04-23-2018 07:37 PM
The reason I suggested returning them to NI was precisely "so that they can be reused". I'm reasonably certain that, short of disassembly and a soldering iron, these are really "Read-Only" Drives. So it you send it back to NI, they can send it to someone else more quickly than shipping them from Hungary.
Bob Schor
04-24-2018 08:12 AM - edited 04-24-2018 08:17 AM
@Bob_Schor wrote:
I'm reasonably certain that, short of disassembly and a soldering iron, these are really "Read-Only" Drives.
Nope not true. After diving into the world of Russian forums relating to USB drive firmware I'm pretty certain that these just have firmware loaded on them that makes them read only, or appear as optical media. The manufacturers of the memory chips used in these drives have utilities on changing the firmware. I was successful in wiping one drive using this software trying to load a new burner and firmware on it. But it failed to write the new firmware, after erasing the drive. I can still communicate with it using the manufacturers software, but Windows doesn't see it. Of the 6 drives I have they have they all seem to be Toshiba's, all with ICVersion 2251-03. The Flash ID varies but the first 4 bytes indicate it might be difficult to reflash with either 98DE9493, or 93DE88A3. Maybe if I get bored I'll play around some more. You can solider on the chip to force it to go into a debug mode, but from what I've read it isn't required, several pinouts are available online.
Unofficial Forum Rules and Guidelines
Get going with G! - LabVIEW Wiki.
17 Part Blog on Automotive CAN bus. - Hooovahh - LabVIEW Overlord
04-24-2018 11:40 AM
@Hooovahh wrote:
@Bob_Schor wrote:
I'm reasonably certain that, short of disassembly and a soldering iron, these are really "Read-Only" Drives.
Nope not true. After diving into the world of Russian forums relating to USB drive firmware I'm pretty certain that these just have firmware loaded on them that makes them read only, or appear as optical media. The manufacturers of the memory chips used in these drives have utilities on changing the firmware. I was successful in wiping one drive using this software trying to load a new burner and firmware on it. But it failed to write the new firmware, after erasing the drive. I can still communicate with it using the manufacturers software, but Windows doesn't see it. Of the 6 drives I have they have they all seem to be Toshiba's, all with ICVersion 2251-03. The Flash ID varies but the first 4 bytes indicate it might be difficult to reflash with either 98DE9493, or 93DE88A3. Maybe if I get bored I'll play around some more. You can solider on the chip to force it to go into a debug mode, but from what I've read it isn't required, several pinouts are available online.
What kind of software did you use to do this? Is it from Toshiba, or something like EaseUS? I've tried a few partition/firmware tools available online, but obviously didn't get anything to work.
I'm glad to know others have received the same flash drives and are possessed with repurposing them. 🙂
04-24-2018 12:06 PM
MPALL, referenced in the Dell USB re purposing link earlier.
http://www.usbdev.ru/files/phison/mpall/
And here is the firmware for these controllers (Under Additional Files):
http://www.usbdev.ru/files/phison/
And an article on the test modes:
http://www.usbdev.ru/articles/testmod/
And another article talking about changing the functionality of these drives:
https://www.pentestingshop.com/recover-a-usb-stick/
Unofficial Forum Rules and Guidelines
Get going with G! - LabVIEW Wiki.
17 Part Blog on Automotive CAN bus. - Hooovahh - LabVIEW Overlord
04-24-2018 12:18 PM
@Bob_Schor wrote:
Send them back to NI. NI clearly can always use some more, as they ship them to the US from (I believe) Hungary, takes > 1 week.
Bob Schor
You previously said that "...it makes very good sense for Vendors, who "brand" their Sticks, to ensure that noone can write to them (and potentially "hide malware")."
If I was NI (or any other software company) and received a box full of USB drives, I would NOT take the risk and send them out for that very same reason.
04-24-2018 02:11 PM
@jamiva wrote:
@Bob_Schor wrote:
Send them back to NI. NI clearly can always use some more, as they ship them to the US from (I believe) Hungary, takes > 1 week.
Bob Schor
You previously said that "...it makes very good sense for Vendors, who "brand" their Sticks, to ensure that noone can write to them (and potentially "hide malware")."
If I was NI (or any other software company) and received a box full of USB drives, I would NOT take the risk and send them out for that very same reason.
I would assume that if NI ever created a recycle/reuse program for USB drives, they'd set up a procedure to wipe them clean and eliminate the possibility of malware before they reused them
I think the bigger risk with malware is what someone could do to them after they've left NI hands. If I had an NI stick, I would assume I could trust it, not knowing that somewhat else had already hidden malware after it left NI's company. And NI wouldn't want the bad publicity that would come if one some was infected by a stick that had their name on it.
08-10-2018 09:52 AM
I stumbled across a solution while looking into ways to reuse our NI thumb drives. PNY has a tool called Ufix on their site that low level formats and also resets the firmware back to OEM defaults.
I had three drives, one Keysight 4GB, a NI 16GB and a NI 32GB. For the Keysight drive I used UfixII since it was the only version that specifically called out 4GB drives. For the two NI drives I used UfixIII as it was Windows 10 compatable. The "Format" option immediately failed so I tried "Restore" and it worked perfectly.
Happy formatting !!
08-10-2018 11:18 AM
Sweet. Okay a couple mixed results. First I downloaded UFix I, II, III, and V. The download UFix III is actually "Restore".
First I tried the drive that I've screwed around with MPALL tool. Using this tool I was able to wipe the drive but couldn't get it to be writable again. I tried UFix III and couldn't restore, I got error 175 "Contact Vendor". This was a 16GB Toshiba and was a tear drop shape, and metallic.
I grabbed another drive that appeared identical to this one, but I hadn't messed with MPALL with it. Restore actually did something and wiped it then showed the drive had 14.4GB free. But I couldn't write to it as it was write protected. And the Format option in the Restore program resulted in Format Failed 46.
So I grabbed a new drive type, a 16GB that was metallic, and rectangular in shape. Here the UFix III worked as expected. I performed the Restore, then format, and it appears to work like a normal drive again, so kudo for that.
I went back to the two tear drop shaped drives with UFix I, UFix II and UFix V but none recognized the drives.
I have one other tear drop shaped drive that is 64GB. UFix I, II, and V didn't recognize it. UFix III (Restore) didn't recognize it in the format, and since it is similar to the other drives I didn't attempt a Restore.
Unofficial Forum Rules and Guidelines
Get going with G! - LabVIEW Wiki.
17 Part Blog on Automotive CAN bus. - Hooovahh - LabVIEW Overlord
08-10-2018 11:28 AM
Okay update on the tear drop drive. I realize what is happening now. So the original firmware that was restored on them is a write once type of firmware. After performing the restore I can write to the drive just fine and format it no problem. As soon as I unplug it, and plug it back in it is read-only again. I can perform the restore again to write again, but only until I unplug and plug it again.
Unofficial Forum Rules and Guidelines
Get going with G! - LabVIEW Wiki.
17 Part Blog on Automotive CAN bus. - Hooovahh - LabVIEW Overlord
08-10-2018 11:30 AM
Mine were all Toshiba drives and came in rectangular brushed aluminum housings.
Possibly another USB drive OEM has similar tools? SanDisk, Samsung, Kingston? Possibly even some of the no namer Chinese OEMS (found on Amazon) have like tools?