All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 72 posts ]  Go to page Previous  1, 2, 3, 4  Next
Author Message
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 18th, 2016, 16:41 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 8163
Location: Portugal
fzabkar wrote:
IIUC, Toshiba's firmware code is entirely on the PCB. The drive only needs to access the SA for certain data modules (SMART, G-list, P-list, etc). Also, the CPs seem to be data modules rather than code. Shouldn't it then be possible to transfer the patient's CPs to a donor ROM, even if the firmware isn't exactly the same version? I mean, it's not like WD or Seagate drives where you need to match ROM code with SA overlays, or is it? Assuming that the lock is activated by the code in the patient but ignored by the code in the donor, then a CP transfer to a regular non-Sagem ROM should unlock the drive.



If the lock were to be on the "main code" of the ROM, re-flashing the ROM code with something like a vendor update tool would revert the "costumized" locked drive to a regular drive. I don't think that the lock is done on the main code but i might be wrong.

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 18th, 2016, 21:05 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 9801
Location: Australia
Video Stream HDD - MQ01ABD100VS / MQ01ABD050VS / MQ01ABD032VS / MQ01ABD025VS:
http://toshiba.semicon-storage.com/us/p ... xxxvs.html

Quote:
Toshiba's MQ01ABD-VS series adds security authentication to our MQ01ABD-V Series. The Security authentication feature is for Digital Rights Management (DRM) used in STB applications. The MQ01ABD-VS series is suitable for video editing, set-top-box (STB), digital video recorders (DVR) and network video recorders (NVR) applications where large capacity, low power and low acoustics are critical.

Perhaps one could adapt a ROM from a MQ01ABD-V HDD.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 19th, 2016, 5:39 
Offline

Joined: February 18th, 2016, 14:37
Posts: 14
Location: Romania
I highly doubt the ROM can be flashed. You don't have acces to the CP's, they're only listed as available, you can't edit sectors, you can do pretty much nothing on it. I'll post later some screenshots from PC3K, and also terminal is locked, enter prompt doesn't work and it actually continuously gives the message to connect the PC-adapter(terminal) to it, even tough it is connected. The only way around I see it is you can short some channels to jump over the platter readings, but I'd need some documentation regarding this drive's PCB details, which I haven't found. fzabkar had a nice idea with the flashing of the ROM, but like I said, on PC3K I doubt you can do it. Only with a stock Toshiba tool maybe to update the firmware. In this regard, I might get my hands on one of those drives. On another note, if anyone has some information regarding the boot-up sequence and the way Toshiba drives load the ROM and CP's, please do post a link or something.


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 19th, 2016, 5:52 
Offline

Joined: February 18th, 2016, 14:37
Posts: 14
Location: Romania
It would be cool if someone actually managed to dump the ROM or CP's, so we could compare them to an unlocked drive of these series. If there is any kind of suggestion regarding how to do that, do post it. Meanwhile, I'm attaching the RAM (read through terminal and ATA), ROM and CP's I got from an ABD unlocked.


Attachments:
SABackup.rar [14.21 KiB]
Downloaded 122 times
ROM.rar [404 Bytes]
Downloaded 138 times
RAM.rar [6.12 KiB]
Downloaded 132 times
Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 19th, 2016, 7:28 
Offline

Joined: February 18th, 2016, 14:37
Posts: 14
Location: Romania
So here are the screenshots from the Toshiba.


Quite interestingly, I do actually have sector acces and can write/read the sectors in user LBA, but that is the only things which you can edit. Everything else goes in that ABR error.


The most important notice, however, is the fact that the drive is detected automatically and it's ID IS read together with it's serial and firmware version. Yet if you look down below, the no. of cylinders is 0 and head also 0 with SPA numbered to N ( wth ? ). This implies that during it's power up you do have acces to the CP's ( at least CP 56 which holds the ID/serial/fw version), and you do have acces to user LBA, meaning you can write/read off the drive. Somehow, it doesn't sucessfully read the drive parameters though ( it doesn't recognize the no. of cylinders, spa , heads blah blah), meaning that the ROM itself is modified, not the CP's.


