Pogo Mo Thoin
Apparently from an Irish phrase (“Póg Mo Thóin”) meaning “Kiss my ass”? This method is awesome. I have only done my own Lite-On 83850c, which pre-May 2011 update allowed keys to be read with a tray half closed status. But after that update or with other drives the old method (MRA?) involved cutting traces.
The method is quick and simple. You merely need a way to remove the 3.3v to power-cycle the IC, and a probe to ground a signal (MPX01).
Firstly, JungleFlasher will ID the device. Then using 'PhatKey' it will instruct you to probe MPX01. You remove 3.3v first, shunt MPX01 to ground, and re-apply 3.3v. Click OK. This is much easier with an assistant if you're using an Xbox 360 to power the device, as one hand is holding a probe to a small 'via' on the circuit board, and the other is flipping a switch, or in my case pinching two wires. :)
Instead of cutting the DVD interface cable in my Xbox 360 to switch 3.3v, I removed pin6 from the motherboard side of the cable by just using a small object to lift the plastic which the pin's keeper presses. I had 30awg wire, which I stripped a small bit off either end, and put into the front of the connector, so that when I plugged it back into the Xbox 360 mainboard it was conducting to the 3.3v pin where the pin I removed would. Then a small twist of the 30awg wire around the pin that use to be there… Make sense?
I tried to do the same for the probe and GND but wire-wrapping 30awg around the paper clip didn't workout. It is so brittle and snapped so I grabbed different wire. I'm running out of wire in my junk box, and all I had was some huge 10awg stuff. Hell, whatever. Lightly sanded my paperclip tip and top of the body, wire-wrapped it to the paper clip and just tightly twisted the other end to a hole on the front of the Xbox 360's chassis. Checked resistance between the DVD interface GND and the tip of my paper clip to be 0.5ohm. Also checked voltage from the paper-clip tip to my 30awg wire to make sure the 3.3v was working. It was perfect. Things went smooth reading the keys.
My PC's mainboard has Sii3114 and Nvidia SATA controllers onboard. I have my harddrives setup as a SoftRAID on the Sii3114, and my DVD-RW on my Nvidia. I unplug my DVD-RW for flashing drives, and things work pretty decently except like the VIA controllers after a Lite-On is erased your PC will lock up, or in my case just crawl. Sometimes it seems to timeout and recover for a bit. I thought, I'll remove the driver like the VIA folks do. Oops, nvata.sys is made to be required to boot and I borked Windows. I booted a Ubuntu Live CD (Since it actually recognizes my SoftRAID) and fixed it.
Then I created a Win98 boot disk on a USB pendrive. Threw dosflash16 v1.8 and l-o-eras.exe on there for good measure. DOS doesn't have SATA drivers, so no problems with an erased device on the bus confusing them. Awesome. Typing “dosflash” on it's own didn't seem to do anything, but the manual mode worked great. I already had the spoofed (key inserted) firmware saved from JungleFlash in windows on the key as “fw.bin” and executed (If I recall correctly): dosflash w 0960 1 a0 2 0 4 fw.bin 0 Bam! that shit was done in a second. So much better than fucking with Windows. If I do anymore of this, I think I'll research Linux solutions that'll cover all the steps, and if source is available so I can compile it for an ARM system I have, no bother ever opening my PC! ;)