Erant's Serial DVD Tool Update for Wii

[Zeus]

Erant has released a new build of his serial DVD drive tool for Wii. Currently it will 'regionfree' the Wii as well as boot any media of your choice!

Official readme file

With my project currently being not-so devved on, I've decided to release my most recent work. In it's current state, it will regionfree the Wii, and boot any media of your choice. You might recognize some of the methods from OpenWii (or will, when they finally release the source), that's because I've given them the methods for all-media-booting and regionfree. I'm not releasing this for warez or any kind of illegal practices. I'm mainly releasing this for the potential in the way I've implemented regionfree. Used like this, it can be used to patch any sector to anything you like, making (very slow) streaming from the PC to the Wii DVD drive possible. The source is a complete mess, but I don't see me working on it in the near future, so I'll release it for now, in the hope that someone will fix it up again. I've never merged my sources with groepaz' (thanks!), so maybe someone can do that for me.

(Usage:
./dvdtool -w 0x40C068 dms.bin
./dvdtool -i code.bin

Currently hardwired for a PAL DMS/D2A console, but like I said, this isn't the point, so kindly not use it as such. ta!

[dipswitch]

I'm a little confused on what this is/does. Is it basically something like WABmodcheap or the Syndicate DVD loader?

[gonepostl]

I'm a little confused on what this is/does. Is it basically something like WABmodcheap or the Syndicate DVD loader?

Wondering the same:confused:

[chris_seaviewfc]

I'm a little confused on what this is/does. Is it basically something like WABmodcheap or the Syndicate DVD loader?

this was the first WII --> PC tool.

[dNa1]

i don´t think so. I think it is a loader to load ntsc games on the wii without a modchip.

[KingCane]

Yea can anyone shed some light on what this thing does? I doubt it's a softmod but wish it was!

[WEBLY]

FOUND THISON GOLE
PLASE DONT DELETE ME IF ITS WRONG
CHEERS
I AINTGOT A CLUE ABOUT THE BELOW HOPE SOOME ONE DOES THO

Amazing tool which communicates with the Wii DVD drive serial interface and allows you to read/write from the Wii's DVD drive RAM. C source code for linux and windows along with a binary compiled for windows. (keyword: Erant's dvdtool)

Usage of the program:

The DVD Tool usage is fairly simple, to read from memory, type
./dvdtool -s -r
So, if you wanted to read 0x40 bytes from 0x8000 (main memory start), you'd type
./dvdtool -s 0x40 -r 0x8000
The file argument is an optional argument for reading, if no valid file is specified,
the output is a formatted output to stdout. The -s argument is also an optional argument,
not specifying it will assume a default of 0x20 bytes.

To write to memory, you'd use a similar syntax

./dvdtool -s -w

The only difference is the last argument, it can take a file or a formatted array.
In either case, the -s option is again optional, not specifying it will assume
the size of the array, or the size of the file.
An example to write an array to 0x8100:

./dvdtool -w 0x8100 "0xFF,0x0,0xFF,0x0" will write {0xFF,0x0,0xFF,0x0} to 0x8100.

The insert code command is slightly more complicated, you need a compiled and assembled
binary to insert. Code execution starts at 0x408000, which is in extra RAM. Code size limit
is estimated at roughly 8kb, so enough for pretty much anything. You need to pre-pend your code
with a NOP instruction, and append it with an 'RTS' instruction, to resume normal code execution.

An example of some code you could assemble and insert:

NOP
MOV 0xFF, D0
MOV 0x8000, A0
MOV D0, (A0)
RTS

This will write the value 0xFF to 0x8000. You can again check proper execution by performing a read operation.If the application returns a 'write error' after code injection, your code has crashed the interrupt thread of the DVD drive, and it'll need either a power cycle or reboot. Syntax of the code inject is easy enough,

./dvdtool -i code.bin

(A sample, compiled program called code.bin is included, it's source is also included. Run it, and check for 0xEA, 0xEA at 0x8001 for correct functioning).

Making the datacable

In order to make the datacable, you need only a few basic items. A DB-25 connector, two diodes, and some cable. Connect the diodes in reverse (so, PC ---|<--- Wii) to the DB-25 connector, to pins 1 and 14. Just connect some wires to pins 18 and 11, these will be the GND and output wires. The other two dioded wires are clock and input. Now, open your Wii, remove the DVD drive, and turn it over. Look for the following pattern near IC3001:
- 1 -
2 3 4
- 5 6

3 is SBO1 (Output)
4 is SBT1 (CLK)
6 is SBI1 (Input)

With the numbers being pads, and - being nothing. Now, solder the wire from pin 1 to pad 4 (CLK line). Pin 14 goes to pad 6, and pin 11 goes to pad 3. Just find a suitable place to attach the wire from pin 18, which is GND. (Placing the board so you can read the writing on IC3001, look at connector P3001, the rightmost pad is GND and the third from the right is GND). Check your solder connections with a multimeter, then close up your Wii, and issue the ./dvdtool -r 0x8000 command in root mode. If you see hexadecimal numbers, congratulations! If you don't, check the proper functioning of your cable, wether or not you're in root mode, and if the parport0 and ppdev drivers are properly installed.

dvdtool.conf

Contains only two things, the second line is the command write delay, the delay after a command is written, and should probably be left alone. The first is the bit read/write delay, the delay done after a bit is written or read. In standby mode (orange led), this is pretty safe at 50, but for ON mode (green led), should be set to 100 or higher, to avoid sync errors.

