CN104965767A - Method for decoding encoded and inaccessible Hitachi hard disk - Google Patents
Method for decoding encoded and inaccessible Hitachi hard disk Download PDFInfo
- Publication number
- CN104965767A CN104965767A CN201510378850.XA CN201510378850A CN104965767A CN 104965767 A CN104965767 A CN 104965767A CN 201510378850 A CN201510378850 A CN 201510378850A CN 104965767 A CN104965767 A CN 104965767A
- Authority
- CN
- China
- Prior art keywords
- hard disk
- group
- mode
- information
- read
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Landscapes
- Storage Device Security (AREA)
Abstract
The invention discloses a method for decoding an encoded and inaccessible Hitachi hard disk and belongs to the technical field of information security. The method comprises the following steps of: 001, enabling the hard disk to enter a factory mode; 002, decoding the encoded hard disk; and 003, switching the factory mode to a user mode. The method has the beneficial effects that firstly, firmware of the hard disk is read, so that the internal work of the hard disk is controlled and the reading and writing of an internal parameter module of the hard disk and the calling of a program module of the hard disk are realized; and secondly, an NVRAM (nonvolatile random access memory) chip is accessed in a security mode by utilizing the hard disk and a firmware zone start mark is modified, so that information in a C group password module is read and written in an A or B group password module and the purpose of decoding is achieved.
Description
Technical field
The invention belongs to field of information security technology, be specifically related to the encrypted decryption method that cannot access of a kind of Hitachi hard disk.
Background technology
The firmware of Hitachi's hard disk is made up of three parts: ROM microcode, the main modular in firmware district on NV-RAM (Non-Volatile RandomAccess Memory, nonvolatile random access memory) inner configuration data and disc.Because the microcode that ROM is embedded in can not be modified, so the firmware upgrade of Hitachi's hard disk can only have been come by the mode of upgrading NV-RAM data and firmware district module.
NV-RAM (Nonvolatile memory, wherein " non-volatile " still can keep data after referring to power-off) is the Flash rom chip of the upper 8 bit serial accesses of circuit board (PCB, Printed Circuit Board) in fact.These data are extremely important, comprising: firmware district starts mark, magnetic head map, firmware regional address, adaptation parameter of data field etc.Wherein, these two parameters of the adaptation parameter of firmware regional address and data field are unique, so be also vital.
The ATA password of hard disk is recorded in crypto module, so the instrument of specialty can be checked crypto module and unlock it.This function is that the password that decoding tool all has on the market removes function.But; Hitachi's hard disk have employed more strict cryptoguard measure: once hard disk is locked in the user mode; enter into all firmware districts (firmware on disc and the firmware on PCB) passage all to be locked, therefore can not go to read crypto module and unlock.Further, be different from the hard disk of other manufacturers, Hitachi's hard disk can not record the ATA password of plain text in crypto module.
In sum, the decryption method that hard disk is encrypted when cannot access becomes the problem needing solution badly.
Summary of the invention
The present invention is directed to the deficiencies in the prior art, provide the encrypted decryption method that cannot access of a kind of Hitachi hard disk, can effectively solution topic Hitachi hard disk is encrypted when cannot access problem.
For overcoming the above problems, the technical solution used in the present invention is as follows: the encrypted decryption method that cannot access of a kind of Hitachi hard disk, comprises the following steps:
001 makes hard disk enter factory mode;
The hard disk of 002 pair of encryption is decrypted;
003 enters user model from factory mode.
As preferably, described 001 comprises the following steps:
The information of NVRAM chip on 101 reading hard disk circuit boards, and be stored into a file;
102 open the file described in 101, the byte at its offset address 0x09 place is revised as 0x00 and makes it enter factory mode;
103 amendments according to 102 upgrade corresponding content in NVRAM chip.
As preferably, described 101 comprise the following steps:
1011 make circuit board enter safe mode;
1012 enter safe mode after read the information of NRAMV chip.
As preferably, the concrete grammar of described step 1011 is: be separated with hard disk disk body by circuit board, and a connection circuit plate enters safe mode.
As preferably, the concrete grammar of described step 1012 is: the information being read NRAMV chip after hard disk enters safe mode by ATA mode.
As preferably, the concrete grammar of described step 1012 is: hard disk takes off NRAMV chip after entering safe mode, is read the information of NRAMV chip by programmable device.
