Unlocking ATA Password of PM863a SSD possible?

[blunden]

I would try shorting SCL (temp sensor) or EN (MP5505) to ground, as explained previously.

Just short one of them to the ground pin the respective chip (any difference beteen AGND and PGND on the MP5505?)?

[fzabkar]

AGND and PGND should be at the same potential. The screw holes will probably also be grounded, or you could use the SATA power ground pins.

https://pinoutguide.com/Power/sata-power_pinout.shtml

[akoznov]

@blunden - did you try to shorten temp sensor with ground? did it help to bypass security on the drive?

I’ve got couples of PM863 (Samsung mz7lm480hmhq-00005) in Maximum security Secure locked state (Master password revision 4) and interested to bypass security to reflash them to normal drives.

@fzabkar - could I ask you to check photos of PCB of my drives for the same possibility of shortening - I think the same as like in case of blunden drives. Another question - I should use small wire that will be soldered to one of the pins of SCL or EN to the ground and then connect them using SATA connection? Or it should be temporary shortening while drive is connected?

[blunden]

@blunden - did you try to shorten temp sensor with ground? did it help to bypass security on the drive?

No, I haven't gotten around to due so yet. I've been busy with other stuff.

I would love to hear about any progress you make though.

[fzabkar]

@fzabkar - could I ask you to check photos of PCB of my drives for the same possibility of shortening - I think the same as like in case of blunden drives. Another question - I should use small wire that will be soldered to one of the pins of SCL or EN to the ground and then connect them using SATA connection? Or it should be temporary shortening while drive is connected?

If the EN pin of the MP5505 is not strapped directly to Vcc, ie if it is tied up to Vcc via a pullup resistor, then you can short this pin to ground while powering up the SSD, and then release the short after the SSD identifies itself. Hopefully this will induce ERRORMOD.

I suspect that the pinout of the temperature sensor may be similar to this IC:

http://ww1.microchip.com/downloads/en/D ... 05192B.pdf

If so, then you could short SCL or SDA to ground during power-on and then release the short.

You could use metal tweezers, if you are careful. A soldered wire, which you touch to ground at power-on, might be safer, though.

[gold6565]

We transfer the disk to the mod safe, write its native firmware into it, you can find it on the Internet, the disk after it is turned on. falls into the Eror mod. Then everyone decides for himself, or issue a cleaning command or connect to the Samsung utility and she will do everything herself.

[blunden]

We transfer the disk to the mod safe, write its native firmware into it, you can find it on the Internet, the disk after it is turned on. falls into the Eror mod. Then everyone decides for himself, or issue a cleaning command or connect to the Samsung utility and she will do everything herself.

Could you describe each step in more detail?

[akoznov]

I would love to hear about any progress you make though.

Alright, I've done procedure, unlocked all drives and reformat them.

You could use metal tweezers, if you are careful. A soldered wire, which you touch to ground at power-on, might be safer, though.

Thanks, I've used tiny wire to touch the ground at ears of drive. Also interesting thing - you don't need to do touch at power-on operation. You can do that after you connect drive - drive will automatically disconnect and reconnect to system in ERRMOD.



Pre-requirements for that operation:

• PC with SATA hot-plug function. Note: USB adapters will not work!
• Linux OS for making life easier (for example, Ubuntu or any system that contains hdparm utility)
• Tiny wire - best to have the same size or less as size of 5505 chip leg
• Good and bright lightning
• Screwdriver with P5 pentalobe bit

Procedure:

• Check BIOS settings for SATA hot-plug option at your SATA controller options and enable it
• Boot your linux distro
• Open case of drive
• Connect drive to SATA connector and SATA power
• Use

  Code:

  dmesg -w

  to follow messages and check that drive is initialized, and you will see errors about status of device (DRDY ERR ABRT):
  

  Code:

