Toshiba 500GB out of DVR Locked

ROM.rar [404 Bytes]
Downloaded 1 time

similar to access terminal blocked
You do not want to sell this locked-HDD?

I don't have any external programmers. If you'd be kind to recommend me a good one + software, I will get one and dump the ROM from a locked one. Unfortunately, I don't have many drives of this kind (only 2 left) as the rest of them left with the batch. DAMN ! The unlocked drive I had was from a long time ago ( I think a few months ) and I don't have anymore of these unlocked drives. Back then I was a real noob and didn't bother with those Toshiba. But yeah, you can write/read/erase them, user LBA is no problem, I only wanted to unlocked them since it seemed like a nice challenge. I'd lost my will when I saw that I couldn't edit anything there, but I found these 2 old locked ones and began researching again. I don't there's a way to sell the locked one, after all I am just an employee here, but I can try to talk and see if it can be done. So the dumping of the ROM of a locked drive with the external programmer - that is kinda the only thing I can do right now. Only useful thing from the above attachments would be the RAM, IIRC it contains an altered ROM image.

I'm not that technical guys but I do have ROM programmer I got with my MRT, I guess the ROM is the one marked in red? If the process involves soldering it will not be worthy to deal with the unlocking of these drives...

Hi all !, I managed to unlock the Toshiba MK5055GSX Firmware ver. FG001M
User Password was forgotten, Security - Maximum, Master Password unchanged.

Here's the solution that helped me !

I have created the dos bootable usb and copied onto atapwd.exe and zu.exe programs.
Next I've run the atapwd.exe and issued the command SECURITY ERASE PREPARE and exit the program.
Next run the zu.exe with zu /s in my case and Bam !!! hdd unlocked !!

Hopefully this will help someone

is it possible to unlock such drives with reading the rom and modify it?

I'm still on hold to a programmer coming, but I've gotten my hands on another Toshiba from the MQ01ABD family, the V series for desktop. I'm uploading the ROM and stuff out of it, maybe we could understand it's internal workings. However, from a glance, I have to say that it's ...different from the ROM's of other brands. Also, trying to read the service tracks yields in errors over errors, I guess there are only some specific tracks that are available/used in the PC3K utility. I'm gonna check out which one's are and try to get them again to get a glimpse on how they are. I am pretty sure the ROM of the locked one's (either 250,320 or 500 GB) is almost exactly the same as this one.

Attachments

000000-07FFFF.rar: ROM read through terminal.; (284.11 KiB) Downloaded 1135 times

000000-000FFF.rar: RAM read through terminal.; (3.04 KiB) Downloaded 1222 times

SABackup.rar: The CP's and G-List.; (14.98 KiB) Downloaded 1239 times

Spildit wrote:
zenelli wrote:is it possible to unlock such drives with reading the rom and modify it?

Maybe ... We would still need to discover how. But the first step would be that- Read ROM and extract it's CPs. Then compare with ROM from unlocked drive.

well i have taking out the chip and read with my programmer, maybe someone can tell me more.
it is an MK5061GSY TOSHIBA

Attachments

toshiba.rar: (274.31 KiB) Downloaded 1072 times

Here are the CPs I extracted from zenelli's ROM:

Attachments

MK5061GSY_ROM_CPs.rar: (23.15 KiB) Downloaded 997 times

fzabkar wrote:Here are the CPs I extracted from zenelli's ROM:

I'm not an expert so i dont know where to look for the password

Does anyone have any idea what this might refer to ?

" 512KB 12V BTIN_ROM UART Program Loader..for Gibson1.0 model Loader Version AUGB14064.00 "

Okay, so I've managed to get a read on a locked ROM by the use of a programmer. Here it is. So far, the differences between it and a normal ROM are MANY. I'm also uploading the ROM of a MQ01ABD of 320 GB, yet do bear in mind that it's firmware is AX01, not AZ01Q like the locked one's. At a close analysis, it crushed any hope to figure out how it's locked, due to the huge number of differences ( more than 30k ), yet I can point out several locations that seemed "suspect" :
at 0x30800 we have smth called scrt_flag;
at 0x54A60 several flags indicating different options appear to be set ( eg hdd is frozen, security locked ).

Before anything, I'll try to understand a bit more about it's internal workings, since there are many descriptions inside available (btw, the omnipresent japanese wording is there).

Attachments

000000-07FFFF(unlocked AX).rar: (284.11 KiB) Downloaded 1104 times

newlockedrom.rar: (283.13 KiB) Downloaded 1255 times

The newlockedrom.bin dump appears to be from the 320GB HDD whereas the 000000-07FFFF(unlocked AX) dump is from the 500GB HDD. Is this correct?

newlockedrom.bin

Code:: Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 0007AFE0 4D 4E 20 20 20 20 20 20 20 20 20 20 20 20 20 20 MN 0007AFF0 20 20 20 20 20 58 34 37 58 54 58 30 43 54 54 4F X47XTX0CTTO 0007B000 53 48 49 42 41 20 4D 51 30 31 41 42 44 30 33 32 SHIBA MQ01ABD032 0007B010 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0007B020 20 20 20 20 20 20 00 00 00 00 00 00 00 00 00 00

000000-07FFFF.bin

Code:: Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 0007AFE0 4D 4E 20 20 20 20 20 20 20 20 20 20 20 20 20 20 MN 0007AFF0 20 20 20 20 20 32 35 4A 41 50 31 57 48 54 54 4F 25JAP1WHTTO 0007B000 53 48 49 42 41 20 4D 51 30 31 41 42 44 30 35 30 SHIBA MQ01ABD050 0007B010 56 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 V 0007B020 20 20 20 20 20 20 00 00 00 00 00 00 00 00 00 00

FWIW, this is my take on the situation.

Each ROM has a table of CPs. The two tables are identical.

newlockedrom.bin

Code:: Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 0005BCE8 AA 00 54 4F 00 00 00 00 ª.TO.... 0005BCFC D0 8A 05 D0 A0 03 A0 03 90 03 01 00 34 00 52 43 00 00 00 00 ÐŠ.Ð . .....4.RC.... 0005BD10 40 8A 05 D0 70 00 70 00 6E 00 01 00 33 00 57 43 00 00 00 00 @Š.Ðp.p.n...3.WC.... 0005BD24 D0 32 0A D0 50 0E 50 0E 4E 0E 01 00 99 00 4D 4F 00 00 00 00 Ð2.ÐP.P.N...™.MO.... 0005BD38 70 8E 05 D0 10 00 00 00 00 00 00 00 44 00 53 47 00 00 00 00 pŽ.Ð........D.SG.... 0005BD4C 80 8E 05 D0 30 00 30 00 2E 00 01 00 92 00 43 4F 00 00 00 00 €Ž.Ð0.0.....’.CO.... 0005BD60 B0 8E 05 D0 10 00 10 00 0C 00 01 00 C1 00 47 4F 00 00 00 00 °Ž.Ð........Á.GO.... 0005BD74 C0 8E 05 D0 10 00 10 00 02 00 01 00 95 00 48 54 00 00 00 00 ÀŽ.Ð........•.HT.... 0005BD88 D0 8E 05 D0 10 00 10 00 0C 00 01 00 55 00 4D 4E 00 00 00 00 ÐŽ.Ð........U.MN.... 0005BD9C E0 8E 05 D0 C0 00 40 00 00 00 01 00 56 00 4D 4E 00 00 00 00 àŽ.ÐÀ.@.....V.MN.... ........ 0005C6FC D0 D1 05 D0 10 00 10 00 0E 00 01 00 0A 01 56 46 00 00 00 00 ÐÑ.Ð..........VF.... 0005C710 D0 2F 0B D0 E0 0F E0 0F DE 0F 01 00 0B 01 45 44 00 00 00 00 Ð/.Ðà.à.Þ.....ED.... 0005C724 00 5B 05 D0 00 18 00 18 FE 17 01 00 83 00 00 00 53 48 00 00 .[.Ð....þ...ƒ...SH.. 0005C738 E0 8F 05 D0 20 00 20 00 18 00 00 00 53 5A 00 00 00 90 05 D0 à..Ð . .....SZ.....Ð 0005C74C D0 00 D0 00 C6 00 00 00 48 50 00 00 D0 90 05 D0 10 00 10 00 Ð.Ð.Æ...HP..Ð..Ð.... 0005C760 0C 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ....................

000000-07FFFF.bin

Code:: Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 0005BD9C AA 00 54 4F 00 00 00 00 D0 8A 05 D0 ª.TO....ÐŠ.Ð 0005BDB0 A0 03 A0 03 90 03 01 00 34 00 52 43 00 00 00 00 40 8A 05 D0 . .....4.RC....@Š.Ð 0005BDC4 70 00 70 00 6E 00 01 00 33 00 57 43 00 00 00 00 D0 32 0A D0 p.p.n...3.WC....Ð2.Ð 0005BDD8 50 0E 50 0E 4E 0E 01 00 99 00 4D 4F 00 00 00 00 70 8E 05 D0 P.P.N...™.MO....pŽ.Ð 0005BDEC 10 00 00 00 00 00 00 00 44 00 53 47 00 00 00 00 80 8E 05 D0 ........D.SG....€Ž.Ð 0005BE00 30 00 30 00 2E 00 01 00 92 00 43 4F 00 00 00 00 B0 8E 05 D0 0.0.....’.CO....°Ž.Ð 0005BE14 10 00 10 00 0C 00 01 00 C1 00 47 4F 00 00 00 00 C0 8E 05 D0 ........Á.GO....ÀŽ.Ð 0005BE28 10 00 10 00 02 00 01 00 95 00 48 54 00 00 00 00 D0 8E 05 D0 ........•.HT....ÐŽ.Ð 0005BE3C 10 00 10 00 0C 00 01 00 55 00 4D 4E 00 00 00 00 E0 8E 05 D0 ........U.MN....àŽ.Ð 0005BE50 C0 00 40 00 00 00 01 00 56 00 4D 4E 00 00 00 00 E0 8E 05 D0 À.@.....V.MN....àŽ.Ð ........ 0005C7B0 10 00 10 00 0E 00 01 00 0A 01 56 46 00 00 00 00 D0 2F 0B D0 ..........VF....Ð/.Ð 0005C7C4 E0 0F E0 0F DE 0F 01 00 0B 01 45 44 00 00 00 00 00 5B 05 D0 à.à.Þ.....ED.....[.Ð 0005C7D8 00 18 00 18 FE 17 01 00 83 00 00 00 53 48 00 00 E0 8F 05 D0 ....þ...ƒ...SH..à..Ð 0005C7EC 20 00 20 00 18 00 00 00 53 5A 00 00 00 90 05 D0 D0 00 D0 00 . .....SZ.....ÐÐ.Ð. 0005C800 C6 00 00 00 48 50 00 00 D0 90 05 D0 10 00 10 00 0C 00 00 00 Æ...HP..Ð..Ð........ 0005C814 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ....................

The CPs in both ROMs are located at 0x79400.

newlockedrom.bin

Code:: Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 00079400 54 4F 06 0A B3 EC 06 0A B3 EC 00 00 DC EC 00 00 DC EC 36 03 TO..³ì..³ì..Üì..Üì6. 00079414 2A F9 36 03 2A F9 36 03 2A F9 36 03 2A F9 36 03 2A F9 36 03 *ù6.*ù6.*ù6.*ù6.*ù6. 00079428 2A F9 36 03 2A F9 36 03 2A F9 00 00 00 00 00 00 00 00 00 00 *ù6.*ù6.*ù.......... 0007943C 00 00 00 1B 43 53 01 00 A0 00 50 00 00 00 00 00 00 00 00 E1 ....CS.. .P........á 00079450 43 53 01 00 A0 00 50 00 00 00 00 00 00 00 00 E1 43 53 00 00 CS.. .P........áCS.. 00079464 00 00 00 00 00 00 00 00 00 00 00 94 43 53 00 00 00 00 00 00 ...........”CS......

000000-07FFFF.bin

Code:: Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 00079400 54 4F 65 05 42 EC 65 05 42 EC 00 00 FC EC 00 00 FC EC 36 03 TOe.Bìe.Bì..üì..üì6. 00079414 2A F9 36 03 2A F9 36 03 2A F9 36 03 2A F9 36 03 2A F9 36 03 *ù6.*ù6.*ù6.*ù6.*ù6. 00079428 2A F9 36 03 2A F9 36 03 2A F9 00 00 00 00 00 00 00 00 00 00 *ù6.*ù6.*ù.......... 0007943C 00 00 00 1B 43 53 01 00 A0 00 50 00 00 00 00 00 00 00 00 E1 ....CS.. .P........á 00079450 43 53 01 00 A0 00 50 00 00 00 00 00 00 00 00 E1 43 53 00 00 CS.. .P........áCS.. 00079464 00 00 00 00 00 00 00 00 00 00 00 94 43 53 00 00 00 00 00 00 ...........”CS......

ISTM that it may be worth trying to patch the locked drive's CPs (addresses 0x79400 - 0x7FFFF) into an unlocked ROM. Each CP has its own XOR8 checksum. However, I don't know if there are any additional checksums. If other checksums do exist, then hopefully the patch will not invalidate them. Also, the patch assumes that the lock is not contained within a CP. If it is, then hopefully the unlocked ROM code will ignore this lock. One additional question is whether the ROM firmware needs to match the SA firmware in some way.

Yes, the second dump is from a 500 GB HDD. So for now, I should just attempt to patch the locked CPs into the unlocked ROM. Actually, I think if the lock is located within a CP that would be great, as we can just extract the CPs from both ROMs and then compare them and see exactly in which CP the lock is located. Otherwise, I assume the lock is located above the CP table and that would be...not so great. Regarding the ROM firmware needing to match the SA firmware...I somehow doubt it has to, but it's just a hunch.

Another thing worth trying would be to take the CPs from the unlocked one and patch them to a locked ROM...and if it would unlock it, then I guess we can be pretty sure where the lock is. Though I do have to ask, don't these CPs contain data essential to each HDD ? Moving them around from one another seems like a stretch.

My CP extraction tool assumes that the CPs are located at 0x70000. When I wrote it I didn't have many ROM examples to work with, so I didn't know what differences I would encounter. I'll try to update it when I can.

I have extracted the CPs from each ROM.

The first CP is actually CP 0x010B ("ED") at offset 0x77C00. Sorry for my error.

Attachments

MQ01ABD032.rar: (19.53 KiB) Downloaded 1176 times

MQ01ABD050V.rar: (21.21 KiB) Downloaded 1159 times

fzabkar wrote:
Each ROM has a table of CPs. The two tables are identical.

Those tables are not complete. They are contains some standard command set.

Martin wrote:
fzabkar wrote:Each ROM has a table of CPs. The two tables are identical.

Those tables are not complete. They are contains some standard command set.

I don't understand. I count 134 CPs in total in each table. Are you saying that there are more?

These empty CPs (PP, WV, PQ) are not in the table. I haven't checked for others.

Code:: Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 0007F2E0 50 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 PP.............. 0007F2F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0007F300 57 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 WV.............. 0007F310 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 ................ 0007F320 50 51 FF FF FF FF FF FF FF FF FF FF FF FF FF FF PQÿÿÿÿÿÿÿÿÿÿÿÿÿÿ 0007F330 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ 0007F340 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ 0007F350 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ 0007F360 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ 0007F370 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ 0007F380 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ 0007F390 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 79 ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿy

There are several CPs (DB -> VF) in the table that don't appear to be in the ROM.

Code:: ID Name Dword2 Rel/Abs Address Byt11 Size (ROM/SA/size3) Byt18 Byt19 XOR8 ---------------------------------------------------------------------------------------- 0109 SX 00000000 05D1D0 / 07F2D0 D0 0010 / 0010 / 000E 01 00 00 - the following empty (?) CPs are not in the table PP 7F2E0 0020 WV 7F300 0020 PQ 7F320 0080 ? - the following CPs are in the table but not in ROM ??? 00F8 DB 00000000 09F010 / 0C1110 D0 1C90 / 1C90 / 1C8E 01 00 00 00FC AM 00000000 0A0CA0 / 0C2DA0 D0 0990 / 0990 / 098E 01 00 00 00BF OU 00000000 0A1630 / 0C3730 D0 0E50 / 0E50 / 0E4E 01 00 00 00C9 OV 00000000 0A2480 / 0C4580 D0 0E50 / 0E50 / 0E4E 01 00 00 0033 WC 00000000 0A32D0 / 0C53D0 D0 0E50 / 0E50 / 0E4E 01 00 00 0230 CA 00000000 0A4120 / 0C6220 D0 1630 / 1630 / 162E 01 00 00 0231 CB 00000000 0A5750 / 0C7850 D0 1630 / 1630 / 162E 01 00 00 0232 CC 00000000 0A6D80 / 0C8E80 D0 1630 / 1630 / 162E 01 00 00 0233 CD 00000000 0A83B0 / 0CA4B0 D0 1630 / 1630 / 162E 01 00 00 0234 CE 00000000 0A99E0 / 0CBAE0 D0 1630 / 1630 / 162E 01 00 00 0235 CF 00000000 0AB010 / 0CD110 D0 1630 / 1630 / 162E 01 00 00 00D3 ZH 00000000 0AC640 / 0CE740 D0 6760 / 6760 / 675E 01 00 00 00F7 FC 00000000 0B2DA0 / 0D4EA0 D0 01A0 / 01A0 / 019E 01 00 00 00F4 WD 00000000 0B2F40 / 0D5040 D0 0090 / 0090 / 008E 01 00 00 010A VF 00000000 0B2FD0 / 0D50D0 D0 0FE0 / 0FE0 / 0FDE 01 00 00

Toshiba 500GB out of DVR Locked

Re: Toshiba 500GB out of DVR Locked

Re: Toshiba 500GB out of DVR Locked

Re: Toshiba 500GB out of DVR Locked

Re: Toshiba 500GB out of DVR Locked

Re: Toshiba 500GB out of DVR Locked

Re: Toshiba 500GB out of DVR Locked

Re: Toshiba 500GB out of DVR Locked

Re: Toshiba 500GB out of DVR Locked

Re: Toshiba 500GB out of DVR Locked

Re: Toshiba 500GB out of DVR Locked

Re: Toshiba 500GB out of DVR Locked

Re: Toshiba 500GB out of DVR Locked

Re: Toshiba 500GB out of DVR Locked

Re: Toshiba 500GB out of DVR Locked

Re: Toshiba 500GB out of DVR Locked

Re: Toshiba 500GB out of DVR Locked

Re: Toshiba 500GB out of DVR Locked

Re: Toshiba 500GB out of DVR Locked

Re: Toshiba 500GB out of DVR Locked

Re: Toshiba 500GB out of DVR Locked