Redump Forum

Posted: **Thu Mar 05, 2015 7:24 am**

scsi_wuzzy wrote:It's a strange drive. Here's a brief discussion about it on the dbpoweramp forums, where a user mentions that it supports only 0xD8, and not 0xBE.

Uploaded test exe (with src)
- changed: from READ_CD(0xbe) to READ_D8(0xd8) or READ12(0xa8)
- fixed: buffer overrun

Posted: **Fri Mar 06, 2015 8:30 pm**

sarami wrote:Uploaded test exe (with src)
- changed: from READ_CD(0xbe) to READ_D8(0xd8) or READ12(0xa8)
- fixed: buffer overrun

Thanks for the update. Unfortunately it looks like there are some other obstacles. I had to bypass "ReadDiscInformation" as the Ultraplex doesn't support those commands either.

After doing that, the code crashes after spinning up the drive. I've started looking at the code through the debugger, and it looks like the problem is around lines 234 to 244 of execScsiCmd.cpp:

Code: Select all

                    if (!ScsiPassThroughDirect(pDevice, lpCmd, CDB12GENERIC_LENGTH, lpBuf,
                        CD_RAW_SECTOR_WITH_SUBCODE_SIZE, &byScsiStatus, _T(__FUNCTION__), __LINE__)
                        || byScsiStatus >= SCSISTAT_CHECK_CONDITION) {
                        throw FALSE;
                    }
                    LPBYTE lpBuf2 = lpBuf;
                    BYTE lpSubcode[CD_RAW_READ_SUBCODE_SIZE] = { 0 };
                    if (pDevice->byPlexType) {
                        lpBuf2 = lpBuf + pDisc->MAIN.nCombinedOffset;
                        AlignRowSubcode(lpBuf2 + CD_RAW_SECTOR_SIZE - pDisc->MAIN.nCombinedOffset, lpSubcode);
                    }
                    else {
                        AlignRowSubcode(lpBuf2 + CD_RAW_SECTOR_SIZE, lpSubcode);
                    }
//                    OutputCDMain2352(lpBuf2, nLBA);
//                    OutputCDSub96Align(lpSubcode, nLBA);
                    if (nLBA == aLBA[bySession]) {
                        BYTE byCtl = (BYTE)((lpSubcode[12] >> 4) & 0x0f);
                        byMode = GetMode(lpBuf2, byCtl);
                    }

The call to ScsiPassThroughDirect seems to only read 2448 bytes into lpbuf (if I'm understanding the ioctl call correctly -- DataTransferLength is only 2448. But then lpbuf2 is lpbuf + combined offset, and combined offset on this disc is 9160 bytes. lpbuf2 then goes past the end of the lpbuf array.

I'll continue playing with it to see if I can get anything going.

I think there are some other issues at play, but that's one I thought should be noted.

Posted: **Sat Mar 07, 2015 10:28 am**

scsi_wuzzy wrote:Unfortunately it looks like there are some other obstacles. I had to bypass "ReadDiscInformation" as the Ultraplex doesn't support those commands either.

- fixed: alway return TRUE

scsi_wuzzy wrote:The call to ScsiPassThroughDirect seems to only read 2448 bytes into lpbuf (if I'm understanding the ioctl call correctly -- DataTransferLength is only 2448. But then lpbuf2 is lpbuf + combined offset, and combined offset on this disc is 9160 bytes. lpbuf2 then goes past the end of the lpbuf array.

sorry, fixed. Could you test again.

Posted: **Sun Mar 08, 2015 7:13 pm**

Thanks for the update. Strange problem now, which I've not been able to find the root of.

The full MSF of the full TOC gotten from the Ultraplex seems to be wrong. The LBA addresses seem to match those the PX-716AL gets though.

First, the LBAs from the disc logs (PX-716AL followed by Ultraplex 40):

Code: Select all

      Data Track  1, LBA        0-   19784, Length    19785
      Data Track  2, LBA    19785-   98116, Length    78332
     Audio Track  3, LBA    98117-   99021, Length      905
     Audio Track  4, LBA    99022-   99923, Length      902
     Audio Track  5, LBA    99924-  100771, Length      848
     Audio Track  6, LBA   100772-  101774, Length     1003
     Audio Track  7, LBA   101775-  102984, Length     1210
     Audio Track  8, LBA   102985-  112584, Length     9600
     Audio Track  9, LBA   112585-  122184, Length     9600
     Audio Track 10, LBA   122185-  131784, Length     9600
     Audio Track 11, LBA   131785-  141384, Length     9600
     Audio Track 12, LBA   141385-  150984, Length     9600
     Audio Track 13, LBA   150985-  160584, Length     9600
     Audio Track 14, LBA   160585-  169734, Length     9150
     Audio Track 15, LBA   169735-  172289, Length     2555
     Audio Track 16, LBA   172290-  181545, Length     9256
     Audio Track 17, LBA   181546-  188175, Length     6630
     Audio Track 18, LBA   188176-  194850, Length     6675
     Audio Track 19, LBA   194851-  201526, Length     6676
     Audio Track 20, LBA   201527-  208202, Length     6676
     Audio Track 21, LBA   208203-  233632, Length    25430
                                            Total    233633

Code: Select all

============================ TOC on SCSIOP_READ_TOC ===========================
      Data Track  1, LBA        0-   19784, Length    19785
      Data Track  2, LBA    19785-   98116, Length    78332
     Audio Track  3, LBA    98117-   99021, Length      905
     Audio Track  4, LBA    99022-   99923, Length      902
     Audio Track  5, LBA    99924-  100771, Length      848
     Audio Track  6, LBA   100772-  101774, Length     1003
     Audio Track  7, LBA   101775-  102984, Length     1210
     Audio Track  8, LBA   102985-  112584, Length     9600
     Audio Track  9, LBA   112585-  122184, Length     9600
     Audio Track 10, LBA   122185-  131784, Length     9600
     Audio Track 11, LBA   131785-  141384, Length     9600
     Audio Track 12, LBA   141385-  150984, Length     9600
     Audio Track 13, LBA   150985-  160584, Length     9600
     Audio Track 14, LBA   160585-  169734, Length     9150
     Audio Track 15, LBA   169735-  172289, Length     2555
     Audio Track 16, LBA   172290-  181545, Length     9256
     Audio Track 17, LBA   181546-  188175, Length     6630
     Audio Track 18, LBA   188176-  194850, Length     6675
     Audio Track 19, LBA   194851-  201526, Length     6676
     Audio Track 20, LBA   201527-  208202, Length     6676
     Audio Track 21, LBA   208203-  233632, Length    25430
                                            Total    233633

But, when we look at the MSF addresses, the results from the Ultraplex look way off while the ones from the PX-716AL look reasonable. Pasted below (PX-716AL first).

Code: Select all

========================= FULL TOC on SCSIOP_READ_TOC =========================
    FirstCompleteSession: 1
     LastCompleteSession: 1
    Session 1, FirstTrack  1, Format: CD-DA or CD-ROM
    Session 1,  LastTrack 21
    Session 1,      Leadout, MSF 51:57:08 (LBA[233783, 0x39137])
    Session 1,     Track  1, MSF 00:02:00 (LBA[000150, 0x00096])
    Session 1,     Track  2, MSF 04:25:60 (LBA[019935, 0x04ddf])
    Session 1,     Track  3, MSF 21:50:17 (LBA[098267, 0x17fdb])
    Session 1,     Track  4, MSF 22:02:22 (LBA[099172, 0x18364])
    Session 1,     Track  5, MSF 22:14:24 (LBA[100074, 0x186ea])
    Session 1,     Track  6, MSF 22:25:47 (LBA[100922, 0x18a3a])
    Session 1,     Track  7, MSF 22:39:00 (LBA[101925, 0x18e25])
    Session 1,     Track  8, MSF 22:55:10 (LBA[103135, 0x192df])
    Session 1,     Track  9, MSF 25:03:10 (LBA[112735, 0x1b85f])
    Session 1,     Track 10, MSF 27:11:10 (LBA[122335, 0x1dddf])
    Session 1,     Track 11, MSF 29:19:10 (LBA[131935, 0x2035f])
    Session 1,     Track 12, MSF 31:27:10 (LBA[141535, 0x228df])
    Session 1,     Track 13, MSF 33:35:10 (LBA[151135, 0x24e5f])
    Session 1,     Track 14, MSF 35:43:10 (LBA[160735, 0x273df])
    Session 1,     Track 15, MSF 37:45:10 (LBA[169885, 0x2979d])
    Session 1,     Track 16, MSF 38:19:15 (LBA[172440, 0x2a198])
    Session 1,     Track 17, MSF 40:22:46 (LBA[181696, 0x2c5c0])
    Session 1,     Track 18, MSF 41:51:01 (LBA[188326, 0x2dfa6])
    Session 1,     Track 19, MSF 43:20:01 (LBA[195001, 0x2f9b9])
    Session 1,     Track 20, MSF 44:49:02 (LBA[201677, 0x313cd])
    Session 1,     Track 21, MSF 46:18:03 (LBA[208353, 0x32de1])

