Firmware tools

freemkv firmware turns a supported optical drive into a faster, unlocked drive. Two small command-line tools do the work: freemkv-fw builds and checks firmware images, and freemkv-flash writes them to a drive. Both are also documented on the public Firmware pages, which cover finding a base image, building it, and flashing it step by step; this page is the detailed reference — for the tools themselves, for identifying your drive, and for the command ABI the firmware they build actually implements.

Install on macOS

For Apple Silicon, install with Homebrew:

brew update
brew install freemkv/tap/freemkv-flash freemkv/tap/freemkv-fw

If already installed, use brew upgrade with the same package names. Run freemkv-flash --version to confirm the installed version. Use the installed command rather than a previously downloaded ./freemkv-flash-… executable. For a drive that appears in list but fails to open in info, see macOS firmware-tool troubleshooting.

Intel direct download

Download the Intel x86_64 app or CLI from Flash or Modify.

App: extract the ZIP and move the app to Applications. The app includes the command line.
CLI: make the downloaded binary executable and run it from Terminal, for example:

cd ~/Downloads
chmod +x freemkv-flash-cli-x86_64-macos
./freemkv-flash-cli-x86_64-macos --version

For Modify, use freemkv-fw-cli-x86_64-macos instead. You can rename the binary to freemkv-flash or freemkv-fw and put it in a directory on your PATH. Replace the downloaded app or binary with a newer download to update. Homebrew also remains available on Intel Macs.

The tools are not notarized by Apple. If macOS blocks a downloaded app or CLI, try opening it, then go to System Settings → Privacy & Security → Open Anyway and confirm if you trust the download.

freemkv-fw

freemkv-fw turns a base MediaTek firmware image into freemkv firmware, and checks whether a file or a live drive is already freemkv.

modify

freemkv-fw modify <input> [output]       # default output: <input-stem>.freemkv.bin
freemkv-fw modify <input> --json         # machine-readable per-capability report
freemkv-fw modify <input> --audit        # verify every applied patch actually landed
freemkv-fw modify <input> --in-place     # rewrite the input image instead of writing a new file
freemkv-fw modify <input> --base         # strict base build: all-or-nothing, refuses without a full freemkv base

Accepts BIN images or website TAR packages and returns the same format. For a paired TAR, Modify changes only the final firmware and preserves the intermediate (INTM) image and its extraction-derived pairing.

Takes one stock (OEM) image and produces one freemkv image. The CLI’s canonical command is freemkv-fw modify; it auto-detects the chipset (MediaTek MT1959 or MT1939) from the image, then applies every capability that drive supports and reports each one individually — by default it is never all-or-nothing (--base is the strict exception, used by the publish pipeline). A capability whose signature isn’t found on that particular image is reported and skipped; the rest still apply. Each capability comes back as one of four states:

Report	Meaning
applied	the patch was added on this run
already set	the feature is already present (e.g. re-running on freemkv firmware) — a safe no-op
n/a	out of scope for this drive (e.g. UHD on a DVD-only drive)
skipped	in scope, but the signature wasn’t found on this image (nothing is written)

Running modify on freemkv firmware again is idempotent: every capability reports already set and the output is byte-identical to the input. --audit (also modify --audit) re-derives the exact expected patch bytes and confirms each applied capability actually landed at its hook site — an automated correctness check, no drive required. Unrestricted is enabled by default where supported; other features start at OEM settings — see Command reference below.

Capability	What it does	Status
Speed	Sets the read-speed / riplock ceiling — a settable cap, not just on/off	ready
Region	Region-free (RPC-1, no ~5-change cap), or force a specific DVD region (1–8) or Blu-ray region (A/B/C)	ready
Unrestricted (was UHD)	Opens the drive to read every disc type, including Blu-ray and Ultra HD Blu-ray (AACS 1.0/2.0). Same wire discriminant as the old `Uhd` name	ready
Revocation (HRL)	Skip the host-certificate revocation check, so a revoked-but-genuine certificate still works (non-destructive)	ready
Encryption	Removes the drive’s disc-encryption handshake so content reads back decrypted; the host applies the title keys	ready
Downgrade versions	Enables supported downgrades; hardware and update-protocol constraints still apply	ready
Diagnostic Dump	Reads 64-byte windows of firmware RAM	ready (diagnostic use)

