Western Digital USB-C encryption key?

[Zero Alpha]

Can someone confirm if the encryption key on the WD USB-C ASMEDIA chips are embedded in the internal rom?

got a physically destroyed 2060-810033-001 pcb with the asmedia chip. Drive can be read ok now but I need to figure out the decryption key

[fzabkar]

Can someone confirm if the encryption key on the WD USB-C ASMEDIA chips are embedded in the internal rom?

What internal ROM?

AFAICT, the MCU ROM is in the top left corner of the photo, and the bridge ROM is near the inductor immediately to the right of the bridge.

https://i.ebayimg.com/images/g/IysAAOSwJili4GZJ/s-l1600.jpg

Here are similar chips (the URLs have expired):

W25X20CLUXIG, Winbond, 2.5/3/3.3V 2M-BIT SERIAL FLASH MEMORY WITH 4KB SECTORS AND DUAL I/O SPI, marking 2Hxxx & 0Gxxxx, USON 2x3-8:
http://chip.tomsk.ru/chip/chipfile0-x.nsf/all/49D18EA25FB19D5A4725822D00642029/$File/w25x05cl_10cl_20cl%20revc_c03_20120801.pdf
http://chip.tomsk.ru/chip/chipfile0-x.nsf/all/4B70D1CEE983C2614725822D00642E89/$File/w25x20cl_revf%2020150806.pdf

W25Q80EWUXIE, Winbond, 1.8V 8M-BIT SERIAL FLASH MEMORY WITH DUAL/QUAD SPI & QPI, marking 8Lxxx & 0Exxxx, USON 2x3-8:
http://chip.tomsk.ru/chip/chipfile0-x.nsf/all/FA65C5CB65A1BD864725822D00641FEF/$File/w25q80ew%20revi%2008222017%20sfdp.pdf

[pepe]

there's a good chance that the drive is SED and the original processor is very probably required to decrypt the data :s

[Zero Alpha]

there's a good chance that the drive is SED and the original processor is very probably required to decrypt the data :s

This yes but I'm hoping its stored in mr asmedia. I'm waiting on a donor board to arrive. I'm not getting anywhere with the marvel chip.

Asmedia don't provide any developer tools that I can't find and they didn't respond to my request for developer tools either

[pepe]

SED keys are never stored in bridge config mem...

[Eastcoast]

I think you will need to move the Marvell CPU (MCU) from the old board to the new one. The SED keys are linked / live on the MCU.

I just completed one like this with a destroyed PCB. We physically removed the CPU chip from one board and moved it to another board. It wasn't easy and the chip also had a few shorted pads (lucky it was Ground).

Under the Red heatsink sticker you will find a Marvell MCU

If it's a 810033 board, then it's going to be a 88i1053-NXZ2 Marvell MCU.

The stencils are available online. 88i1047-NDB2 or 88i1053-NXZ2.
These can be lifted off, reballed and placed onto a new donor board with original ROM.

That's the only way to decode the data. Might also need a PC3K to get around any damage and to lock UA access.

[Eastcoast]

Technically, It may be possible to swap MCU and ROM to SATA unlock board rather than another USBC board.

We did attempt this first to a SATA 2060-800065 but it didn't work for us so we just moved our MCU and ROM from one damaged 2060-800067-001 to another good PCB.

Might try it again on a few other boards to see for my own research.

I think this is quite niche as it's only for cases when the original PCB is beyond repair and the MCU needs to be moved.

Most people solder a connector, or use one of these clip on SATA boards that convert the USB board to SATA.

[michael chiklis]

What is the ball diameter of these mcu?
Do you get this balls on bottle or do you use solder paste?
Usually solder paste is prefered to use when is needed to make very tiny balls.

This PCBs are very fragile because are very thin, heat might kill inside tracks while unsoldering/soldering mcu.
Do you use prehating oven under this boards and low temperature hot air on top?

[Amarbir[CDR-Labs]]

I think you will need to move the Marvell CPU (MCU) from the old board to the new one. The SED keys are linked / live on the MCU.

I just completed one like this with a destroyed PCB. We physically removed the CPU chip from one board and moved it to another board. It wasn't easy and the chip also had a few shorted pads (lucky it was Ground).

Under the Red heatsink sticker you will find a Marvell MCU

If it's a 810033 board, then it's going to be a 88i1053-NXZ2 Marvell MCU.

The stencils are available online. 88i1047-NDB2 or 88i1053-NXZ2.
These can be lifted off, reballed and placed onto a new donor board with original ROM.

That's the only way to decode the data. Might also need a PC3K to get around any damage and to lock UA access.

Hey ,
Any Link For Stencils

[Eastcoast]

I think you will need to move the Marvell CPU (MCU) from the old board to the new one. The SED keys are linked / live on the MCU.

I just completed one like this with a destroyed PCB. We physically removed the CPU chip from one board and moved it to another board. It wasn't easy and the chip also had a few shorted pads (lucky it was Ground).

Under the Red heatsink sticker you will find a Marvell MCU

If it's a 810033 board, then it's going to be a 88i1053-NXZ2 Marvell MCU.

The stencils are available online. 88i1047-NDB2 or 88i1053-NXZ2.
These can be lifted off, reballed and placed onto a new donor board with original ROM.

That's the only way to decode the data. Might also need a PC3K to get around any damage and to lock UA access.

Hey ,
Any Link For Stencils

Hey Amarbir,

https://www.hddheadtools.com/product-ca ... -stencils/

I got the set of 2 MCU and comes with 213C solderballs. I think it's 0.3mm

[Eastcoast]

What is the ball diameter of these mcu?
Do you get this balls on bottle or do you use solder paste?
Usually solder paste is prefered to use when is needed to make very tiny balls.

