CompactFlash, SD, MMC, USB flash storage. Anything that does not have moving parts inside.
November 29th, 2021, 6:25
Hi all,
Maybe someone has seen this?
This is the 4th drive we get with the same behavior. The first one we saw in 2017, then we got 3 more until today.
All 4 drives are TeamGroup branded and model is L7 EVO.
They would read green sectors and append a "Game Over!!!" signature in a loop.
All other sectors are zeroed.
The controller seems to work (I've tried changing one byte and changes were saved successfully).
The first drive we got in 2017 would have an intact MBR and then nothing. The other 3 drives were simply zeroed with this signature (no MBR or other meta).
It's very, very strange to me.
- Attachments
-
- game over3.png (137.39 KiB) Viewed 10988 times
-
- game over2.png (129.65 KiB) Viewed 10988 times
-
November 29th, 2021, 7:39
Odd - Any clues in the history given from the client? It has almost a hardware bug or malware feel to it.
November 29th, 2021, 11:52
I would suggest to dump the firmware and grep for "Game Over", perhaps it's a way for the firmware to signal a bad sector read.
November 30th, 2021, 3:09
That's a Marvell 88NV1120 ssd controller inside with a failed translator module. That's how it behaves when the translator is gone. Unfortunately no commercial tool is able to work with this controller (correct me if I'm wrong).
There is a tool that can repair the ssd, by rebuilding the translator, but of course, you'll loose all the data in the process.
November 30th, 2021, 5:28
Thanks everyone for your feedback.
I dug a little into the fw as suggested by sourcerer.
ccc is right, signature comes from drive's fw when translator is gone.
November 30th, 2021, 8:42
Ow wow. Now I feel like I am in a Mr. Robot episode
November 30th, 2021, 10:39
FW developers have a strange humor
November 30th, 2021, 11:31
concerning humor, all the hard disk firmwares are full of dead beef, dead food, dead face, Beef Food and so on.
pepe
December 1st, 2021, 5:00
I still remember the first time in my life I witnesses "DE AD BE EF". I was literally "wtf, really now?"
February 23rd, 2022, 16:01
Hey Guys,
i have a ADATA SP580 with this Marvell 88nv1120 Controller and the same behavior.
Gets Full ID, access is a little bit weak and shown sectors are empty.
Any advice to fix?
February 24th, 2022, 11:11
No commercial tool available to fix/bypass the translator problem, so for now it's game over I'm afraid.
This isn't a very popular controller so we didn't spend time researching it, not worth it.
Maybe Ace will add this controller in future releases.
Powered by phpBB © phpBB Group.