Jump to content


Photo

Unlocking Xbox Hard Disks Without Eeprom Or Motherboard


  • Please log in to reply
11 replies to this topic

#1 shambles1980

shambles1980

    X-S Freak

  • Members
  • PipPipPipPipPip
  • 1,092 posts
  • Location:wales uk
  • Xbox Version:v1.2
  • 360 version:v4.0 (jasper)

Posted 07 March 2012 - 02:30 PM

Ok, Il let you know how this happend..
the other day some one wanted to buy an xbox stock hard disk from me, so i had to find an unlocked one, i only had 2-3 unlocked ones but i had 34 hard drives. And the xboxes they came from had been sold. I also knew which xbox the eeprom beloned too but not which hard disk. So using the eeprom to unlock would have been a nightmare.

The answer was found on lama.com

The segate U5's are really easy to unlock.
heres the llama how to + my statment about each process after it...



SEGATE U5 "fat drives with a rubber jacket"
----
Lowtech found the answer for the rubber jacketed Seagate ST310211A 10GB drive.

Download firmw.rar " http://www.llamma.co...nload/firmw.rar "
and unpack it, then boot to a dos boot disc with the files from the archive on it.

There must be four files in addition to the system boot files on the boot disc:
u5339.ovl
u5339.fls
u5339.crt
sf.exe

Plug your Seagate into an available IDE channel

Execute the command "SF -v -f U5339 -m U5"

It will scan all channels for the drive and when it finds it, it will flash it with the same firmware that is already on it. This has a side effect of the drive becoming unlocked.

----
I used a sd card reader and a sd card That was formated to act like a boot disk. i connected 2 hard disks at once " i would have connected 4 but i only had one ide connector" It completed the flash in a few mins and the drives were unlocked..
I did 8 u5's like this last night, very easy and painless.
you can use a floppy disk. or usb thumb drive excetera.. i just used sd card + reader because that was the closest thing to me at the time.
------------


Western digital
------
02/22/06 WD80EB - I've received this solution many times over the last year or so with reports of it working increasing I have to list it as a solution even though I have been unsuccessful in making it work. Thomas has submitted this solution with a more descriptive step 6 and 7 that make the difference!
1. Connect the hard drive as primary master (remove the jumper)
2. Create a bootable floppy with ATAPWD.EXE on it.
3. Boot from the floppy and launch ATAPWD.EXE select the WD80EB drive and press enter.
4. Select ERASE PREPARE and then ERASE UNIT.
5. Enter the master password: WDCWDCWDCWDCWDCWDCWDCWDCWDCWDCWD
6. It will give you a Busy error, that means it is erasing the drive so please dont turn off the computer.
7. After 30min press F5 to refresh the list and you will see that the drive has become unlocked biggrin.gif


---

Ok this one is not 100% correct. But its close enough..
You do connect the drive as a master drive.
I used Xboxhdm to boot then selected option 4 boot dos unlocking tools.
When you get the prompt type ATAPWD
Now go to security tools.
Then select Erase prepair it will say ok.
Now go to erase hard disk it will ask for the password.
its. WDCWDCWDCWDCWDCWDCWDCWDCWDCWDCWD "ALL CAPS!!"
it will say this will erase your didk. are you sure?
say yes And you will get an "ERROR Busy" Do not press enter. Just walk away and leave it. It takes no more than 6 mins with an ata 133 interface "not 30 mins"
when you come back after the 6 mins is up Press f5 then enter then f5 again. It will now be unlocked.
Now go back to security tools and select dissable with master password.
again the password is. WDCWDCWDCWDCWDCWDCWDCWDCWDCWDCWD "ALL CAPS!!"

i did 13 drives with this method last night so it does work. you just have to do it right.
------------

SEGATE UX "slim drives with white oem lable, no jacket"
---------

Ok 12/29/05 An answer for the slim seagate was sent to me via email, make a little serial programmer!

http://www.llamma.co.....l english.pdf

Osiris sent this in and confirms it is working
Document created by cyd0g

02/06/06 Built and tested working by Llamma.com

------
The translation of the pdf is not right the ctl + z should be ctrl + y or ctrl + t to enter the hyper terminal. (i havent used it yet but i remember its either y for yes or t for terminal. and not z.)

I havent tested this yet but the little serial programers can be bought for next to nothing on ebay. and the parts to make them are really cheap.
You cannot flash the drive like you can with the u5's because they are a specific xbox drive hence the "UX" family name. so SF.exe "the flashing program" will refuze to flash as the family is not supported.
Decompiling sf.exe then re writing the U5 family to be ux family may be possible but im not going to be doing that.
I have tried a few methods for unlocking these drives now. but the UX does not seem to share the usual master password so i cant erase the drive, so it looks like you have to use a serial programer
-----------------

here is a link to the source page.
http://www.llamma.co.....ard Drive.htm

id like to see this stickied if possible. Even though the answers are on llama.com it took quite a while to find them..

Edited by steveo1978, 07 March 2012 - 06:58 PM.


#2 shambles1980

shambles1980

    X-S Freak

  • Members
  • PipPipPipPipPip
  • 1,092 posts
  • Location:wales uk
  • Xbox Version:v1.2
  • 360 version:v4.0 (jasper)

Posted 22 March 2012 - 06:32 PM

Ok this is basically the above post but corrected and formated for easier reading..
So just read this one instead,
So here it is in full

Here is how to unlock the drives according to llama.com,
I have then added my findings about the process below each one.
these are permanent methods to unlock a hard disk. its not for temp unlock to soft mod.
QUOTE

SEGATE U5 "fat drives with a rubber jacket"
----
Lowtech found the answer for the rubber jacketed Seagate ST310211A 10GB drive.

Download firmw.rar " http://www.llamma.co...nload/firmw.rar "
and unpack it, then boot to a dos boot disc with the files from the archive on it.

There must be four files in addition to the system boot files on the boot disc:
u5339.ovl
u5339.fls
u5339.crt
sf.exe

Plug your Seagate into an available IDE channel

Execute the command "SF -v -f U5339 -m U5"

It will scan all channels for the drive and when it finds it, it will flash it with the same firmware that is already on it. This has a side effect of the drive becoming unlocked.

----
I used a sd card reader and a sd card That was formated to act like a boot disk. i connected 2 hard disks at once " i would have connected 4 but i only had one ide connector" It completed the flash in a few mins and the drives were unlocked..
I did 8 u5's like this last night, very easy and painless.
you can use a floppy disk. or usb thumb drive excetera.. i just used sd card + reader because that was the closest thing to me at the time.
------------

QUOTE

Western digital
------
02/22/06 WD80EB - I've received this solution many times over the last year or so with reports of it working increasing I have to list it as a solution even though I have been unsuccessful in making it work. Thomas has submitted this solution with a more descriptive step 6 and 7 that make the difference!
1. Connect the hard drive as primary master (remove the jumper)
2. Create a bootable floppy with ATAPWD.EXE on it.
3. Boot from the floppy and launch ATAPWD.EXE select the WD80EB drive and press enter.
4. Select ERASE PREPARE and then ERASE UNIT.
5. Enter the master password: WDCWDCWDCWDCWDCWDCWDCWDCWDCWDCWD
6. It will give you a Busy error, that means it is erasing the drive so please dont turn off the computer.
7. After 30min press F5 to refresh the list and you will see that the drive has become unlocked

---

Ok this one is not 100% correct. But its close enough..
You do connect the drive as a master drive.
I used Xboxhdm to boot then selected option 4 boot dos unlocking tools.
When you get the prompt type ATAPWD
Now go to security tools.
Then select Erase prepair it will say ok.
Now go to erase hard disk it will ask for the password.
its. WDCWDCWDCWDCWDCWDCWDCWDCWDCWDCWD "ALL CAPS!!"
it will say this will erase your didk. are you sure?
say yes And you will get an "ERROR Busy" Do not press enter. Just walk away and leave it. It takes no more than 6 mins with an ata 133 interface "not 30 mins"
when you come back after the 6 mins is up Press f5 then enter then f5 again. It will now be unlocked.
Now go back to security tools and select dissable with master password.
again the password is. WDCWDCWDCWDCWDCWDCWDCWDCWDCWDCWD "ALL CAPS!!"

i did 13 drives with this method last night so it does work. you just have to do it right.
------------
QUOTE

SEGATE UX "slim drives with white oem lable, no jacket"
---------

Ok 12/29/05 An answer for the slim seagate was sent to me via email, make a little serial programmer!

http://www.llamma.co.....l english.pdf

Osiris sent this in and confirms it is working
Document created by cyd0g

02/06/06 Built and tested working by Llamma.com

------
ok i did the serial porgrammer on 15 UX slim segates and worked perfectly fine..
the german word in the settings of hyperterminal that you dont understand is "none" in english so use that setting.
It really is Ctrl Z to get to the terminal.
and the rest of the tutorial is fine..

if you buy a serial programer then you need 5v going to Vcc and the ground of the 5v goes to ground. (I pulled the 5v from usb. (red and black wire from a usb cable, "red is +5 vcc" "black is -5v Grnd"
then all you need is TXD and RXD connected to pins 3 and 4 of the Jumper settings.
here is a image of it..
IPB Image

You cannot flash the drive like you can with the u5's because they are a specific xbox drive hence the "UX" family name. so SF.exe "the flashing program" will refuze to flash as the family is not supported.
Decompiling sf.exe then re writing the U5 family to be ux family may be possible but im not going to be doing that.
I have tried a few methods for unlocking these drives now. but the UX does not seem to share the usual master password "Segate + 25 spaces" so i cant erase the drive, so it looks like you have to use a serial programer
-----------------

Hard disks locked by xboxhdm or chimp excetera should have the master password.
XBOXSCENE or TEAMASSEMBLY

Just use ATAPWD to dissable the password using a master password.

Some segate drives will have the master password
SEAGATE
please note that seagate also has 25 spaces after it.
to utilize that password you would do the same method as mentioned for the western digitals listed above. however usually this password wont work for xbox drives. and definatly wont work on the slim UX drives.

---------------
as for MHDD as far as i can tell its just a more advanced version of ATAPWD and wont be able to zero out the ux drives without a working master password.
i have used MHDD on all the above drives and it does not do anything radically diferent to ATAPWD. unlocking the drives still needs the same process with both programs, so i will continue to recomend ATAPWD as it is more user freindly.

P.S

i have personally tested and verified all of these unlocking methods to be working.
if you cannot follow the instruction and managed to ruin a paper weight hard disk and turn it in to a permanent paperwight hard disk please for the love of all things remotley technicall Step away from the computer before you mess something els up. and dont send me any complaints.
The methods work. if it dosent for you then thats because its your comprehention or execution of the instructions that has failed not the instructions.

Thanks smile.gif

#3 ldotsfan

ldotsfan

    X-S Messiah

  • Dev/Contributor
  • PipPipPipPipPipPipPip
  • 3,100 posts
  • Xbox Version:v1.1
  • 360 version:unknown

Posted 24 March 2012 - 01:57 AM

QUOTE(shambles1980 @ Mar 23 2012, 01:32 AM)  

as for MHDD as far as i can tell its just a more advanced version of ATAPWD and wont be able to zero out the ux drives without a working master password.
i have used MHDD on all the above drives and it does not do anything radically diferent to ATAPWD. unlocking the drives still needs the same process with both programs, so i will continue to recomend ATAPWD as it is more user freindly.

MHDD 4.5 the older version has ATA terminal mode to issue ATA commands to the hdd. Seagate hdd usually require hardware acess to access the vendor specific commands, an example: http://sites.google....ite/seagatefix/ whereas hddguru.com has an ongoing thread on how to unlock certain families of WD hdds which uses MHDD 4.5, I posted this method sometime back. Somebody over at hddguru also claimed to have written a Windows programs to change model/serial no and lock/unlock WD hdd but I haven't tried that, ie search for PUIS.



#4 shambles1980

shambles1980

    X-S Freak

  • Members
  • PipPipPipPipPip
  • 1,092 posts
  • Location:wales uk
  • Xbox Version:v1.2
  • 360 version:v4.0 (jasper)

Posted 22 April 2012 - 05:40 PM

well i can 100% confirm all the above methods work..
sppv mentioned a linux app that would flash the ux 10 drives with a stock unlocked firmware so you dont have to use the serial programer like i did.

however he never got back to me on the actual program.
The firmware needed i could probably dump from one of my unlocked drives. but as i dont have the program for doing it i cant supply either.

he also mentioned a windows variant but that never worked.
Any way like i said these methods work 100%. some of them had to be edited slightly to work properly but i corrected them all in my post.

There is a way to dump the password from a wd drive. but i dont see the point in that unless you plan on re using the same password. this thread is just about unlocking the drives because you "like me" sold the xbox aftyer upgrading the hard disk but never unlocked the drive and now you want to use it or sell it.
or the xbox mother board is totaly dead and you dont have the means to power the eeprom and extract it from the board.
i may add the method to extract the password from westerndigitals some time. but i dont think its worth my effort to do that.
its just a file that gets edited and added to mhdd. and i dont think its worth the effort of making a bootable disk for mhdd just for wd drives to get the password. (if you have the board that needs the password as well as the hard disk there are much easier methods of geting the password via softmods)

IMO the western digitals were the 2nd easiest drives to unlock.. just took about 6 mins each.
the U5's were the easiest and just needed a firmware upgrade.
and the ux10's I had to use a serial programer.
So Id say that the segate UX10's are the ones that need to be simplified. the Western digitals and UX5's are easy

Edited by shambles1980, 22 April 2012 - 05:47 PM.


#5 lilkuz2005

lilkuz2005

    X-S Enthusiast

  • Members
  • 6 posts
  • Location:USA
  • Xbox Version:v1.1
  • 360 version:v5.0 (360S - trinity)

Posted 14 August 2012 - 05:03 PM

hey i was looking for a way to unlock a 250gb WD hdd that i used in my original xbox, the hdd was built using xboxhdm, but i have lost the disk over the years as well as my eeprom.bin backup. i tried to dump the eeprom from the mobo but im afraid that the mobo is shot and i cant get the eeprom.bin to dump. so i was looking for a way to just unlock the drive so i can send the data from it to my new xbox that is chipped with an xecuter 2.6 ce and using a WD green 1tb sata hdd with a sata to ide adapter. will using the master password xboxsceen or teamassembly work, i dont think i changed any settings when i used the tool to build the drive so im not sure if xbhdm sets these passwords automatically

#6 shambles1980

shambles1980

    X-S Freak

  • Members
  • PipPipPipPipPip
  • 1,092 posts
  • Location:wales uk
  • Xbox Version:v1.2
  • 360 version:v4.0 (jasper)

Posted 15 August 2012 - 01:46 AM

yeah just make a xboxhdm disk (dont need to add any files) then go to dos unlocking tools.
type ATAPWD when you get to the black screen (obviously hit enter too)

then you need to unlock the hard disk using XBOXSCENE as your password. when its unlocked you then need to Dissable the lock again use XBOXSCENE as the password.




#7 MrMajst3r

MrMajst3r

    X-S Senior Member

  • Members
  • PipPip
  • 191 posts
  • Xbox Version:v1.1
  • 360 version:unknown

Posted 29 August 2012 - 08:51 AM

QUOTE(shambles1980 @ Mar 22 2012, 07:32 PM) View Post

Ok this one is not 100% correct. But its close enough..
You do connect the drive as a master drive.
I used Xboxhdm to boot then selected option 4 boot dos unlocking tools.
When you get the prompt type ATAPWD
Now go to security tools.
Then select Erase prepair it will say ok.
Now go to erase hard disk it will ask for the password.
its. WDCWDCWDCWDCWDCWDCWDCWDCWDCWDCWD "ALL CAPS!!"
it will say this will erase your didk. are you sure?
say yes And you will get an "ERROR Busy" Do not press enter. Just walk away and leave it. It takes no more than 6 mins with an ata 133 interface "not 30 mins"
when you come back after the 6 mins is up Press f5 then enter then f5 again. It will now be unlocked.
Now go back to security tools and select dissable with master password.
again the password is. WDCWDCWDCWDCWDCWDCWDCWDCWDCWDCWD "ALL CAPS!!"

