View source for XBOX 360 Liteon 83850-V2 / 93450 Solderless Key Dumping

<meta name="keywords" content="TIAOWIKI,JTAG,TJTAG,FTA,JTAG,WRT54G,DD-WRT,debrick,tomato,router,wireless router,motorola modem,sb5100,wiggler,arm,mips,avr,buffered jtag,unbuffered jtag,10 pin,20 pin, 12 pin,xbox,xbox 360,modchip mod-chip,mod chip,liteon,lite-on,samsung,hitachi,lg,dvd rom,sata,dvd key,usb probe,cable modem, usb spear,serial spear, serial probe, extract dvd key,mod xbox 360,video games"></meta>
<meta name="description" content="TIAOWIKI tutorials on how to fix your fta receiver, debrick your wireless router, fix you cable modem, mod your xbox 360, extract the xbox 360 dvd key, flash xbox 360 dvd firmware, flash ixtreme firmware"></meta>


__TOC__

<span class="plainlinks">
<include nopre noesc src="/home/tiao/public_html/tiaowiki/wiki/extensions/include/360.inc"/>

Buy Game Console Adapters from [http://www.easymg.com/game-console-adapters.html http://www.easymg.com] or [http://www.diygadget.com/store/game-console-adapters/cat_6.html http://www.diygadget.com]

</span>

== What's new ==

Starting from Liteon firmware version 83850 V2, there has no easy to extract the key.  Thanks to MRA at XBH, he figured out a way to extract the key with lifting the legs of the chip.  However, it still requires soldering wires on the PCB.

In this tutorial, we are going to show you how to extract the key from a 83850 V2 or 93450 without soldering anything on the PCB.

<html>
<font color=red>
<b>Warning</b>
<br><br>
We strongly encourage you to use multimeter to check the trace after rejoin it using silver glue (when it is dried).  Fail to do that, you may damage your DVD drive.
If you are not too afraid of soldering,  you can also solder the cuts, however, you still need to use multimeter to check the joint, to make sure there is no short circuit.
You are responsible for any damage you cause to your device.  We are not liable for any damages you cause to your device.
</font>
</html>

== Tools required ==

You will need access to 3.3V and GND, thus you need our own brand of DVD power adapter, which has easy access to 3.3V and GND.

#XBOX 360 case opening tool with TORX bit.  Buy from [[http://www.diygadget.com/game-console-adapters/xbox-360-case-opening-torx-tools.html here]] or [[http://www.easymg.com/game-console-adapters/xbox-360-case-opening-torx-tools.html here]]
#Access to your PC's native SATA port, or a PCI to SATA card.  A VT6421A powered PCI to SATA card works best.  USB to SATA convert does NOT work.  Buy VT6421A PCI to SATA controller card from [[http://www.diygadget.com/game-console-adapters/vt6421a-raid-pci-sata-controller-card-for-xbox-360.html here]] or [[http://www.easymg.com/game-console-adapters/vt6421a-raid-pci-sata-controller-card-for-xbox-360.html here]]
#A XBOX DVD power adapter.  Buy from [[http://www.diygadget.com/game-console-adapters/xbox-360-dvd-power-adapter-with-on-off-switch-and-power-cable-version-3.html here]], [[http://www.diygadget.com/game-console-adapters/xbox-360-connectivity-kit-v3.html here]], [[http://www.easymg.com/game-console-adapters/xbox-360-dvd-power-adapter-with-on-off-switch-and-power-cable-version-3.html here]], [[http://www.easymg.com/game-console-adapters/xbox-360-connectivity-kit-v3.html here]]
#TIAO's 83850V2 and 93450 Solderless Key Extractor.  Buy from [[http://www.diygadget.com/game-console-adapters/connectivity-kit-v3-and-solderless-extractor-combo-78.html here]] or [[http://www.easymg.com/game-console-adapters/connectivity-kit-v3-and-solderless-extractor-combo-78.html here]]
#Dosflash 1.8+ [[http://www.tiaowiki.com/download//file.php?id=25 download]] and Jungleflasher 1.67b+ [[http://www.tiaowiki.com/download//file.php?id=26 download]]
#ixtreme 1.6 Liteon templates, check xbins.org

To make your life easier, we have created a package, contains [http://www.diygadget.com/game-console-adapters/xbox-360-connectivity-kit-v3-and-liteon-83850-v2-93450-solderless-key-extractor-combo.html the XBOX 360 Connectivity Kit V3 and 83850 V2 and 93450 lite-on DVD drive key extractor].


