I've been Looking into some SSD firmware as this seems to be a good place to start research. Samsung firmware is encoded by a rather silly method. I really wonder why they bothered.?. I have coded up a small python script to decode Samsung firmware and the associated file that accompanies a firmware update. I am using Python 3.4.3

This script supports current firmware:

840 EVO EXT0DB6Q
840 PRO DXM06B0Q
840 DXT09B0Q
830 Series CXM03B1Q
470 Series AXM09B1Q

http://www.samsung.com/global/business/semiconductor/minisite/SSD/global/html/support/downloads.html

For firmware update ISO's, you can strip out the relevant DSRD.enc update info file and, for example, "DXM06B0Q.enc" firmware files in a number of ways.
here are a few steps that work:

1 .Right-click and choose extract using 7-zip.

2. Open the extracted folder, then navigate to the appropriate disk image that holds the firmware. it will be called something like "Bootable_2.88M.img". Depending on the ISO, if it is a DOS or Linux based boot, the files will be in various places, not hard to find. Interestingly there is also mac trash files and deleted firmware, looks rather sloppy TBH.

3. Extract the files from this image, you can use winhex to parse the image, probably even R-Studio or GetDataBack..or whatever. many ways to do this.

4. find the firmware files. DSRD.enc and DXM06B0Q.enc are examples.

5. copy "samsung_ssd_decode.py" to the same folder and run it.


here is before and after screenshot, but the actual firmware file is probably WAY more interesting


I have some other stuff I am working on, hopefully I can get something interesting to share out of it.

Thanks very much for that. I don't know any Python, but your code is easily understandable.

_________________
A backup a day keeps DR away.

Very interesting solution!
I selected another way. I have used 256 bytes XOR values array.
If use your notations then my solution written in pseudo-Pascal looks like this:

I think your solution is more elegant, but my solution is more general.
Since it allows to use any array of XOR values and abandon a nibble division.

What deals with unpacking of firmware from previous drives like MLC SSD (VBM18C1Q, VBM19C1Q, VBM1AD1Q,...)?

By the way question of dumb procedure recedes given firmware protection.
Did you start research of check sums of microcode? You can see whatever ranging from CRC16 to Elliptic Curve DSA (ECDSA).
And firmware is protected by several control sums concurrently.
Seems like Samsung developers don't like if somebody modifies the firmware of their SSD.
There is idea that if they read this topic then they will change encryption algorithm.

Nice to see another way of doing it, thanks
I don't have any other firmware a currently so I am not sure how they are obfuscated

Actually I haven't really started looking at the firmware itself in great detail

I was starting to look at the update mechanism itself and was attempting to reverse the flasher utility

I never really got into reversing DOS 16-bit programs and certainly haven't much experience in DOS extenders. The usual tools puke at this and to make it worse the stubbed exe is also packed... As far as I know there never has been any interest in anyone unpacking it
The firmware itself should be just a mixture of arm and thumb code and may or may not be worth looking at
Thanks for the checksum info!

Can you explain, how did you know about this algorithm of microprogram unpacking? I have spend a lot of time for analysis of packed firmwares for XOR detection...
I seen the flasher, there is nothing interesting in it. It doesn't contain a tech key - only 92h command and a few of simple tests inside it.
Firmware has a special block structure and consist of ARM and Thumb codes. That's why before you will upload it into disassemble, try to find which blocks and by which addresses are uploading on SSD RAM. Also, please don't forget that controller have three CPU cores.

Also, here is a couple advice:
1. You are choose Samsung 840 series SSD - its very complicated for research works. Better to use 830 series.
2. All Samsung SSD drives have COM-Port, but it is turned-off in main firmware.
3. Drives have a special mode for working under MASK ROM control.
4. Drives have a small number of technological commands.
5. On many drives you can disable senior memory banks for the purpose of repair. Actually, these SSD is quite repairable. Much more complicated task is data recovery...

If you will have some interesting information about the Samsung SSD, please write me a private message. In exchange I can tell you what I know about these drives or to offer something more interesting for you

I will preface this by saying I have mostly VBA coding experience and am just learning Python.

That said, I have a need to encode the *.enc file. I have been using the samsung_ssd_decode.py with great success. Now, I would like to make a change and encode to test a firmware package. While the code is straight forward, I'm having difficulty with the same process in reverse. Any help is appreciated.

Since I'm a new member, I tried to PM but the system said I needed more activity. So, I'm now being active.

I haven't tested it, but I think this should work:

I would test it by encoding and then decoding a test file. The result should be identical to the original file.

_________________
A backup a day keeps DR away.

That worked perfectly, fzabkar, thanks!

I think you will find the Zheino CHN-25PATA01 range of drives, likely to be the most hack-able as they are specifically designed to be utilized in a wide range of industrial machinery. They respond to email and I think you would be able to communicate directly with the engineering group

Available on Amazon or from Ali Express here:http://goo.gl/VYdv5a

Cheers

Thanks a lot, will have a look at those for sure. nice to someone else in SA even knows what an SSD is, let alone hacking one!

edit:
looking them up, I got a chuckle at the Lost in Translation.. couldn't resist, hope no-one is easily offended:

Why is their whole support page just an image and link to http://www.baidu.com/ ? same with the News Page..
forum looks dodgy:


I wouldn't be sending a cent over paypal to these guys

If you go through a checkout process and pay via Paypal, as a buyer you cannot lose. I know from the perspective of an eBay seller for 14 years, the buyer always wins and in some cases keeps the goods as well

Edit: I just bought one off eBay Australia (Australian stock) @ $82 and I have no fear of losing money

http://www.ebay.com.au/itm/171110782702

Sorry for my stupid question, but i can't find any .enc files. There are only four files in iso image: btdsk.img, isolinux.bin, isolinux.cfg, memdisc.

not stupid at all. This stuff gets easier the more you play around with it.

after you extract files from the ISO, you will be left with a few files... You then have to further extract from one of these files.

You will notice btdsk.img is about 2,880kb, and being the largest file you can be certain this one contains the firmware. So extract this file... with z-zip, "extract here" then look in folder "btdsk\Samsung\DSRD\FW\DXT09B0Q" for example

if you read number 2. and 3. where I explained it above, it should make sense.

HaQue, thnx

I disassembled this firmware and now i'm trying to understand this code.
How can i find port addresses?

@HaQue
I want to edit "dsrd.enc",so I use "samsung_ssd_decode.py" to change it ,but how to change "dsrd.enc.decoded" to "dsrd.enc" ? and can't use
"samsung_ssd_decode.py" to change "CXM03B1Q.enc".

Some alternative code/projects ...

Samsung SSD firmware encoder/decoder (Zibri's Blog):
http://www.zibri.org/2015/05/samsung-ssd-firmware-encoderdecoder.html

Samsung SSD Firmware Deobfuscation Utility:
https://github.com/ddcc/drive_firmware
https://github.com/ddcc/drive_firmware/blob/master/samsung/samsung.c
https://www.reddit.com/r/ReverseEngineering/comments/2uwhls/samsung_ssd_firmware_deobfuscation_utility/

_________________
A backup a day keeps DR away.

New firmwares is packed using another algorithm.
As an example, you can consider firmware EXM04B6Q.
http://downloadcenter.samsung.com/conte ... 6Q_Win.iso
So the above methods are already outdated.

a question,when I got firmware files. DSRD.enc and DXM06B0Q.enc ,and decoded it ,how to write back to ssd?

You have to either sign the firmware correctly and then send it into the SSD with hdparm or Samsung Magician. Or you can upload it with JTAG.