saramibreak / DiscImageCreator

This is the disc (CD, GD, DVD, HD-DVD, BD, GC/Wii, XBOX, XBOX 360) and disk (Floppy, MO, USB etc) image creation tool
http://forum.redump.org/topic/10483/discimagecreator/
Apache License 2.0
538 stars 46 forks source link

DiscImageCreator doesn't retry C2 errors properly when dumping GD-ROMS with /c2 (var1) 0 or /c2 (var1) 1 using a compatible drive #146

Open ehw opened 2 years ago

ehw commented 2 years ago

Version 20220707T220452

Describe the bug Note: These errors seem to occur on any drive that natively supports C2 retries (like the PX-708a, PX-760a, etc). This occurs with the "gd" command, VGPC audio trap disc (549150 sector TOC), and any GD-ROMs with slight defects (small scratches, etc). Even though TSST drives are recommended, you absolutely can dump these discs with certain Plextors, and it should be encouraged because of the ability to do C2 and scrambled reads.

When using /c2 (var1) 0 (default behavior): DiscImageCreator is substituting sectors in the .scm with $00 upon rereading discovered C2 errors when dumping with a compatible drive when the second parameter in the /c2 command is set to 0 (which is default for Plextors). For some reason, the drive will only reread each c2 error exactly once, and will always return the same crc32 value (0xbe97ce3f). DIC never successfully retries a c2 error at all. For example, here are the first five c2 errors for this dump:

                              ofs: 74a, 74b, 76d, 774, 775, 
             LBA[469200, 0x728d0] Detected C2 error 5 bit
                              ofs: 6dc, 6e4, 6e5, 6e6, 6e7, 
             LBA[469709, 0x72acd] Detected C2 error 5 bit
                              ofs: c4, c5, c7, cd, 185, 195, 
             LBA[469817, 0x72b39] Detected C2 error 6 bit
                              ofs: 6ba, 6e4, 6e5, 6ec, 
             LBA[470031, 0x72c0f] Detected C2 error 4 bit
                              ofs: 11c, 11d, 
             LBA[470112, 0x72c60] Detected C2 error 2 bit

This is what DIC tries to do. It only does exactly one attempt per c2 error, returning the same crc32 value for each (because the value is based off of a completely 00'd out sector):

             LBA[469200, 0x728d0]: crc32[000]: 0xbe97ce3f good. Rewrote .scm[1103514960-1103517311(41c64d50-41c6567f)] .c2[137899995-137900288(8382fdb-8383100)]
             LBA[469709, 0x72acd]: crc32[000]: 0xbe97ce3f good. Rewrote .scm[1104712128-1104714479(41d891c0-41d89aef)] .c2[138049641-138049934(83a7869-83a798e)]
             LBA[469817, 0x72b39]: crc32[000]: 0xbe97ce3f good. Rewrote .scm[1104966144-1104968495(41dc7200-41dc7b2f)] .c2[138081393-138081686(83af471-83af596)]
             LBA[470031, 0x72c0f]: crc32[000]: 0xbe97ce3f good. Rewrote .scm[1105469472-1105471823(41e42020-41e4294f)] .c2[138144309-138144602(83bea35-83beb5a)]
             LBA[470112, 0x72c60]: crc32[000]: 0xbe97ce3f good. Rewrote .scm[1105659984-1105662335(41e70850-41e7117f)] .c2[138168123-138168416(83c473b-83c4860)]

When using /c2 (var 1) 1 (read from beginning to end of sector): If the /c2 command's second variable is set to 1 instead (which rereads the entire disc from the beginning up to where the error occurs), DIC seems to try to correct sectors that aren't even marked for correction, causing the .scm to have MORE errors after the c2 "retries" than before it retries anything. DIC marks the sectors in the beginning of the c2 error log as its creating the .scm file correctly, but as it steps through the beginning of the HD layer (45000). it randomly starts to "correct" sectors that never reported any errors. For instance, we saved a copy of the .scm file after it finished dumping and saved another copy after the c2 errors were retried and ran a ECC/EDC checker that we made ourselves, and we determined that there were more errors in the .scm file after DIC had retried the c2 errors than before. See the attached logs for comparison, but to give you an idea:

In the dump attempt where /c2 (var 1) 1 is used, it marked sector 470916 as the first sector for correction. However, running the .scm after DIC retries the C2 errors in a program to check for ECC/EDC errors in a scrambled dump, there are errors at Sector 90000 which weren't present in the version of the .scm before retries were made. Sector 90000 (20:02:00 0x64ef450) has an error that was caused by the c2 retries according to the .scm file. This sector doesn't appear marked as an error in the c2 error log file. For this sector, it reports this:

