==================================== TODO =====================================
[unintentioanl behavior (or bug)]
. failed to read of LBA 16 http://forum.redump.org/post/94542/#p94542
. the shifted offset be explained by ASUS drive or a Linux bug? http://forum.redump.org/post/90412/#p90412 http://forum.redump.org/post/93955/#p93955
. The C2 errors are completely random and inconsistent Scooby-Doo! 2.0.0 for the iXL http://forum.redump.org/post/89722/#p89722 http://forum.redump.org/post/90011/#p90011
. failed to read Directory Record of some XBOX discs http://forum.redump.org/post/97640/#p97640
. PS2 unlicenced disc doesn't match the hash http://forum.redump.org/post/96246/#p96246 http://forum.redump.org/post/97804/#p97804

[protection]
. support DiscGuard http://forum.redump.org/post/94457/#p94457
. support twin sector disc (for ALPHA-ROM, ROOT, TAGES)
. support SafeDisc on DVD http://forum.redump.org/post/87385/#p87385

[image]
. support mdf/mds (for SecuROM v4.x or higher, StarForce, CD-Cops)
. support cue file of sub-pchannel version

[main]
. check IED, EDC of DVD
  ecma-267 p24
  [quote]
  16.2 ID Error Detection Code (IED) 
  When identifying all bytes of the array shown in figure 16 as Ci,j for i = 0 to 11 and j = 0 to171, the check bytes of 
  IED are represented by C0,j for j = 4 to 5. Their setting is obtained as follows. 
  [/quote]
  
  [quote]
  16.4 Error Detection Code (EDC) 
  This 4-byte field shall contain the check bits of an Error Detection Code computed over the preceding 2 060 bytes 
  of the Data Frame. Considering the Data Frame as a single bit field starting with the most significant bit of the first 
  byte of the ID field and ending with the least significant bit of the EDC field, then this msb will be b16 511 and the 
  lsb will be b0. Each bit bi of the EDC is as follows for i = 31 to 0 : 
  [/quote]

. support generating ecc/edc when unreadable sectors are generated http://forum.redump.org/post/93774/#p93774

. LBA 2174 has 2352+16 bytes? Due to this sector LBA 2175 ... last are all shifted. http://forum.redump.org/post/92408/#p92408
. LBA 950 ... last are all shifted because LBA 949 is mastering error (2352 + 120 bytes) http://forum.redump.org/post/92507/#p92507

[sub]
. check parity P, Q for CD+G
  https://webstore.iec.ch/publication/3885 p24
  [quote]
  19.3 Error Correction parity P
  (24, 20)Read-Solomon code over GF(2^6)
   Polynominal: P(X) = X^6 + X + 1
   1 symbol = 6 bit

   The parity matrix WHp is:
               {  1   1   1 . . .  1 1}
          Hp = {a23 a22 a21 . . . a1 1}
               {a46 a44 a42 . . . a2 1}
               {a69 a66 a63 . . . a3 1}

   The primitive element a of GF(2^6) is:

                   msb      lsb
              a = (0 0 0 0 1 0)

   The parity symbols P0 = P - S24n+20 and P1 = P - S24n+21, P2 = P - S24n+22 and P3 = P - S24n+23
   are defined to satisfy the following question:

              Hp X Vp = 0
   where
               {D - S24n}
          Vp = {D - S24n+1}
               {D - S24n+2}
               {D - S24n+3}
                  :
               {D - S24n+23}
  
  19.7 Error Correction parity Q
  (4, 2)Read-Solomon code over GF(2^6)
   Polynominal: P(X) = X^6 + X + 1
   1 symbol = 6 bit

   The parity matrix WHq is:
          Hq = { 1  1  1 1}
               {a3 a2 a1 1}

   The primitive element a of GF(2^6) is:

         msb      lsb
    a = (0 0 0 0 1 0)

   The parity symbols Q0 = D - S24n+2 and Q1 = D - S24n+3 are defined to satisfy the following
   equation:
               Hq x Vq = 0
   where
               {D - S24n}
          Vq = {D - S24n + 1}
               {D - S24n + 2}
               {D - S24n + 3}

   This Q-parity system combined with scrambling and interleaving can correct an error burst of
   59 subcoding symbols on the disc by using a single symbol correcting strategy (symbols 0, 1, 2
   and 3 only).
  [/quote]
   => ISO/IEC 10149:1995 (http://standards.iso.org/ittf/PubliclyAvailableStandards/index.html)
      14.5 P-Parity field p17, 14.6 Q-Parity field p17, Annex A pp25-28
       This document is the specification of the CD-ROM, and these pages are described about
      EDC(Error Detection Code), ECC(Error Correction Code).
       EDC, ECC is coded by "ecm - Encoder/decoder for Error Code Modeler format" of Neill Corlett.
      So, I can use these documents and source codes as reference, but I don't understand these yet.

