I found out how to use a vendor-specific command to read the raw data from the buffer of the drive before descrambling and ECC. Look up the "FriiDump" project for some more background information. I then patched the firmware in memory (that took a lot of work...) to cause regular read commands to return the raw data.
(Contrary to some of the other comments in this thread, the drive was actually an LG.)
I'd also like to know. I tried to send those commands (SCSI I think?) to the drive, but it seemed to just ignore them. Heck, it seemed to ignore a huge portion of the different commands I tried to send it.
That matches with my recollection too. I remember getting a specific model of a LiteOn drive specifically to ensure that I had the ability to do this, both for data recovery and because some forms of copy protection abused disc read errors and made reading your own CDs a (kernel blocking) pain under linux. I think the source of `cdparanoia` [1] has some good examples.
(Contrary to some of the other comments in this thread, the drive was actually an LG.)