Matthew Jackson
15e263451e
The variant-B firmware load hardcoded one drive's F1 vendor-verify token and a fixed 0x9C0 firmware size. Across the 140 B drives the verify CDB has 39 distinct per-drive values, and the real firmware length is encoded in each drive's MODE SELECT CDB (2192..2528 bytes) — so the constants were wrong for ~139 of 140 drives and truncated 13. - DriveProfile gains fw_verify_cdb (the per-drive 0xF1 verify). - variant_b uploads firmware.len() (now the correct per-drive size from the regenerated profiles.json) and issues profile.fw_verify_cdb, falling back to the const only for legacy profiles. - profiles.json regenerated: 79 firmware fields corrected (13 truncated recovered to full length, 66 over-reads trimmed). - Adds a recording-transport regression test asserting the profile's F1 verify is issued (not the const) and MODE SELECT carries firmware.len().
freemkv-unlock-ld
The LibreDrive unlocker plugin for libfreemkv.
libfreemkv ships only the Unlocker trait + registry and stays firmware-clean.
This crate owns how MediaTek MT1959 drives are firmware-unlocked: the bundled
drive-profile database (profiles.json), the firmware blobs, the
WRITE_BUFFER / MODE SELECT upload, the unlock CDBs, and the variant-A / variant-B
handshake logic.
Usage
Register the unlocker once at process start, before any rip:
libfreemkv::register_unlocker(Box::new(freemkv_unlock_ld::LibreDrive::new()));
That single line is the whole plug. Any drive whose identity matches a bundled profile is firmware-unlocked at drive-prep; everything else falls through to libfreemkv's host-certificate AACS handshake.
The Unlocker contract
This crate is the LibreDrive unlocker — an implementation of libfreemkv's
Unlocker trait. The trait is a 3-method capability contract:
unlock_drive— put the drive into extended-access mode. The one required capability.read_volume_id— read the disc Volume ID directly, bypassing the AACS cert handshake.None→ libfreemkv falls back to the cert-based read. No-op default.set_max_read_speed— raise the drive to its maximum read speed. No-op default.
libfreemkv's AACS layer is the always-present baseline; it uses an unlocker's capabilities when one matches, and does the full cert handshake when none do. Remove this crate and libfreemkv still compiles and rips — every capability falls back to the OEM/baseline path.
Scope: RAM microcode only (#2), never the bootloader flash (#1)
freemkv uploads the RAM microcode to an already-bootloader-flashed drive.
The permanent bootloader flash (#1) is the drive owner's one-time manual
step; it is never automated by freemkv. This crate only performs the
non-persistent #2 step — the microcode lives in RAM and is gone on power
cycle.
Credits
LibreDrive was created by Mike Chen and the MakeMKV team. This crate builds on their work — our thanks and full credit to them for the LibreDrive capabilities.