As preferably, described 002 comprises the following steps:
201 hard disks are divided into A group, B group and C group, under factory mode, read the information of the crypto module of the A group backed up in C group, if the C group crypto module of faulty disk damages, then need the crypto module write back information finding homologous series hard disk;
The address of the 202 crypto module information write A groups read 201 or B group crypto module.
As preferably, the concrete grammar of described step 003 is as follows: open the file described in 101, the byte at its offset address 0x09 place is revised as 0x01, makes hard disk get back to user model.
Compared with prior art the invention has the advantages that:
1, understand the firmware of hard disk, thus control the internal work of hard disk, realize calling of the read-write of hard drive internal parameter module and hard disk program module;
2, utilize hard disk to access NVRAM chip in the secure mode, amendment firmware district starts mark, thus C group crypto module is read rear write A group or B group crypto module, reaches the object of deciphering.
Accompanying drawing explanation
Fig. 1 is the main flow chart of hard disk deciphering;
Fig. 2 is the detail flowchart that hard disk enters safe mode;
Fig. 3 is deciphering detail flowchart.
Embodiment
For making object of the present invention, technical scheme and advantage clearly understand, to develop simultaneously embodiment referring to accompanying drawing, the present invention is described in further details.
As shown in Figure 1, the encrypted decryption method that cannot access of a kind of Hitachi hard disk, comprises the following steps:
001 makes hard disk enter factory mode;
The hard disk of 002 pair of encryption is decrypted;
003 enters user model from factory mode.
001 Hitachi's hard disk has three groups of firmwares: A group, and B group and C group, support the read-write of 3 groups of firmwares.A group and C group are stored on main head, and B group is stored on time head.A group firmware contains a lot of module, and B group firmware contains only the main modular that module map records, and it is a backup of A group firmware.C group contains the main modular be recorded on module map, but most of module contents is all different from the module in A group and B group.Hitachi's hard disk has three kinds of mode of operations: user model, factory mode, safe mode.User model is exactly drive firmware, initialization hard disk from A group; Mode of operation is exactly start firmware, initialization hard disk from C district; The circuit board pattern that namely safe mode works; Hitachi's hard disk can work under general mode (user model and factory mode).In the normal mode, hard disk to read on disc and firmware (ROM microcode and NV-RAM configuration data) on PCB (circuit board) simultaneously, and initialize UI.NVRAM have recorded firmware district and starts mark.When after hard disk energising, this mark meeting " tells " that hard disk should read A group firmware or C group firmware, and initialization.If hard disk reads and initialization A group firmware, it can be operated in user model; If hard disk reads and initialization C group firmware, it then can be operated in factory mode;
002 pair of hard disk carries out unlock password, needs to use " blank " crypto module (not being recorded password) the write-back A group of C group or the crypto module that have recorded password of B group;
003 in the user mode, and firmware district and data field can be accessed; And under factory mode, because decoding table can not be loaded, so Jin You firmware district could access.Need after deciphering to make hard disk get back to user model.
101 could access NVRAM in the secure mode when only having after HD encryption, and in this pattern, hard disk can not starter motor, and only can read the firmware on PCB.As a rule, safe mode is used to obtain NV-RAM access rights.Forward hard disk to safe mode, only need circuit board to be separated with disk body, a connection circuit plate.Read the information of NVRAM on hard disk circuit board in the secure mode by ATA mode, and be stored into a file.Also can directly take off NVRAM chip, use programmable device to read.
The mode of operation of hard disk is have recorded, magnetic head map, the important informations such as firmware district start address in 102 NVRAM.Use 16 system softwares for editing to open file described in 101, the byte revising its offset address 0x09 place is revised as 0x00, herein the mode of operation of byte representation hard disk, and 0x00 represents factory mode, and 0x01 represents user model.
103 upgrade the content in NVRAM chip, can read and write under factory mode to NVRAM, for the situation of taking off NVRAM chip in 101 steps, the content upgraded are used programmable device write NVRAM chip, then by NVRAM chips welding on circuit boards.
201 under factory mode, reads the crypto module of C group firmware group.If the C group crypto module of faulty disk is bad, isonomic crypto module can be looked for carry out write-back.
The address of the 202 crypto module information write A groups read 201 or B group crypto module.