<html>
<a href="http://www.diygadget.com/game-console-adapters/xbox-360-connectivity-kit-v3-and-liteon-83850-v2-93450-solderless-key-extractor-combo.html"><img src="http://www.diygadget.com/media/catalog/product/cache/3/image/5e06319eda06f020e43594a9c230972d/c/k/ck3-83850-93450-600.jpg" border=0></a>
</html>

The kit will provide 4 resistors, 22 Ohm, 20 Ohm, 18 Ohm and 16 Ohm.  Always start with 22 Ohm, then go to next one if it doesn't work.

This is how to read the color coded resistors:

[[Image:ResCode.GIF]]


OK.  Let's get started!

== Complete diagram ==

This is the overall diagram of the connections:

[[Image:83850v2.93450.sch.jpg|none|thumb|overall diagram for liteon 83850 V2 and 93450]]

== The advantage ==

You only need to rejoin 2 points.  Other methods involves at least 6 points, not to mention that you need to remove the paints etc.

[[Image:Method.advance.jpg|none|thumb|Advantage: only need to rejoin 2 points]]

== Remove the Liteon DVD PCB ==

The first step is to remove the Liteon DVD drive from your xbox 360, if you don't know how to do that, you can google it.

Once you have the DVD drive removed from your XBOX 360, remove the cover and then locate the two screws and remove them:

[[Image:Liteon-pcb.jpg|none|thumb|Liteon PCB]]

Then unlatch the three flat cables as shown in the pic:

[[Image:Unlatch.flat.cables.jpg|none|thumb|unlatch the flat cables]]

Now you have the cables removed:

[[Image:Flat-cable-removed.jpg|none|thumb|Flat cables removed]]

Carefully remove the PCB from the DVD drive housing:

[[Image:PCB.removed.jpg|none|thumb|PCB removed]]


== Make two cuts on the PCB ==

Close up of the PCB:

[[Image:Liteon-pcb-closeup.jpg|none|thumb|PCB close up]]

We will be working on the circled area in the above picture.  Here is a close up of the AOI.

[[Image:Liteon-pcb-closeup-aoi.jpg|none|thumb|AOI close up]]

As you can see from the above picture, we need to make two cuts (A and B).

First, use a utility knife, carefully remove the paint above the PCB trace at A and B:

[[Image:Paint-removed.jpg|none|thumb|Paint removed]]

Then, use a sharp utility to make a V cut at point A and straight cut at point B, do NOT cut too deep, and be gentle.  You may want to practice before you make the real cut.
For point A, it is recommended to make the cut as shown in the pic, in the middle of the trace.  The purpose of this cut is to isolate the pad from the 3.3V line and also keep the 3.3V line connected.
For point B, just make a straight cut as show in the pic below.
Again, be gentle and practice many many times before work on the PCB!!!

[[Image:paint-removed-ready-to-cut.jpg|none|thumb|Ready to cut]]

OK, the result:

[[Image:Cut-done.jpg|none|thumb|cut is done]]

If you have a multimeter, it is recommended to check you have isolated the pad from the 3.3v line and you have broken the trace at point B.  If you don't have multimeter, then it is still ok, but you will have to make sure it is done correctly.


== Prepare to read ==

Now, insert one end of the 22 Ohm resistor to the black flexible cable's header and the other end to the 20cm flexible cable.  We will start with 22 Ohm resistor, if it doesn't work, try 20 Ohm, if it still doesn't work, try 18 Ohm, and then 16 Ohm.

