An Enhanced Crossflashing Tutorial for Renesas-based LG Drives


#1

An ‘Enhanced Crossflashing’ Tutorial for Renesas-based LG Drives

.
DEFINITIONS

Manufacturers often sell their drives to different OEMs. Different OEM drives often tend to use customised firmware which differentiates them from their retail counterparts. OEM drives often have different model names/codes (drive identifier strings) compared to their retail counterparts and their firmware could contain various limitations and customisations, even though their hardware is identical to that of their retail counterparts. Official flashers released either by the manufacturer or by the various OEMs will not allow crossflashing between various OEM models. For example, a flasher released by LG won’t work with an HP OEM drive, or a flasher released by DELL won’t work on an ACER OEM drive. To perform an OEM crossflash, one would need to use a third party tool, a patched firmware or an unlocked/patched flasher. Needless to say that crossflashing is only possible between models which have identical hardware.

This guide only applies to LG drives which use Renesas chipsets and it should therefore be interpreted in this context. It is NOT for LG drives that use Panasonic or Mediatek chipsets or for any other non LG drives. This guide will only work for LG drives based on Renesas chipsets.

LG drives based on Renesas chipsets have two separate firmware components: the main firmware, which most of the time is all that one needs to perform a crossflash, and a separate core part, which in most cases doesn’t need to be touched at all.

.
STANDARD CROSSFLASH

This is what is regarded as an OEM crossflash, i.e. force flashing a different OEM firmware or a retail firmware on a drive that comes from another OEM. This can be done quite easily by using tools such as ala42’s MCSE to patch the firmware and enable a crossflash, or by using DevilsClaw’s Flasher which can be used to force flash the main firmware to a drive. In such situations, all that one needs to do to perform a successful crossflash, is to flash the drive in question with the desired main firmware sourced from another OEM.

Again, for the avoidance of any doubt, any type of crossflashing operation (being that standard or enhanced) can only ever be performed amongst drives that use identical hardware. Attempting to crossflash drives with incompatible hardware will brick a drive, possibly for good.

A standard crossflash only works as long as the different OEM models involved in the crossflash have the same core identifier string (core code). By in large this is typically the case in most situations. If you are in this situation, then this guide is not for you. All you need to do is to perform a standard crossflash, as described above.

If on the other hand the cores are different, then a standard crossflash is not possible, even if using a third party tool or an unlocked/patched flasher and even if the drives are identical in hardware. Attempting to force flash the main firmware will simply fail. This is because internally, the drive always checks if the OEM code of the firmware is asked to flash itself with, matches its own internal OEM core code, and if there is a mismatch between the two, the drive will refuse to flash itself with a main firmware whose OEM code doesn’t match its own internal core code. In such situations, an enhanced crossflash (aka a ‘core crossflash’) is required.

.
ENHANCED CROSSFLASH

This enhanced crossflash method is only meant for crossflashing between models which have identical hardware but have different cores, for which, as noted before, a standard crossflash is not possible. Let’s call this an enhanced crossflash, or a ‘core crossflash’, to differentiate it from the more straightforward ‘standard’ crossflash. This is what the following guide is all about.

Generally speaking, a different core typically translates into different hardware and an impossible crossflash, but luckily this is not always the case. There are a number of known cases when drive models with identical hardware are known to use different core codes (presumably not least in order to make crossflashing between models more difficult).

Some well known examples are the GSA-T20L and GSA-E50L models which both use identical hardware but different cores, and most notably the 10x and 12x family of LG BluRay writers (BH3x[N/L], [BH/WH][10/12][NS/LS]3x models, where x=0,5,8,9) which all use the same identical hardware, but some of these models use different cores, which of course would preclude a standard crossflash.

If your intention is to crossflash between models that use the same core, then a standard crossflash is sufficient, and this enhanced crossflash method is not necessary. However, if the cores are different, then a standard crossflash is not possible and this enhanced method will need to be used instead. This is because as explained before, these drives always check if the OEM code of the firmware sent to the drive matches their own internal OEM code, and if there is a mismatch between the two core codes, then the drive will refuse to flash itself with a main firmware which doesn’t match its existing core code. If you are in this situation, then read on.

.
DISCLAIMER:

  • Always backup your firmware first.
  • Don’t skip any steps. They are there for a good reason.
  • If you want to crossflash your drive, you do so at your own risk!
  • If you’re not sure of what you’re doing, then it is probably wiser not do it at all.
  • Crossflashing is always only possible between models which have identical hardware.
  • As an example, this tutorial explains step by step how to perform an enhanced crossflash in order to crossflash a GSA-T20L drive into a GSA-E50L model.
  • This tutorial can be adapted to work for other LG drives that use a Renesas chipset (as long as the models in question use identical hardware of course). Just read the explanations provided as part of STEP A3 and make sure that the necessary editing of the core code is performed correctly.
  • This tutorial does not apply to non-LG drives or to LG drives based on Panasonic or Mediatek chipsets.It is solely for LG drives that use a Renesas chipset.

