ILO / LiteOn SMART Firmware Hacker

vbimport

#1

Go to my ILO Firmware page. Near the top is a link to a program that will hack most LiteOn/ILO recorders to make them Region Free, Macrovision Free and enable 3-Hour LP mode. It has been tested on some but not all, but it is based on the hex locations for these hacks that have stayed consistant throughout all firmware versions and recorders so it should work on any unmodified firmware file.


#2

I’m not saying this doesn’t work but for my 0098 5005A FW it has 5 differences from my confirmed hacked FW (not hacked for region free)

So unless all 5 of those differences are for the region free, something is different.

Also I thought the HEX locations HAD changed which is why it took a while to crack 0091 FW?


#3

The ILO/LiteOn Smart Firmware Hacker has been updated for better support for LiteOn recorders. Go to my ILO Firmware Download Page to get it. Here is a rev list for the program:

Version History:

1.3b - Fixed an issue where some LiteOn firmware checksums were not correct.
1.3 - Added LP Mode hack for more LiteOn Firmwares (XXXX1098 included)
1.2b - Fixed bug that would add LP mode hack to firmwares that did not need it.
1.2 - Added ability to hack DVDRHD04 to enable LP Mode (3HR mode)
1.1 - Added ability to hack all regions of firmware & liteon firmware
1.0 - Initial Release


#4

The original LiteOn hacks were using a checksum balancing method of hacking. This worked great for recorders where the checksum bits were known. Like you say, newer firmware codes changed these locations and made it hard to hack the newer firmware, but they were figued out.

The Smart Updater uses a bit balancing method that allows the hacks without needing the checksum location. This came from the need to hack the ILO recorders, since the checksums were not known.

For Macrovision and 3-hour mode, the same code strings as the LiteOns were present in the firmware but the checksums to balance the hacks were not known. So to make it work this is what was done:

Macrovision: The code string for the Macrvision hack also included the bit for the region code. To make it work, the Macrovision bit was changed +1 and the region bit was changed -1 to balance it. So basically, in one shot, this disabled Macrovision AND made the recorder region free, assuming it was a region 1 recorder. For anyone with a recorder other than region 1, you just use the 2960 remote hack to change the recorder back to the region you needed.

3-Hour LP Mode: To offset the +4 change needed in the 3-hour mode hack, there was a filler bit in the same area as the 3-hour code string that was changed -4 to balance the change.

As you can see, this method of hack makes it applyable to most any LiteOn/ILO firmware since the checksums are not needed.

There have been some exceptions and the Smart Updater is being changed as they come to light.

Thanks goes to Mr. Wizard at the Techolio forums for the program!!!


#5

Well All I Can Say Is,it Worked For My Machine! Guitarman Is God (well Almost) I’ve Been Scouring These Forums,been Flummoxed By All The Tech.hex Talk And There It Is, A Simple To Use Program That Even I Could Use! Just Follow The Instructions Carefully. The Program Is Very Easy to use,does All The Work For You. 3 Hour And Region Free Is There Now,dont Know About Macrovision,not Tried It Yet.
Now I’m Not Gonna Say It’ll Work For Everybody, But It Worked On The Latest Firmware For Me. See Guitarmans Posting On This Thread.
I’m In The U.k…,lvw5005…s/n 0102 3243 0098 G2bd
Firmware (latest) Lnfbe098 Es3

As Far As I Can See There Is No Noticeable Loss In Quality On 3 Hr(although I Suppose There Must Be) It Gives You Another Useful Option When Working Out Recording Times To Fit On A Disc. Why Liteon Cant Just Include It On The Firmware I Dont Know. 6hrs.is A Waste Of Time.
Thanks To Guitarman/wizard.


#6

ilo hacker program stated :
Found Macrovision Hex String at 0x000A12C6.
Found Macrovision v098 Checksum at 0x00000047.
Found LP v098 Hex String at 0x001D9B9C.
Found LP v098 Checksum at 0x000000A7.
Found MainChecksum at 0x000000EB.
Added LP Record Ability.
Removed Macrovision.
Added Region Free.
However changed nothing at location 0x47 where it states it found the check some.
It added some other stuff to but I need a better hex file comparer for 32bit window then uedit? Any Sugestions?