003 opens the file described in 101, the byte at its offset address 0x09 place is revised as 0x01, makes hard disk get back to user model.
Those of ordinary skill in the art will appreciate that, embodiment described here is to help reader understanding's implementation method of the present invention, should be understood to that protection scope of the present invention is not limited to so special statement and embodiment.Those of ordinary skill in the art can make various other various concrete distortion and combination of not departing from essence of the present invention according to these technology enlightenment disclosed by the invention, and these distortion and combination are still in protection scope of the present invention.
Claims (8)
1. the encrypted decryption method that cannot access of Hitachi's hard disk, is characterized in that, comprise the following steps:
001 makes hard disk enter factory mode;
The hard disk of 002 pair of encryption is decrypted;
003 enters user model from factory mode.
2. method according to claim 1, is characterized in that, described 001 comprises the following steps:
The information of NVRAM chip on 101 reading hard disk circuit boards, and be stored into a file;
102 open the file described in 101, the byte at its offset address 0x09 place is revised as 0x00 and makes it enter factory mode;
103 amendments according to 102 upgrade corresponding content in NVRAM chip.
3. method according to claim 2, is characterized in that, described 101 comprise the following steps:
1011 make circuit board enter safe mode;
1012 enter safe mode after read the information of NRAMV chip.
4. method according to claim 3, is characterized in that, the concrete grammar of described step 1011 is: be separated with hard disk disk body by circuit board, and a connection circuit plate enters safe mode.
5. the method according to claim 3 or 4, is characterized in that, the concrete grammar of described step 1012 is: the information being read NRAMV chip after hard disk enters safe mode by ATA mode.
6. the method according to claim 3 or 4, is characterized in that, the concrete grammar of described step 1012 is: hard disk takes off NRAMV chip after entering safe mode, is read the information of NRAMV chip by programmable device.
7. method according to claim 1, is characterized in that, described 002 comprises the following steps:
201 hard disks are divided into A group, B group and C group, under factory mode, read the information of the crypto module of the A group backed up in C group, if the C group crypto module of faulty disk damages, then need the crypto module write back information finding homologous series hard disk;
The address of the 202 crypto module information write A groups read 201 or B group crypto module.
8. method according to claim 1, is characterized in that, the concrete grammar of described step 003 is as follows: open the file described in 101, the byte at its offset address 0x09 place is revised as 0x01, makes hard disk get back to user model.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510378850.XA CN104965767A (en) | 2015-07-02 | 2015-07-02 | Method for decoding encoded and inaccessible Hitachi hard disk |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510378850.XA CN104965767A (en) | 2015-07-02 | 2015-07-02 | Method for decoding encoded and inaccessible Hitachi hard disk |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN104965767A true CN104965767A (en) | 2015-10-07 |
Family
ID=54219803
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201510378850.XA Pending CN104965767A (en) | 2015-07-02 | 2015-07-02 | Method for decoding encoded and inaccessible Hitachi hard disk |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN104965767A (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106201925A (en) * | 2016-07-01 | 2016-12-07 | 四川效率源信息安全技术股份有限公司 | A kind of decryption method of western number hard disk |
| CN106648999A (en) * | 2016-12-28 | 2017-05-10 | 四川秘无痕信息安全技术有限责任公司 | Method for restoring damaged firmware module in A working area of Hitachi hardware |
| CN108052282A (en) * | 2017-12-06 | 2018-05-18 | 四川巧夺天工信息安全智能设备有限公司 | A kind of unlocking method for hard disk instruction lock |
| CN109445976A (en) * | 2018-10-23 | 2019-03-08 | 四川巧夺天工信息安全智能设备有限公司 | A method of extracting the western number hard disc data of circuit board model 800041 |
| CN109710192A (en) * | 2018-12-27 | 2019-05-03 | 公安部物证鉴定中心 | A kind of western number hard disk has used the data method for deleting in firmware area |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1488099A (en) * | 2001-08-23 | 2004-04-07 | ���ṫ˾ | Information processing apparatus and method |
