Reverse Engineering CD-ROM Firmware

Question

I am trying to write a program for a Mediatek based CD-ROM to write information to CDs in a different manner. I want to be able to control the laser with, or without a CD within. So my question is, what is the best approach to getting the firmware to rewrite the instruction set accepted from the computer. I am assuming that the architecture is ARM, but do you think that it is best to download the firmware from the company's website, then put it in a disassembler and try things, or is there a better or different approach? My last resort is to create a new control board, in which can control the electronics.

Thanks,

Simon

Answer 1

Coastermelt project: open source firmware for creatively repurposing BD-R drives from Micah Scott aka @scanlime.

It contains 2 very interesting videos:

• https://vimeo.com/110257380
• https://vimeo.com/111417458

Github code: https://github.com/scanlime/coastermelt/

Answer 2

The solution you refer to as a “last resort” is not that difficult. If you don't need to control the position of the laser precisely, there are a few things that need control:

1. Brushless motor to spin the disk
2. Stepper motor to move the laser
3. Laser diode to actually burn something

You may even do it without much soldering with a board like Arduino.

If you do need to save most of the CD-ROM functionality, you will need to RE the firmware. The problem is that while the core of the microprocessor is ARM, it also contains a lot of peripheral modules which you don't have any documentation for. You may be able to deduce some of the hardware registers, but this task is not easy overall. It would be useful to have a JTAG adapter hooked up to the board in order to control the program execution.

Answer 3

Usually is ARM MCU (two different possible opcodes, can be Thumb). The information you want is usually not that public. Mediatek seems to be using some ARM core in their chips https://en.wikipedia.org/wiki/List_of_devices_using_Mediatek_SoCs. You have to explore. Maybe this work helps https://media.blackhat.com/us-13/US-13-Zaddach-Workshop-on-Embedded-Devices-Security-and-Firmware-Reverse-Engineering-Slides.pdf