Jump to content
OGXbox.com

Unlock XBox Hdd - No Eeprom, No XBox


HDShadow
 Share

Recommended Posts

As I mentioned in another thread here I recently bought a 'for parts' Xbox which is giving error 16 but the seller also included another retail HDD, almost certainly not softmodded, which is giving error 6.

Pretty sure it did not come from the same Xbox so obviously locked with an unknown eeprom on another Xbox which again, obviously, I do not have. Not likely being softmodded means no master password use possible either.

I've looked into methods of unlocking it and either here or on another forum somebody mentioned there are Windows programs that can do this. I'm not bothered about the content just interested in finding out if it can be unlocked preferably, via a USB connection.

Any recommendations/suggestions welcome.  

Link to comment
Share on other sites

If is a stock drive if the passwords listed don't work  you are flogging a dead horse

 

WESTERN DIGITAL -> “WDCWDCWDCWDCWDCWDCWDCWDCWDCWDCWD”

SEAGATE -> “Seagate” +25 spaces

For xbox hdds try “XBOXSCENE” or “TEAMASSEMBLY”

The passwords are case sensitive as well

Or you could try this.


If you don't care about the contents, you could just zero the drive with a Linux live boot, using your PC.  You don't even need to wait for dd to finish.  Just let it run for a bit.

dd if=/dev/zero of=/dev/(your hard drive)

 

I found this as some reading as well

https://forum.hddguru.com/viewtopic.php?f=1&t=12920&hilit=Non+Standard+ATA+Master+Password

 

 

Cheers

SS Dave


Soft modding is like masturbating, It gets the job done but it's nothing like the real thing.

 

Link to comment
Share on other sites

I've got XBHDM USB Beta23 which I've never used and I assume I can use to test the passwords but I've been Googling for the last half hour and I can't find much help about what, exactly, I need to do to even get XBHDM running. All the YT videos assume it is booted and working without any explanation about how that was done.

Inside XBHDM there are 7 qemu EXE at least, including an uninstaller, the readme and other documentation is practically useless providing no step by step guide about how to even launch the tool. Normally with a portable program you click on the EXE and it launches a GUI and away you go. But with this I've no idea what I'm doing. Its probably simple but nobody seems to have been bothered creating a genuinely noob friendly set of instructions from the ground up. 

Lets say I have the Xbox HDD in question I want to try to unlock attached by USB and Windows recognises it a some sort of USB mass storage device. How do I get XBHDM USB Beta 23 to open, find and then try to unlock it?  

Link to comment
Share on other sites

I thought it might be that but why on earth isn't that simple advice included with it? Its not exactly intuitive running a batch file to launch a program, at least not for me.

I doubt I'll have much luck unlocking it either but I thought I might as well try. When I fit a new cloned HDD in a Xbox after softmodding once I'm certain that is working I often refit the original HDD and use ConfigMagic to unlock/lock it just to make sure I have that master password option available if ever I lost the eeprom details. Just hope something like that was done in this case. 

One thing more thing I don't understand is both how and why zero filling a HDD would unlock it. If it is locked how would a Linux Live disc or anything else gain access to be able to zero fill it?

There's another tool I've come across: Hdat2.

There a short thread about it here.

Looks like a bit of a faff too but unfortunately the YT guide has been made private for some odd reason. In any case it does appear it also requires password use too so a bit redundant if XBHDM USB is doing the same thing but in a more convenient way.   

Link to comment
Share on other sites

The theory of zeroing  the hard drive is the 1st sector contains the TOC(Table Of Contents) and the security lock info, So by zeroing it's you are removing the lock and wiping the drive.

The locking of a hard drive was originally designed to protect the data on the drive with some computers also locking the drive until the bios boot password is entered or the security dongle is connected the drive  is locked.

 

 

Cheers

SS Dave


Soft modding is like masturbating, It gets the job done but it's nothing like the real thing.

  • Like 1
Link to comment
Share on other sites

You can try to unlock the hard drive using the smartctl.exe applications that's part of XboxHDM23USB.  Open a cmd.exe window using the Run as Administrator option.  Change directory to the location where you've installed XboxHDM23USB.  There are two different versions of this it.  Next, change into the 

Beta 2 - your in the correct directory to use smartctl.exe,

Beta 3 - cd into the XboxHD subfolder.

You'll need to determine which device - /dev/sd%1 the command needs to communicate with. (You will be substituting a single character for %1.)

Type in: wmic diskdrive get model,name

%1 will be replaced with a single character depending upon which

PHYSICALDRIVEn

is returned where the Xbox HDD is seen by Windows:

  • n = 0 : %1 = a
  • n = 1 : %1 = b
  • etc.

The format of the smartctl.exe command used to check the lock status is:

  • smartctl.exe -g security /dev/sd%1 

(remember to substitute the single character for %1 of the drive's device name)

Unlock the hard drive with the password computed from the eeprom.bin's HDDKey

  • smartctl.exe -s security-eeprom-unlock,eeprom.bin /dev/sd%1

Remove the locking password again computed with the HDDKey in the eeprom.bin file so it will not be locked again after power cycling the hard drive:

  • smartctl.exe -s security-eeprom-disable,eeprom.bin /dev/sd%1

To use a keyed in password, I believe the format is:

  • smartctl.exe -s security-unlock,"Password" /dev/sd%1

That command will unlock drive until power cycle or IDE bus reset.

smartctl.exe -s security-disable,"Password" /dev/sd%1

That command will disable ATA security - drive will be remain unlocked after power cycle or IDE bus reset.

I've not tried keying in a text password. It may not need the quotation marks surrounding the password text.   However, I don't know how it would know the Seagate hard drive password of 

  • "Seagate                                " 

without them.  There are 25 space characters after Seagate.  

To disable the ATA security password, both the unlock and disable command have to be issued in the order shown above.  Unlock the drive then disable security.

  • Like 1
Link to comment
Share on other sites

The password for smartctl.exe's options:

  • -s security-unlock,[password] 
  • -s security-disable,[password]

may have to be entered as a hexadecimal string (2 hex characters (0-9,a-f) per each byte of the password.

Thus, if the password is the ASCII string: Seagate + 25 spaces

the equivalent hexadecimal string is: 

  • 5365616761746520202020202020202020202020202020202020202020202020

S = 53
e = 65
a = 61
g = 67
a = 61
t = 74
e = 65
<space character> = 20.

The Western Digital hard drive default password: WDCWDCWDCWDCWDCWDCWDCWDCWDCWDCWD equivalent hexadecimal string is:

  • 5744435744435744435744435744435744435744435744435744435744435744

W = 57
D = 44
C = 43

Xbox-scene locking/unlocking application default MASTER passwords:

TEAMASSEMBLY => 5445414d415353454d424c59

and

XBOXSCENE => 58424f585343454e45

Link to comment
Share on other sites

smartlctl.exe does a lot more than lock and unlock an Xbox hard drive:

Obtain help about all of the command line options by entering: smartctl.exe -h

You'll  will see the following result in your cmd.exe window:


smartctl 6.2 2013-07-26 r3841 [x86_64-w64-mingw32-win8] (local build)
Copyright (C) 2002-13, Bruce Allen, Christian Franke, www.smartmontools.org

Usage: smartctl [options] device

============================================ SHOW INFORMATION OPTIONS =====

  -h, --help, --usage
         Display this help and exit

  -V, --version, --copyright, --license
         Print license, copyright, and version information and exit

  -i, --info
         Show identity information for device

  --identify[=[w][nvb]]
         Show words and bits from IDENTIFY DEVICE data                (ATA)

  -g NAME, --get=NAME
        Get device setting: all, aam, apm, lookahead, security, wcache, rcache, wcreorder

  -a, --all
         Show all SMART information for device

  -x, --xall
         Show all information for device

  --scan
         Scan for devices

  --scan-open
         Scan for devices and try to open each device

================================== SMARTCTL RUN-TIME BEHAVIOR OPTIONS =====

  -q TYPE, --quietmode=TYPE                                           (ATA)
         Set smartctl quiet mode to one of: errorsonly, silent, noserial

  -d TYPE, --device=TYPE
         Specify device type to one of: ata, scsi, sat[,auto][,N][+TYPE], usbcypress[,X], usbjmicron[,p][,x][,N], usbsunplus, areca,N[/E], auto, test

  -T TYPE, --tolerance=TYPE                                           (ATA)
         Tolerance: normal, conservative, permissive, verypermissive

  -b TYPE, --badsum=TYPE                                              (ATA)
         Set action on bad checksum to one of: warn, exit, ignore

  -r TYPE, --report=TYPE
         Report transactions (see man page)

  -n MODE, --nocheck=MODE                                             (ATA)
         No check if: never, sleep, standby, idle (see man page)

============================== DEVICE FEATURE ENABLE/DISABLE COMMANDS =====

  -s VALUE, --smart=VALUE
        Enable/disable SMART on device (on/off)