This is how to read color coded resistors:

[[Image:ResCode.GIF|none|thumb|Hoe to read color coded resistors]]

[[Image:Resistor-in-header.jpg|none|thumb|Insert resistor]]

Check with the following photo to identify the resistors comes with the package:

[[Image:Resistors.jpg|none|thumb|Resistors in the package]]

Insert pogo pins to RED flexible cable and the other end of the 20CM flexible cable:

[[Image:pogo.in.jpg|none|thumb|Pogo pin]]

Now, connect our DVD adapter to your PC's Molex adapter, using DVD power cable to connect your Liteon PCB with DVD power adapter, and connect your PC's SATA port to Liteon's SATA port.  Then attach the red alligator to the 3.3v pad and the black alligator to GND pad on our DVD power adapter.  Make sure you are firmly connected all the cables or alligator clips.

<font color="red">'''Attention: Make sure you connect the DVD power cable to the DVD adapter and DVD drive in the correct direction.  One side of the DVD cable's header has a raised bar, another side is flat, make you connect them in the correct way as show in the picture below:''' </font>

[[Image:Correct_way.jpg|none|thumb|to DVD adapter]]

[[Image:Correct_way2.jpg|none|thumb|to DVD Drive]]

<font color="red">'''Attention: Do not let the DVD adapter to touch any metal object or your PC's case.  Always put a book under the DVD adapter to prevent short circuit:'''</font>

[[Image:No_touch.jpg|none|thumb|This is bad, it will cause short circuit]]

[[Image:Use_a_book.jpg|none|thumb|This is good, put a book under the DVD adapter]]

Alligator clips attached:

[[Image:Clip-on.jpg|none|thumb|Alligator attached]]

== Read the key ==

In this step, we will need to run dosflash or jungleflasher to read the key.

Before we do anything, let's get familiar with the points we will be working on.

We will need to apply 3.3v to the bottom pad as shown in the pic while we are reading the key, and we will need to connect the top pad via a resistor (22/20/18/16) to GND to get the DVD driver recognized by DOSFLASH or Jungleflasher, once the driver is recognized, we will need to disconnect top via from GND while we are reading the key.

[[Image:Touch-points.jpg|none|thumb|touch points]]

Now, use your left hand to hold the pogo pin (connect to 3.3V via RED cable) on the bottom via (B), use your right hand to hold the pogo pin (connect to the resistor then to GND via BLACK cable) on the top via (A), then slowly hand over the black header to your left hand, so you can free up your right hand.  Try to use you left hand to release the BLACK header (on point A) while keeping the B connected to 3.3V.  Practice a few times, until you are ok.  Make sure pogo pin on black header do NOT touch anything after it is disconnected from point A.

[[Image:liteon-touched.jpg|none|thumb|touched]]

OK. are you ready?

Make sure DVD power adapter is OFF, turn on PC, open windows explore to location Dosflash 1.8, make sure it is highlighted so with a single hit of Enter button, you will have it launched.  The reason for that is, your left hand is busy holding the pogo pin, so you only have one hand to use :-) Also make sure you have easy access to your mouse, because you need to click 'Ready' button in Dosflash.

Double check the trace again, make sure they are cut, and DVD power cable is connected in the right direction.  If everything is ok, use your left hand to hold the pogo pins to B (to 3.3V) and A (to GND via a resistor) as shown in above pic, then turn on the DVD power adapter:

[[Image:turn-on-dvd.jpg|none|thumb|Turn on DVD power adapter]]

Launch DOSFlash, you will see status is 0x72:

[[Image:dosflash18_ready.png|none|thumb|Doshflash 1.8 status 0x72]]

Once the status is 0x72, you can read the key... but before you ready the firmware, you will need to disconnect the pogo pin from point A (black one, connect to GND via resistor), but make sure you still keep point B connected to 3.3V:

[[Image:release-point-a.jpg|none|thumb|Release point B]]

Now you click 'Read Flash' button on Dosflash, it will pop up a dialog box, you select the path and file name of the firmware:

[[Image:save.flash.png|none|thumb|Save flash]]

Flash is read:

[[Image:Read.done.jpg|none|thumb|Read done]]

Now, power off the DVD power adapter, read again, and save to a different file, after that compare it with the first dump, make sure they are identical.  (this is to verify the dump is good).

== Rejoin the PCB cuts ==

OK.  You have made two cuts to the PCB, it's time to rejoin them back.

In this step, you will need to use the silver conductive glue (included in your purchase) to rejoin the traces.