These map to the features in the command reference below, each an independent setting. Which capabilities apply to a given image depends on the chipset and generation, so modify reports them per image rather than assuming — a DVD-only drive has no Unrestricted gate, for example. Every feature except Unrestricted (armed by default) ships at OEM, and the rest stay stock until deliberately armed; settings live in RAM and revert on power-off unless saved to flash. Every build is statically verified (integrity re-signs, structural audit passes); the levers are structurally verified across the corpus.

verify

freemkv-fw verify <file-or-device>

Answers one question two ways. Point it at a file to check the firmware image’s own internal integrity. Point it at a live drive (e.g. /dev/sg0) to send the Identity command over SCSI and report what the drive itself says back. For a file, --family <mt1959|mt1939> forces the chipset instead of auto-detecting it.

info

freemkv-fw info <device>                                        # print the drive's freemkv identity
freemkv-fw info <device> --dump <addr> --len <len> --out <file>  # read an explicit memory range (hex)
freemkv-fw info <device> --full --out <prefix>                  # capture the whole decrypted image

Probes a live freemkv drive. With no flags it prints the drive’s freemkv identity; --dump reads a memory range, and --full captures every readable flash and RAM region, one <prefix>-<address>.bin file per region. Read-only.

When modify writes the changed firmware image, it automatically recomputes and verifies the active integrity data. There is no separate signing step in the normal workflow.

freemkv-flash

freemkv-flash backs up, dumps and flashes supported optical-drive firmware on Windows, macOS and Linux. Executable write paths support MediaTek images and Pioneer packages understood by the backend. MT1959 is the hardware-tested MediaTek path; MT1939 is recognized but not hardware-validated. A catalogued chipset or model alone is not proof that its firmware can be flashed. The desktop app uses the same workflows as the CLI.

list, info and check

freemkv-flash list
freemkv-flash info <device>
freemkv-flash check firmware.tar

Use the drive name or ID printed by list. Omit the device when exactly one drive is connected. info identifies a drive or inspects a firmware file; check always inspects a file without opening a drive. Identification is not a guarantee of compatibility or a successful flash.

backup and dump

# MediaTek update-format image:
freemkv-flash backup <device> -o backup.bin
# Pioneer package:
freemkv-flash backup <device> -o backup.tar
# Raw diagnostic capture, not an update package:
freemkv-flash dump <device> -o dump.bin

Backup reads and validates supported firmware. MediaTek output is a 2 MiB update image with factory per-drive data. Pioneer output is a package of captured components; recognized images can be reconstructed in OEM format. An unsigned Pioneer candidate is not automatically a transferable update: Recovery accepts it as a Current reference, but the target must pass authentication. Keep a copy of the original signed OEM package as well as your backup.

Dump captures accessible memory and records unavailable regions. It is not a validated restoration image. Pioneer dump may enable temporary command logging in RAM. Read commands can fail on unsupported or degraded drives.

flash

# Preview (default):
freemkv-flash flash <device> -i firmware.bin
# Write, with an automatically saved pre-flash backup:
freemkv-flash flash <device> -i firmware.bin --execute --i-understand-risk
# Choose a new backup destination:
freemkv-flash flash <device> -i firmware.bin --backup preflash.bin --execute --i-understand-risk

Normal Flash retains compatibility checks and attempts to save a fresh backup before writing. If a backup cannot be made, the app asks whether to proceed. Many MediaTek firmwares cannot be backed up; the app explains this restriction. Choose No to stop, or Yes to continue to the separate final Flash confirmation. Inputs include supported MTK images and older backup archives, and Pioneer envelopes or envelope packages.

In the desktop app, select the firmware currently installed as Current firmware. For MediaTek drives, a file is required and Read from drive is hidden. Backends that support automatic acquisition select Read from drive by default. Flash and Recovery use the same selection layout. A paired Current TAR also needs its exact member; choose the member that is currently running, including INTM if applicable. The CLI equivalent is --current FILE, with --current-member MEMBER when needed. Completion checks depend on the backend; do not assume every protocol supports byte-for-byte firmware readback. Eject any disc and close the empty tray first.

