ATA password bypassing

[kotel]

https://www.hddoracle.com/viewtopic.php?f=95&t=166&p=334#p334

Running the ZU under win XP, the application opens for a quarter of a second then closes, but under CMD it works. Is there anyway to see what drive i selected? I know that there are /P, /S and /A commands, but I am not sure which command to use. Currently i got 1 hdd on SATA (OS drive) and 1 IDE drive set as master (the one i want the password to be removed). Running both commands seem to also move the os drive's heads. I am also very new to ZU. Any ideas?

[kotel]

https://www.hddoracle.com/viewtopic.php?f=95&t=166&p=334#p334

Do i need to run it under CMD or DOS? Running it in windows closes the tool after quarter of a second. Also, since i got 1 sata drive (OS drive) and 1 ide drive (the one i want to unlock) should I choose /S command or /P command? I an very new to ZU.

[kotel]

Okay, i unlocked it using ZU under dos. Unplugged the OS drive and just left the locked drive. Now ill try unlocking an Seagate ST310014ACE and an Fujitsu MHV2100BH.

[kotel]

Sadly, i couldn't unlock both of the drives. Seagate one is detected but after 1 second it clicks and ZU says unlock not complete. The fujitsu drive isn't detected at all. The sata is set to IDE so it should get detected, right? Any ideas?

[fzabkar]

Script for retrieving Fujitsu HDD CPs :

https://www.hddoracle.com/viewtopic.php?p=14363#p14363

One of the CPs would be security related, I would think.

How to unlock a Seagate Drive (prior to F3):

https://www.hddoracle.com/viewtopic.php?p=31#p31

[kotel]

Script for retrieving Fujitsu HDD CPs :

https://www.hddoracle.com/viewtopic.php?p=14363#p14363

One of the CPs would be security related, I would think.

How to unlock a Seagate Drive (prior to F3):

https://www.hddoracle.com/viewtopic.php?p=31#p31

Running the script in MHDD leaves me with an ERROR: cannot create file FUJ_MODS.BIN. Since i don't have an TLL adapter for the seagate, im gonna focus on the fujitsu hdd. Any ideas?

[kotel]

Running the script returns me with an error that it cant create the file FUJ_MODS.BIN. Im gonna focus on the fujtisu hdd first since it seems like the seagate one is from an xbox. Any ideas?

[fzabkar]

Code:

sectorsto = fuj_mods\%modid.bin

You need to create a directory named "fuj_mods". All the modules will then be saved to this directory.

[kotel]

Can i create that directory anywhere on the floppy or in the mhdd folder?

[fzabkar]

If you use the following line, then you can place the directory in the root. Otherwise, it is a subdirectory of your MHDD directory.

Code:

sectorsto = \fuj_mods\%modid.bin

See page 12:

https://www.acelab.ru/dep.pc/doc.pc3000dos/060713.001/Fuj_MPG-3.pdf

CP 0x0C (SM) stores the master password.

CP 0x0D (SU) stores the user password.

[kotel]

After running the script it created .bin files from 1 to 161 until it filled up the whole floppy. Any ideas what should i do next?

[fzabkar]

Examine 12 and 13 with a hex editor, eg HxD.

[kotel]

Examine 12 and 13 with a hex editor, eg HxD.

The problem is they are missing Seems like it also skiped 56-64, 80, 83-85, 87-95, 113-127, and 160. Any ideas?

[fzabkar]

I do have some ideas, but they would require experimenting with a donor drive. I suspect that the SU and SM modules cannot be accessed due to some kind of protection issue.

In any case, I find it disturbing that you want to defeat the password on so many drives. Something is not right ...

Edit: Xbox?

https://forum.hddguru.com/viewtopic.php?f=1&t=33526

[fzabkar]

Can you upload your module dump?

Here are two resource dumps:

https://files.hddguru.com/download/PC-3000%20Support/Firmware/Fujitsu/FUJITSU%20MHV2100BH%20PL-00000029-NWAET632566W.rar
https://files.hddguru.com/download/PC-3000%20Support/Firmware/Fujitsu/FUJITSU%20MHV2080BH%20PL-0042002A-NWAWT6C26B77.rar

[kotel]

The reason I've got so many locked drives is because i recently got 9 "untested" drives, 3 of which are locked. I've also forgot to state that i do not need the data on them, just trying to make them usable again. Ill try to look for a working donor drive thats for a reasonable price. I'll try dumping the modules today.

[kotel]

Sadly i forgot that i am not able to do module dumps and i don't have an TLL adapter for the seagate drive. Any ideas?

[fzabkar]

Sadly i forgot that i am not able to do module dumps and i don't have an TLL adapter for the seagate drive. Any ideas?

After running the script it created .bin files from 1 to 161 until it filled up the whole floppy.

Upload these .bin files (after ZIP-ing them).

[kotel]

Sadly i forgot that i am not able to do module dumps and i don't have an TLL adapter for the seagate drive. Any ideas?

After running the script it created .bin files from 1 to 161 until it filled up the whole floppy.

Upload these .bin files (after ZIP-ing them).

Here.

Attachments

fuj_mods.zip

(102.27 KiB) Downloaded 10 times

[fzabkar]

I can't see anything that looks like a security module. Those other resource dumps don't have the SU and SM modules, either, so I don't know whether a donor would be useful. I was thinking that a hot swap might work, but now I'm not so sure. If I knew how to obtain a full track dump I might be able to do something, but unfortunately I don't.