View topic - Unlocking ATA Password of PM863a SSD possible?

Main » Forums home » Flash storage, SSD

All times are UTC - 5 hours [ DST ]

Unlocking ATA Password of PM863a SSD possible?

Page 2 of 4

[ 63 posts ]

Go to page Previous 1, 2, 3, 4 Next

Print view

Previous topic | Next topic

Author

Message

blunden

Post subject: Re: Unlocking ATA Password of PM863a SSD possible?

Posted: April 17th, 2023, 13:29

Joined: February 7th, 2020, 17:30
Posts: 22
Location: Sweden

fzabkar wrote:

I would try shorting SCL (temp sensor) or EN (MP5505) to ground, as explained previously.

Just short one of them to the ground pin the respective chip (any difference beteen AGND and PGND on the MP5505?)?

Top

fzabkar

Post subject: Re: Unlocking ATA Password of PM863a SSD possible?

Posted: April 17th, 2023, 14:04

Joined: September 8th, 2009, 18:21
Posts: 16955
Location: Australia

AGND and PGND should be at the same potential. The screw holes will probably also be grounded, or you could use the SATA power ground pins.

https://pinoutguide.com/Power/sata-power_pinout.shtml

_________________
A backup a day keeps DR away.

Top

akoznov

Post subject: Re: Unlocking ATA Password of PM863a SSD possible?

Posted: August 15th, 2023, 3:23

Joined: August 15th, 2023, 2:33
Posts: 3
Location: Nuremberg

@blunden - did you try to shorten temp sensor with ground? did it help to bypass security on the drive?

I’ve got couples of PM863 (Samsung mz7lm480hmhq-00005) in Maximum security Secure locked state (Master password revision 4) and interested to bypass security to reflash them to normal drives.

Attachment:

IMG_3258.jpeg [ 2.57 MiB | Viewed 56535 times ]

Attachment:

IMG_3260.jpeg [ 2.48 MiB | Viewed 56535 times ]

@fzabkar - could I ask you to check photos of PCB of my drives for the same possibility of shortening - I think the same as like in case of blunden drives. Another question - I should use small wire that will be soldered to one of the pins of SCL or EN to the ground and then connect them using SATA connection? Or it should be temporary shortening while drive is connected?

Attachment:

IMG_3251.jpeg [ 2.03 MiB | Viewed 56535 times ]

Attachment:

IMG_3257.jpeg [ 1.6 MiB | Viewed 56535 times ]

Top

blunden

Post subject: Re: Unlocking ATA Password of PM863a SSD possible?

Posted: August 15th, 2023, 3:27

Joined: February 7th, 2020, 17:30
Posts: 22
Location: Sweden

akoznov wrote:

@blunden - did you try to shorten temp sensor with ground? did it help to bypass security on the drive?

No, I haven't gotten around to due so yet. I've been busy with other stuff.

I would love to hear about any progress you make though.

Top

fzabkar

Post subject: Re: Unlocking ATA Password of PM863a SSD possible?

Posted: August 15th, 2023, 13:33

Joined: September 8th, 2009, 18:21
Posts: 16955
Location: Australia

akoznov wrote:

fzabkar wrote:

If the EN pin of the MP5505 is not strapped directly to Vcc, ie if it is tied up to Vcc via a pullup resistor, then you can short this pin to ground while powering up the SSD, and then release the short after the SSD identifies itself. Hopefully this will induce ERRORMOD.

I suspect that the pinout of the temperature sensor may be similar to this IC:

http://ww1.microchip.com/downloads/en/D ... 05192B.pdf

If so, then you could short SCL or SDA to ground during power-on and then release the short.

You could use metal tweezers, if you are careful. A soldered wire, which you touch to ground at power-on, might be safer, though.

_________________
A backup a day keeps DR away.

Top

gold6565

Post subject: Re: Unlocking ATA Password of PM863a SSD possible?

Posted: August 15th, 2023, 16:05

Joined: February 18th, 2020, 9:35
Posts: 71
Location: Ukraina

We transfer the disk to the mod safe, write its native firmware into it, you can find it on the Internet, the disk after it is turned on. falls into the Eror mod. Then everyone decides for himself, or issue a cleaning command or connect to the Samsung utility and she will do everything herself.