.
Here is a step by step guide to crossflash your GSA-T20L drive and turn it into a GSA-E50L model:

.
PREPARATION STAGES

Let’s prepare an enhanced crossflash-ready firmware first. Follow these steps:

.
STEP A1. Download the latest Windows version of devilsclaw’s Renesas flasher from https://github.com/devilsclaw/flasher/releases/tag/Current_Release and extract it in a folder such as ‘C:\Flasher’.

Open a Command Prompt window and change the current directory to ‘C:\Flasher’. In Windows 7 and above you might need to open a Command Prompt with Admin privileges (Run as Administrator).

.
STEP A2. Download the GSA-E50L NE02 firmware from LG (or other reputable source such as MyCE or FirmwareHQ). Save the *.exe file in the ‘C:\Flasher’ directory that you have created before, and rename it as ‘GSA-E50L_NE02.exe’.

Extract the main and core firmware from the GSA-E50L_NE02.exe flasher, by running the following ‘rip’ command:

flasher -r GSA-E50L_NE02.exe

Rename the two resulting files as ‘E50L_main_fw.bin’ and ‘E50L_core_fw.bin’ respectively.

.
STEP A3. Use a hex editor to modify the ‘E50L_main_fw.bin’ as indicated below.

The original GSA-E50L NE02 main firmware should look like this:

Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

00000000   D3 33 00 00 00 00 00 00  00 00 00 00 00 00 00 00   Ó3..............
00000010   47 53 41 2D 45 35 30 4C  4D 41 49 4E 20 20 20 20   GSA-E50LMAIN   
00000020   52 45 56 20 4C 56 4C 20  4E 45 30 32 00 00 00 00   REV LVL NE02....
00000030   52 4F 4D 20 52 45 56 20  00 00 00 00 00 00 00 00   ROM REV ........
00000040   00 41 00 00 00 1A 00 00  00 00 00 00 00 00 00 00   .A..............

Change the ‘GSA-E50L’ string to ‘GSA-T20L’ so that the edited firmware looks like this:

Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

00000000   D3 33 00 00 00 00 00 00  00 00 00 00 00 00 00 00   Ó3..............
00000010   47 53 41 2D 45 35 30 4C  4D 41 49 4E 20 20 20 20   GSA-T20LMAIN   
00000020   52 45 56 20 4C 56 4C 20  4E 45 30 32 00 00 00 00   REV LVL NE02....
00000030   52 4F 4D 20 52 45 56 20  00 00 00 00 00 00 00 00   ROM REV ........
00000040   00 41 00 00 00 1A 00 00  00 00 00 00 00 00 00 00   .A..............

Save the modified firmware as ‘E50L_main_crossflash.bin’.
.
[DETAILED EXPLANATIONS]

What we have done here is to change the core code of the firmware we want to crossflash the drive with (the GSA-E50L firmware) to match the current core code of our drive that we want to crossflash (which is a GSA-T20L drive). This will trick our GSA-T20L drive into believing that the GSA-E50L firmware has the same core code as itself, so that the drive accepts to flash itself with the GSA-E50L firmware. Remember that we want to crossflash an existing GSA-T20L drive and turn it into a GSA-E50L model instead (of course this is only possible because both drives use the same hardware). Note that our GSA-T20L drive, like all GSA-T20L drives, has a ‘GSA-T20L’ core code. GSA-E50L drives on the other hand, have a different ‘GSA-E50L’ core code, so a standard crossflash is impossible. To make the crossflash possible, we have to edit the main firmware that we want to crossflash our drive with (i.e. the GSA-E50L firmware) by replacing its existing ‘GSA-E50L’ core string with a ‘GSA-T20L’ string that matches the existing core code of the GSA-T20L drive that we are trying to crossflash.

Making such edits to a firmware will result into a checksum mismatch (corrupt firmware) and as a result the drive will refuse to allow the flash to go through. In order to correct the checksum and obtain a crossflash-ready firmware file that can be successfully used for crossflashing, we need to carry out STEP A4.

.
STEP A4. Fix the checksum of the modified file, by running the following command:

flasher --checksum E50L_main_crossflash.bin

Once this command has completed, the ‘E50L_main_crossflash.bin’ file should now look like this:

Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

00000000   C4 36 00 00 00 00 00 00  00 00 00 00 00 00 00 00   Ä6..............
00000010   47 53 41 2D 54 32 30 4C  4D 41 49 4E 20 20 20 20   GSA-T20LMAIN   
00000020   52 45 56 20 4C 56 4C 20  4E 45 30 32 00 00 00 00   REV LVL NE02....
00000030   52 4F 4D 20 52 45 56 20  00 00 00 00 00 00 00 00   ROM REV ........
00000040   00 41 00 00 00 1A 00 00  00 00 00 00 00 00 00 00   .A..............

The first two bytes (which are the checksum) have now been recalculated and fixed to match the changes that we made during the previous step, and you can now use this crossflash-ready firmware file to crossflash your GSA-T20L drive and turn it into a GSA-E50L model.

Preparation done! Now you have a crossflash-ready firmware, waiting to be flashed to your drive.

