HDD GURU FORUMS
http://forum.hddguru.com/

"Game Over" signature?
http://forum.hddguru.com/viewtopic.php?f=10&t=41927		 Page 1 of 1
Author:  northwind [ November 29th, 2021, 6:25 ]
Post subject:  "Game Over" signature?
Hi all,

Maybe someone has seen this?

This is the 4th drive we get with the same behavior. The first one we saw in 2017, then we got 3 more until today.
All 4 drives are TeamGroup branded and model is L7 EVO.
They would read green sectors and append a "Game Over!!!" signature in a loop.
All other sectors are zeroed.
The controller seems to work (I've tried changing one byte and changes were saved successfully).

The first drive we got in 2017 would have an intact MBR and then nothing. The other 3 drives were simply zeroed with this signature (no MBR or other meta).
It's very, very strange to me.

Attachments:
game over3.png
game over3.png [ 137.39 KiB | Viewed 10930 times ]
game over2.png
game over2.png [ 129.65 KiB | Viewed 10930 times ]
game over.png
game over.png [ 249.7 KiB | Viewed 10930 times ]
Author:  Lardman [ November 29th, 2021, 7:39 ]
Post subject:  Re: "Game Over" signature?
Odd - Any clues in the history given from the client? It has almost a hardware bug or malware feel to it.
Author:  sourcerer [ November 29th, 2021, 11:52 ]
Post subject:  Re: "Game Over" signature?
I would suggest to dump the firmware and grep for "Game Over", perhaps it's a way for the firmware to signal a bad sector read.
Author:  ccc [ November 30th, 2021, 3:09 ]
Post subject:  Re: "Game Over" signature?
That's a Marvell 88NV1120 ssd controller inside with a failed translator module. That's how it behaves when the translator is gone. Unfortunately no commercial tool is able to work with this controller (correct me if I'm wrong).
There is a tool that can repair the ssd, by rebuilding the translator, but of course, you'll loose all the data in the process.
Author:  northwind [ November 30th, 2021, 5:28 ]
Post subject:  Re: "Game Over" signature?
Thanks everyone for your feedback.

I dug a little into the fw as suggested by sourcerer.

ccc is right, signature comes from drive's fw when translator is gone.
Author:  Arch Stanton [ November 30th, 2021, 8:42 ]
Post subject:  Re: "Game Over" signature?
Ow wow. Now I feel like I am in a Mr. Robot episode :o
Author:  digisupport [ November 30th, 2021, 10:39 ]
Post subject:  Re: "Game Over" signature?
FW developers have a strange humor :o
Author:  pepe [ November 30th, 2021, 11:31 ]
Post subject:  Re: "Game Over" signature?
concerning humor, all the hard disk firmwares are full of dead beef, dead food, dead face, Beef Food and so on.

pepe
Author:  northwind [ December 1st, 2021, 5:00 ]
Post subject:  Re: "Game Over" signature?
I still remember the first time in my life I witnesses "DE AD BE EF". I was literally "wtf, really now?"
Author:  Arch Stanton [ December 2nd, 2021, 3:23 ]
Post subject:  Re: "Game Over" signature?
https://youtu.be/dsx2vdn7gpY
Author:  crashpcberlin [ February 23rd, 2022, 16:01 ]
Post subject:  Re: "Game Over" signature?
Hey Guys,

i have a ADATA SP580 with this Marvell 88nv1120 Controller and the same behavior.

Gets Full ID, access is a little bit weak and shown sectors are empty.

Any advice to fix?
Author:  northwind [ February 24th, 2022, 11:11 ]
Post subject:  Re: "Game Over" signature?
No commercial tool available to fix/bypass the translator problem, so for now it's game over I'm afraid.
This isn't a very popular controller so we didn't spend time researching it, not worth it.

Maybe Ace will add this controller in future releases.
Page 1 of 1 All times are UTC - 5 hours [ DST ]
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
http://www.phpbb.com/