Top

blunden

Post subject: Re: Unlocking ATA Password of PM863a SSD possible?

Posted: August 16th, 2023, 5:20

Joined: February 7th, 2020, 17:30
Posts: 22
Location: Sweden

gold6565 wrote:

Could you describe each step in more detail?

Top

akoznov

Post subject: Re: Unlocking ATA Password of PM863a SSD possible?

Posted: August 16th, 2023, 10:07

Joined: August 15th, 2023, 2:33
Posts: 3
Location: Nuremberg

blunden wrote:

I would love to hear about any progress you make though.

Alright, I've done procedure, unlocked all drives and reformat them.

blunden wrote:

You could use metal tweezers, if you are careful. A soldered wire, which you touch to ground at power-on, might be safer, though.

Thanks, I've used tiny wire to touch the ground at ears of drive. Also interesting thing - you don't need to do touch at power-on operation. You can do that after you connect drive - drive will automatically disconnect and reconnect to system in ERRMOD.

Pre-requirements for that operation:

PC with SATA hot-plug function. Note: USB adapters will not work!
Linux OS for making life easier (for example, Ubuntu or any system that contains hdparm utility)
Tiny wire - best to have the same size or less as size of 5505 chip leg
Good and bright lightning
Screwdriver with P5 pentalobe bit

Procedure:

Check BIOS settings for SATA hot-plug option at your SATA controller options and enable it
Boot your linux distro
Open case of drive
Connect drive to SATA connector and SATA power
Use
Code:
dmesg -w
to follow messages and check that drive is initialized, and you will see errors about status of device (DRDY ERR ABRT):
Code:
[5838.528212] ata5.00: configured for UDMA/133
[5838.528240] ata5: EH complete
[5838.549271] ata5.0o: exception Emask OX0 SAct OX0 SErr 0x0 action ox0
[5838.549288] ata5.00: irq_stat 0x40000001
[5838.549293] ata5.00: failed conmand: READ DMA EXT
[5838.549297] ata5.00: cd 25/00:08:00:36: 4/00:00:37:00:00/e0 tag 23 dma 4096 in res 51/04:08:00:36:e4/00:00:37:00:00 /e0 Emask Ox1 (device error)
[5838.549313] ata5.00: status: { DRDY ERR }
[5838.549317] ata5.00: error: { ABRT }

If you check status of drive using hdparm you will see that Security level is maximum, device is locked and using custom password (rev. 4):
Code:
hdparm -I /dev/sda
*****
Security:
Master password reviston code = 4
supported
enabled
locked
not frozen
not expired: security count
supported: enhanced erase
Security level maximun
32min for SECURITY ERASE UNIT, 32min for ENHANCED SECURITY ERASE UNIT.
Logical Unit WWN Device Identifler: 5002538C403e74e5
Take wire and connect one side of wire to EN pin #6 of MP5505 chip and second to ground (I used screw holes of drive) for a moment.
Attachment:

