Do WD SED locked drives still have RAM access?

[maximus]

Fairly simple question. Do WD SED locked drives still have RAM access? I am asking because I think I might be able to perform the slow fix in RAM on these drives via USB without special hardware tools, if there is access to RAM. Also, there could be the possibility to unlock in the future, but I don't have any to test with.

[Doomer]

only some of them, depends on the config of a particular drive

[maximus]

Well that is a bit disappointing, but I guess not surprising. Not sure it is worth it to pursue any further for only a few drives.

[Nick_CT]

If I remember correctly, every SED WD I've worked on I've 'unlocked' by uploading dir and ldr into RAM and then doing the neccessary. This means you can access RAM on most of them?

[maximus]

If I remember correctly, every SED WD I've worked on I've 'unlocked' by uploading dir and ldr into RAM and then doing the neccessary. This means you can access RAM on most of them?

Are you putting them in safe (kernel) mode to do this? I think ram would be accessible then, but then a proper loader is definitely needed. If you are not putting them in safe mode and still have ram access, that would be a good thing for what I am trying to do.

[maximus]

I don't have any SED here to test but even if you don't gain RAM access directly you should still be able to patch ROM to prevent SA loading and then access to RAM.

I have a couple problems with this. First, I do not know how to decompress the ROM file into actual data to be modified, let alone know what to modify in the ROM.

Second, I am hoping for this to work on USB attached drives, and I consider it VERY dangerous to write ROM to a USB attached drive, especially a drive that has any issues. If the erase command succeeds but then the write fails, you have made a brick. Trust me, I came very close to making a brick! I would think the only way to recover from that is to use a chip programmer to reprogram the ROM (assuming you were smart enough to read it and save a copy before you killed it).

[Doomer]

If you cannot write memory on a particular drive then you cannot write ROM either

[maximus]

If you cannot write memory on a particular drive then you cannot write ROM either

Not that it would help (or work) at all for USB connected drives, but if you put it in safe (kernel) mode, is RAM and ROM access available then?

[maximus]

If you cannot write memory on a particular drive then you cannot write ROM either

You said "write". On these drives can RAM and ROM be read, and just not written?

[Doomer]

If you cannot write memory on a particular drive then you cannot write ROM either

Not that it would help (or work) at all for USB connected drives, but if you put it in safe (kernel) mode, is RAM and ROM access available then?

If you have physical access to the drive's PCB then you can do whatever you like

[Doomer]

If you cannot write memory on a particular drive then you cannot write ROM either

You said "write". On these drives can RAM and ROM be read, and just not written?

no, only a few vendor commands work in the locked mode

[guru]

Very true!
If you have physical access to the drive's PCB then you can do whatever you like[/quote]

[D_R]

@maximus
I have some of the SED HDDs from WD here on my table. On all drives I had in my hand, I was able to access the RAM of the SED. So I think, that the SED Part is only in the USB2SATA Chip (and on some of the modules in SA).

[maximus]

@maximus
I have some of the SED HDDs from WD here on my table. On all drives I had in my hand, I was able to access the RAM of the SED. So I think, that the SED Part is only in the USB2SATA Chip (and on some of the modules in SA).

From this statement, I assume that all of these drives had PC board swap to SATA to achieve these results? If so, was ROM readable when the drives were still USB? Or was there the need for physical chip transfer?

[D_R]

Hi,

for my work, I use PC3k. I connected the drive via USB to a power supply and with the serial connector to the drive. I use PC3k in the Marvell/USB Mode, to connect to the drive. There I have full access to the ROM and the SA. From this point, I can backup the HDD-Ressources without a problem - but it takes a while with the serial connection.

And over the serial connection I also can manipulate everything in the SA, for example fix the slow responding problem. Then I can disconnect the drive from the USB Power Supply and connect it via USB to a normal machine and image the drive through USB.

Or - like with a current case - I can write the ROM into a compatible SATA Board and convert the drive to SATA. Then I have to use the PC3k feature to decrypt the SED-Data

[maximus]

I don't have PC3k, I am doing this with just a computer and Linux. The slow fix works (as long as the drive responds well enough to send commands). But I have reports of drives that this does not work on, and from one report I saw it looked like the drive accepted the command to enable VSC but then rejected the command to read a module from SA. After some experimenting I was hoping that in these cases that RAM (and ROM) was still accessible. I guess the only way to find out is to have some test scripts ready when I get the next report of it not working.

[D_R]

I don't have PC3k, I am doing this with just a computer and Linux. The slow fix works (as long as the drive responds well enough to send commands). But I have reports of drives that this does not work on, and from one report I saw it looked like the drive accepted the command to enable VSC but then rejected the command to read a module from SA. After some experimenting I was hoping that in these cases that RAM (and ROM) was still accessible. I guess the only way to find out is to have some test scripts ready when I get the next report of it not working.

Well, if you don't have PC3k or other software, I would suggest, that you take a SATA PCB for your drive and move the ROM Chip to the SATA PCB. Then you can do your SA-fix. Well, some time ago, I saw a software on GitHub, that can crack the encryption of a SED drive. So you can image the encrypted drive with the SATA Board and then decrypt it.

Or transfer the ROM Chip back to the patient PCB.

[maximus]

Well, if SA access is blocked but RAM access is allowed, then it seems to be possible to perform the slow fix in RAM, at least from the small testing that I have been able to do. But if RAM (and ROM) access is also blocked, all is not lost. I have found that a drive that is put into kernel mode can still be recognized in Linux when connected via USB (this surprised me, but a nice surprise it is). Then ROM can be read and backed up. It could then be written to a compatible SATA PC board and the drive could be accessed that way, without physically moving ROM chip.

Or better yet, the ROM can be patched to not load any of the SA and written back to the drive. After a power cycle there should be raw access to the SA, and the slow fix could be directly applied. After the fix then rewrite original ROM and then clone / access files on the drive. All of this done through USB using Linux. This is how the big boy tools such as PC3k do it, and I am now learning how to do it myself.

The next time someone has a SED locked drive that they can't perform the slow fix on, and they are not willing to pay for recovery, I would be willing to work with them to attempt the fix.

[D_R]

Well, if SA access is blocked but RAM access is allowed, then it seems to be possible to perform the slow fix in RAM, at least from the small testing that I have been able to do. But if RAM (and ROM) access is also blocked, all is not lost. I have found that a drive that is put into kernel mode can still be recognized in Linux when connected via USB (this surprised me, but a nice surprise it is). Then ROM can be read and backed up. It could then be written to a compatible SATA PC board and the drive could be accessed that way, without physically moving ROM chip.
...
This is how the big boy tools such as PC3k do it, and I am now learning how to do it myself.

The next time someone has a SED locked drive that they can't perform the slow fix on, and they are not willing to pay for recovery, I would be willing to work with them to attempt the fix.

Congratulations for a successful recovery.

But there is one thing: you can't compare your solution to PC3k. Yes, maybe lot of operations we do in PC3k can be done with other free tools. The reason I use PC3k is, because I have everything in one piece of software. Designed for Mass Data recovery.