All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 53 posts ]  Go to page 1, 2, 3  Next
Author Message
 Post subject: Toshiba 500GB out of DVR Locked
PostPosted: April 20th, 2016, 16:31 
Offline

Joined: April 20th, 2016, 16:25
Posts: 1
Location: Dominican Republic
Hi, so i got these 2 hdd's that were taken out of a DVR from sagemcom, they are locked.
i tried before with some tools but no success...

Model: MQ01ABD050VS

Thanks!


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: April 25th, 2016, 9:21 
Offline

Joined: March 7th, 2009, 12:43
Posts: 1080
Location: Angel Data Recovery
What is terminal log?

_________________
Angel Data Recovery


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: April 27th, 2016, 14:26 
Offline

Joined: October 24th, 2005, 17:04
Posts: 242
DR-Kiev wrote:
What is terminal log?

and what should be in the terminal ?


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: May 2nd, 2016, 3:57 
Offline

Joined: April 14th, 2014, 17:19
Posts: 48
Location: new zealand
There are a few master passwords on drives, there is also a few tools around on xbmc4xbox forums for this as the hdd in the original xbox had a similar setup to avoid tampering.
but I have never seen any Toshiba specific drives mentioned.

_________________
drugstoredir2014.com


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 8th, 2016, 4:58 
Offline

Joined: September 8th, 2016, 4:39
Posts: 16
Location: Israel
Hi,

I have some of this model as well, anyone managed to get this unlocked?


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 8th, 2016, 5:00 
Offline

Banned User

Joined: August 12th, 2016, 12:54
Posts: 55
Location: US
jarogill wrote:
Hi, so i got these 2 hdd's that were taken out of a DVR from sagemcom, they are locked.
i tried before with some tools but no success...

Model: MQ01ABD050VS

Thanks!

Can you need to use the toolkit PC3K, DFL, MRT
To break the hard drive password

_________________
I am from cuudulieuocung.org and I am currently banned from this forum for creating multiple accounts to promote my crappy website.


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 8th, 2016, 5:03 
Offline

Joined: September 8th, 2016, 4:39
Posts: 16
Location: Israel
I have MRT but it can't handle this lock. it's not conventional password, it's more than that!


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 8th, 2016, 5:11 
Offline

Banned User

Joined: August 12th, 2016, 12:54
Posts: 55
Location: US
eyal wrote:
I have MRT but it can't handle this lock. it's not conventional password, it's more than that!

Can you update New Version 160528

_________________
I am from cuudulieuocung.org and I am currently banned from this forum for creating multiple accounts to promote my crappy website.


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 8th, 2016, 7:50 
Offline

Joined: September 8th, 2016, 4:39
Posts: 16
Location: Israel
tonny wrote:
eyal wrote:
I have MRT but it can't handle this lock. it's not conventional password, it's more than that!

Can you update New Version 160528


Update MRT software? I'm on last version, updated 2 days ago.


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 14th, 2016, 4:48 
Offline

Joined: September 8th, 2016, 4:39
Posts: 16
Location: Israel
Spildit wrote:
Maybe you should start by dumping the CPs of your drive and compare with CPs of the same unlocked drive ?

Does the drive report as ATA locked or you can't just scan the user area ?


This is what I get:

Image


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 14th, 2016, 15:34 
Offline

Joined: March 19th, 2015, 15:01
Posts: 1387
Location: isreal
eyal wrote:
Spildit wrote:
Maybe you should start by dumping the CPs of your drive and compare with CPs of the same unlocked drive ?

Does the drive report as ATA locked or you can't just scan the user area ?


This is what I get:
Why do you think its locked and not a head(s) problem ?


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 18th, 2016, 5:52 
Offline

Joined: September 8th, 2016, 4:39
Posts: 16
Location: Israel
I can't scan surface, sectors can't be read, also CP and ROM are not accessible. I have 6 different drives, all are showing in HDSetninel as 100% health, it's not head problem, it's some sort of lock made by sagemcom Set top boxes, there are also HGST and WD drives locked by this same technique.


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 18th, 2016, 12:57 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 3464
Location: CDRLabs @ Chandigarh [ India ]
Spildit wrote:
eyal wrote:
I can't scan surface, sectors can't be read, also CP and ROM are not accessible. I have 6 different drives, all are showing in HDSetninel as 100% health, it's not head problem, it's some sort of lock made by sagemcom Set top boxes, there are also HGST and WD drives locked by this same technique.


WD should be easy to unlock by editing mod 02.
Can you dump the ROM chip using external programmer ?
I would start by dumping the ROM image and then extract the CPs out of it (if there is a module directory on ROM). Then you can compare with one unlocked drive of the same model.
If you can't get to the ROM then you can't edit a thing. I don't think it will be as easy to unlock as the WD drive.
HGST you will need to dump the NVRam but i don't think that the MRT Pro/PC3K will allow for you to do so as the drive will prevent access to it (locked). You can use "other methods" like external programmer as well.