Website downloads are TAR packages. When a MediaTek package contains an explicitly paired INTM, Flash installs it first, confirms startup, then installs the final firmware. Failure stops the sequence. A standalone BIN flashes only that supplied image. Transfer encoding is detected automatically from the active receiver.

recover

MediaTek Recovery accepts a website TAR without a Current reference and creates no backup. For a paired TAR, explicitly select the one image to write:

freemkv-flash recover <device> -i firmware.tar --member intermediate.bin
# After reviewing the preview:
freemkv-flash recover <device> -i firmware.tar --member intermediate.bin --execute --i-understand-risk

Choose firmware.bin instead to recover with the final image. Recovery never automatically writes the second member. It detects BOOT/application mode and plaintext/encrypted transfer, bypasses installed-model compatibility policy, and retains image, controller, receiver and write validation. The paired update and MediaTek BOOT recovery paths have simulated-transport coverage; physical-drive validation remains outstanding.

Pioneer recovery

Recovery is a separate command and desktop tab. For Pioneer, use packages containing both Kernel and Normal. Supply a copy of the firmware currently running on the drive and the package you want to install:

# Preview with a supplied receiver reference:
freemkv-flash recover <device> --current current.tar -i target.tar
# Write:
freemkv-flash recover <device> --current current.tar -i target.tar --execute --i-understand-risk
# Explicit alternative: read Current firmware from the drive:
freemkv-flash recover <device> --read-from-drive -i target.tar --execute --i-understand-risk

Choose exactly one of --current or --read-from-drive. Unsupported drives are rejected before firmware reads or update commands. With a supplied Current file, Recovery makes no firmware memory reads, backups or readback verification; identity and status queries still occur. The explicit read option needs working firmware reads and does not save a backup.

Recovery derives receiver credentials from Current, enters update mode only if needed, then sends the target Kernel and Normal. It skips normal installed-versus-target compatibility policy, but retains required file integrity, target authentication, protocol and write-error checks. It does not automatically patch a downgrade or try additional restoration passes. The correct Current reference is essential.

In 0.11.0, flash --force is removed. There are no --skip-backup, --allow-crossflash, --mode, or flash --recover switches. Use recover for the Pioneer recovery workflow. Both write commands require --execute and --i-understand-risk; without --execute, they preview without programming firmware. Diagnostic logs are saved automatically for failures and successful operations.

How do I tell what drive I have?

Before building or flashing anything, confirm what you’re working with — vendor, model, and firmware revision:

freemkv-flash info <device> — the quickest path; prints the drive’s vendor, product, and firmware revision straight from its INQUIRY data.
Linux, lsscsi — lists attached SCSI/ATAPI devices, including the vendor and model string, without touching the drive.
Linux, sg_inq <device> (from sg3-utils) — issues a standard INQUIRY directly and prints the same vendor/product/revision fields freemkv-flash info reads.
The label on the drive itself, or on Windows, Device Manager → DVD/CD-ROM drives — the model string printed there usually matches the INQUIRY product field.

Once you have vendor + model + firmware revision, check it against the base images in the firmware index (see the Firmware → Find page) before building.

Command reference

Every freemkv-fw command is a hijack of the standard SCSI READ BUFFER (0x3C) command, discriminated by an OEM-unused mode byte plus a 2-byte knock. READ BUFFER is used because it’s a standard opcode that USB/UAS bridges pass through unmodified (a bare vendor opcode gets rejected by the bridge), and it returns data through an existing transfer path. freemkv claims an OEM-unused mode byte and hands every other mode straight back to the stock handler, so normal READ BUFFER behavior stays byte-identical until the knock arrives.

The full discriminator is the 4-byte prefix 3C 0E C0 DE: standard opcode + OEM-unused mode

knock. There is no separate vendor opcode and no persistent mode — control rides one command every optical drive already answers, and the drive stays 100% OEM until that exact prefix shows up.

freemkv-fw modify wires these features into the firmware image it builds, and freemkv-fw verify /dev/… sends the Identity command to test a live drive.

Grammar: `verb [feature] [state]`

The command surface is a small set of verbs operating on a flat namespace of features, each holding a state. A verb (SET, GET, RESET, SAVE, IDENTITY, DUMPALL) says what to do; a feature (Speed, Region, Unrestricted, …) says which subsystem; a state says how to set it. Every feature has an OEM state — the firmware does not touch that subsystem, so a drive left at OEM is byte-behaviour-identical to stock. Settings live in RAM and are lost on power-off unless you SAVE them to flash; on boot the firmware restores the saved config, or falls back to the baked defaults (Unrestricted armed, everything else OEM) if nothing was saved. RESET reloads that state — back to the last saved config (--to flash), to the baked defaults (mode 01), or all the way to OEM (--to oem, which also blanks the saved config). Features are orthogonal: the familiar “modes” are just combinations (see Composing features below).

