Hitachi C5K500 HCC545032B9A300 (ELSIL from SAGEM ESI-88)Lock

[locarno]

Hello all
I have hardly proteced drive from Sagem TV Recorder. Sagemcom ESI-88
HITACHI C5K500 HCC545032B9A300
Disk is not proteced by password. Is proteced by change firmware and modules in SA.
Look photo's
HDD
https://dl.dropboxusercontent.com/u/84908032/CIMG6361.JPG
PCB
https://dl.dropboxusercontent.com/u/84908032/CIMG6362.JPG
HDD without ESLIL label
https://dl.dropboxusercontent.com/u/84908032/CIMG6363.JPG

ELSIL. They proteced this drive
http://www.elsil-tunisia.com/

Look this PDF. Page 61.
12.9 Protected Area Function
http://www.hgst.com/tech/techlib.nsf/techdocs/1CB2318624655E0186257547007FB08C/$file/CSC5K500_OEM_Specification_R14.pdf

Windows XP don't boot with this drive. I must connect it after boot Windows.

#1MHDD:
Command: EID
Result: Busy, busy busy, busy......busy forever
https://dl.dropboxusercontent.com/u/84908032/CIMG6364.JPG

#MHDD2
Command: EID
Result: Busy, busy, busy, busy............unplug and connect SATA cable. Get information's
https://dl.dropboxusercontent.com/u/84908032/CIMG6365.JPG

I think WD3200BUDT is locked this same as HITACHI.
For WD3200BUDT please look here
http://wdmarvel.com/forum/ru/viewtopic.php?f=3&t=374&sid=0dd78e0b475cc0fb077f850fa7c51798
http://forum.hddguru.com/viewtopic.php?f=1&t=21467
A lot of reading.
WDMarvel can unlock WD3200BUDT, but this tool is not for hitachi.

Difference ? WD3200BUDT and MHDD:

MHDD support only LBA mode

HGST
Without any message


Hitachi surface scan:
https://dl.dropboxusercontent.com/u/84908032/CIMG6367.JPG

Hitachi SMART:
https://dl.dropboxusercontent.com/u/84908032/CIMG6366.JPG

DUMPS
In this thread, @grubskee read ROM1/NVRAM...
http://forum.hddguru.com/viewtopic.php?f=1&t=23578&p=194463#p194463
Readed by IBM-v2c explorer.
I thnik this dump's is corrupted. IBM v2c is old program for IDE drives not for SATA.
DUMPS mirror:
http://www50.zippyshare.com/v/12246114/file.html

[locarno]

Hello.
I read two memory from PCB. I use JetProg programmer.

First memory: LE25fu106b It is 100% ROM:
DUMP: https://dl.dropboxusercontent.com/u/84908032/LE25fu106b%20org.BIN

Second memory: M93C76-R I don't know what it is. Strange dump. Can you tell me what it is ? It's RAM or what ?
DUMP: https://dl.dropboxusercontent.com/u/84908032/M93C76-R%20org.BIN

Look PCB photo.
Red First memory
Green Second memory
https://dl.dropboxusercontent.com/u/84908032/CIMG6362xxx.JPG

Regards

@EDIT
I can read/write this memory.

[waqas_ali766]

Hello,
Kindly mail me the firmware of your hdd. i want to see it ..
Regards
Waqas Ali

[guru]

Locarno, cheaper just buy yourself a new drive, if you only have 1 or 2 ;@)

[locarno]

Hello,
Kindly mail me the firmware of your hdd. i want to see it ..
Regards
Waqas Ali

ROM=Firmware. I answer on Sediv forum. bin. readed from eeprom.

[vides]

locarno
   I said send me
the promotion
I'll do
  All forum for asking
who knows,
and so
no answer
not respond
nobody can answer this
this is normal

Igreet

[locarno]

Yes, but maybe I find somebody who share knowledge about that.

[bolle2k]

Well yes, maybe i chould help you on that problem

The HDD is encrypted and Software & Hardware paired in the
OS of the STB.

http://www48.zippyshare.com/v/25866812/file.html

/lib/modules

Have fun

[bolle2k]

The second dump that you did is a normal EEprom.
http://www.st.com/web/en/catalog/mmc/FM ... 2/PF208350

Maybe the keying or something else could be inside.

[locarno]

It's not modules from drive.
It's FW from esi-88

We can read modules from drive using SediV.

It's hard to find encryption in ESI-88 FW. Easier found this in drive modules.

[bolle2k]

If you have a look in the hal3 modul with IDA you see the pairing commands
Possible to step the FW and see what happen´s xD

.export SECU_ioctlGetPrivateKey_f
SECU_ioctlGetPrivateKey_f:
rts
mov #h'FFFFFFFB, r0
; End of function SECU_ioctlGetPrivateKey_f

[locarno]

Ok
But If want unlock drive. You must have acess for modules (SA) on drive.
It's is unhelpfull for us.

[locarno]

@REFRESH

[unick_04]

Hi locarno, I have the same problems with Hitachi. Did you find the solutions?
Thanks in advance for your reply.

[Doomer]

deleted

[cezarylee]

Something new with Hitachi HITACHI C5K500 HCC545032B9A300 by ELSIL from SAGEM ESI-88 ?? Can anyone solve the problem ?

[cezarylee]

Hm...yes, but as @locarno says this is the firmware by ELSIL - ESI-88 and what exactly modules ? Does anyone know that ?

[vides]

Hi
Hello
locked
Hitaci hdd Elsil
manual edit
hitachi ARM HCC543232A7AXXX
https://www.youtube.com/watch?v=pl5LMihIRes


hitachi old model Elsil HCC545032B9A300

https://www.youtube.com/watch?v=vm5so2SWASA


reseler info etc
http://forum.sediv.pl/

I greet