...

If you folloow steps from Brianp and lvs you get 3 hr and no macrovision on the 1091 firmware. I just confirmed this on my unit with manuf. date of Oct. 2004.

I can confirm that this is working. In fact, I am copying at 3 hr right now. lvs , you're the man, that x'eb' address was the key to the hack. Thank you very much.

What program do you use to edit the firmware?
And did anyone post the edited version somewhere for ignorant people like me who don't know how to do it by themself?

Thank you

The edited ENU is can be obtained at http://s19.yousendit.com/d.aspx?id=2...D2RVCFJVLRR6N7 Just unzip, burn and run. Make sure you have a good copy of the enu around, just in case!!!!!

wow.

Just upgraded with the 0091 edited version and it now shows the 3 hrs recording mode and in the setup page the serial changed to 013, which I believe is the microvision disabled.
Thank you guys, you are grand.

assume all yuo guys above are in America then, anyone making progress on PAL version?

And has anyone got a clean PAL 091 fware please so I can have a play with the USA edited firmware above. Liteon site wont give me the 091 Pal!

Have you tried to load this version on your machine? You can alter the macrovision hack for PAL. The worst that can happen is you have to reload your last good firmware upgrade.

I have just downloaded a file from the lite-on site (liteonit.com) with this name:
LNFBE091.ESU.0102.124x.rar

This un-rars to produce a file called LNFBE091.ESU

To get this I told them my serial number :
0102-1241-0090-F2SC(201-010B) (bought dec 04)

and that I'm in the UK. Both true, as it happens :-) So I assume this is a PAL version. It's ~1.8MB. If anyone wants a copy then say so, but it's probably as easy to download it yourself.

I'd like the 3hr and macrovision hacks, so I'll try to duplicate some of the (presumably) US hacks if I find some time but that probably won't be soon. If anyone else can, that would be great. Is everyone who has succesfully hacked the 0091 firmware:
a) using US kit ?
b) starting from the file LNFA1091.ESU.0102.184x.rar ?

I've been trying to figure out what the serial numbers and download filenames mean. I assume that the 0090 in my serial number is the firmware rev, and will change to 0091 if I upgrade with the file I downloaded. I can also see 0102 in both numbers, and 1241/124x so I'm speculating wildly that these are indicating hardware versions/compatability issues of different bits inside, either just because it keeps changing or to cope with different national/regional requirements.

From what I've read here the LNF at the start of the name is constant (liteon new firmware?) but the next 2 characters vary in no particularly obvious way.

Does anyone know any more about decoding these numbers?

Cheers,

Ian.

cheers, thats all I need IPL to get a clean PAL version of 091, now I can have a go at hex editing the NTSC version without worries, I will post back when Ive done!

I purchased an lvw-5005 made in October, mainly as a vcr replacement. I found that the timer function worked successfully less than half the time. After the recording was supposed to have been completed I would find that the unit was frozen, usually with a blinking "Stop" showing in the front lcd. It would require a powercycle.

I updated with the latest firmware from Liteon, and found that the problem persisted. I finally took it back to Costco to exchange it for a new one, but they no longer had any in stock. I ended up buying an lvw-5006 from Radio Shack, which now offers a $50 rebate, so the price ended up only marginally more than what I had gotten from Costco.

The lvw-5006 has 3 hour mode as well as vcr+ built in -- although I don't use it because programming all the channel swaps to agree with my local cable is tedious, and it's just as easy to program in the time as it is to set up vcr+. At first, I found that this unit had a problem with the TV tuner. It would only see a block of about 10 channels at a time. Sometimes it would see the block from 2-11, and sometimes the block from 61-70. I was about to take the unit back for good, when I tried installing the latest Liteon firmware (version 1092 I believe, although I can't recall for certain). That seemed to fix the tuner problem, and the unit now seems to work as expected.

The question I have is: will the mv hack for the 5005 work on the 5006? This unit looks physically the same as the 5005, and the only difference would seem to be the firmware -- that the 5006 supports the 3hour mode and has vcr+. I suspect that if I load the 5005 hack, I might lose the vcr+ capabilty, but since I don't use it, I don't really care. Yet trying to change the firmware might also re-introduce the tuner flakiness. I suppose I could always try it and see what happens, and return to the working firmware if I need to.

Anybody have any experience with any of this? Anybody else see the timer record problem with the 5005 or the tv-tuner problem with the 5006?