CDB layout

byte:  0     1     2  3     4      5          6        7   8       9
       0x3C  0x0E  C0 DE    <verb> <feature>  <state>  <alloc_len 16-bit BE>  <ctrl>

Field	Bytes	Offset	Meaning
Opcode	1	`cdb[0]`	`0x3C` — `READ BUFFER`, the command freemkv hijacks
Knock mode	1	`cdb[1]`	`0x0E` — an OEM-unused `READ BUFFER` mode
Knock	2	`cdb[2..4]`	`C0 DE`; a defence-in-depth signature behind the mode byte
Verb	1	`cdb[4]`	selects the operation — `SET` / `GET` / `RESET` / `SAVE` / `IDENTITY` / `DUMPALL` (see verb table)
Feature	1	`cdb[5]`	which feature to act on, for `SET` / `GET` (else `00`; see feature table)
State	1	`cdb[6]`	the state to write, for `SET`; for `RESET` the mode byte (`00` = to saved flash, `01` = to baked defaults, `FF` = to OEM); else `00`
Alloc length	2	`cdb[7..9]`	16-bit big-endian allocation length — sizes the data-in transfer for data-returning verbs
Control	1	`cdb[9]`	`0x00`

build_cdb() (the host-side helper) assembles exactly this 10-byte frame. Without the 3C 0E C0 DE prefix, every byte is interpreted by the OEM’s normal READ BUFFER handler — nothing about a bare READ BUFFER command changes. DUMPALL is the one exception to the field layout: it carries a 32-bit RAM address big-endian in cdb[5..9] (no feature / state / alloc-length).

Verb table (`cdb[4]`)

CDB prefix	Verb	Value	Meaning	Status
`3C 0E C0 DE 01`	Identity	`0x01`	Status / ping — returns the `freemkv` magic, version, and current feature-state table	ready
`3C 0E C0 DE 02 <feat> <state>`	Set	`0x02`	Set one feature to a state (RAM only)	ready
`3C 0E C0 DE 03 <feat>`	Get	`0x03`	Read one feature’s current state back in the data-in	ready
`3C 0E C0 DE 04 00 <mode>`	Reset	`0x04`	Reload the live state — `cdb[6]` mode `00` = to saved flash config (RAM only), `01` = to the baked defaults a never-saved drive boots to (RAM only), `FF` = to true OEM (RAM and blanks the saved flash config)	ready
`3C 0E C0 DE 0B`	Save	`0x0B`	Persist the current (live) feature-state table to flash	ready
`3C 0E C0 DE 09 <addr32>`	DumpAll	`0x09`	Diagnostic 64-byte RAM peek at a 32-bit address	ready (diagnostic use)

Feature table (`cdb[5]`, for `SET` / `GET`)

Each feature is an independent state byte in the firmware’s flag table. Every feature reserves one universal code — FF = OEM (do exactly what the stock drive does) — and defines its own values on top. Two shapes result: toggles (FF OEM / 00 / 01) and valued features (Speed and Region, which take a range).

Feature	Value	States	Status
Speed	`0x01`	`FF` = OEM ramp · `00` = off = max / uncapped · `01`–`FE` = explicit speed cap	ready
Region	`0x02`	`FF` = OEM region logic · `00` = locked (nothing plays) · `01`–`08` = force DVD region 1–8 · `0A`/`0B`/`0C` = force BD region A/B/C · `0F` = region-free	ready
Unrestricted	`0x03`	`FF` (`STATE_PASSTHROUGH`) = replay OEM · `00` (`STATE_OFF`) = replay OEM, drive refuses non-`0xC*` states · `01` (`STATE_ON`) = widen, accept BD + UHD + the extended auth-cell nibble set	ready
BD	`0x04`	Deprecated (0.9.2). `FF` = OEM · `00`/`01` still round-trip via SET/GET but have no runtime effect — use Unrestricted	deprecated
HRL	`0x05`	`FF` = OEM enforce · `00` = off, skip the revocation lookup (accept revoked, non-destructive) · `01` = on, enforce	ready
Encryption	`0x06`	`FF` = OEM real handshake · `00` = off, null/bypass (drive acts pre-authenticated, no handshake, content reads back de-bussed) · `01` = on, require the real handshake	ready