Attachments:
t6.png
t6.png [ 98.63 KiB | Viewed 3211 times ]
t5.png
t5.png [ 157.18 KiB | Viewed 3211 times ]
t4.png
t4.png [ 153.64 KiB | Viewed 3211 times ]
t3.png
t3.png [ 139.72 KiB | Viewed 3211 times ]
t2.png
t2.png [ 105.79 KiB | Viewed 3211 times ]
t1.png
t1.png [ 118.01 KiB | Viewed 3211 times ]
Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 19th, 2016, 8:10 
Offline

Joined: March 19th, 2015, 15:01
Posts: 1289
Location: isreal
g0dzax wrote:
meaning that the ROM itself is modified, not the CP's.

Most of the CP's is stored in ROM


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 19th, 2016, 9:15 
Offline

Joined: February 18th, 2016, 14:37
Posts: 14
Location: Romania
What I meant to say is maybe the code is modified such that it accesses the CP in another way than the "normal" drives access the CP's.


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 19th, 2016, 12:55 
Offline

Joined: October 24th, 2005, 17:04
Posts: 218
Quote:
ROM.rar [404 Bytes]
Downloaded 1 time

similar to access terminal blocked
You do not want to sell this locked-HDD?


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 19th, 2016, 13:16 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 8163
Location: Portugal
g0dzax wrote:
What I meant to say is maybe the code is modified such that it accesses the CP in another way than the "normal" drives access the CP's.


The PCB should have a ROM chip. Dump that ROM with external programmer.

Do you have many of those locked drives or just one ?

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 19th, 2016, 13:18 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 8163
Location: Portugal
Your PC3K screen captures show that the drive ID correctly and that you have access to LBA space ....

So if you place the drive on a regular computer you can't read it or write to it ?

If so then what is "unlocking" the drive is the VSC that PC3K uses when you run the Toshiba utility, most likely the some sort of Super On VSC.

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 19th, 2016, 13:23 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 8163
Location: Portugal
g0dzax wrote:
It would be cool if someone actually managed to dump the ROM or CP's, so we could compare them to an unlocked drive of these series. If there is any kind of suggestion regarding how to do that, do post it. Meanwhile, I'm attaching the RAM (read through terminal and ATA), ROM and CP's I got from an ABD unlocked.


Your posted ROM is invalid :

Attachment:
1.jpg
1.jpg [ 81.89 KiB | Viewed 3163 times ]


Please DUMP the ROM with PC3K TERMINAL. Do not use ATA. Please do post again the ROM of the good drive.

Do not assume that the CPs were correctly retrieved as well. PC3K is buggy on that regard.

I will extract the ROM CPs from the ROM IMAGE with @fzabkar Toshiba ROM-CPs tool : - http://www.hddoracle.com/viewtopic.php?f=22&t=1724

UNLIKE PC3K this will extract the CPs with correct size from ROM image as long as ROM image have CP directory table on it. Never rely on PC3K to dump CPs in particular if some of them show CRC error : - http://www.hddoracle.com/viewtopic.php?f=12&t=1721

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 20th, 2016, 2:46 
Offline

Joined: February 18th, 2016, 14:37
Posts: 14
Location: Romania
I don't have any external programmers. If you'd be kind to recommend me a good one + software, I will get one and dump the ROM from a locked one. Unfortunately, I don't have many drives of this kind (only 2 left) as the rest of them left with the batch. DAMN ! The unlocked drive I had was from a long time ago ( I think a few months ) and I don't have anymore of these unlocked drives. Back then I was a real noob and didn't bother with those Toshiba. But yeah, you can write/read/erase them, user LBA is no problem, I only wanted to unlocked them since it seemed like a nice challenge. I'd lost my will when I saw that I couldn't edit anything there, but I found these 2 old locked ones and began researching again. I don't there's a way to sell the locked one, after all I am just an employee here, but I can try to talk and see if it can be done. So the dumping of the ROM of a locked drive with the external programmer - that is kinda the only thing I can do right now. Only useful thing from the above attachments would be the RAM, IIRC it contains an altered ROM image.


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 20th, 2016, 16:51 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 8163
Location: Portugal
I think that something like this should work just fine :

http://www.reveltronics.com/en/products ... rammer-usb

Also please confirm that the chip on the PCB is on the programmer list of supported chips.

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 22nd, 2016, 9:08 
Offline

Joined: September 8th, 2016, 4:39
Posts: 16
Location: Israel
I'm not that technical guys but I do have ROM programmer I got with my MRT, I guess the ROM is the one marked in red? If the process involves soldering it will not be worthy to deal with the unlocking of these drives...

Image


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 26th, 2016, 19:16 
Offline
User avatar

Joined: September 26th, 2016, 18:33
Posts: 7
Location: Poland
Hi all !, I managed to unlock the Toshiba MK5055GSX Firmware ver. FG001M
User Password was forgotten, Security - Maximum, Master Password unchanged.

Here's the solution that helped me !

I have created the dos bootable usb and copied onto atapwd.exe and zu.exe programs.
Next I've run the atapwd.exe and issued the command SECURITY ERASE PREPARE and exit the program.
Next run the zu.exe with zu /s in my case and Bam !!! hdd unlocked !! :)

Hopefully this will help someone ;)


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 29th, 2016, 17:27 
Offline

Joined: January 7th, 2012, 11:48
Posts: 25
Location: netherlands
is it possible to unlock such drives with reading the rom and modify it?


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 29th, 2016, 17:35 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 8163
Location: Portugal
zenelli wrote:
is it possible to unlock such drives with reading the rom and modify it?


Maybe ... We would still need to discover how. But the first step would be that- Read ROM and extract it's CPs. Then compare with ROM from unlocked drive.

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 29th, 2016, 17:36 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 8163
Location: Portugal
eyal wrote:
I'm not that technical guys but I do have ROM programmer I got with my MRT, I guess the ROM is the one marked in red? If the process involves soldering it will not be worthy to deal with the unlocking of these drives...

Image


Yes, chip is correct but you will have to un-solder it and also i'm not sure if MRT programmer would handle that chip. You would have to check the CHIP markings and check if it's compatible with MRT programmer.

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 30th, 2016, 1:23 
Offline

Joined: February 18th, 2016, 14:37
Posts: 14
Location: Romania
I'm still on hold to a programmer coming, but I've gotten my hands on another Toshiba from the MQ01ABD family, the V series for desktop. I'm uploading the ROM and stuff out of it, maybe we could understand it's internal workings. However, from a glance, I have to say that it's ...different from the ROM's of other brands. Also, trying to read the service tracks yields in errors over errors, I guess there are only some specific tracks that are available/used in the PC3K utility. I'm gonna check out which one's are and try to get them again to get a glimpse on how they are. I am pretty sure the ROM of the locked one's (either 250,320 or 500 GB) is almost exactly the same as this one.


Attachments:
File comment: ROM read through terminal.
000000-07FFFF.rar [284.11 KiB]
Downloaded 114 times
File comment: RAM read through terminal.
000000-000FFF.rar [3.04 KiB]
Downloaded 105 times
File comment: The CP's and G-List.
SABackup.rar [14.98 KiB]
Downloaded 99 times
Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 30th, 2016, 7:52 
Offline

Joined: January 7th, 2012, 11:48
Posts: 25
Location: netherlands
Spildit wrote:
zenelli wrote:
is it possible to unlock such drives with reading the rom and modify it?


Maybe ... We would still need to discover how. But the first step would be that- Read ROM and extract it's CPs. Then compare with ROM from unlocked drive.



well i have taking out the chip and read with my programmer, maybe someone can tell me more.
it is an MK5061GSY TOSHIBA


Attachments:
toshiba.rar [274.31 KiB]
Downloaded 112 times
Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 72 posts ]  Go to page Previous  1, 2, 3, 4  Next

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Yahoo [Bot] and 38 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group