Here are the two firmware modules identified by the security researchers in the abovementioned paper:

Module 0x127


Module 0x124


Notice that the default user password consists of 30 spaces while the default master password is "WDCWDC ...". The researchers bypassed the SED lock (using PC3000) and accessed these modules in the normal way.

_________________
A backup a day keeps DR away.

I don't think they talked about modules. I think they talked about offset in module.

They refer to "SA area" and "different SAs". That doesn't sound like they are referring to offsets. ???

_________________
A backup a day keeps DR away.

Will see.

Hello fzabkar,

USBdeview output is here.

Here is a detailed photo of the drive.

I will try to use reallymine but I could not connect the drive via SATA. I see there are [12 pins] - USB port and [2 pins] on the drive. They don't seem compatible with SATA cables. I have found this article but it is an old one and my drive seems different.

Here is a close picture.

If you have any idea please share with me.

If you want me provide any other info please tell me.

Here is the circuit photo. Thank you!

AIUI, the drive is a SED (VID/PID = 1058/0810):

http://www.hddoracle.com/viewtopic.php? ... 9069#p9069

This means that encryption is handled by the drive rather than the bridge. Therefore I don't think that reallymine would be applicable in your case. You could always ask the author, though.

Note that your drive will have a locked SA which means that you will need special techniques to gain access:

viewtopic.php?f=1&t=33822&p=236436

You could wait for WDMarvel (US$15) to add this feature (if it doesn't have it already?).

_________________
A backup a day keeps DR away.

One of the heads is weak or dead.

_________________
Sistrum Data Recovery
http://www.sistrum.mk/en

This thread explains what you need to do:
viewtopic.php?f=1&t=27819

Notice that removing (or defeating) U14 causes the bridge IC to behave like an ordinary "dumb" bridge. In this state you will probably find that the drive then reports, via the ATA Identify Device command, that it is locked by an ATA password (if I understand the research paper correctly). You will also be able to search the end of the drive's user area for a key (which will probably not be stored there).

_________________
A backup a day keeps DR away.

I am desperately trying to figure out how can a software unlock WD Security software after 5 wrong entries.

What exactly does cause this counter to be reset? Turning the power for the drive on and off?

Disabling/enabling the drive using "devcon" does not reset the counter.

I guess coding a program which will reset the counter variable in memory to prevent unlock is a difficult task... Just an idea...

Does anybody know where does WD Security software store the counter for wrong entries?

Can a "USB-over-TCP/IP program" be a solution?

Somebody from this site told me that the software can "do it by itself if I will solder small board which could repower drive if software will ask about it". I don't understand what it is meant by that. Can somebody please explain it to me how can I do that or direct me to a tutorial?

I have posted a question about this issue on stackoverflow as well.

It was me.
It's easy to solder primitive board (control through lpt port) which will be able to switch power on and off.

Just to note here for others who may be interested: A friend told me to use a USB relay like this one. He told me to cut the cable and connect red cable to the relay.

Yes.


I think the wrong password attempts are counted in the drives firmware.
The counting of the WD software is irrelevant.


No I don't see a way too fool out the drives firmware with this solution.
Even if it would work... it wouldn't be an efficient solution.

If you still want to decrypt the drive I could maybe help you.
The easiest way would be to send the drive to me.
Please send me a private message for this purpose.

Best Regards

You would need to write a batch routine to test 4 passwords, then send a command to switch off the relay, wait for 1 second, switch the relay back on, and then wait for a few seconds for the drive to spin up again.

_________________
A backup a day keeps DR away.

Do you think using this method might decrease the drive's lifespan?

Every power up/shutdown cycle decreases it a little. So, if you are doing a couple hundred/thousands/more cycles, yes, it will decrease .

It will take a lot of time to check significant number of passwords.

Too much time in my opinion.

reallymine now supports password entry. One could probably use a shell script to try a list of passwords, but I expect that it would be slow.

From the author ...
http://www.hddoracle.com/viewtopic.php? ... 9638#p9638

_________________
A backup a day keeps DR away.

When I connect my drive using USB port it sees two drives, lsblk output is:

When the drive is connected normally via usb, this command:

gives this output:


[portion of this message was deleted]

I am trying to find a way to

1. Read the key sector (Can you please simply explain to me how can I read this drive's key sector?)
2. Use reallymine's new version to try passwords. (How should I connect the drive and what is the command for trying passwords? I think it is related with "kek" option but I am confused with its documentation, my tries did not work)