State conventions. Every feature reserves OEM (0xFF) — the firmware jumps to the stock drive code, so that subsystem behaves exactly as shipped. Beyond that each feature has its own value domain. For the toggle features the two poles differ in meaning:

Unrestricted (and, historically, BD, now deprecated) answers “does this drive accept this disc type?” — 00 (STATE_OFF) = No (refuse — replays OEM), 01 (STATE_ON) = Yes (widen — accept), FF (STATE_PASSTHROUGH) = OEM (replay OEM, byte-identical to an unmodified drive). 00 and FF both replay OEM behavior; only 01 arms the widen.
HRL / Encryption are unlock switches where 00 is the unlock direction — 00 = off (skip revocation / bypass the encryption handshake so content reads back de-bussed), 01 = on (enforce), FF = OEM.

On BU40N 1.00, arming Unrestricted also hooks the OEM auth-cell gate at 0x00136826 (cmp (state>>4),#0xC; bne <6F/02>) and widens the accepted top-nibble set, so discs whose classifier lands the state byte outside the usual 0xC* band (observed: 0xE8 on a triple-layer UHD) are no longer silently refused with 0x30/0x02 Incompatible medium installed. It shares the same lever and the same tri-state semantics as the BD/UHD acceptance gate — there’s no separate CDB feature code for it. CreateReport exposes auth_cell_site / auth_cell_stub_va, which read zero on hardware where the anchor shape doesn’t exist (e.g. MT1939 classic). A freshly flashed drive with virgin NV boots with Unrestricted = STATE_ON — the widen is armed out of the box, unlike every other feature, which boots at OEM until explicitly saved.

The valued features carry a range: Speed (00 = max/uncapped, 01–FE = a specific speed cap) and Region (00 = locked, 01–08 = DVD 1–8, 0A–0C = BD A/B/C, 0F = region-free). A freshly flashed, never-saved drive boots with every feature at OEM except Unrestricted (see above); boot otherwise restores whatever config was last saved. That OEM-compatibility guarantee is the point of the design.

Default unlock profile

The freemkv-unlock host tool applies this profile for a normal rip — the common “just unlock everything” combination. The firmware supports any mix of feature values; this is simply the default the tool arms:

Feature	Setting	State
Speed	max (uncapped)	`0x00`
Region	region-free	`0x0F`
Unrestricted	yes (widen — accept BD + UHD)	`0x01`
HRL	off (skip revocation)	`0x00`
Encryption	off (bypass handshake, de-bussed)	`0x00`

BD (0x04) is deprecated as of 0.9.2 and no longer part of this profile — Unrestricted covers both BD and UHD acceptance.