Code: Select all

========================= FULL TOC on SCSIOP_READ_TOC =========================
    FirstCompleteSession: 1
     LastCompleteSession: 1
    Session 1, FirstTrack  1, Format: CD-DA or CD-ROM
    Session 1,  LastTrack 33
    Session 1,      Leadout, MSF 81:87:08 (LBA[371033, 0x5a959])
    Session 1,     Track  1, MSF 00:02:00 (LBA[000150, 0x00096])
    Session 1,     Track  2, MSF 04:37:96 (LBA[020871, 0x05187])
    Session 1,     Track  3, MSF 33:80:23 (LBA[154523, 0x25b9b])
    Session 1,     Track  4, MSF 34:02:34 (LBA[153184, 0x25660])
    Session 1,     Track  5, MSF 34:20:36 (LBA[154536, 0x25ba8])
    Session 1,     Track  6, MSF 34:37:71 (LBA[155846, 0x260c6])
    Session 1,     Track  7, MSF 34:57:00 (LBA[157275, 0x2665b])
    Session 1,     Track  8, MSF 34:85:16 (LBA[159391, 0x26e9f])
    Session 1,     Track  9, MSF 37:03:16 (LBA[166741, 0x28b55])
    Session 1,     Track 16, MSF 39:17:16 (LBA[176791, 0x2b297])
    Session 1,     Track 17, MSF 41:25:16 (LBA[186391, 0x2d817])
    Session 1,     Track 18, MSF 49:39:16 (LBA[223441, 0x368d1])
    Session 1,     Track 19, MSF 51:53:16 (LBA[233491, 0x39013])
    Session 1,     Track 20, MSF 53:67:16 (LBA[243541, 0x3b755])
    Session 1,     Track 21, MSF 55:69:16 (LBA[252691, 0x3db13])
    Session 1,     Track 22, MSF 56:25:21 (LBA[253896, 0x3dfc8])
    Session 1,     Track 23, MSF 64:34:70 (LBA[290620, 0x46f3c])
    Session 1,     Track 24, MSF 65:81:01 (LBA[298576, 0x48e50])
    Session 1,     Track 25, MSF 67:32:01 (LBA[303901, 0x4a31d])
    Session 1,     Track 32, MSF 68:73:02 (LBA[311477, 0x4c0b5])
    Session 1,     Track 33, MSF 70:24:03 (LBA[316803, 0x4d583])

The results from the Ultraplex seem to skip some track numbers, and also thinks the disc is 81+ minutes long.

When I look at the TOC with EAC the Ultraplex matches the PX-716AL.

I'm not sure what's going on here.

Posted: **Sun Mar 08, 2015 10:36 pm**

Somehow Ultraplex seems to get the fulltoc data as "hexadecimal"
PX-716AL: LastTrack 21, Ultraplex: LastTrack 33(=0x21)
PX-716AL: Leadout, MSF 51:57:08, Ultraplex: Leadout, MSF 81:87:08(=0x51:0x57:0x08)
:
:
I coded to convert hexadecimal to decimal these value. Could you test again..