             LBA[090000, 0x15f90]: crc32[000]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[001]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[002]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[003]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[004]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[005]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[006]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[007]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[008]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[009]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[010]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[011]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[012]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[013]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[014]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[015]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[016]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[017]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[018]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[019]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[020]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[021]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[022]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[023]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[024]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[025]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[026]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[027]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[028]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[029]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[030]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[031]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[032]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[033]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[034]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[035]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[036]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[037]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[038]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[039]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[040]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[041]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[042]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[043]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[044]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[045]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[046]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[047]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[048]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[049]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[050]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[051]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[052]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[053]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[054]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[055]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[056]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[057]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[058]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[059]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[060]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[061]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[062]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[063]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[064]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[065]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[066]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[067]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[068]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[069]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[070]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[071]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[072]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[073]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[074]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[075]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[076]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[077]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[078]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[079]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[080]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[081]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[082]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[083]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[084]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[085]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[086]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[087]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[088]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[089]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[090]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[091]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[092]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[093]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[094]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[095]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[096]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[097]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[098]:0xe42242d0,
             LBA[090000, 0x15f90]: crc32[099]:0xe42242d0,

But since it returned the same crc32, it didn't do any rewrites. So why did it change in the .scm after the retries? LBA[089999, 0x15f8f]: to[090000] All same crc32. No rewrite LBA[090000, 0x15f90]: to[090001] All same crc32. No rewrite LBA[090001, 0x15f91]: to[090002] All same crc32. No rewrite

Ultimately, regardless of what happened in both dumps, despite there being clear c2 errors that were uncorrectable, DIC still descrambled and provided an output anyway.

Screenshots /c2 (var1) 0 output scm comparison: This is an image of a comparison between the .scm before DIC retries the sectors with marked c2 errors, and after it retries. Notice how after DIC retries the sector, its all filled with $00. image

/c2 (var1) 1 output scm comparison: This is an image of a comparison between the .scm before DIC retries the sectors with marked c2 errors, and after it retries every single sector starting from 45000. Notice how despite the DIC log file (included below) says that the first c2 error is at sector 471267, there is a difference at sector 90000. The scm before the c2 retries is correct at this sector, the scm after the c2 retries is wrong. Nothing in any DIC log indicates sector 90000 was an issue, so I don't know why this happened: image

Disc title Sonic Adventure - E3 Trial Edition (GD-ROM)

Disc ringcode Mastering Code: MK-51015-0101 1MM1 C 96 Mastering SID Code: IFPI L223 Toolstamp or Mastering Code: (BLANK) Mould SID Code: (BLANK)

URL Tell me the link to get the disc. Rare disc, can't be obtained easily. Issue is caused by some small surface damage on the disc. These issues can occur on any GD-ROM we think.

Log file DIC Log Files: Dump 2 (/c2 var2 is 0): https://www.mediafire.com/file/ggq5w2cptivlj72/sa+e3+dump+2+-+c2+var2+is+0.7z/file Dump 1 (/c2 var2 is 1): https://www.mediafire.com/file/c9i70ztepfd0qqh/sa+e3+dump+1+-+c2+var2+is+1.7z/file ECC/EDC logs for Dump 1 (/c2 var2 is 1), on a copy of the scm before c2 retries, and on a copy of the scm after c2 retries which contains more errors: https://www.mediafire.com/file/ymx0mxbbv47lgtm/sa+e3+dump+2+-+eccedc+scans+before+and+after+c2+retries.zip/file

saramibreak commented 2 years ago

Sonic Adventure - E3 Trial Edition (GD-ROM)

What version is it? https://hiddenpalace.org/Sonic_Adventure_AutoDemo_(Oct_16,_1998_prototype) https://hiddenpalace.org/Sonic_Adventure_Taikenban_(Mar_2,_1999_build) https://hiddenpalace.org/Sonic_Adventure_(Jun_3,_1999_prototype) https://hiddenpalace.org/Sonic_Adventure_(Jun_8,_1999_prototype)

ehw commented 2 years ago

Hey there, thanks for looking into it.

https://hiddenpalace.org/Sonic_Adventure_(Jun_8,_1999_prototype)

The one on the site is based on an old BBA dump when the disc was in better shape back in 2008. We didn't make these attempts in DIC public because we haven't gotten a good dump in anything yet. The old dump is free from any errors (we checked the EDC/ECC data).

Let us know if you want to see the raw dumps with DIC and DCDumper so far. We save every attempt. :)