What each verb and feature does

Identity (0x01, read-only). Returns the ASCII freemkv magic, a firmware version byte, and the current feature-state table. Send it first, and only treat a drive as freemkv-flashed if it answers with the magic. Changes nothing.
Set (0x02) / Get (0x03). SET writes cdb[6] (state) into the feature named in cdb[5]; GET reads that feature’s current state back as a 1-byte data-in. Both act on exactly one feature, and SET touches RAM only — the change is lost on power-off unless you SAVE.
Reset (0x04). Reloads the live RAM state without reflashing — --to flash (cdb[6] = 00) restores the last saved config and cdb[6] = 01 restores the baked defaults; both are RAM only. --to oem (cdb[6] = FF) returns every feature to OEM and blanks the saved flash config in one step, so no SAVE is needed — the drive is left exactly like a never-saved one.
Save (0x0B). Persists the current live feature-state table to flash (the only other command that writes flash is RESET --to oem). Saved settings survive a power-cycle and are restored on the next boot; a drive that has never saved boots to the baked defaults.
Speed. Read-speed / riplock ceiling. FF (OEM) = the OEM speed ramp; 00 (off) = speed control off, so the drive reads at max / uncapped; 01–FE set an explicit speed cap. Use max to lift the playback-speed riplock so discs read back at the drive’s full rate for ripping.
Region. RPC control across DVD and Blu-ray. FF (OEM) keeps the drive’s own region logic; 00 locks the drive (nothing plays); 01–08 pin the drive to DVD region 1–8; 0A / 0B / 0C pin it to BD region A / B / C; 0F makes it region-free (RPC-1, with none of retail’s ~5-change limit).
Unrestricted (0x03, renamed from Uhd in 0.9.2 — same wire byte). One AACS media-acceptance gate for BD (AACS 1.0), UHD (AACS 2.0), and, on hardware where the anchor exists, the auth-cell state-band gate at 0x00136826. FF (STATE_PASSTHROUGH) and 00 (STATE_OFF) both replay OEM behavior (refuse non-0xC* states); 01 (STATE_ON, “widen”) accepts BD, UHD, and the extended top-nibble set. (In scope only on UHD/BD-capable hardware; the auth-cell hook is additionally gated on BU40N 1.00’s anchor shape — auth_cell_stub_va reads 0 where it doesn’t apply.) A fresh flash with virgin NV boots with this feature already at STATE_ON — widen is the baked-in default.
BD (0x04, deprecated since 0.9.2). The old Blu-ray-only (AACS 1.0) capability gate. SET/GET still round-trip through its own NV slot for legacy hosts, but the value has no runtime effect — the drive’s BD acceptance is driven entirely by Unrestricted now. New hosts should not arm this feature; use Unrestricted instead.
HRL. Host-certificate revocation handling on the cert path. FF (OEM) = enforce; 00 (off) is the unlock direction — it skips the revocation lookup so a revoked-but-genuine certificate is accepted (non-destructive, reversible); 01 (on) enforces the check.
Encryption (0x06, consolidated from AKE + Bus in 0.9.0). Content encryption / the drive↔host AKE handshake, now a single feature — hardware proved that toggling the handshake alone de-busses content reads, so the two are one lever. FF (OEM) = the real handshake; 00 (off) is the unlock direction — the drive acts pre-authenticated, performs no handshake, and content reads back de-bussed, so READ(10) comes back exactly as it sits on the disc (still AACS-encrypted at rest, so the host applies the title keys); 01 (on) requires the real handshake. Turning the handshake off also releases the Volume ID (and the other AACS-gated values) to a normal READ DISC STRUCTURE request, since the gate no longer refuses to emit them.
DumpAll (0x09, read-only). Returns a fixed 64-byte window read from the 32-bit address packed big-endian across cdb[5..9] (cdb[5] = address bits 31:24 … cdb[8] = address bits 7:0). The host iterates in 64-byte steps to dump any RAM region. This is a read-only diagnostic tool (used by the fw09_dump helper script), not a drive-facing capability toggle.

Composing features

Features are orthogonal, so the familiar “modes” are just combinations of independent settings:

OEM-style rip (real authentication). Unrestricted = yes + HRL = off (skip) + Encryption = OEM — the drive still runs the genuine handshake, but a revoked host certificate is accepted.
Full bypass. Encryption = off (bypass) (+ Unrestricted = yes for a UHD disc) — the drive skips the handshake entirely and returns de-bussed sectors.
Quality-of-life only. Speed = max and/or Region = region-free, with every AACS-path feature left at OEM — a faster, region-free drive that is otherwise 100% stock.

How the firmware is built

freemkv firmware is not tied to any one OEM image. Every firmware address a patch needs is located by signature at build time — nothing is hardcoded — so the same builder works across MediaTek MT1959 and MT1939 OEM images, auto-detecting the chipset and applying the capabilities that drive supports (reported per image). Once the patches are applied, the image’s integrity table is re-signed with CMAC using the known key so the drive accepts it, and the DE (downgrade-enable) byte is always set on every build.

Downgrade-enable — flash over any existing version. By default a drive refuses to accept an older firmware than the one it’s running (anti-rollback). freemkv sets the DE byte (0x1EC056 = 0xDE) in every image it builds, which flips that gate off — so a freemkv image installs cleanly over any existing firmware version. This is proven on hardware: with the DE byte set the drive accepts a lower version; with it cleared the same downgrade is rejected (ILLEGAL REQUEST / INVALID FIELD IN CDB) and nothing is written.