Debugging

If you're getting out of sync errors every now and again, make sure your Wii is in stand by mode (orange LED, higher transfer rates), or adjust the timing settings in dvdtool.conf, or try adding a 47pF capacitor to GND to your clock line. (At the Wii side). The code is also still fairly crude, so if you encounter any bugs, please give them to me.


Wii Disc Drive:

Chips:

IC1001 "[M]" "AN22023" "619P7002" (tqfp-48)
IC1002 "[M]" "41224" "616C5279" (probably a power switching / motor controller chip. - tqfp-65)
IC2001 "GC2-D1" "616P7300" (tqfp-144)
IC2003 "(underlined L) X9" "TDA" (6-pin package)
IC3001 Panasonic "Panasonic" "GC2R-D2A" "610U6MF7" (tqfp-100)

Ports:

P1001 Connects to laser/focus/read assembly
P1003 Connects to laser assembly movement motor
P1004 Connects to optical Disc detection subboard on "bottom" side
P2001 Connects to Wii motherboard Port P4 (via 32 pin flat cable)
P3001 Connects to Wii motherboard Port P8 (via 12-pin wire bundle cable)


Wii Mainboard Chips:

Chip listing:

U1: "(E)" "HOLLYWOOD" "(C)(M)'06Nintendo" "(ATI logo)" "(BroadOn logo)" "(NEC logo) JAPAN" "C10046F5-211-PN2-A" "0633KK01X" (video/IO chip, BGA/unknown 31x31mm)
U2: "(IBM logo)" "BROADWAY" "39X6735" "IBM9316" "BWYC-72914" "06340706V 14" "CANADA" (CPU, BGA/unknown 21x21mm)
U3: Samsung K4J52324QC-BC14 "SAMSUNG 631" "K4J52324QC-BC14" "EFEA75DX" (Memory!, BGA/unknown 14x11mm)
U3 (alternate): Quimonda "0638" "A" "HYB18H512321AFL14B" "HVV52176" (Memory chip, likely the same pinout and same/similar specs to the samsung chip)
U4: Sharp PQ070XH02Z "070XH02" "SHARP" "12H U6" (LDO voltage regulator, set at 1.8V - TO-263 package, 5 pins 10x8mm)
U5: "H8DU" (*tiny* 5-pin tsop-6 3x1.5mm)
U6: "AVE-RVL" "BU9055EKV" "629 145" (Audio/Video encoder/DAC tqfp-64 10x10mm)
U6 (alternate): "AVE-RVL A" "C8391" "0635EMM" (same package as previous chip)
U7: Mitsumi "616" "AMPAM" (Audio Amp, tsop-8 5x4mm)
U7 (alternate): No logo, "AMPAM" "6943" (same package as previous chip)
U8: MX "E062674-MG" "MX23L4005-24C1" "RTC-RVL A" "2S08802" (RTC, TSOP28 18x8mm)
U9: "JK0U" (Power-on-reset generator *tiny* 5-pin tsop-6 3x1.5mm)
U10: "JK0U" (Power-on-reset generator *tiny* 5-pin tsop-6 3x1.5mm)
U11:
U12:
U13:
U14: Samsung K9F4G08U0A "SAMSUNG 631" "K9F4G08U0A" "PCG1" "FHFL82GAU" (flash memory, tsop-48 18.5x12mm)
U14 (alternate): Hynix "KOR" KY27UF084G2M" "TPCB 647A" (flash memory, same package/pinout as samsung chip)
U15: Sanyo LV5043 "LV5043" "6SP0" (DC-DC Converter controller, ssop-30 10x5mm)
U16: Sanyo LV5043 "LV5043" "6SP0" (DC-DC Converter controller, ssop-30 10x5mm)
U17: Sanyo LV5043 "LV5043" "6SP0" (DC-DC Converter controller, ssop-30 10x5mm)
U18: "2901" "6M56" (tsop-14 5x4mm)
U19: Sharp PQ033DNA1ZPH "033DNA1" "SHARP" "H U7" (LDO regulator, 3.3V 1A, 4 pins 6x5mm)
U20:
U21:
U22: "H4" (*tiny* 5-pin tsop-6 3x1.5mm)

Ports:

P1 Gamecube memory cards port
P2 Rear fan power connector
P3 Disc slot LED port
P4 Disc drive port (see Wii console Disc Drive page)
P5 AV and "sensor bar" port
P6 Gamecube controller ports (all 4 of 'em)
P7 Battery port
P8 Disc drive port (see Wii console Disc Drive page)
P9 USB ports
P10 SD Card port. Marked "A0635D6"
P11 Power connector
P12 Bluetooth Daughtercard
P13 802.11 Wifi daughtercard

Crystals:

X1 "6373" "T 6276"
X1 (alternate) "27000" "K640Y"
X2 "32.768" "KDS0631" (32768Hz, RTC oscilator)