. sub fixing algo
  http://forum.redump.org/post/61192/#p61192
  1. You define 9 variables: SubRereadNum, CurrentSubReadNum, CurrentSectorNum, FixLevel, QCurrentSector, QNextSector, QGenSector, QEAN, QISRC.
  2. From commandline args you read FixLevel (should be between 0 and 96) and SubRereadNum (0 or larger)
  3. You read a sector with the LBA = CurrentSectorNum (0 by default) and put its Q-channel into QCurrentSector.
  3.1. If QNextSector is null: you read a sector with LBA = CurrentSectorNum + 1, check its Mode (should be 0x01) and Q-CRC and put its Q-channel into QNextSector. 
       If Q-CRC is bad or Mode != 1, you read a sector with LBA = CurrentSectorNum + 2, check its Mode and Q-CRC, if both are fine, you substract 1 frame from MSF and AMSF (MSF - 1 and AMSF - 1), fix Q-CRC and write that into Q-NextSector.
       If Q-CRC is bad again or Mode != 1, you read a sector with LBA = CurrentSectorNum + 3, etc.
  4. If Q-CRC of QCurrentSector matches, go to p.5.
  4.1. If Q-CRC of QCurrentSector doesn't match: QGenSector = QNextSector - 1 frame (MSF - 1, AMSF - 1, fix Q-CRC).
  4.2. You do a binary compare (96 bits vs 96 bits) between QCurrentSector and QGenSector and count a number of bits that differ. If their count is <= FixLevel: QCurrentSector = QGenSector and go to p.5.
  4.3. If QEAN != null, you do a binary compare between QCurrentSector and QEAN and count a number of bits that differ. If their count is <= FixLevel: QCurrentSector = QEAN and go to p.5.
  4.4. If QISRC != null, you do a binary compare between QCurrentSector and QISRC and count a number bits that differ. If their count is <= FixLevel: QCurrentSector = QISRC and go to p.5.
  4.5. If still not matched and CurrentSubReadNum < SubRereadNum: clear the drive's cache and go to p.3
  5. Write QCurrentSector to the .sub
  5.1. If Q-CRC is bad: QNextSector = QNextSector + 1 frame (add + 1 to MSF, add + 1 to AMSF, fix Q-CRC)
  5.2. If Q-CRC is good and QCurrentSector mode = 0x01: QNextSector = QCurrentSector + 1 frame
  5.3. If Q-CRC is good and QCurrentSector mode = 0x02 (EAN): QEAN = QCurrentSector and QNextSector = QNextSector + 1 frame
  5.4. If Q-CRC is good and QCurrentSector mode = 0x03 (ISRC): QISRC = QCurrentSector and QNextSector = QNextSector + 1 frame
  5.5. CurrentSectorNum = CurrentSectorNum + 1, CurrentSubReadNum = 0

  http://forum.redump.org/post/61203/#p61203
  For each of the P, R, S, T, U, V, W channels you just need to detect the padding byte for the current sector
  (if more than 6 bytes are 0x00 - the padding byte is 0x00, if more than 6 bytes are 0xFF - the padding byte is 0xFF), 
  then do a bit compare of the current sector against 000000000000000000000000 or FFFFFFFFFFFFFFFFFFFFFFFF or any other variant, if exists.
  If a number of mismatching bits is <=FixLevel: fix them, if >FixLevel: reread or skip.
  If the padding byte can't be detected - reread or skip, for R-W channels that could mean CD+G data.
  
[other]
. support 0xd8 dumping of SONY, PIONEER
  ftp://ftp.t10.org/t10/document.95/95-104r0.pdf
  http://www.pioneerelectronics.com/pio/pe/images/portal/cit_3424/31636562SCSI-2RefManV31.pdf
   => I don't have these old drive yet.

. read lead-in precisely
  http://senbee.seesaa.net/article/20732055.html
  http://www.13thmonkey.org/documentation/SCSI/mmc6r02g.pdf p43
  [quote]
   Addressing in the program area begins with 00:00:00. This advances up through the Lead-out.
   The last frame in the Lead-in is 99:59:74 and decreases as the spiral is followed toward the center of the disc.
   The Lead-in is typically 3 to 4 minutes in length.
  [/quote]
   => I don't know the precise length of the Lead-in/out. I want the specification about the Lead-in/out.
   => I know PLEXTOR drive reads lead-in partially (about 2000 sectors) and lead-out (100 sectors - 00:01:25)
   => I know Lite-on drive reads lead-out (about 6750 sectors - 01:30:00)

. search the offsets precisely
  http://forum.redump.org/post/56707/#p56707
  [quote]
  1.search sync. (IsValidMainDataHeader) "i" is 0x6c(108)
  2.get msf. (BcdToDec) "sm" is 0, "ss" is 01, "sf" is 70
  3.convert msf to lba. (00:01:70 -> 145) "tmpLBA" is -5
  4.calc offset. (2352 * -(-5 - 0) + 108 = 11868(bytes), 2967(samples)

  Well, you should additionally read the 0-(-5) sector applying the +108 offset correction and if 
  you don't get the LBA 0 header there - you need to check the nearby bytes until you find it (and modify the offset value afterwards).

  As for the problem in general (this and my Saturn examples), you may improve the offset detection the following way:

  1. Extract -5000 to 0 area into track01_pregap.bin
  2. Search for the first occurence of the LBA -150 sync (AMSF 00:00:00)
  3. Search for the following occurence of the LBA 0 sync (AMSF 00:02:00)
  4. Cut all the data before -150 and all the data starting from 0.
  5. Count the resulting size of track01_pregap.bin in bytes, then substract 150*2352. 
  If the result isn't 0 - redo all the steps, if the result is the same - report, then substract 
  the difference from the previously detected offset value. Note, that it would be the offset value to report for the disc,
   but for the dumping process itself, you should use the previously detected one. 
  As a bonus, you will have the properly dumped Track01 pregap (of course, 
  that algorythm is only correct for the discs with the first track and its pregap data, not audio.
   PCE/PC-FX/Jag discs need a different approach, as well as Audio CD ones).
  [/quote]