  [5838.528212] ata5.00: configured for UDMA/133
[5838.528240] ata5: EH complete
[5838.549271] ata5.0o: exception Emask OX0 SAct OX0 SErr 0x0 action ox0
[5838.549288] ata5.00: irq_stat 0x40000001
[5838.549293] ata5.00: failed conmand: READ DMA EXT
[5838.549297] ata5.00: cd 25/00:08:00:36: 4/00:00:37:00:00/e0 tag 23 dma 4096 in res 51/04:08:00:36:e4/00:00:37:00:00 /e0 Emask Ox1 (device error)
[5838.549313] ata5.00: status: { DRDY ERR }
[5838.549317] ata5.00: error: { ABRT }


  
  If you check status of drive using hdparm you will see that Security level is maximum, device is locked and using custom password (rev. 4):
  

  Code:

  hdparm -I /dev/sda
*****
Security:
     Master password reviston code = 4
          supported
          enabled
          locked
          not frozen
          not expired: security count
          supported: enhanced erase
          Security level maximun
32min for SECURITY ERASE UNIT, 32min for ENHANCED SECURITY ERASE UNIT.
Logical Unit WWN Device Identifler: 5002538C403e74e5


  
  
• Take wire and connect one side of wire to EN pin #6 of MP5505 chip and second to ground (I used screw holes of drive) for a moment.
  

  

• After shortening in dmesg output you will see messages that link will go down and COMRESET failed events:
  

  Code:

  [6626.611720] atas: SATA link down (SStatus 0 SControl 300)
[6637.063591] ata5: link is slow to respond, please be patient (ready 0)
[6641.743552] ata5: COMRESET failed (errno=-16)
[6647.095462] ata5: link is slow to respond, please be patient (ready 0)
[6651.775435] ata5: COMRESET failed (errno=-16)
[6652.147445] ata5: SATA link down (SStatus 0 SControl 300)
[6652.147485] ata5.0o: link offline, clearing class 1 to NONE [ 6657.264156] ata5: SATA link up 6.0 Gbps (SStatus 133 SControl 300)
[6658.841970] ata5.00: failed to IDENTIFY (I/0 error, err_mask=0×100)
[6658.841983] ata5.00: revalidation failed (errno=-5)
[6658.841991] ata5.00: disabled


• After 4 seconds drive should make power cycle and drive should load to ERRMOD with size of 1GB:
  

  Code:

  [6662.743568] ata5: SATA link down (Status 0 Control 300)
[6662.743659] ata5.00: detaching (SCSI 4:0:0:0)
[6662.759268] sd 4:0:0:0: [sda] Synchronizing SCSI cache
[6662.759350] sd 4:0:0:0: [sda] Synchronize Cache(10) failed: Result: hostbyte-DID_BAD_TARGET driverbyte-DRIVER_OK
[6662.759357] sd 4:0:0:0: [sda] Stopping disk
[6662.759375] sd 4:0:0:0: [sda] Start/Stop Unit failed: Result: hostbyte-DID_BAD_TARGET driverbyte-DRIVER_OK
[6664.891298] ata5: SATA link up 6.0 Gps (SStatus 133 Control 300)
[6664.891823] ata5.00: HA detected: current 1965352, native 1965353
[ 6664.891838] ata5.00: ATA -9: [b]SAMSUNG MZ7LM480HCHP -00005, ERRORMOD[/b], max UDMA/133
[ 6664.892210] ata5.00: Read log 0x00 page 0x00 failed, Emask 0x1
[6664.892223] ata5.00: NCQ Send/Rec Log not supported
[6664.892226] ata5.00: 1965352 sectors, multi 16: LBA48 NCQ (depth 32), AA
[6664.893130] ata5.00: Read log 0x00 page 0x00 failed, Emask 0×1
[6664.893141] ata5.00: NCQ Send/Rev Log not supported
[6664.893152] ata5.00: configured for UDMA/133
[6664.893379] scst 4:0:0:0: Direct-Access ATA SAMSUNG MZ7LM480 RMOD PQ: 0 ANSI: 5
[ 6664.893740] sd 4:0:0:0: Attached scsi generic sg0 type 0
[6664.893898] sd 4:0:0:0: [sda] 1965352 [b]512-byte logical blocks: (1.01 GB/960 MB)[/b]
[6664.893921] sd 4:0:0:0: [sda] Write Protect is off
[6664.893926] sd 4:0:0:0: [sda] Mode Sense: 00 3a 00 00
[6664.893951] sd 4:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DO or FUA
[6664.9673511 sd 4:0:0:0: [sda] Attached SCSI disk


