Freya: Created page with " =Unlocking Drives= We have a bunch of HGST drives that cannot be used on our servers because they have some FUCKED UP firmware that doesn’t allow their use in other servers The problem is flashing the right firmware is not allowed because of a vendor lock Crossflashing 2 known solutions Hydata ScusiTools -> paid software, not viable Russian guy knows how to do it, has video evidence On online forums, supposedly can un..."

2026-11-02T20:21:58Z

Created page with "<span id="unlocking-drives"></span> =Unlocking Drives= *We have a bunch of HGST drives that cannot be used on our servers because they have some FUCKED UP firmware that doesn’t allow their use in other servers *The problem is flashing the right firmware is not allowed because of a vendor lock *Crossflashing **2 known solutions **Hydata ScusiTools -> paid software, not viable **Russian guy knows how to do it, has video evidence ***On online forums, supposedly can un..."

New page

<span id="unlocking-drives"></span>
=Unlocking Drives=

*We have a bunch of HGST drives that cannot be used on our servers because they have some FUCKED UP firmware that doesn’t allow their use in other servers
*The problem is flashing the right firmware is not allowed because of a vendor lock
*Crossflashing
**2 known solutions
**Hydata ScusiTools -> paid software, not viable
**Russian guy knows how to do it, has video evidence
***On online forums, supposedly can unlock drives
***Uses Western Digital Niagra and a custom script
***Charges 10 bucks a drive and requires RDP and a windows machine
***Attempted MITM by LUG to get the script, failed to get all the files
***WDN: internal WD software leaked onto the internet ## Timeskip
*Checked through LUG Wiki about the drives
*Decided that Niagara route would be best
*Worked with and learned Niagara
*Ran into a wall
*Simone shares Noah’s collection of files from MITM attack
**Mostly useless, but a couple key files are in there
***CPGNA496.bin -> firmware file
***Backup_cobra_ep.tcl -> backup script
*Backup script does a backup of RIDs and ROM
*Also has “Techno mode”, where firmware downloads are allowed to occur
**Gives useful errors!!!
*What is an RID?
**Firmware modules
**Basically just the firmware, some are changed when firmware update is applied
**RID lie in service area of drive
***Service area is a special part of the platter that YOU CANNOT WRITE TO (normally)
*NOW we can do firmware writes and reads
*Used AI patch in the firmware, killed a drive outright, not even recognized by HBA
**Please for the love of god do not use AI
*Use firmware mode 4 to download firmware patches and NOT BRICK THE DRIVES
*Drives turn out to use ARM and lots of Thumb Code
*Finally read datasheet, turns out download mode 4 doesn’t even work on these drives!!
*They prompt ChatGPT until it gives them a Vendor-Specific Command that can read the RAM of the drive
*Feed GPT the memory dump, finds the Vendor ID in the RAM (which was what was changed to brick the drive last time), also found it in an RID
*The ONLY THING preventing the crossflash was a 2 byte value that stored the Vendor ID

Minutes 2026-10-08 - Revision history