Thanks!

rad_rat

Doesnt seem any hope of editing UK 091 in same way as same strings do not appear at all ad not even sure Im understanding fully this add 4 or value thingy. Tried to amend where possible the uSA 091 back with PAL values but nothing doing..

For 0xe7 I get a value of 00, follwoing original advice to add 4 to this gives me????

---

Last edited by DrMabuse; 07-01-2005 at 19:39.

04 If you are using windows bring up the calcuator then click view and scientific. Then click hex then you calculate and put the result shown in the hack.

By the way x'e7' was the original 063 hack address. x'E7' is now at x' A7' so use x'A7' location and also x'EB' which was not in the original 063 hack.

Also, as some of us in the US found out, the firmware you download must be for your machine. If you download a different one (even though it is PAL) it may not load on your machine .

Thanks for tips PJ4900, didnt know about the calculator thing. Im going to have a proper bash at this on staurday.

The firmware Ive now got 091 is recognised ok by my 5005b even thought thats already on, so Ive go t a safe version of it stored away and a versionr eady to have a go at hacking.

091 firmware contains a checksum that includes parts of the serial number of the device, that's why different firmware won't load. For example, if your serial number starts with 0102-1840, 0x184 and 0x20 added to the checksum. The same values are indicated in the name of the firmware file, e.g. LNFA1091.ESU.0102.184x.rar. By the way, I suppose the 4-th letter in the file name comes from the device model: LNFA for LVW-5005A and LNFB for LVW-5005B.

hello all, im new to this. but i've been able to edit the pal fw in the same way as suggested by lvs, brianp6621 and pj4900 and it works fine.

what i did was downloaded the latest fw from the liteon site www.liteonit.com/DC/english/download.htm but when i entered my serial no. it said i already had the latest fw, so in my serial i changed xxxx-xxxx-0091-xxxx to xxxx-xxxx-0090-xxxx and this then enabled me to download the latest fw for my machine.

so after reading all the post on this forum this is what i did to edit my fw.
i used UltraEdit-32 and opened the fw.

i then found the string '55 53 00 00 00 00 00 02 00 00 00 00' and changed it to '55 53 00 00 00 00 00 02 00 00 00 01'

then i used the search, find and found the string ' 00 00 00 01 00 00 00 03 00 00 00 1B ' and changed that to ' 00 00 00 01 00 00 00 03 00 00 00 1F '

then i used search, goto line/page and found the hex ' 0x47 ' which was 67 and changed it to 68

then i used search, goto line/page and found the hex ' 0xEB ' which was 89 and changed it to 8E

then i used search, goto line/page and found the hex ' 0xA7 ' which was 7F and changed it to 83

i then saved the fw and burnt it onto a cdrw disc and it worked, 3hr mode and no mv. a big thanks to lvs, brianp6621 and pj4900

Thanks intersys for posting the modified firmware!

(And thanks again to everyone else for working out how to get it done!)

Congrats mw9772 on succesfully getting 3 hours on your pal machine - sounds like a bit of a breakthrough!

Please can you post the file for us? Thanks in advance!

OK, i've got hold of a hex editor, but now I'm not so sure what I'm doing. mw9772 has added:

1 to the value at the end of the first string,
4 to the value at the end of the second string,
1 to the value at 0x47, from 67 to 68
5 to the value at 0xEB, from 89 to 8E
4 to the value at 0xA7. from 7F to 83

Some of the guys above talk about adding 4 to each value.
The following is what I've got - should I add the same values, or add 4?

Firmware - LNFBE076.DSU from file LNFBE076.DSU.0102.024x.rar

55 53 00 00 00 00 00 02 00 00 00 00 - change to ....... 01
00 00 00 01 00 00 00 03 00 00 00 1B - change to ....... 1F

At 0x47, I have the value 64. This should be....... 65 (adding 1)?
At 0xEB, I have the value 6A. This should be....... 6F (adding 5)?
At 0xA7, I have the value 15. This should be....... 19 (adding 4)?

If you can confirm my changes, this should make things easier for everyone with PAL machines to see exactly how much to add to theirs, especially if the theory that you can't load other firmwares onto your own machine is true. Thanks.

The edited pal fw with no mv and 3hr mode can be got at this link http://s13.yousendit.com/d.aspx?id=3...G1QC41KFSJMMCE Just unzip, burn and run. but have a good fw just incase.