MPGE5505_pin.png [ 982.17 KiB | Viewed 56278 times ]
After shortening in dmesg output you will see messages that link will go down and COMRESET failed events:
Code:
[6626.611720] atas: SATA link down (SStatus 0 SControl 300)
[6637.063591] ata5: link is slow to respond, please be patient (ready 0)
[6641.743552] ata5: COMRESET failed (errno=-16)
[6647.095462] ata5: link is slow to respond, please be patient (ready 0)
[6651.775435] ata5: COMRESET failed (errno=-16)
[6652.147445] ata5: SATA link down (SStatus 0 SControl 300)
[6652.147485] ata5.0o: link offline, clearing class 1 to NONE [ 6657.264156] ata5: SATA link up 6.0 Gbps (SStatus 133 SControl 300)
[6658.841970] ata5.00: failed to IDENTIFY (I/0 error, err_mask=0×100)
[6658.841983] ata5.00: revalidation failed (errno=-5)
[6658.841991] ata5.00: disabled
After 4 seconds drive should make power cycle and drive should load to ERRMOD with size of 1GB:
Code:
[6662.743568] ata5: SATA link down (Status 0 Control 300)
[6662.743659] ata5.00: detaching (SCSI 4:0:0:0)
[6662.759268] sd 4:0:0:0: [sda] Synchronizing SCSI cache
[6662.759350] sd 4:0:0:0: [sda] Synchronize Cache(10) failed: Result: hostbyte-DID_BAD_TARGET driverbyte-DRIVER_OK
[6662.759357] sd 4:0:0:0: [sda] Stopping disk
[6662.759375] sd 4:0:0:0: [sda] Start/Stop Unit failed: Result: hostbyte-DID_BAD_TARGET driverbyte-DRIVER_OK
[6664.891298] ata5: SATA link up 6.0 Gps (SStatus 133 Control 300)
[6664.891823] ata5.00: HA detected: current 1965352, native 1965353
[ 6664.891838] ata5.00: ATA -9: [b]SAMSUNG MZ7LM480HCHP -00005, ERRORMOD[/b], max UDMA/133
[ 6664.892210] ata5.00: Read log 0x00 page 0x00 failed, Emask 0x1
[6664.892223] ata5.00: NCQ Send/Rec Log not supported
[6664.892226] ata5.00: 1965352 sectors, multi 16: LBA48 NCQ (depth 32), AA
[6664.893130] ata5.00: Read log 0x00 page 0x00 failed, Emask 0×1
[6664.893141] ata5.00: NCQ Send/Rev Log not supported
[6664.893152] ata5.00: configured for UDMA/133
[6664.893379] scst 4:0:0:0: Direct-Access ATA SAMSUNG MZ7LM480 RMOD PQ: 0 ANSI: 5
[ 6664.893740] sd 4:0:0:0: Attached scsi generic sg0 type 0
[6664.893898] sd 4:0:0:0: [sda] 1965352 [b]512-byte logical blocks: (1.01 GB/960 MB)[/b]
[6664.893921] sd 4:0:0:0: [sda] Write Protect is off
[6664.893926] sd 4:0:0:0: [sda] Mode Sense: 00 3a 00 00
[6664.893951] sd 4:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DO or FUA
[6664.9673511 sd 4:0:0:0: [sda] Attached SCSI disk
If you now check status of drive using hdparm you will see that Security level is gone and device is unlocked and using standard password (rev. 65534):
Code:
hdparm -I /dev/sda
*****
Security:
[b]Master password reviston code = 65534[/b]
supported
not enabled
[b]not locked[/b]
not frozen
not expired: security count
supported: enhanced erase
Security level maximun
32min for SECURITY ERASE UNIT, 32min for ENHANCED SECURITY ERASE UNIT.
Logical Unit WWN Device Identifler: 5002538C403e74e5
Open another console and perform secure erase using hpdarm utility:
Code:
hdparm --security-erase NULL /dev/sda

Issuing SECURITY_ERASE command, password="", user=user
ST_IO: bad/missing sense data, sb[] 70 00 05 00 00 00 00 0a 00 50 40 00 21 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Try to format the drive and copy some data

Photo from process of unlocking:

Attachment:

Unleashed_drive_with_wire.png [ 1.03 MiB | Viewed 56278 times ]

Top

gold6565

Post subject: Re: Unlocking ATA Password of PM863a SSD possible?

Posted: August 16th, 2023, 13:09

Joined: February 18th, 2020, 9:35
Posts: 71
Location: Ukraina

1. transfer the disk to the safe mod. We close two separate holes on the board and incl.
2. Read how to download firmware to disk ( https://blog.muwave.de/2019/09/samsung- ... urrection/ ) and download. OFF and ON The disk accepts the firmware, but is in ERROR MOD.
3. We search the Internet for Samsung Magician DC ver 1.0.0.0, it has a repair function ERROR MOD, launch, repair.

Top

blunden

Post subject: Re: Unlocking ATA Password of PM863a SSD possible?

Posted: August 16th, 2023, 17:14

Joined: February 7th, 2020, 17:30
Posts: 22
Location: Sweden

gold6565 wrote:

Thanks!