Well,
Only Few Mods Are There on Platter in toshiba ,Like G List Etc .So Reading ROM Using a Tool And Then Extracting CP Should Be Good Enough If Other Working HDD and Its CP Are available For comparison .What i cannot digest is that why CP's cannot be read .Hopefully a Better Tool Like PC3k might work then mrt and dfl

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 18th, 2016, 16:25 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
IIUC, Toshiba's firmware code is entirely on the PCB. The drive only needs to access the SA for certain data modules (SMART, G-list, P-list, etc). Also, the CPs seem to be data modules rather than code. Shouldn't it then be possible to transfer the patient's CPs to a donor ROM, even if the firmware isn't exactly the same version? I mean, it's not like WD or Seagate drives where you need to match ROM code with SA overlays, or is it? Assuming that the lock is activated by the code in the patient but ignored by the code in the donor, then a CP transfer to a regular non-Sagem ROM should unlock the drive.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 18th, 2016, 21:05 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
Video Stream HDD - MQ01ABD100VS / MQ01ABD050VS / MQ01ABD032VS / MQ01ABD025VS:
http://toshiba.semicon-storage.com/us/p ... xxxvs.html

Quote:
Toshiba's MQ01ABD-VS series adds security authentication to our MQ01ABD-V Series. The Security authentication feature is for Digital Rights Management (DRM) used in STB applications. The MQ01ABD-VS series is suitable for video editing, set-top-box (STB), digital video recorders (DVR) and network video recorders (NVR) applications where large capacity, low power and low acoustics are critical.

Perhaps one could adapt a ROM from a MQ01ABD-V HDD.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 19th, 2016, 5:39 
Offline

Joined: February 18th, 2016, 14:37
Posts: 14
Location: Romania
I highly doubt the ROM can be flashed. You don't have acces to the CP's, they're only listed as available, you can't edit sectors, you can do pretty much nothing on it. I'll post later some screenshots from PC3K, and also terminal is locked, enter prompt doesn't work and it actually continuously gives the message to connect the PC-adapter(terminal) to it, even tough it is connected. The only way around I see it is you can short some channels to jump over the platter readings, but I'd need some documentation regarding this drive's PCB details, which I haven't found. fzabkar had a nice idea with the flashing of the ROM, but like I said, on PC3K I doubt you can do it. Only with a stock Toshiba tool maybe to update the firmware. In this regard, I might get my hands on one of those drives. On another note, if anyone has some information regarding the boot-up sequence and the way Toshiba drives load the ROM and CP's, please do post a link or something.


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 19th, 2016, 5:52 
Offline

Joined: February 18th, 2016, 14:37
Posts: 14
Location: Romania
It would be cool if someone actually managed to dump the ROM or CP's, so we could compare them to an unlocked drive of these series. If there is any kind of suggestion regarding how to do that, do post it. Meanwhile, I'm attaching the RAM (read through terminal and ATA), ROM and CP's I got from an ABD unlocked.


Attachments:
SABackup.rar [14.21 KiB]
Downloaded 549 times
ROM.rar [404 Bytes]
Downloaded 645 times
RAM.rar [6.12 KiB]
Downloaded 603 times
Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 19th, 2016, 7:28 
Offline

Joined: February 18th, 2016, 14:37
Posts: 14
Location: Romania
So here are the screenshots from the Toshiba.


Quite interestingly, I do actually have sector acces and can write/read the sectors in user LBA, but that is the only things which you can edit. Everything else goes in that ABR error.


The most important notice, however, is the fact that the drive is detected automatically and it's ID IS read together with it's serial and firmware version. Yet if you look down below, the no. of cylinders is 0 and head also 0 with SPA numbered to N ( wth ? ). This implies that during it's power up you do have acces to the CP's ( at least CP 56 which holds the ID/serial/fw version), and you do have acces to user LBA, meaning you can write/read off the drive. Somehow, it doesn't sucessfully read the drive parameters though ( it doesn't recognize the no. of cylinders, spa , heads blah blah), meaning that the ROM itself is modified, not the CP's.


Attachments:
t6.png
t6.png [ 98.63 KiB | Viewed 17073 times ]
t5.png
t5.png [ 157.18 KiB | Viewed 17073 times ]
t4.png
t4.png [ 153.64 KiB | Viewed 17073 times ]
t3.png
t3.png [ 139.72 KiB | Viewed 17073 times ]
t2.png
t2.png [ 105.79 KiB | Viewed 17073 times ]
t1.png
t1.png [ 118.01 KiB | Viewed 17073 times ]
Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 19th, 2016, 8:10 
Offline

Joined: March 19th, 2015, 15:01
Posts: 1387
Location: isreal
g0dzax wrote:
meaning that the ROM itself is modified, not the CP's.

Most of the CP's is stored in ROM


Top
 Profile  
 
 Post subject: Re: Toshiba 500GB out of DVR Locked
PostPosted: September 19th, 2016, 9:15 
Offline

Joined: February 18th, 2016, 14:37
Posts: 14
Location: Romania
What I meant to say is maybe the code is modified such that it accesses the CP in another way than the "normal" drives access the CP's.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 53 posts ]  Go to page 1, 2, 3  Next

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Google [Bot] and 47 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group