Hi

i have rosewood harddisk ST2000LM009 fw : SED! . Anyone know how we create 1d2 module from 1d1 module or what change we do in module 1d2 so drive get parmanet unlock.

thanks and regards
piyush

How to Generate/Modify 1D2 Module for Permanent Unlock
1. Understand the Modules:
1D1 Module → Contains the Media Key (Encryption Key).
1D2 Module → Contains the password hash and unlock rules.
To disable password protection, you need to modify 1D2 to bypass authentication.

2. Method 1: Copy 1D1 to 1D2 (Basic Unlock)
Some technicians copy the first 0x200 bytes of 1D1 into 1D2 (effectively making the password check pass).
Steps:
Dump 1D1 and 1D2 (using PC-3000, MRT, or Seagate Terminal).
Open 1D1 in a hex editor (e.g., HxD).
Copy the first 0x200 bytes of 1D1.
Paste them into 1D2 (overwriting the first 0x200 bytes).
Write the modified 1D2 back to the drive.

3. Method 2: Patch 1D2 to Disable Password (Advanced)
Some drives require specific patches in 1D2 to disable security.
Common patches:
Change password hash to all zeros.
Modify unlock flags (e.g., set "No Password Required" bit).
Example Patch (Hex Edit):
Find and replace password-related structures in 1D2 with 00 or FF.
Some versions require specific offsets (varies by firmware).

4. Method 3: Use a Pre-Patched 1D2 (Community-Shared)
Some data recovery forums share pre-patched 1D2 modules for certain Rosewood FWs. (use yandex.com, bing.com etc)
Search for:
"ST2000LM009 SED unlock 1D2 patch"
"Rosewood 1D2 permanent unlock"

Risks:
Wrong modifications can brick the drive permanently.
Some drives re-lock after power cycle if not patched correctly.

Tools Needed:
PC-3000, MRT, or Seagate Terminal (to read/write modules).
Hex Editor (HxD, WinHex).

@jackass25, there was an MRT thread that used a different method. If you upload your 0x1D1 and 0x1D2 modules, I'll show you how they did it.

_________________
A backup a day keeps DR away.

hi
I am attach the 1d1 and 1d2 module. please guide how do i do patch.

Extract a copy of 0x1D2 from 0x1D1 at 0x22000 - 0x38fff.


The carved file is very similar to your 1D2.

There are differences at the beginning:


This is the remaining difference (apart from the checksum):



To "permanently unlock" 1D1, change offset 0x04 from 0x80 to 0x81 and add 1 to the checksum word at 0x1C88.

I don't understand why there are so many differences between 1D2 and the version that was carved from 1D1, but this method has worked twice in the past.

_________________
A backup a day keeps DR away.