| CN101398790A (en) * | 2007-09-30 | 2009-04-01 | 联想（新加坡）私人有限公司 | Merging external nvram with full disk encryption |
-
2015
- 2015-07-02 CN CN201510378850.XA patent/CN104965767A/en active Pending
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1488099A (en) * | 2001-08-23 | 2004-04-07 | ���ṫ˾ | Information processing apparatus and method |
| CN101398790A (en) * | 2007-09-30 | 2009-04-01 | 联想（新加坡）私人有限公司 | Merging external nvram with full disk encryption |
Non-Patent Citations (1)
| Title |
|---|
| WQSDPSHINE: "效率源日立硬盘（Hitachi)解密攻略", 《HTTPS://WENKU.BAIDU.COM/VIEW/F99AE20DCC7931B764CE1505.HTML》 * |
Cited By (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106201925A (en) * | 2016-07-01 | 2016-12-07 | 四川效率源信息安全技术股份有限公司 | A kind of decryption method of western number hard disk |
| CN106201925B (en) * | 2016-07-01 | 2019-03-22 | 四川效率源信息安全技术股份有限公司 | A kind of decryption method of western number hard disk |
| CN106648999A (en) * | 2016-12-28 | 2017-05-10 | 四川秘无痕信息安全技术有限责任公司 | Method for restoring damaged firmware module in A working area of Hitachi hardware |
| CN106648999B (en) * | 2016-12-28 | 2019-10-29 | 四川秘无痕科技有限责任公司 | The restorative procedure of firmware module damage in a kind of workspace Hitachi's hard disk A |
| CN108052282A (en) * | 2017-12-06 | 2018-05-18 | 四川巧夺天工信息安全智能设备有限公司 | A kind of unlocking method for hard disk instruction lock |
| CN108052282B (en) * | 2017-12-06 | 2021-01-01 | 四川巧夺天工信息安全智能设备有限公司 | Unlocking method for hard disk instruction lock |
| CN109445976A (en) * | 2018-10-23 | 2019-03-08 | 四川巧夺天工信息安全智能设备有限公司 | A method of extracting the western number hard disc data of circuit board model 800041 |
| CN109710192A (en) * | 2018-12-27 | 2019-05-03 | 公安部物证鉴定中心 | A kind of western number hard disk has used the data method for deleting in firmware area |
| CN109710192B (en) * | 2018-12-27 | 2022-04-05 | 公安部物证鉴定中心 | Data erasing method for firmware area used by Western digital hard disk |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN104965767A (en) | Method for decoding encoded and inaccessible Hitachi hard disk | |
| CN101385004B (en) | Data storage device using two types storage medium | |
| CN101526926B (en) | Digital encryption key method and system | |
| CN103635911B (en) | For the protection of the memory device of content and main process equipment and method thereof | |
| US11416417B2 (en) | Method and apparatus to generate zero content over garbage data when encryption parameters are changed | |
| US8996933B2 (en) | Memory management method, controller, and storage system | |
| WO2008008245A3 (en) | System and method for controlling information supplied from memory device | |
| CN102184143B (en) | Data protection method, device and system for storage device | |
| CN105700830B (en) | A kind of solid state hard disc master control, solid state hard disc and the WORM storage methods of supporting WORM to store | |
| US20190377693A1 (en) | Method to generate pattern data over garbage data when encryption parameters are changed | |
| JP2008165351A (en) | Data processing method and detachable drive | |
| JP6055047B1 (en) | Erase system for nonvolatile memory device, nonvolatile memory device, external erase device and method | |
| CN102012874B (en) | USB (universal serial bus) storage device provided with resource manager | |
| JP5005477B2 (en) | Nonvolatile memory device | |
| CN103324581B (en) | Memory cells and method for reading data, Memory Controller and storage device | |
| CN102722919A (en) | Train monitoring recording device data updating equipment and method | |
| JP2005530293A5 (en) | ||
| TWI612440B (en) | Information storage system with information security protection | |
| US20170228333A1 (en) | Reader/writer device, information processing device, and data transfer control method, and program | |
| TW201601000A (en) | A system for writing key to electronic device and method thereof | |
| CN201886784U (en) | USB (Universal Serial Bus) storage equipment with resource manager | |
| CN112685802B (en) | Flash chip reading control method and device and storage medium | |
| US20160063263A1 (en) | Data storage system with information security protection | |
| JP2008059380A (en) | Storage medium | |
| CN102375958A (en) | Method for restricting accessing of files |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| WD01 | Invention patent application deemed withdrawn after publication | ||
| WD01 | Invention patent application deemed withdrawn after publication |
Application publication date: 20151007 |