I'm not sure what you mean in step 1 by "transfer the disk to the safe mod" though? Also, which two separate holes on the board do you close? By "closing them", do you mean that you short them together or something else?

In step 2, do you mean that you power cycle the drive after using hdparm --fwdownload to upload the firmware to the drive?

Top

SWM

Post subject: Re: Unlocking ATA Password of PM863a SSD possible?

Posted: August 17th, 2023, 2:39

Joined: February 22nd, 2023, 13:49
Posts: 327
Location: Eastern Europe

The link describes everything in detail (https://blog.muwave.de/2019/09/samsung- ... urrection/).
Two holes next to five JTAGs.
After downloading the microcode (ATA 92H), the power is switched.

Top

fzabkar

Post subject: Re: Unlocking ATA Password of PM863a SSD possible?

Posted: August 17th, 2023, 2:55

Joined: September 8th, 2009, 18:21
Posts: 16955
Location: Australia

@akoznov, thank you for the feedback, and congratulations. :-)

_________________
A backup a day keeps DR away.

Top

fzabkar

Post subject: Re: Unlocking ATA Password of PM863a SSD possible?

Posted: August 17th, 2023, 13:40

Joined: September 8th, 2009, 18:21
Posts: 16955
Location: Australia

Is "ERROR MOD" the same as "safe mode"?

Doesn't this mean that the secure erase command failed? :-?

Code:

hdparm --security-erase NULL /dev/sda

Issuing SECURITY_ERASE command, password="", user=user
ST_IO: bad/missing sense data, sb[] 70 00 05 00 00 00 00 0a 00 50 40 00 21 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Samsung Magician Software for Enterprise SSD:
https://semiconductor.samsung.com/consumer-storage/support/tools/

Quote:

This Data Center Magician SSD management utility is designed to work with the Samsung PM863 and SM863 Series only. This software is not compatible with other manufacturer's SSDs.

User Guide:
https://semiconductor.samsung.com/resources/software-resources/Samsung_Magician_DC_Brand_v2_User_Guide.pdf

Magician Software for Windows and Linux OS 64bit:
https://semiconductor.samsung.com/resources/software-resources/Samsung_Magician_DC_Windows_64bit.exe
https://semiconductor.samsung.com/resources/software-resources/Samsung_Magician_DC_Linux_64bit.zip

Attachments:

Samsung_Magician_DC_ERRORMOD.gif [ 67.14 KiB | Viewed 56137 times ]

_________________
A backup a day keeps DR away.

Top

blunden

Post subject: Re: Unlocking ATA Password of PM863a SSD possible?

Posted: August 17th, 2023, 14:47

Joined: February 7th, 2020, 17:30
Posts: 22
Location: Sweden

I'm having trouble getting SATA hotplug to work in Ubuntu on my Asus Crosshair Dark Hero motherboard despite enabling it for all SATA ports in the BIOS. After some googling, I found someone else with a similar issue where changing the LPM state to max_performance worked for him.

https://forum.level1techs.com/t/sata-ho ... 0-p/189719

Unfortunately it makes no difference for me after setting it on all "hosts" under sys/class/scsi_host/. Dmesg doesn't show anything when I hotplug a SATA drive. I also tried with a different drive just in case, but no change. I guess I'll have to find a different computer to use.

Top

fzabkar

Post subject: Re: Unlocking ATA Password of PM863a SSD possible?

Posted: August 18th, 2023, 1:38

Joined: September 8th, 2009, 18:21
Posts: 16955
Location: Australia

@blunden, just short the two pads, as instructed.

Quote:

... “my” SSD responds to the safe-mode pin bridge mentioned in the PC-3000 video (connect the two separated vias next to the 5 JTAG vias on the pcb while powering up the drive)

https://youtu.be/jvPRpatmHeY?t=87

My idea was only an alternative in case the safe-mode method didn't work for all ERRORMOD cases. It would be an idea to use Magician DC to fix the ERRORMOD condition rather than a secure erase, just to see if the data become accessible.

_________________
A backup a day keeps DR away.

Top

gold6565

Post subject: Re: Unlocking ATA Password of PM863a SSD possible?