#7

Wont change anything at0x47 as this is the Checksum for region free and
disable Macrovision you are adding 1 to disable macrovision and taking 1 off
to make region free therefore the outcome is the same value.
0xA7is the checksum to add 3hr mode which adds 4
if no 3hr mode ALREADY
0xEB is the main checksum which also should increase by four.
There is a trial ware Cygnus Hex editor I found easier to use than Ultraedit


#8

Another happy ILO Hacker customer here. Just used Guitarman’s sweet little program to hack my LNFA1098.ES3 FW, burned it to a CD-RW with Nero and 2 mins later I have 3 hour mode, as well as MV off, and region free enabled on my US 5005. Many thanks to Guitarman and everyone who helped make these hacks work. Much appreciated. Now I’m off to start archiving movies off my DTivo using 3 hour mode…

  • Chris

#9

Mr. Wizard is really the one to thank for the Smart Firmware Hacker program. I just make it easily available!!

I’m glad everyone is enjoying the hacked firmware. It’s always cool to get more out of your recorder than was intended!!


#10

hello

I can confirm the 3h mode and region free work too with LNFB2098.ES3 ,I don’t try mv.

tibill


#11

If you havent got Nero, Roxio (easy c.d.creator) works o.k. Burn it as a data
disc.


#12

I used RecordNow and it worked great! Just make sure you use disc-at-once and close the session (no open session).


#13

I have already updated my 5005A to the latest version of firmware and drive update and am now at 0102-1840-0098-g2bd. How can I apply the macrovision hack?
Thanks


#14

with mine,(sept.04 lvw 5005 uk ) i can just apply the ilohacked disc over the downloaded unhacked firmware already in the machine and can change back as many times as I want. :)As long as it’s the same version.


#15

robbie - Thanks for the reply ! I have the lvw 5005a sept 04 US and ilohacker v1.4 and the 1098 firmware I downloaded from liteon. I’ll give it a try.


#16

Does anybody still have any of the following problems after their recent upgrade-- still:

  1. The poor contrast problem(the snow)- i.e. like when its turned all all the way down on the tv.
  2. jerkyness or jitter i.e. picture jumping –slow down
  3. picture freezing up even while only watching the tv tuner “no recording”
  4. blocky blur
  5. picture freezing up during play back –seems like its not playing directly off the disc—like its loading the material into some temp memory i.e picture freezing and the drive trys to load the temp memory and then play continues.
  6. the green tint problem
  7. when recording a disc –if I let it record on it’s own for the full 2 hours formatted for –it won’t let me finalize the disc.
  8. won’t let me format dvd-rw unless the region of the recorder is what it is supposed to be originally.

#17

I definitely still have the green tint issue on my US 5005 with 1098 FW hacked with Ilo-hacker. Very annoying…

  • Chris

#18

robbie, no joy, :-(. I ran ilo on the 1098 firmware from liteon and it said it was successful. I burned the file as a non multisession data cd with nero . I put it in my 5005. No update screen option. Maybe the US 5005’s only allow firmware updates? Any else have a suggestion?


#19

The ILO v1.4 (didn’t try others) worked for my firmware, LNFA1091.ESU.0102.184x, on my LiteOn LVM-5005 bought at Costco last fall (Oct 2004). Confirmed 3-hr mode and MV off. I used a CD-RW to burn the modified file, closed/finalized the session (but not disc), CD-ROM ISO9660 format using Roxio EZCD6 Platinum.

Thanks, Guitarman1!

WormGuy


#20

Wormguy, was your 5005 alrady updated to the latest firmware and system update? The updates I d/l’d were LNFA1098.ESU.0102.184x.zip and LNFA1000.E20.0102.184x.zip. They were burned to cd with nero the same way and were successful in updating my US 5005A Sept '04 back in Jan '05 from 0102-1840-0090-g2b9 to where it is now 0102-1840-0098-g2bd.