This PCBs are very fragile because are very thin, heat might kill inside tracks while unsoldering/soldering mcu.
Do you use prehating oven under this boards and low temperature hot air on top?

The stencil kit comes with 0.03mm 213C solderballs which I ended up using. The paste method we did try but something didn't work out so not sure why that was which is why I reballed it with the balls that came with the kit. They are tiny, even under microscope and they go everywhere. You could technically use 183C solderpaste which would make it safer.

Yes, heat was a real worry. I did practice a lot on other boards first before attempting it on customer board. Just taking off, cleaning with wick, reballing and putting back on and checking if board was still good and working on donors. Did this about 4 times.

We removed using flux starting at 250C 50Air to preheat, rising to about 310-350C 50Air till the chip can be lifted. The chip is not underfilled with glue which makes it easier. The surrounding chips should be masked off heat resistant tape foil or Kapton.

Just a warning, the temp depends on your ambient temp and your station, not sure what the MCU thermal limit was but glad we didn't cook it. I would definitely practice on a non customer board.

I don't use a preheater, just warmed up the area first with air from a distance. I have been practicing with working with safe removing, chip quick or low melt solder to clean pads on board and MCU chip before reballing back. If you use 183C solderpaste or balls, it will make it a lot safer.

[michael chiklis]

I think those stencil are too expensive.
Maybe is possible to find similar stencil for iphone (compatible stencil) at lower the price which might have more holes but you can cover the extra holes with kapton tape.
See here what this guy does with stencil and kapton tape:
https://www.youtube.com/live/OgOinb7y5S ... are&t=3190

[Eastcoast]

I think those stencil are too expensive.
Maybe is possible to find similar stencil for ihones (compatible stencil) at lower the price which might have more holes but you can cover the extra holes with capton tape.
See here what this guy does with stencil and capton tape:
https://www.youtube.com/live/OgOinb7y5S ... are&t=3190

Agree they cost a lot. But if you get a couple of these jobs then it's not so bad considering.

Yes, that's not bad idea, just need to get the stencil with the right spacing. I've got a stack of phone stencils coming and might take a look to see if any come close in terms of spacing.

[michael chiklis]

Great, let us know if you find a phone stencil that can be used for this MCU reball job.

[Zero Alpha]

I think you will need to move the Marvell CPU (MCU) from the old board to the new one. The SED keys are linked / live on the MCU.

I just completed one like this with a destroyed PCB. We physically removed the CPU chip from one board and moved it to another board. It wasn't easy and the chip also had a few shorted pads (lucky it was Ground).

Under the Red heatsink sticker you will find a Marvell MCU

If it's a 810033 board, then it's going to be a 88i1053-NXZ2 Marvell MCU.

The stencils are available online. 88i1047-NDB2 or 88i1053-NXZ2.
These can be lifted off, reballed and placed onto a new donor board with original ROM.

That's the only way to decode the data. Might also need a PC3K to get around any damage and to lock UA access.

OK Thanks... I'll try again with the marvel mcu

[Eastcoast]

I think you will need to move the Marvell CPU (MCU) from the old board to the new one. The SED keys are linked / live on the MCU.

I just completed one like this with a destroyed PCB. We physically removed the CPU chip from one board and moved it to another board. It wasn't easy and the chip also had a few shorted pads (lucky it was Ground).

Under the Red heatsink sticker you will find a Marvell MCU

If it's a 810033 board, then it's going to be a 88i1053-NXZ2 Marvell MCU.

The stencils are available online. 88i1047-NDB2 or 88i1053-NXZ2.
These can be lifted off, reballed and placed onto a new donor board with original ROM.

That's the only way to decode the data. Might also need a PC3K to get around any damage and to lock UA access.

OK Thanks... I'll try again with the marvel mcu

Good luck. Practice, practice on donors first.

I assume you have mounted the ROM onto a unlock board and can only see encrypted sectors.

Sometimes I wonder why WD linked the encryption to the MCU rather than the old way that we can easily get around with the PC3K, but then I see Apple and others are doing the same things on their Macbooks and Phones and Android encryption. I guess they call it progress.

[Zero Alpha]

Took some pictures of the stencil I ended up using here https://www.zeroalpha.com.au/services/b ... a-recovery

Works well makes the job much easier.

[Eastcoast]

Took some pictures of the stencil I ended up using here https://www.zeroalpha.com.au/services/b ... a-recovery

Works well makes the job much easier.

Nice job - goods pics too.

I'm definitely going to try again solder paste instead next time. It would be less messy. We tried 2 attempts with solder paste previously but no joy, I guess it may have been bad luck.

If it doesn't work, and the ball method works again, it might be due too much solder creating too large a ball that when heated shorts out neighbouring pads once the chip is placed back on pcb.

I guess I'll try and practice on some more donors when it gets quieter but hoping I don't see one in the wild for a while.

The crack we had in ours was in the same place in our PCB so it must be a weak spot.

[fzabkar]

Took some pictures of the stencil I ended up using here https://www.zeroalpha.com.au/services/b ... a-recovery

Works well makes the job much easier.

I notice that your web site claims that yours is the "First company in Australia to be officially certified for professional data recovery". Which accreditation body provides official certification for data recovery in Australia, or anywhere for that matter?

"Direct access to manufacturers firmware & solutions." Really? What kind of "solutions" do the HDD/SSD manufacturers provide to the DR business? I thought they either fell off the back of a truck or were provided by your tool suppliers.

[sin]

Manual reballing for the MCU and REDFIN servo ic is possible too.

it takes on an average of 1hr 18 mins to reball 240 pins.

https://youtu.be/mpFPxUoHELg

--