All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 12 posts ] 
Author Message
 Post subject: "Game Over" signature?
PostPosted: November 29th, 2021, 6:25 
Offline
User avatar

Joined: January 28th, 2009, 10:54
Posts: 3445
Location: Greece
Hi all,

Maybe someone has seen this?

This is the 4th drive we get with the same behavior. The first one we saw in 2017, then we got 3 more until today.
All 4 drives are TeamGroup branded and model is L7 EVO.
They would read green sectors and append a "Game Over!!!" signature in a loop.
All other sectors are zeroed.
The controller seems to work (I've tried changing one byte and changes were saved successfully).

The first drive we got in 2017 would have an intact MBR and then nothing. The other 3 drives were simply zeroed with this signature (no MBR or other meta).
It's very, very strange to me.


Attachments:
game over3.png
game over3.png [ 137.39 KiB | Viewed 10578 times ]
game over2.png
game over2.png [ 129.65 KiB | Viewed 10578 times ]
game over.png
game over.png [ 249.7 KiB | Viewed 10578 times ]

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners
Top
 Profile  
 
 Post subject: Re: "Game Over" signature?
PostPosted: November 29th, 2021, 7:39 
Offline

Joined: November 7th, 2020, 5:31
Posts: 1072
Location: The_UK
Odd - Any clues in the history given from the client? It has almost a hardware bug or malware feel to it.

_________________
Data Recovery Services in the UK.
https://www.usbrecovery.co.uk/


Top
 Profile  
 
 Post subject: Re: "Game Over" signature?
PostPosted: November 29th, 2021, 11:52 
Offline

Joined: August 13th, 2016, 17:10
Posts: 192
Location: Vienna, Austria
I would suggest to dump the firmware and grep for "Game Over", perhaps it's a way for the firmware to signal a bad sector read.


Top
 Profile  
 
 Post subject: Re: "Game Over" signature?
PostPosted: November 30th, 2021, 3:09 
Offline
User avatar

Joined: January 9th, 2007, 11:12
Posts: 390
Location: Romania
That's a Marvell 88NV1120 ssd controller inside with a failed translator module. That's how it behaves when the translator is gone. Unfortunately no commercial tool is able to work with this controller (correct me if I'm wrong).
There is a tool that can repair the ssd, by rebuilding the translator, but of course, you'll loose all the data in the process.

_________________
www.datasave.ro


Top
 Profile  
 
 Post subject: Re: "Game Over" signature?
PostPosted: November 30th, 2021, 5:28 
Offline
User avatar

Joined: January 28th, 2009, 10:54
Posts: 3445
Location: Greece
Thanks everyone for your feedback.

I dug a little into the fw as suggested by sourcerer.

ccc is right, signature comes from drive's fw when translator is gone.

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners


Top
 Profile  
 
 Post subject: Re: "Game Over" signature?
PostPosted: November 30th, 2021, 8:42 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
Ow wow. Now I feel like I am in a Mr. Robot episode :o

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
 Post subject: Re: "Game Over" signature?
PostPosted: November 30th, 2021, 10:39 
Offline
User avatar

Joined: March 6th, 2010, 3:46
Posts: 599
Location: Kolding | Denmark
FW developers have a strange humor :o

_________________
Digitalsupport Data Recovery
https://digitalsupport.dk


Top
 Profile  
 
 Post subject: Re: "Game Over" signature?
PostPosted: November 30th, 2021, 11:31 
Offline

Joined: October 3rd, 2005, 0:40
Posts: 4301
Location: Hungary
concerning humor, all the hard disk firmwares are full of dead beef, dead food, dead face, Beef Food and so on.

pepe

_________________
Adatmentés - Data recovery


Top
 Profile  
 
 Post subject: Re: "Game Over" signature?
PostPosted: December 1st, 2021, 5:00 
Offline
User avatar

Joined: January 28th, 2009, 10:54
Posts: 3445
Location: Greece
I still remember the first time in my life I witnesses "DE AD BE EF". I was literally "wtf, really now?"

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners


Top
 Profile  
 
 Post subject: Re: "Game Over" signature?
PostPosted: December 2nd, 2021, 3:23 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
https://youtu.be/dsx2vdn7gpY

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
 Post subject: Re: "Game Over" signature?
PostPosted: February 23rd, 2022, 16:01 
Offline
User avatar

Joined: March 15th, 2017, 10:25
Posts: 63
Location: Berlin
Hey Guys,

i have a ADATA SP580 with this Marvell 88nv1120 Controller and the same behavior.

Gets Full ID, access is a little bit weak and shown sectors are empty.

Any advice to fix?


Top
 Profile  
 
 Post subject: Re: "Game Over" signature?
PostPosted: February 24th, 2022, 11:11 
Offline
User avatar

Joined: January 28th, 2009, 10:54
Posts: 3445
Location: Greece
No commercial tool available to fix/bypass the translator problem, so for now it's game over I'm afraid.
This isn't a very popular controller so we didn't spend time researching it, not worth it.

Maybe Ace will add this controller in future releases.

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 12 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 22 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group