.
BACKUP YOUR DRIVE’S CURRENT FIRMWARE

You should always backup (dump) your existing firmware first, so that you can undo any changes later should something go wrong or if you change your mind later and want to crossflash back. Let’s start the firmware backup process then!

.
STEP B1. Find out the drive ID number of your drive. Run the following command (please note that that flasher switches are case sensitive, so use these commands exactly as written):

flasher -D

You’ll get an output like this:

Devilsclaw's LG Renesas Drive Utility
drive_inquiry: failed to inquiry drive info

AVAILABLE DRIVES AND IDs:
Drive ID: 1 Name: DVDRAM GSA-T20L

In this example the drive ID is 1 because this is the only drive connected to this computer. If in your case the reported drive ID is a number different than 1, just replace the 1 in all the commands below with the actual drive ID number reported for your drive after running the above command. Now that you know what your drive ID is, you are ready to backup the firmware of your drive.

.
STEP B2. Dump the main firmware of your drive by running the following command:

flasher -d 1 -m T20L_main_fw.bin

.
STEP B3. Dump the core firmware of your drive by running the following command:

flasher -d 1 -c T20L_core_fw.bin

If you’ve done everything correctly, you should now have a full firmware backup. Keep it safe!

.
CROSSFLASH YOUR DRIVE

Now that we have the crossflash- ready firmware and a firmware backup, we can finally start crossflashing our drive.

.
STEP C1. Flash the crossflash-ready firmware produced after completing STEP A4 by running the following command:

flasher -d 1 -f E50L_main_crossflash.bin

.
STEP C2. Wait until the flasher finishes and then perform a full shut down of your computer. LG drives need a power cycle to complete a flash operation (on some computers a normal restart is not enough, because the motherboard doesn’t cut the power to the optical drives, so just to be safe please do a complete shut down, not just a normal restart/reboot of your machine).

.
STEP C3. Flash the original GSA-E50L core firmware extracted at STEP A2 (‘E50L_core_firmware.bin’) to make sure that your crossflashed drive has a genuine E50L core, without any GSA-T20L references left behind.

To flash the core, run the following command:

flasher -d 1 -f E50L_core_fw.bin

Flashing the core will remove even the last traces of the fact that this drive used to be a GSA-T20L.

.
STEP C4. When the flasher finishes, shut down your computer once more.

.
CONGRATULATIONS! You’ve now got a 100% genuine GSA-E50L drive!

.
From this point onwards you’ll obviously need to use GSA-E50L firmwares for this drive, since the old GSA-T20L firmwares will no longer work. Once the crossflash has successfully completed, there’s no need to touch the core part ever again.

.
MCSE PATCHING [OPTIONAL STEP]

The examples provided above are all for ‘stock’ firmware. If you want to apply any MCSE patches before flashing your drive, there’s nothing to stop someone using MCSE to patch the original firmware as desired. This can be done either by loading and patching the official *.exe flasher before extracting the two firmware parts from it as part of STEP A2, of it can be done later, after obtaining the crossflash ready main firmware once STEP A4 has been completed, by loading the crossflash-ready main firmware *.bin file to MCSE and patching it as desired before proceeding to STEP C1.

If later down the line you want to do any additional MCSE patches, all one needs to do is to download the official GSA-E50L *.exe firmware (or the main *.bin firmware part only), patch it with MCSE and flash it to the drive the normal way. Note that as far as patching is concerned, you only need to patch and flash the main firmware. The core has nothing to do with patching, so leave it alone.

.
Happy crossflashing and may the Force be with you!


BH10LS30 crossflash problem
LG BH16NS50/BH16NS55, 2nd gen BH14/WH14/BH16/WH16NS40 (SVC. Code NS50, 2015+)
BH10LS30 crossflash problem
#2

Thank you so much!
But I have some problem

-r can not be used, May I ask where is wrong


#3

Please follow the instructions provided properly:

Your current directory is ‘C:\Users\Administrator’ not ‘C:\Flasher’.

Also please use the proper command line format for flasher: flasher -r name_of_the_fw.exe. Don’t use paths in the command line.

I noticed that you’re using a GSA-T50N firmware as the end result of the crossflash. What current drive model are you trying to crossflash to a GSA-T50N firmware? What are you trying to achieve? Also, I say it one more time just to be clear, you can only crossflash two drives if they have identical hardware, so for this to work, in your case you must make sure that your current drive model uses exactly the same hardware as a GSA-T50N drive, otherwise you’ll brick your drive.


#4

You are right, thank you!
and Thanks for your reminder, I’m just trying to use this method because my job will need,


#5

This time I operate on DU20N, I want to change into GU10N,The hardware is exactly the same。Follow your steps exactly,

This is the original content


I changed,

Change to exactly the same
34

Still fail。Bother you again

this GU10N_main_crossflash.bin after checksume content


#6

Are you absolutely sure of that? DU20N is a DVD-ROM drive while the GU10N is a DVR-RW drive!


#7

I know ,and I did it, because customer is God, so I have to. anyway, thank you