---------------------------------------------------
Maximus XTREME 1.5 For GDR-3120L V0078FK REVISION 2
---------------------------------------------------
Whats new / corrected:

	- FIXED Media Detect V2 Jump
	  (THANKS TO GARYOPA FOR POINTING MISTAKE)

Untested as I dont have any V78 here

The memdump command and flashsec does not work so you will need
to remove the flash chip and reprogram it external

FEATURES:
 - ModeB when poweron with tray open 
 - Media Detection V2 
 - Xtreme 800 to load backups 
 - No F900 core, maybe later
 - No Firmware Stealth (maybe not needed anymore with this one)

The code is very similar to previous ones so I am very confident
will work (maybe with minimal changes)

The reason to release it untested is exactly that.. to get it
tested.

Use at your own risk, in the worst case just revert your previous
firmware.

You need to remove the chip and program it external since no
software tools at the moment. Make sure you know what you are
doing.

Dont forget to put your keys onto it before flashing 
(you can use firmware toolbox 1.2 or hex editor)
Dont forget to crypt the file before flashing


Technical Data: (End read here if you are bored)
----------------

Changes V78
Master Checksum
-------------------------------------------------------
Offset		Original    Hacked
@3E7FC		AA6C7FDA -> 00000000



Modeb tweak
-------------------------------------------------------
Jump a 3150    
@06681		F8EC10C90EDD29210200800410A000C809      DCCFCAFFFFCBCBCBCBCBCBCBCBCBCBCBCB


code in 3150
@03150		FFF...FF	F8EC10C8143430D9F8EC01C90CFE81B0
@03160		FFF...FF	0540DC4E350000DC32350000


Eject tweak
@A9F0		C8		CA


Media Detect Patch PFI ON RAM
----------------------------------
Code on 3500
@03500		FFF...FF	FCA4BCBA0380FCC8E10F3210C812FCC8
@03510		FFF...FF	010F3110C80AFCC8010F3210C90EFCCC
@03520		FFF...FF	01023110FC81BCBA0380800302480ADC
@03530		FFF...FF	8A0B0300

Jump to 3500
@340B4		800302480A	DC4CF4FCFF


STRING ID
---------------------------------------
@37F0		FFF...FF	5854524D3A4D41583A37383A56312E35



Drive response Table Decrypt
------------------------------------------------
Code at 3100
@03100		FFF...FF 	00FCA8FE640380FAC83100C80FCBCBFC
@03110		FFF...FF 	DC1C640380DC739B01000004FCDD2C6C
@03120		FFF...FF 	0380FCDC006E03809ACF15F405F44444
@03130		FFF...FF 	F199C0F8FCDD006D038086DCE29B0100

Jump to 3100
@1CC82		FCDC1C640380	DC7E64FEFFCB



Challenge Response
-------------------------------------------------
@268DE		C9		CA

jump to 3200
@269EF		34E608A000	DC11C8FDFF

@26AA8		C8		CA
@26AB4		C8		CA
@26AC0		C8		CA
@26ACC		C8		CA


Code at 3200 - 3370
	FCA8FE640380FAC83100C80C34E608A000DCE337020034E608A001C810A003C8
	11A005C812A007C813CAE3DC14000000DC0F000000DC69000000DC64000000FC
	DC016E0380FCDDFC66038036E70804F040A2C80A20092109CBCBCAF5CBCB34E7
	08021907341107021A07341207021B07341307021C07341407021D07F8410402
	1E07F84105021F07F84106022007F84107022107DC6C000000CBCBCBCBCBFCDC
	016E0380FCDDFC66038036E70804F040A2C80A20092109CBCBCAF5CBCB34E708
	021907341107021A07341207021B07341307021C07341407021D07F84104021E
	07F84105021F07F84101022007F84100022107CBCBCBCBCBCBCBCBCBCBCBCBCB
	FE82DF0A20C947FE82B00520C9408001DD629E0100000014A001C9328002DD54
	9E0100000014A000C9248002DD659E0100000014A001C9168002DDBE9E010000
	0480028501DDF19D01000000800181DDE79D0100000034100735E608DDD64502
	000000DD5D450200C00C800402F106DF2008



Security Sector READ
-------------------------------------------------
SS addresses
@35202		06FDFF		050600
@35209		7009		1002
@35212		02FDFF		FB0400

Inconditional jumps
@35264		C9		CA
@35280		C8		CA
@352BC		C8		CA

Jump to 3000
@352D1		FCC80010310F	DC2FDDFCFFCB

code at 3000 - 3060
	FCC80010310FC907DCD3220300FCA8FC640380FAC8E100C80DFAC8D100C807DC
	9F220300FCDCFC640380FCDDEC5C038000F04441F05545401CFAC80008C9F400
	FCDCEC5E038004F05441401CFAC8E000C9F70004FCDCCC670380FCDDE75C0380
	F04441F0554540A004C9F7DC70220300



Credits:
-------------------------------------------------------
Birdy, Geremia, C4E, Garyopa, Seventhson, The Specialist
and all other who contributes to the scene.