Toshiba (lenovo) MK5061GSY ATA password unlock

[zenelli]

I've got this hdd from an lenovo laptop and it has an ata password on it, is there any free solution for this to unlock?
Can somebody please help me??

[pcimage]

"ZU" may well do the job for you.

[zenelli]

Hi,
I tried that before the latest one but no luck

[Doomer]

Lenovo FW has additional protection, I don't think free tools would serve much help

[zenelli]

Lenovo FW has additional protection, I don't think free tools would serve much help

yeah i thought so, but i thouhgt also you never know maybe someone send me a pm with an solution

I heard even from MOLTKE that you also not connect it through terminal, probably protected.

[zenelli]

Soo after 5 years later i'm back with the same HDD.
Still no free solution???

[zenelli]

thank you Spildit,
but i was looking for a DIY, i dont want to spent any money for this hdd because its not worth it.
If there are still no free solution for this then i put it in the closet and come back again years later

[zenelli]

You might need to get "normal" main ROM code and move all CPs from your ROM to the "unlocked" ROM if special "Lenovo" ROM main code is preventing the use of VSCs. Then you need to send the VSC to regen the "S" sector on platter or as alternative read/write that sector by PBA...

No free sollution. Most likely there will never be a free sollution for this unless the VSC that is used to regen "S" somehow does work on your drive even with "Lenovo" firmware ....

ok,
is it possible if i read the rom with mine programmer to see the password encrypted somewhere in de dump?

[BGman]

Lenovo FW has additional protection, I don't think free tools would serve much help

You say this?
It's a 1-minute job. SON + VSC...

[BGman]

You do need to read ROM with extrenal programmer, carve the CPs and write those to ROM with normal main code, then you can use VSC to re-create "S" or read/write "S" by VSC ...

In fact it's much easier....

[BGman]

Maybe you should PM him the VSCs to unlock the drive ?

I could as well as you could, too. But I don't want to mess up with your business.

"
I think that i can unlock it for you.

https://www.ebay.com/itm/ATA-Password-U ... 2861542747 "

[Doomer]

Lenovo FW has additional protection, I don't think free tools would serve much help

You say this?
It's a 1-minute job. SON + VSC...

AFAIR (was 5 years ago) SON is locked on those

[zenelli]

do i need some special software or hardware to unlock it?
i unlocked some disk with ZU and Seagate with Zoc script.
i have external programmer to read the rom( I think i already read the rom a few years ago)
Any secrets or tricks will be apreciated

[BGman]

AFAIR (was 5 years ago) SON is locked on those

I don't think so. I have repaired a lot of Lenovo drives - no one locked.
Anyway. When one door is closed, another one is left open...

[BGman]

I could as well as you could, too. But I don't want to mess up with your business.

I don't have any problem with that !!!

Just post the sollution here if you want to !!!

This is not only yours business!!!
When somebody ask you to unlock his drive what do you do? Mail him VSC's or ask him to send you the drive?

[zenelli]

Ok,
i got some news, i have found the bios dump of the lenovo where this hdd is from.
The password from the laptop is on this dump (see picture) 2 same lines with encrypted password, i'm 99% sure this password is also the hdd password.
can i use this with victoria?

Attachments

[fzabkar]

Ok,
i got some news, i have found the bios dump of the lenovo where this hdd is from.
The password from the laptop is on this dump (see picture) 2 same lines with encrypted password, i'm 99% sure this password is also the hdd password.
can i use this with victoria?

I don't think so.

ThinkPad BIOS Password Design for UEFI:
http://monitor.espec.ws/files/lewnovo_password_399.pdf

Password Characters and Data

• Supported characters
– Alphabet (case insensitive)
– Number
– Space ‘ ‘

• Code set
– Scan code

• Maximum length
– 64 characters

• Data transformation
– Hash 64 scan codes by SHA-256 and take first 16 bytes

Power On Password

• Storage
–Inside HDD
–Security feature is locked by SET FREEZELOCK command

• before exiting POST

• when the _GTF is evaluated by a storage driver at resuming from S3

• Salting
–Salted with the hashed Model number and the serial number before sending to HDDs

• Master HDP and User HDP are supported

Supervisor Password

• Requested to input when:
– BIOS Setup is invoked
– Signature diskette is detected
– EFI Shell is invoked
– BIOS update is invoked while OS is running
– TPM state change is invoked while OS is running

• Storage
– EEPROM Block 6 (C2 Space)
10-1Fh: Primary SVP
20-2Fh: Backup SVP

• Salting
– Salted with the random number in the boot block before storing in the EEPROM

Hard Drive Password

• Storage
– Inside HDD
– Security feature is locked by SET FREEZELOCK command

• before exiting POST

• when the _GTF is evaluated by a storage driver at resuming from S3

• Salting
– Salted with the hashed Model number and the serial number before sending to HDDs

PC Keyboard Scan Codes:
http://www.users.on.net/~fzabkar/MSKeyLog.TXT

[fzabkar]

Sorry, that should have been ...

Power On Password

• Requested to input at:
– Boot
– Waking up from Hibernate (POST)

• Storage
– CMOS

Lower 38-3Fh: First 8bytes of hashed passphrase (Offset 0-7h)
Upper 38-3Bh: Remaining 4bytes of hashed passphrase (Offset 8-Bh)
Upper 3Ch : Checksum of lower 38-3Fh and upper 38-3Bh

– Storage are locked

• before exiting POST if the signature diskette is not detected

• before jumping to OS waking vector

• Salting
– Salted with the random number in the boot block before storing in the CMOS

[fzabkar]

i have found the bios dump of the lenovo where this hdd is from.

If you have the original laptop, does this mean that the [unhashed] HDD password is known and that you are needing to circumvent the password because the laptop is dead? If so, have you tried the HDD in another Lenovo laptop?

[zenelli]

i have found the bios dump of the lenovo where this hdd is from.

If you have the original laptop, does this mean that the [unhashed] HDD password is known and that you are needing to circumvent the password because the laptop is dead? If so, have you tried the HDD in another Lenovo laptop?

No i dont have this laptop anymore, and no i dont know the password. i bought this laptop long time ago with bios and hdd password, the bios password i could read it with special software and removed it (See picture of dump)
the hdd password is the same i think with the bios password