CD/DVD reverse engineering to have full low level control

[ricko_uk]

Hi,
I would like to fully control a CD or DVD so I can record data while having full control of the motor and laser. To be more precise I want to be able to encode the 0s and 1s so that their burned "length" on the disk is fully controllable.

Has anybody done that? Any guidelines or reference projects or references would be much appreciated.

Are there any CD/DVD units that are easier to reverse engineer and control for such applications?

I guess the first thoughts that come to mind are:
1) what motors they use (steppers or other)?
2) I assume they use some feedback mechanism to know at which angle at any given point the disk is and that the current speed is constant?
3) how to modulate the laser (maybe this it just an easy on/off)?

Thank you

[NiHaoMike]

https://github.com/scanlime/coastermelt

[amyk]

They use brushless DC motors for the spindle and a brushed motor (with a significant reduction) for the head. Tracking is done via embedded servo and an astigmatic lens.

Get a copy of ECMA-394 (CD-R) and/or 359 (DVD-R), and be prepared to do some very, very deep reading...

[DiTBho]

two years ago i wanted to hack a PDA and a GPS, and only because they use a CPU you couldn't find in other products.

I did it, and it took over two years of time just to completely reverse engineer it in a way i can the full control.

It sound cool, hacking stuff is always cool, why would you pragmatically want to control a dvd-burner at the bit level?

[NiHaoMike]

They use brushless DC motors for the spindle and a brushed motor (with a significant reduction) for the head.

The brushed motor for the tracking hasn't been used in a long time, most newer ones use stepper motors.

It sound cool, hacking stuff is always cool, why would you pragmatically want to control a dvd-burner at the bit level?

My guess is either to defeat (or create) the copy protection of some nonstandard disk like the ones used in some game consoles or for artistic purposes.

[DiTBho]

My guess is either to defeat (or create) the copy protection of some nonstandard disk like the ones used in some game consoles or for artistic purposes.

Like the one used in Sony Playstation1 CD. I guess.

A customer did something similar with a Plextor SCSI CDRW years ago. There are a few Plextor models that allow the final user to take the full control over the stream, and my customer he wrote a special program that burns special CDs with extra bits used as copy protections. But that means "normal" CD-readers won't read extra bits because seen as "errors" while there are not.

This is the kind of weak protection he though about. Sony Playstation1 CDs can be copied and played with mod-chipped consoles.

So, weak protections, but it somehow makes sense

[ricko_uk]

Thank you all!

Interesting infos and feedback. I was hoping in something much faster and simpler to implement. i.e. direct motor control (spindle and radial movement) and laser control.

But it sounds it might not be that easy to do.

Thank you for the feedback though!

[excitedbox]

You only need to disassemble the driver and reprogram it to work the way you want. Or write your own driver. I doubt that it is actually controlled by the onboard firmware. If it was you could try using jtag to read out the memory. In either case older hardware is better because there will be less integration. In some of my research I have seen Drive test software that controlled the drive directly.

Most of the OPU manufacturers have been bought up by LG, SONY, and Philips but there is Datasheets available for many of the SD models such as the SD65 SD62 etc. There are also datasheets for some of the first and second generation PS3 and at least 1 Xbox HDDVD+BluRay drive that uses 2 lasers.

Most of the connections are fairly standard and there is a datasheet of a Philips CD player that lists the laser pin outs for almost all models. There is only like 5 or 6 combinations that are used by everyone and you will find them in this datasheet/repair manual.

I will have a quick look in a minute to see if I can find it.

The laser control is pretty simple using a set of op amps and a photodiode with several quadrants to measure brightness and then check if (A+B)-(C+D) =0 or something like that to know if the laser is in focus. I forget the exact equations right now. You are basically checking if each quadrant is receiving the same intensity light and recording that bit. There are special driver chips for this that handle the focus and tracking but they are really cheap. I have some laying around here somewhere.

[m k]

This is the kind of weak protection he though about. Sony Playstation1 CDs can be copied and played with mod-chipped consoles.

So, weak protections, but it somehow makes sense

At least one(black disk) Playstation model had coded track alignment signals.

A recollection says that it was few ASCII characters, "Playstation" feels a bit long, and something RS-232 related, could be also just NRZ bits.

[amyk]

Thank you all!

Interesting infos and feedback. I was hoping in something much faster and simpler to implement. i.e. direct motor control (spindle and radial movement) and laser control.

But it sounds it might not be that easy to do.

Thank you for the feedback though!

If you really want direct control you can do it, and depending on your skills it might be easier to implement a motor driver and control servo loop than try to reverse-engineer the existing control system. The track on the disc is a continuous spiral, not concentric.

[DiTBho]

Get a copy of ECMA-394 (CD-R) and/or 359 (DVD-R), and be prepared to do some very, very deep reading...

ECMA-394 (CD-R)  ECMA 394 1st Edition, December 2010 Complete Document Recordable Compact Disc Systems CD-R Multi-Speed

is there any free document?

[amyk]

https://www.ecma-international.org/publications/files/ECMA-ST/ECMA-394.pdf

[ricko_uk]

Thank you all for the additional infos!!

@ excitedbox, did you find it? I tried few searches but couldn't.

Thank you again!

[tooki]

This is the kind of weak protection he though about. Sony Playstation1 CDs can be copied and played with mod-chipped consoles.

So, weak protections, but it somehow makes sense

At least one(black disk) Playstation model had coded track alignment signals.

A recollection says that it was few ASCII characters, "Playstation" feels a bit long, and something RS-232 related, could be also just NRZ bits.

That was the PS1. Wobble in the track, which the PS1’s drive would look for and return a “genuine” flag to the CPU. A regular CD drive would simply ignore the wobble as if they were ordinary manufacturing imperfections, and of course had no way to burn them.