Posted: August 18th, 2023, 3:09

Joined: February 18th, 2020, 9:35
Posts: 71
Location: Ukraina

fzabkar wrote:

@blunden, just short the two pads, as instructed.

Quote:

... “my” SSD responds to the safe-mode pin bridge mentioned in the PC-3000 video (connect the two separated vias next to the 5 JTAG vias on the pcb while powering up the drive)

If you are talking about shorting the bus, then this is the most correct idea. There are also PM883 PM983 and others. And after ERROR MOD, the data disappears.

Top

akoznov

Post subject: Re: Unlocking ATA Password of PM863a SSD possible?

Posted: August 18th, 2023, 4:32

Joined: August 15th, 2023, 2:33
Posts: 3
Location: Nuremberg

fzabkar wrote:

@akoznov, thank you for the feedback, and congratulations. :-)

Thanks a lot! :-)

fzabkar wrote:

Doesn't this mean that the secure erase command failed? :-?

Really don't know, but after that message I've successfully reformated drive and copied data (around 100 gigabyte) successfully.

fzabkar wrote:

And after ERROR MOD, the data disappears.

True, here I think, more important to restore usage of drive, not saving data.

Top

blunden

Post subject: Re: Unlocking ATA Password of PM863a SSD possible?

Posted: August 18th, 2023, 7:23

Joined: February 7th, 2020, 17:30
Posts: 22
Location: Sweden

fzabkar wrote:

@blunden, just short the two pads, as instructed.

Quote:

... “my” SSD responds to the safe-mode pin bridge mentioned in the PC-3000 video (connect the two separated vias next to the 5 JTAG vias on the pcb while powering up the drive)

Yeah, I guess I could try that. I would still need to flash the firmware using hdparm when using that method, right?

The problem is that my computer seemingly won't let me continue to boot until I enter the unknown drive password if I power on with the drive connected. I therefore have to hotplug it, unless I can bypass that screen which seems to be presented by the BIOS/UEFI.

Also, I wouldn't be surprised if the drive is in a frozen state even if I manage to boot with it connected, which once again would require hotplugging to most easily bypass.

Are you saying I should simply short those pads when powering on the computer and then boot to Linux to flash the firmware in order to trigger ERRORMOD?

Wouldn't a secure erase reset the security level, which is very beneficial in this case? I'm not sure that the Magician DC command will necessary do that, depending on how it's implemented.

Top

blunden

Post subject: Re: Unlocking ATA Password of PM863a SSD possible?

Posted: August 19th, 2023, 6:27

Joined: February 7th, 2020, 17:30
Posts: 22
Location: Sweden

When shorting the two holes to enter Safe Mode, the drive doesn't show up at all in dmesg from what I can tell. It certainly doesn't show up as an ATA device under /dev/sd* so I can't really interact with it in that mode with hdparm to flash the firmware. Samsung's tools seemingly don't see it either.

Shorting those to holes with a tweezer while powering on the PC allowed it to boot to Linux instead of showing the password screen so it clearly didn't load the drive firmware like it normally would. I used the computer mentioned previously with non-working SATA hotplugging though, but my understanding was that it shouldn't matter when using this particular method?

Just to confirm that I didn't somehow destroy the drive, I later powered it on normally connected to a laptop using a USB enclosure and it still shows up properly, but locked.

Top

blunden

Post subject: Re: Unlocking ATA Password of PM863a SSD possible?

Posted: August 19th, 2023, 8:34

Joined: February 7th, 2020, 17:30
Posts: 22
Location: Sweden

Checking if it shows up in the BIOS when I try to get the drive to enter safe mode, it shows up as "ROM MODE (0.0GB)". That's the same as Safe Mode, right?

It's weird that I don't see it in dmesg when booted to Ubuntu 23.04 though. I guess I'll have to try again later with a different PC.

Top

Page 2 of 4

[ 63 posts ]

Go to page Previous 1, 2, 3, 4 Next

Main » Forums home » Flash storage, SSD

All times are UTC - 5 hours [ DST ]

Who is online

Users browsing this forum: No registered users and 8 guests

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum