"Game Over" signature?

[northwind]

Hi all,

Maybe someone has seen this?

This is the 4th drive we get with the same behavior. The first one we saw in 2017, then we got 3 more until today.
All 4 drives are TeamGroup branded and model is L7 EVO.
They would read green sectors and append a "Game Over!!!" signature in a loop.
All other sectors are zeroed.
The controller seems to work (I've tried changing one byte and changes were saved successfully).

The first drive we got in 2017 would have an intact MBR and then nothing. The other 3 drives were simply zeroed with this signature (no MBR or other meta).
It's very, very strange to me.

Attachments

game over3.png (137.39 KiB) Viewed 10938 times

game over2.png (129.65 KiB) Viewed 10938 times

[Lardman]

Odd - Any clues in the history given from the client? It has almost a hardware bug or malware feel to it.

[sourcerer]

I would suggest to dump the firmware and grep for "Game Over", perhaps it's a way for the firmware to signal a bad sector read.

[ccc]

That's a Marvell 88NV1120 ssd controller inside with a failed translator module. That's how it behaves when the translator is gone. Unfortunately no commercial tool is able to work with this controller (correct me if I'm wrong).
There is a tool that can repair the ssd, by rebuilding the translator, but of course, you'll loose all the data in the process.

[northwind]

Thanks everyone for your feedback.

I dug a little into the fw as suggested by sourcerer.

ccc is right, signature comes from drive's fw when translator is gone.

[Arch Stanton]

Ow wow. Now I feel like I am in a Mr. Robot episode

[digisupport]

FW developers have a strange humor

[pepe]

concerning humor, all the hard disk firmwares are full of dead beef, dead food, dead face, Beef Food and so on.

pepe

[northwind]

I still remember the first time in my life I witnesses "DE AD BE EF". I was literally "wtf, really now?"

[Arch Stanton]

https://youtu.be/dsx2vdn7gpY

[crashpcberlin]

Hey Guys,

i have a ADATA SP580 with this Marvell 88nv1120 Controller and the same behavior.

Gets Full ID, access is a little bit weak and shown sectors are empty.

Any advice to fix?

[northwind]

No commercial tool available to fix/bypass the translator problem, so for now it's game over I'm afraid.
This isn't a very popular controller so we didn't spend time researching it, not worth it.

Maybe Ace will add this controller in future releases.