Posted: **Mon Mar 09, 2015 6:14 am**

sarami wrote:Somehow Ultraplex seems to get the fulltoc data as "hexadecimal"

Ahh, I should've spotted that. I looked at the bits to see if maybe it was some kinda byteswapping being done, but it didn't occur to me that it might be returning hex. Good catch!

Thanks again. We're close now, I think. The lead-out is read as well as the scrambled sectors.

However, there's a segfault during the WriteCueForFirst() function:

Code: Select all

    if (pDisc->SCSI.pszTitle[0][0] != 0) {
        _TCHAR str[META_CDTEXT_SIZE] = { 0 };
#ifdef UNICODE
        MultiByteToWideChar(CP_ACP, 0, 
            pDisc->SCSI.pszTitle[0], META_CDTEXT_SIZE, str, META_CDTEXT_SIZE);
#else
        strncpy(str, pDisc->SCSI.pszTitle[0], META_CDTEXT_SIZE);
#endif
        _ftprintf(fpCue, _T("TITLE \"%s\"\n"), str);
    }

pDisc->SCSI.pszTitle == 0, because pDevice->bCanCDText == FALSE, so the pszTitle array isn't initialized. Same problem exists with pszPerformer, etc. I bypassed it by checking first if pDisc->SCSI.pszTitle == 0, and similar for other psz* variables. I'm not sure if that's the best solution, though.

One other problem which I haven't looked into yet is, after reading all the scrambled sectors for a PSX disc, an error is presented:

Code: Select all

[L:1542] Internal error. Failed to analyze the subchannel. Track[01]/[63]

The read successfully completed on the one data-only disc I tried (VIS disc, Mode 1), but I noticed the hash is different each time. I noticed the same thing happens with the PX-716AL too. The scrambled files mostly match between the two (I don't know how many bytes differed, but it was a small enough number that I could go through all of them in a hex editor).

Posted: **Mon Mar 09, 2015 2:24 pm**

sarami wrote:Your disc is needed by subdump.exe ripping. Please report to F1ReB4LL.

Yeah, 02:01 confirmed. My disc is a bit scratched - https://www.sendspace.com/file/1nfovg - either the gap misdetected due to that or simply overlooked something. Cue was locked on Jan 09 2012, 02:19, that's before the DIC and only a few weeks after the trurip's leak, most likely used PerfectRip or manual splitting&descrambling.

Posted: **Mon Mar 09, 2015 2:37 pm**

scsi_wuzzy wrote:pDisc->SCSI.pszTitle == 0, because pDevice->bCanCDText == FALSE, so the pszTitle array isn't initialized. Same problem exists with pszPerformer, etc. I bypassed it by checking first if pDisc->SCSI.pszTitle == 0, and similar for other psz* variables. I'm not sure if that's the best solution, though.

Uploaded.

scsi_wuzzy wrote:One other problem which I haven't looked into yet is, after reading all the scrambled sectors for a PSX disc, an error is presented:

Please all log file.

Posted: **Mon Mar 09, 2015 11:55 pm**

Crash seems to be resolved. Thanks.

sarami wrote:Please all log file.

https://www.sendspace.com/file/nqut2q

Disc is Nights into Dreams (US). I can upload logs from the PX-716AL too if you want to compare.

Edit: Went ahead and uploaded the logs from the PX-716AL:
https://www.sendspace.com/file/7kzsm4

Posted: **Tue Mar 10, 2015 12:10 pm**

- fixed: If ModeSense failed, set drive buffer size manually. (Ultraplex is 512)
Could you test again and upload all log of Ultraplex.

Redump Forum

DiscImageCreator

Re: DiscImageCreator

Re: DiscImageCreator

Re: DiscImageCreator

Re: DiscImageCreator

Re: DiscImageCreator

Re: DiscImageCreator

Re: DiscImageCreator

Re: DiscImageCreator

Re: DiscImageCreator

Re: DiscImageCreator