[[Image:Wire-glue.jpg|none|thumb|Silver wire glue]]

Use a small flat head screw driver, dip s tiny amount (size of sesame) of the silver conductive glue and put it on the trace, DO NOT use the needle attached on the syringe.  DO not put a large amount other then the width of the trace:

[[Image:glueontrace.jpg|none|thumb|Glue on trace]]

This is a better picture, fill in the red-circled area, do not cross the red circle.

[[Image:Area.jpg|none|thumb|Areas need to be filled in]]

In the above picture, I messed a bit, don't worry, you can fix it.

Use your small flat head screw driver to push the redundant glue onto the trace and press it make it firm.  You can also use your finger nail to do that, the key is be gentle.  The guideline is to have the glue cover all the areas without paint, and the thickness is about 0.2mm.

[[Image:Refine-glue.jpg|none|thumb|Refine the trace]]

After you have done that, let it try for a couple hours, then use a multimeter to check the joints, make sure they are solid and correct. <font color=red>This is very important.</font>

If everything is ok, put the PCB back to the housing and your are done with hardware part.

== Manually spoof the firmware ==

You need to download the ixtreme 1.6 templates for liteon, google it for download.

Launch Jungleflasher 1.67b or higher, click on the 'Open Target Firmware':

[[Image:open-jf.jpg|none|thumb|Open target firmware]]

In the popup, select the firmware you dumped from your liteon DVD drive, in my example, it is 111.bin:

[[Image:select.dumped.firmware.jpg|none|thumb|Select dumped firmware]]

Dumped firmware loaded, you can see the key is found.  Highlight the key field, right mouse button click and select "Copy" to copy the key to your clipboard:

[[Image:dumped.firmware.loaded.jpg|none|thumb|original firmware loaded]]

Click 'Open target firmware' again, this time select the ixtreme firmware template for your particular version of DVD drive:

[[Image:opentargetagain_template.jpg|none|thumb|Load template firmware]]

Once you have the template firmware loaded, click 'Manual spoofing' button:

[[Image:Template.firmware.loaded.jpg|none|thumb|Click manual spoofing]]

Now, highlight the key field, delete the key and then paste your key (copied from the previous step) to the key field, then click OK:

[[Image:manually.spoof.jpg|none|thumb|Manual spoof]]

Now the firmware is spoofed with your own key, double check the key is your key. click 'Save to file' button:

[[Image:manual.spoofing.done.jpg|none|thumb|Save firmware]]

In the dialog box, type in the file name and location of your spoofed firmware:

[[Image:new.firmware.save.jpg|none|thumb|new firmware file name]]

After you press 'Save', you will be back to the main window, check the status box, you will see your firmware is correctly saved:

[[Image:new-firmware-saved.jpg|none|thumb|new firmware saved]]

Now you have finished this step.  The next step is to erase the firmware and write the new firmware to your liteon.  You can follow our tutorials:

*[[Flash XBOX 360 Lite-on DVD drive with spoofed firmware]]
*[[Extracting key, spoofing firmware and flashing XBOX 360 Lite-on DVD drive using JungleFlasher in Windows (No PC Freezing)]]


== Troubleshooting ==

If you got status 0x80, 0x52 or 0x51, turn off your dvd power adapter for 5 seconds and turn on again, it may change to 0x72.

If the above does not work, try to replace the resistor to a lower value, e.g from 22to 20, or from 20 to 18, from 18 to 16 and try again.  Do not go below 16.

If your PC freezes when you turn on your DVD power adapter, you can do it in DOS (use DOSFLASH 16bit version in DOS), or change your SATA driver to UNIATA driver as mentioned in the following tutorial and the do it again:

*[[Extracting key, spoofing firmware and flashing XBOX 360 Lite-on DVD drive using JungleFlasher in Windows (No PC Freezing)]]


<span class="plainlinks">
<include nopre noesc src="/home/tiao/public_html/tiaowiki/wiki/extensions/include/adsense.inc"/>
Buy Game Console Adapters from [http://www.easymg.com/game-console-adapters.html http://www.easymg.com] or [http://www.diygadget.com/store/game-console-adapters/cat_6.html http://www.diygadget.com]

</span>