Minutes 2026-10-08

Unlocking Drives

• We have a bunch of HGST drives that cannot be used on our servers because they have some FUCKED UP firmware that doesn’t allow their use in other servers
• The problem is flashing the right firmware is not allowed because of a vendor lock
• Crossflashing
  • 2 known solutions
  • Hydata ScusiTools -> paid software, not viable
  • Russian guy knows how to do it, has video evidence
    • On online forums, supposedly can unlock drives
    • Uses Western Digital Niagra and a custom script
    • Charges 10 bucks a drive and requires RDP and a windows machine
    • Attempted MITM by LUG to get the script, failed to get all the files
    • WDN: internal WD software leaked onto the internet ## Timeskip
• Checked through LUG Wiki about the drives
• Decided that Niagara route would be best
• Worked with and learned Niagara
• Ran into a wall
• Simone shares Noah’s collection of files from MITM attack
  • Mostly useless, but a couple key files are in there
    • CPGNA496.bin -> firmware file
    • Backup_cobra_ep.tcl -> backup script
• Backup script does a backup of RIDs and ROM
• Also has “Techno mode”, where firmware downloads are allowed to occur
  • Gives useful errors!!!
• What is an RID?
  • Firmware modules
  • Basically just the firmware, some are changed when firmware update is applied
  • RID lie in service area of drive
    • Service area is a special part of the platter that YOU CANNOT WRITE TO (normally)
• NOW we can do firmware writes and reads
• Used AI patch in the firmware, killed a drive outright, not even recognized by HBA
  • Please for the love of god do not use AI
• Use firmware mode 4 to download firmware patches and NOT BRICK THE DRIVES
• Drives turn out to use ARM and lots of Thumb Code
• Finally read datasheet, turns out download mode 4 doesn’t even work on these drives!!
• They prompt ChatGPT until it gives them a Vendor-Specific Command that can read the RAM of the drive
• Feed GPT the memory dump, finds the Vendor ID in the RAM (which was what was changed to brick the drive last time), also found it in an RID
• The ONLY THING preventing the crossflash was a 2 byte value that stored the Vendor ID