Hi !!!

I do need to unlock one WD80EFZX-68UW8N0 drive. ATA password.

PC-3000 doesn't support that drive at all.

Does anyone here knows the "Super On" to gain module access on those modern drives ?

If the "arch" is the same of the older ARM based models i think i will have no problem in unlocking the drive if i can find the super on to gain module access.

Ram access / NVRam access shouldn't be a problem as well, again, assuming the arch is the same as the older models ...

Can someone here work at firmware level with those "newer" drives not suppoorted by PC-3000 ?

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

it's Hitachi and it has different architecture.

_________________
https://www.linkedin.com/in/artemrubtsov/

Interesting. I do know that it's Hitachi...

Problem is to gain access to SA ....

Any idea ? Does anyonme know how to do it ?

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

Yes, I do
Never tried it with a password on though

_________________
https://www.linkedin.com/in/artemrubtsov/

Does it use the same commands to read NVRam / memory access that all the other ARM based HGST use ?

And is the VSC to read module the same only changing the "super on" like on other ARM based drives ?

If i do have the super on can i read module directory with the same command used on other HGST arm based drives ?

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

no

no

no

it's a different drive, what you basically asking is "can I use WD commands to read a Samsung drive", no you can't.

_________________
https://www.linkedin.com/in/artemrubtsov/

@Doomer
Coold you upload the ROM image of such a drive?

Yes !!!

Also please do upload modules, NVRam, etc ...

I would love to see if the modules are more or less the same as the ones on HGST (IBM native).

Thanks.

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

ARM based are different from arch M24 and even so the modules are more or less the same and the way to check "road map" and retrieve the modules is more or less the same as well on both archs ... What i was asking is if the "system" to gain access to SA is absolutly different or if it's "close"....

WD use "key" VSCs sent on buffer. Both Arch M24 and ARM on Hitachi use ATA VSC even if newer ARM use LBA 48.

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

I don't know how else to answer this
it is a different architecture, different vendor commands, different SA and different hardware.
This drive has nothing to do with M24 or so-called "ARM" architecture.

_________________
https://www.linkedin.com/in/artemrubtsov/

Ok, thanks.

Do you have some NVRam, ROM, Modules, etc ... that you can post so that we can check them out ?

It would be nice to have an idea about it !

Maybe we can figure out the commands to access the SA/platters by checking ROM ...

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

I do but I'm not going to post it here
There are some things I don't like to be exposed

_________________
https://www.linkedin.com/in/artemrubtsov/

Can you PM, mail, etc .... the files ?

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

Spildit, I would eat my hat if Doomer posted any files from the SA on those drives.

_________________
All went well until I plugged the drive in.

I did get a ROM .... But i don't even know if it was obtained by VSC/SATA or read by external programmer.

At any rate this is quite different from traditional "ARM" arch ... No clue how to access SA and because this is not like traditional HGST ARM i can't find Super On on ROM as well ....

I do need to unlock one of those drives ...

I might have short points on PCB to make the drive go intro "safe mode" or kernel mode ... But i don't think it will help to remove password.

Also i think that on ROM there are mention to modules so ... Might be a start but it's not going to be easy mission....

One thing is to grab the commands that PC-3000, MRT, SeDiv, etc ... use and then send them by HRT terminal ... Another thing is to figure out the commands if none of the commercial tools (or any other available tool) to exist / support a specific drive ... In other words sniffing commands will not be possible so it's required to figure out the commands prior to all other firmware tools makers ...

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

Even if i somehow manage to access to SA on platters i would still need to figure out the module that is used to store the ATA password + flag that the password is "ON" and i would need a copy of the module from one unlocked drive ...

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

These drives support a new command set named SPC. One of these new commands allows reading of drive's memory . No need of SuperOn or VSC....or sniffing.

Interesting .... And how to access the modules on the platters ?

Any idea on how to unlock the drive ?

Can you read/write to memory on those drives ? If so it might be possible to patch memory to change the password on RAM.

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

So ... Are you saying that SPC is "standard" and allows to read/write the drive memory ?

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

Ok ... I did manage to get a ROM file from Doomer .... Time to eat your hat ?

This is very cool. Drive is not like "older" ARM based drives at all.

It does have SA on platter and CPs on ROM.

There is a CODF section on ROM that indicates the drive family :

T515000
515
09/03/14 12:18:58
A4GNT514
ARIESHC8SATA
RELEASE
bldcrew
fjofficial1
Y:/ccb6p/R515/library/ARIESHC84KA4GNT515

On ROM there are a table of SA modules with a DIR and a FAT module. This would suggest that the SA file system has a FAT-like structure.

There is also a table for CP modules that are stored on ROM.

The first ROM resident CP is FSVG.

We will be targeting the security CPs .... So those would be CODF CP (ID = 82h), FCOD (security class appears to be Generic), FSEC (ID = 98H) and GNRC CPs.

Maybe we can still unlock this drive by ROM manipulation ...

A huge thanks to @fzabkar for taking the time to analyze this ROM and providing me the information that i did just post.

One step close to unlock this drive and to better understand the firmware arch of those newer drives.

Maybe this time we will beat ACE and figure out a way to access the SA on those prior to PC-3000 support !

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.