22.bin read

[swaytec]

hi,
first: i´m from german, my english is not well!

i´ve got a wd2500BEVT locked with ata-password on high level master-pw-revision is FFFE (hdat2)
it was installed in a notebook, the owner forgotten his passwords for bios and hd.
now i´m trying to find out the hd-password, maybe it´s the same on bios, so i can unlock it.
can someone tell me if the pw is writen in this file:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000 3C 55 00 01 00 00 20 00 64 00 00 BA 00 19 01 00 <U.... .d..º....
00000010 00 00 00 00 00 00 01 60 02 12 00 22 00 0A 00 00 .......`..."....
00000020 00 00 00 01 01 01 00 00 01 E0 01 0F 0F 01 02 02 .........à......
00000030 0A 01 02 00 02 02 08 01 00 FF FF 02 03 50 01 1E .........ÿÿ..P..
00000040 64 00 11 04 40 0B 02 00 01 00 00 00 00 05 00 00 d...@...........
00000050 00 00 00 FF FF 00 00 00 00 12 0A 12 00 00 00 05 ...ÿÿ...........
00000060 00 00 00 00 00 1E 00 00 00 00 00 00 00 00 00 4D ...............M
00000070 00 29 00 07 00 12 2E 00 00 00 0E 00 00 00 00 05 .)..............
00000080 00 01 00 00 00 00 00 00 07 00 01 02 0D 00 01 03 ................
00000090 00 03 01 00 01 00 00 00 00 00 00 00 01 57 44 43 .............WDC
000000A0 20 57 44 32 35 30 30 42 45 56 54 2D 32 32 5A 43 WD2500BEVT-22ZC
000000B0 54 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 T0
000000C0 20 20 20 20 20 20 20 20 20 00 00 00 00 00 00 00 .......
000000D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000000E0 01 53 7C 42 7C 4C 7C 50 41 4D 57 48 47 43 5A 52 .S|B|L|PAMWHGCZR
000000F0 44 56 41 4B 51 55 41 00 20 20 20 20 20 20 20 20 DVAKQUA.
00000100 20 20 20 20 20 30 37 2D 30 39 2D 32 30 30 39 00 07-09-2009.
00000110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000120 00 00 00 00 00 00 01 07 00 1E 00 13 00 14 00 05 ................
00000130 00 08 00 00 00 00 00 53 54 50 43 00 00 00 00 00 .......STPC.....
00000140 00 00 00 00 00 00 00 00 00 1E 00 13 00 14 00 05 ................
00000150 00 08 00 00 00 00 00 53 54 50 43 00 00 00 00 00 .......STPC.....
00000160 00 00 00 00 00 00 00 00 00 08 40 FE FF 00 01 30 ..........@þÿ..0
00000170 00 00 05 00 64 00 0A 20 32 00 00 00 0F 00 01 02 ....d.. 2.......
00000180 00 00 01 78 00 32 00 20 00 55 FF 00 01 00 00 00 ...x.2. .Uÿ.....
00000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000001A0 00 00 00 00 00 58 58 58 58 58 58 58 58 58 58 58 .....XXXXXXXXXXX
000001B0 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 XXXXXXXXXXXXXXXX
000001C0 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 XXXXXXXXXXXXXXXX
000001D0 58 58 58 58 58 01 01 01 01 01 00 00 00 00 00 00 XXXXX...........
000001E0 00 00 00 00 01 30 30 5A 43 30 30 32 32 1D 00 05 .....00ZC0022...
000001F0 00 01 00 00 00 00 00 00 00 00 00 00 01 02 05 10 ................

thx so long
tom

[swaytec]

ok, no one can or want help me...

now i used "zu"

and the drive is now unlocked.