i did 13 drives with this method last night so it does work. you just have to do it right.
--

It doesn't work for me.
I connected WD80EB drive, then ran ATAPWD, then went to ERASE PREPARE, typed WDCWDCWDCWDCWDCWDCWDCWDCWDCWDCWD, then ERASE DISK, I got ERROR BUSY, then I waited 15 min, then I pressed F5, ENTER, F5 and then drive dissapeared from list! So I couldn't disable lock.

Now, when I run ATAPWD and try it again I'm getting error "COMMAND REJECTED BY DRIVE"

#8 shambles1980

shambles1980

    X-S Freak

  • Members
  • PipPipPipPipPip
  • 1,092 posts
  • Location:wales uk
  • Xbox Version:v1.2
  • 360 version:v4.0 (jasper)

Posted 29 August 2012 - 12:41 PM

you need to be able to tell it to dissable the lock using master password after you tell it to erase..
you dont leave atapwd..
You may need to just wait longer than 15 mins..
like mentioned its dependant on your ata speed.

Edited by shambles1980, 29 August 2012 - 12:46 PM.


#9 ldotsfan

ldotsfan

    X-S Messiah

  • Dev/Contributor
  • PipPipPipPipPipPipPip
  • 3,100 posts
  • Xbox Version:v1.1
  • 360 version:unknown

Posted 06 September 2012 - 03:18 PM

An interesting feature in the new version of HDAT2: 4.9b1

CODE

- Commands Menu:
   1. new command 'Dump WD password' - it works only on some Western Digital
      models, if it works it dumps module with stored user and master password
CHANGES:
- updated:
   - power mode description
   - known master passwords


I have no idea if it works for WD80EB. Anybody game to try?

#10 xboxmods2977

xboxmods2977

    X-S Freak

  • Members
  • PipPipPipPipPip
  • 1,156 posts
  • Xbox Version:v1.0
  • 360 version:none

Posted 06 September 2012 - 11:16 PM

I would try it, but I am house sitting and none of my gear is here. I can try it when I get home in a few days and report if no one else has tried it by then.

#11 shambles1980

shambles1980

    X-S Freak

  • Members
  • PipPipPipPipPip
  • 1,092 posts
  • Location:wales uk
  • Xbox Version:v1.2
  • 360 version:v4.0 (jasper)

Posted 07 September 2012 - 05:19 PM

you can already do that with one of the older versions of MHDD, you added a script file on the boot disk with mhdd. and you could do it..

i dont see the reason behind wanting to though.. because if you have the xbox that the drive is locked for "only reall reason to want to find out the password" then there are easier methods of accessing the eeprom data..



#12 ldotsfan

ldotsfan

    X-S Messiah

  • Dev/Contributor
  • PipPipPipPipPipPipPip
  • 3,100 posts
  • Xbox Version:v1.1
  • 360 version:unknown

Posted 17 September 2012 - 01:57 PM

I added similar code to smartctl to display the wdc passwords(both user/master) but don't have the hdd to test it. Perhaps somebody wants to test it? I will upload the executable(Windows and Linux) later. Some years back, we were pondering whether this was possible, see this thread for details. Files uploaded to here

Syntax:
CODE

smartctl --set=security-wdc /dev/sdX

where X is a,b,c and so on representing the target hdd. This will dump the wd password using the MHDD script equivalent in hexadecimal. First 32 bytes master password, next 32 bytes user password.

Does this work?

Edited by ldotsfan, 17 September 2012 - 02:46 PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users