Response conventions

Responses are not uniform — read each verb’s response by its own rule:

Identity (0x01) returns the ASCII freemkv magic, a 1-byte version, and the current feature-state table. This is the command to use to confirm you’re talking to freemkv-flashed firmware.
Get (0x03) returns the named feature’s current state as a single byte.
Set (0x02) / Reset (0x04) / Save (0x0B) return a 1-byte status (01 = ok, 00 = fail); Reset also echoes its mode byte. After a SET that turns off the encryption handshake (Encryption = off), read the released Volume ID with a normal READ DISC STRUCTURE request — it does not come back in the command’s own response.
DumpAll (0x09) returns exactly 64 raw bytes from the requested address.

Safety

Examples (`sg_raw` on Linux)

The sg3-utils package provides sg_raw, which sends a raw CDB and prints the bytes read back. Pass the 10-byte READ BUFFER CDB and use -r <n> to request enough bytes for the response; keep the cdb[7..9] allocation length consistent with -r. The SET frame is … 02 <feature> <state>; GET is … 03 <feature>. Replace /dev/sg0 with your drive.

Identity probe — expect the response to lead with freemkv:

sg_raw -r 96 /dev/sg0 3C 0E C0 DE 01 00 00 00 60 00   # Identity → "freemkv" + version + state table

Speed — unlock to max, or write OEM (FF) to hand the subsystem back to the stock ramp:

sg_raw -r 1 /dev/sg0 3C 0E C0 DE 02 01 00 00 00 00    # SET Speed → max / uncapped
sg_raw -r 1 /dev/sg0 3C 0E C0 DE 02 01 FF 00 00 00    # SET Speed → OEM ramp

Region — go region-free, or pin a specific DVD / BD region:

sg_raw -r 1 /dev/sg0 3C 0E C0 DE 02 02 0F 00 00 00    # SET Region → region-free (RPC-1)
sg_raw -r 1 /dev/sg0 3C 0E C0 DE 02 02 02 00 00 00    # SET Region → force DVD region 2
sg_raw -r 1 /dev/sg0 3C 0E C0 DE 02 02 0B 00 00 00    # SET Region → force BD region B

Unrestricted — widen: accept Blu-ray and Ultra HD Blu-ray (AACS 1.0 / 2.0) discs, plus the extended auth-cell state-band on hardware where that hook exists:

sg_raw -r 1 /dev/sg0 3C 0E C0 DE 02 03 01 00 00 00    # SET Unrestricted → widen (STATE_ON)

An OEM-style rip keeps the real handshake but skips revocation; a full bypass turns the encryption handshake off entirely so sectors read back de-bussed. For HRL / Encryption, 00 is the unlock direction (wire id 0x07 is retired):

sg_raw -r 1 /dev/sg0 3C 0E C0 DE 02 05 00 00 00 00    # SET HRL → off (skip revocation check)
sg_raw -r 1 /dev/sg0 3C 0E C0 DE 02 06 00 00 00 00    # SET Encryption → off (bypass handshake, sectors de-bussed)

Read a feature’s current state back, persist the live settings, or reload the state:

sg_raw -r 1 /dev/sg0 3C 0E C0 DE 03 01 00 00 01 00    # GET Speed → 1-byte state
sg_raw -r 1 /dev/sg0 3C 0E C0 DE 0B 00 00 00 01 00    # SAVE → persist live settings to flash
sg_raw -r 1 /dev/sg0 3C 0E C0 DE 04 00 00 00 01 00    # RESET --to flash → reload saved config
sg_raw -r 1 /dev/sg0 3C 0E C0 DE 04 00 01 00 01 00    # RESET mode 01 → reload the baked defaults
sg_raw -r 1 /dev/sg0 3C 0E C0 DE 04 00 FF 00 01 00    # RESET --to oem → every feature to OEM, saved config blanked

DumpAll at an address of your choice (0xAABBCCDD shown as a placeholder) — expect 64 raw bytes:

sg_raw -r 64 /dev/sg0 3C 0E C0 DE 09 AA BB CC DD 00   # dump → 64 bytes at 0xAABBCCDD

The allocation length lives in cdb[7..9] big-endian (two bytes, e.g. 00 60 = 96 bytes for Identity), with cdb[9] the control byte. For DumpAll the 32-bit address instead occupies cdb[5..9].