the 22.bin after unlocking:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000 3C 55 00 01 00 00 20 00 64 00 00 BA 00 19 01 00 <U.... .d..º....
00000010 00 00 00 00 00 00 01 60 02 12 00 22 00 0A 00 00 .......`..."....
00000020 00 00 00 01 01 01 00 00 01 E0 01 0F 0F 01 02 02 .........à......
00000030 0A 01 02 00 02 02 08 01 00 FF FF 02 03 50 01 1E .........ÿÿ..P..
00000040 64 00 11 04 40 0B 02 00 01 00 00 00 00 05 00 00 d...@...........
00000050 00 00 00 FF FF 00 00 00 00 12 0A 12 00 00 00 05 ...ÿÿ...........
00000060 00 00 00 00 00 1E 00 00 00 00 00 00 00 00 00 4D ...............M
00000070 00 29 00 07 00 12 2E 00 00 00 0E 00 00 00 00 05 .)..............
00000080 00 01 00 00 00 00 00 00 07 00 01 02 0D 00 01 03 ................
00000090 00 03 01 00 01 00 00 00 00 00 00 00 01 57 44 43 .............WDC
000000A0 20 57 44 32 35 30 30 42 45 56 54 2D 32 32 5A 43 WD2500BEVT-22ZC
000000B0 54 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 T0
000000C0 20 20 20 20 20 20 20 20 20 00 00 00 00 00 00 00 .......
000000D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000000E0 01 53 7C 42 7C 4C 7C 50 41 4D 57 48 47 43 5A 52 .S|B|L|PAMWHGCZR
000000F0 44 56 41 4B 51 55 41 00 20 20 20 20 20 20 20 20 DVAKQUA.
00000100 20 20 20 20 20 30 37 2D 30 39 2D 32 30 30 39 00 07-09-2009.
00000110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000120 00 00 00 00 00 00 01 03 00 00 00 00 00 00 00 00 ................
00000130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000140 00 00 00 00 00 00 00 00 00 1E 00 13 00 14 00 05 ................
00000150 00 08 00 00 00 00 00 53 54 50 43 00 00 00 00 00 .......STPC.....
00000160 00 00 00 00 00 00 00 00 00 08 40 FE FF 00 01 30 ..........@þÿ..0
00000170 00 00 05 00 64 00 0A 20 32 00 00 00 0F 00 01 02 ....d.. 2.......
00000180 00 00 01 78 00 32 00 20 00 55 FF 00 01 00 00 00 ...x.2. .Uÿ.....
00000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000001A0 00 00 00 00 00 58 58 58 58 58 58 58 58 58 58 58 .....XXXXXXXXXXX
000001B0 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 XXXXXXXXXXXXXXXX
000001C0 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 XXXXXXXXXXXXXXXX
000001D0 58 58 58 58 58 01 01 01 01 01 00 00 00 00 00 00 XXXXX...........
000001E0 00 00 00 00 01 30 30 5A 43 30 30 32 32 1D 00 05 .....00ZC0022...
000001F0 00 01 00 00 00 00 00 00 00 00 00 00 01 02 05 10 ................

one "STPC" is now deleted by using "zu".
the other "STPC" must be the master-pwd.

i don´t understand why the revision-code of the master-pwd is still on FFFE, cause the pwd was changed for sure!
any clue about this?
where are you gurus?

[drc]

You could examine the relevant module from http://files.hddguru.com/index.php?acti ... 20Digital& for example to see what it looks like with no user password and original master password

[pepe]

u deleted the user pwd, that's why master pwd rev code was not changed.

pepe

[Samo]

Your password did not start exact from the "STPC", and also can not be unlocked with sending pass through keyboard only. Ony sending it in hex or otherway modify neccessary module in the SA.

[swaytec]

@pepe: hdat2 issued the revision-code while the drive was locked (my first post)
i just thougt that this code is only on FFFE, if the master-pwd is set by manufactor (WDCWDCWDCW....)
but obviously it was changed!

@Samo: yes, i couldn´t unlock with "STPC" in any program (atapwd, mhdd, hdat2, hdderase...)
what i didn´t check, is unlocking in the original notebook. maybe the notebookbios sends those extra-bytes, there are also only 8 or 10 chrakter available for password.

i think user-pwd starts in my file at adr. 129:
1E 00 13 00 14 00 05 00 08 00 00 00 00 00 53 54 50 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00
? ? ? ? ? S T P C
|------------v-----------|
generated by bios???

master-pwd starts at adr.149 and is exactly the same as user-pwd

and after unlocking, adr. 127 changed from 07 to 03, maybe a lockbit (0000 0111 to 0000 0011)

i think it´s needfull to make some (much) more tests with the hd + notebook, to find out how the lock works.

but now the drive works very well in another notebook, so it is unnecessary for me, to spend more time on it.
hope the pwd works for bios-setup, cause it´s a newer lenovo, cmoskill or cmospwd etc. don´t work at these...