Minutes 2026-10-08
Unlocking Drives
- We have a bunch of HGST drives that cannot be used on our servers because they have some FUCKED UP firmware that doesn’t allow their use in other servers
- The problem is flashing the right firmware is not allowed because of a vendor lock
- Crossflashing
- 2 known solutions
- Hydata ScusiTools -> paid software, not viable
- Russian guy knows how to do it, has video evidence
- On online forums, supposedly can unlock drives
- Uses Western Digital Niagra and a custom script
- Charges 10 bucks a drive and requires RDP and a windows machine
- Attempted MITM by LUG to get the script, failed to get all the files
- WDN: internal WD software leaked onto the internet ## Timeskip
- Checked through LUG Wiki about the drives
- Decided that Niagara route would be best
- Worked with and learned Niagara
- Ran into a wall
- Simone shares Noah’s collection of files from MITM attack
- Mostly useless, but a couple key files are in there
- CPGNA496.bin -> firmware file
- Backup_cobra_ep.tcl -> backup script
- Mostly useless, but a couple key files are in there
- Backup script does a backup of RIDs and ROM
- Also has “Techno mode”, where firmware downloads are allowed to occur
- Gives useful errors!!!
- What is an RID?
- Firmware modules
- Basically just the firmware, some are changed when firmware update is applied
- RID lie in service area of drive
- Service area is a special part of the platter that YOU CANNOT WRITE TO (normally)
- NOW we can do firmware writes and reads
- Used AI patch in the firmware, killed a drive outright, not even recognized by HBA
- Please for the love of god do not use AI
- Use firmware mode 4 to download firmware patches and NOT BRICK THE DRIVES
- Drives turn out to use ARM and lots of Thumb Code
- Finally read datasheet, turns out download mode 4 doesn’t even work on these drives!!
- They prompt ChatGPT until it gives them a Vendor-Specific Command that can read the RAM of the drive
- Feed GPT the memory dump, finds the Vendor ID in the RAM (which was what was changed to brick the drive last time), also found it in an RID
- The ONLY THING preventing the crossflash was a 2 byte value that stored the Vendor ID