  
  
• If you now check status of drive using hdparm you will see that Security level is gone and device is unlocked and using standard password (rev. 65534):
  

  Code:

  hdparm -I /dev/sda
*****
Security:
     [b]Master password reviston code = 65534[/b]
          supported
          not enabled
          [b]not locked[/b]
          not frozen
          not expired: security count
          supported: enhanced erase
          Security level maximun
32min for SECURITY ERASE UNIT, 32min for ENHANCED SECURITY ERASE UNIT.
Logical Unit WWN Device Identifler: 5002538C403e74e5


• Open another console and perform secure erase using hpdarm utility:
  

  Code:

  hdparm --security-erase NULL /dev/sda

Issuing SECURITY_ERASE command, password="", user=user
ST_IO: bad/missing sense data, sb[] 70 00 05 00 00 00 00 0a 00 50 40 00 21 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00


• Try to format the drive and copy some data
  

Photo from process of unlocking:

[gold6565]

1. transfer the disk to the safe mod. We close two separate holes on the board and incl.
2. Read how to download firmware to disk ( https://blog.muwave.de/2019/09/samsung- ... urrection/ ) and download. OFF and ON The disk accepts the firmware, but is in ERROR MOD.
3. We search the Internet for Samsung Magician DC ver 1.0.0.0, it has a repair function ERROR MOD, launch, repair.

[blunden]

1. transfer the disk to the safe mod. We close two separate holes on the board and incl.
2. Read how to download firmware to disk ( https://blog.muwave.de/2019/09/samsung- ... urrection/ ) and download. OFF and ON The disk accepts the firmware, but is in ERROR MOD.
3. We search the Internet for Samsung Magician DC ver 1.0.0.0, it has a repair function ERROR MOD, launch, repair.

Thanks!

I'm not sure what you mean in step 1 by "transfer the disk to the safe mod" though? Also, which two separate holes on the board do you close? By "closing them", do you mean that you short them together or something else?

In step 2, do you mean that you power cycle the drive after using hdparm --fwdownload to upload the firmware to the drive?

[SWM]

The link describes everything in detail (https://blog.muwave.de/2019/09/samsung- ... urrection/).
Two holes next to five JTAGs.
After downloading the microcode (ATA 92H), the power is switched.

[fzabkar]

@akoznov, thank you for the feedback, and congratulations. :-)

[fzabkar]

Is "ERROR MOD" the same as "safe mode"?

Doesn't this mean that the secure erase command failed? :-?

Code:

hdparm --security-erase NULL /dev/sda

Issuing SECURITY_ERASE command, password="", user=user
ST_IO: bad/missing sense data, sb[] 70 00 05 00 00 00 00 0a 00 50 40 00 21 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Samsung Magician Software for Enterprise SSD:
https://semiconductor.samsung.com/consumer-storage/support/tools/

This Data Center Magician SSD management utility is designed to work with the Samsung PM863 and SM863 Series only. This software is not compatible with other manufacturer's SSDs.

User Guide:
https://semiconductor.samsung.com/resources/software-resources/Samsung_Magician_DC_Brand_v2_User_Guide.pdf

Magician Software for Windows and Linux OS 64bit:
https://semiconductor.samsung.com/resources/software-resources/Samsung_Magician_DC_Windows_64bit.exe
https://semiconductor.samsung.com/resources/software-resources/Samsung_Magician_DC_Linux_64bit.zip

Attachments

[blunden]

I'm having trouble getting SATA hotplug to work in Ubuntu on my Asus Crosshair Dark Hero motherboard despite enabling it for all SATA ports in the BIOS. After some googling, I found someone else with a similar issue where changing the LPM state to max_performance worked for him.

https://forum.level1techs.com/t/sata-ho ... 0-p/189719

Unfortunately it makes no difference for me after setting it on all "hosts" under sys/class/scsi_host/. Dmesg doesn't show anything when I hotplug a SATA drive. I also tried with a different drive just in case, but no change. I guess I'll have to find a different computer to use.

[fzabkar]

@blunden, just short the two pads, as instructed.

... “my” SSD responds to the safe-mode pin bridge mentioned in the PC-3000 video (connect the two separated vias next to the 5 JTAG vias on the pcb while powering up the drive)

https://youtu.be/jvPRpatmHeY?t=87

My idea was only an alternative in case the safe-mode method didn't work for all ERRORMOD cases. It would be an idea to use Magician DC to fix the ERRORMOD condition rather than a secure erase, just to see if the data become accessible.

[gold6565]

@blunden, just short the two pads, as instructed.

... “my” SSD responds to the safe-mode pin bridge mentioned in the PC-3000 video (connect the two separated vias next to the 5 JTAG vias on the pcb while powering up the drive)

https://youtu.be/jvPRpatmHeY?t=87

My idea was only an alternative in case the safe-mode method didn't work for all ERRORMOD cases. It would be an idea to use Magician DC to fix the ERRORMOD condition rather than a secure erase, just to see if the data become accessible.

If you are talking about shorting the bus, then this is the most correct idea. There are also PM883 PM983 and others. And after ERROR MOD, the data disappears.

[akoznov]

@akoznov, thank you for the feedback, and congratulations.

Thanks a lot!

Doesn't this mean that the secure erase command failed?

Really don't know, but after that message I've successfully reformated drive and copied data (around 100 gigabyte) successfully.

And after ERROR MOD, the data disappears.

True, here I think, more important to restore usage of drive, not saving data.

[blunden]

@blunden, just short the two pads, as instructed.

... “my” SSD responds to the safe-mode pin bridge mentioned in the PC-3000 video (connect the two separated vias next to the 5 JTAG vias on the pcb while powering up the drive)

https://youtu.be/jvPRpatmHeY?t=87

My idea was only an alternative in case the safe-mode method didn't work for all ERRORMOD cases. It would be an idea to use Magician DC to fix the ERRORMOD condition rather than a secure erase, just to see if the data become accessible.

Yeah, I guess I could try that. I would still need to flash the firmware using hdparm when using that method, right?

The problem is that my computer seemingly won't let me continue to boot until I enter the unknown drive password if I power on with the drive connected. I therefore have to hotplug it, unless I can bypass that screen which seems to be presented by the BIOS/UEFI.

Also, I wouldn't be surprised if the drive is in a frozen state even if I manage to boot with it connected, which once again would require hotplugging to most easily bypass.

Are you saying I should simply short those pads when powering on the computer and then boot to Linux to flash the firmware in order to trigger ERRORMOD?

Wouldn't a secure erase reset the security level, which is very beneficial in this case? I'm not sure that the Magician DC command will necessary do that, depending on how it's implemented.

[blunden]

When shorting the two holes to enter Safe Mode, the drive doesn't show up at all in dmesg from what I can tell. It certainly doesn't show up as an ATA device under /dev/sd* so I can't really interact with it in that mode with hdparm to flash the firmware. Samsung's tools seemingly don't see it either.

Shorting those to holes with a tweezer while powering on the PC allowed it to boot to Linux instead of showing the password screen so it clearly didn't load the drive firmware like it normally would. I used the computer mentioned previously with non-working SATA hotplugging though, but my understanding was that it shouldn't matter when using this particular method?

Just to confirm that I didn't somehow destroy the drive, I later powered it on normally connected to a laptop using a USB enclosure and it still shows up properly, but locked.

[blunden]

Checking if it shows up in the BIOS when I try to get the drive to enter safe mode, it shows up as "ROM MODE (0.0GB)". That's the same as Safe Mode, right?

It's weird that I don't see it in dmesg when booted to Ubuntu 23.04 though. I guess I'll have to try again later with a different PC.