  -o VALUE, --offlineauto=VALUE                                       (ATA)
        Enable/disable automatic offline testing on device (on/off)

  -S VALUE, --saveauto=VALUE                                          (ATA)
        Enable/disable Attribute autosave on device (on/off)

  -s NAME[,VALUE], --set=NAME[,VALUE]
        Enable/disable/change device setting: aam,[N|off], apm,[N|off],
        lookahead,[on|off], security-freeze, security-setpass,[password] security-disable,[password] security-erase,[password] security-unlock,[password] standby,[N|off|now],
        security-eeprom-setpass,[filename] security-eeprom-disable,[filename] security-eeprom-unlock,[filename]
        wcache,[on|off], rcache,[on|off], wcreorder,[on|off]

======================================= READ AND DISPLAY DATA OPTIONS =====

  -H, --health
        Show device SMART health status

  -c, --capabilities                                                  (ATA)
        Show device SMART capabilities

  -A, --attributes
        Show device SMART vendor-specific Attributes and values

  -f FORMAT, --format=FORMAT                                          (ATA)
        Set output format for attributes: old, brief, hex[,id|val]

  -l TYPE, --log=TYPE
        Show device log. TYPE: error, selftest, selective, directory[,g|s],
                               xerror[,N][,error], xselftest[,N][,selftest],
                               background, sasphy[,reset], sataphy[,reset],
                               scttemp[sts,hist], scttempint,N[,p],
                               scterc[,N,M], devstat[,N], ssd,
                               gplog,N[,RANGE], smartlog,N[,RANGE]

  -v N,OPTION , --vendorattribute=N,OPTION                            (ATA)
        Set display OPTION for vendor Attribute N (see man page)

  -F TYPE, --firmwarebug=TYPE                                         (ATA)
        Use firmware bug workaround:
        none, nologdir, samsung, samsung2, samsung3, xerrorlba, swapid

  -P TYPE, --presets=TYPE                                             (ATA)
        Drive-specific presets: use, ignore, show, showall

  -B [+]FILE, --drivedb=[+]FILE                                       (ATA)
        Read and replace [add] drive database from FILE
        [default is +C:/Users/Penny/Downloads/Xbox/JCRocky5 Tools/xboxhdm23usb/XboxHD/drivedb-add.h
         and then    C:/Users/Penny/Downloads/Xbox/JCRocky5 Tools/xboxhdm23usb/XboxHD/drivedb.h]

============================================ DEVICE SELF-TEST OPTIONS =====

  -t TEST, --test=TEST
        Run test. TEST: offline, short, long, conveyance, force, vendor,N,
                        select,M-N, pending,N, afterselect,[on|off]

  -C, --captive
        Do test in captive mode (along with -t)

  -X, --abort
        Abort any non-captive test on device

=================================================== SMARTCTL EXAMPLES =====

  smartctl -a /dev/sda                       (Prints all SMART information)

  smartctl --smart=on --offlineauto=on --saveauto=on /dev/sda
                                              (Enables SMART on first disk)

  smartctl -t long /dev/sda              (Executes extended disk self-test)

  smartctl --attributes --log=selftest --quietmode=errorsonly /dev/sda
                                      (Prints Self-Test & Attribute errors)
  smartctl -a /dev/sda
             (Prints all information for disk on PhysicalDrive 0)
  smartctl -a /dev/pd3
             (Prints all information for disk on PhysicalDrive 3)
  smartctl -a /dev/tape1
             (Prints all information for SCSI tape on Tape 1)
  smartctl -A /dev/hdb,3
                (Prints Attributes for physical drive 3 on 3ware 9000 RAID)
  smartctl -A /dev/tw_cli/c0/p1
            (Prints Attributes for 3ware controller 0, port 1 using tw_cli)
  smartctl --all --device=areca,3/1 /dev/arcmsr0
           (Prints all SMART info for 3rd ATA disk of the 1st enclosure
            on 1st Areca RAID controller)

  ATA SMART access methods and ordering may be specified by modifiers
  following the device name: /dev/hdX:[saicm], where
  's': SMART_* IOCTLs,         'a': IOCTL_ATA_PASS_THROUGH,
  'i': IOCTL_IDE_PASS_THROUGH, 'f': IOCTL_STORAGE_*,
  'm': IOCTL_SCSI_MINIPORT_*.
  The default on this system is /dev/sdX:pasifm

  • Like 1
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Unfortunately, your content contains terms that we do not allow. Please edit your content to remove the highlighted words below.
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

Board Life Status


Board startup date: April 23, 2017 12:45:48
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.