No guarantee's as I already paid others to unlock mine and the date has passed.

http://hddunlock.com/

They are advertising a limited time free unlock. I will lock a drive shortly and test but I wanted to get this out ASAP.

Pulp.

On that main page it says:
While unlocking, HDD Unlock Wizard will erase and re-certify the drive.

Doesn't that seem like something we don't want?

ducatiboy said:

On that main page it says:
While unlocking, HDD Unlock Wizard will erase and re-certify the drive.

Doesn't that seem like something we don't want?

I didn't see that at first.

DO NOT USE THIS SERVICE, ducatiboy is correct.

I locked a drive (250 gig) to test and they want $20 to unlock it and they did give the warning that all data would be lost.

Sorry about the false hope. Free time was over anyway.

No problems. Thanks for looking for a good solution for us. It's really apreciated.

You shouldn't have to pay anyone to unlock a drive. You should be able to unlock a drive by booting it in the device that locked it. When that device gets to a certain point (you have to figure out when) you can unplug the drive's data cable (but keep the power plugged in, usually I use the PC's power at all times) and plug it into a PC, boot the PC, and you can access the drive.

You can even read the password off that drive then and using an algorithm you can generate a new password for a different drive and put that in the original device.

Cirbirus said:

You shouldn't have to pay anyone to unlock a drive. You should be able to unlock a drive by booting it in the device that locked it. When that device gets to a certain point (you have to figure out when) you can unplug the drive's data cable (but keep the power plugged in, usually I use the PC's power at all times) and plug it into a PC, boot the PC, and you can access the drive.

You can even read the password off that drive then and using an algorithm you can generate a new password for a different drive and put that in the original device.

You are correct. In fact I wrote about this earlier and was going to try it but I couldn't find the cable I needed to extend the drive out the front of the Z1 and taking it apart was too messy to do. Find a M-F 44 pin cable (probably make one I guess), use an adapter for power, get your PC next to the Z1 (on the bench of course) and it should work.

As far as generating a new password. No need for any algorithm, just use MHDD and delete the lock ability, problem solved. Problem with changing the password is the Z1 sends the unlock command from it's firmware and we have not found a way to access that yet. Can you do this? If so, please give it a shot. This is also where I think we will find the Windows CE install I want to play with as its not on the HDD.

If you can get into the firmware where you would change the password you could probably read the original one. From what I've been reading this password should not be encrypted. It is sent at the start of the init sequence well before the OS has booted. My reason for thinking this is if you put in a HDD without the correct folder structure/partitions the unit is very quick to tell you it can't use the HDD. This means it is looking at the HDD early on and without unlocking it this would fail. Additionally, when I put in a HDD that was not partitioned correctly (it had Windows XP from my laptop on it) it locked it up for me proving it was sending the ATA commands. :evil:

No access to firmware; I'm still waiting on my unit to be shipped! I was just letting people know how to unlock their drive for free.

I've got some more questions for you but I need to go read the HDD thread to make sure those questions haven't already been asked and answered.

Pulp Fiction,

Has anyone considered hooking this thing up to a data analyzer and looking for signs of JTAG? I'd say it's pretty likely that Pioneer uses a JTAG implementation to flash the firmware EEPROM. If it wasn't such a PITA to take my Z1 out, I might even try removing, reading, and then socketing the EEP. I've got all the stuff to work with most high density surface mount packaging pretty easily, except BGA. I can do it, but I have to use my own ghetto rig to reball and reflow, and I wouldn't want to risk my $1500 Z1. There's no way there's room for a BGA socket in there either for experimentation.

tech10002 said:

Pulp Fiction,

Has anyone considered hooking this thing up to a data analyzer and looking for signs of JTAG? I'd say it's pretty likely that Pioneer uses a JTAG implementation to flash the firmware EEPROM. If it wasn't such a PITA to take my Z1 out, I might even try removing, reading, and then socketing the EEP. I've got all the stuff to work with most high density surface mount packaging pretty easily, except BGA. I can do it, but I have to use my own ghetto rig to reball and reflow, and I wouldn't want to risk my $1500 Z1. There's no way there's room for a BGA socket in there either for experimentation.

We are thinking along the same lines. Look here: http://www.avic411.com/forum/viewtopic.php?t=105

I have a few jtag tools from another hobby only. I'm not knowledgable with them in general. Are you?

Pulp_Fiction said:

tech10002 said:

Pulp Fiction,

Has anyone considered hooking this thing up to a data analyzer and looking for signs of JTAG? I'd say it's pretty likely that Pioneer uses a JTAG implementation to flash the firmware EEPROM. If it wasn't such a PITA to take my Z1 out, I might even try removing, reading, and then socketing the EEP. I've got all the stuff to work with most high density surface mount packaging pretty easily, except BGA. I can do it, but I have to use my own ghetto rig to reball and reflow, and I wouldn't want to risk my $1500 Z1. There's no way there's room for a BGA socket in there either for experimentation.

We are thinking along the same lines. Look here: http://www.avic411.com/forum/viewtopic.php?t=105

I have a few jtag tools from another hobby only. I'm not knowledgable with them in general. Are you?

I'm pretty familiar with the boundary layer scan of JTAG implementation, but I've never figured it out from scratch. It's an IEEE standard, so it shouldn't be too tough to figure out. Since we only need to read for the moment, it won't be quite as hard. If we could get the thing in link mode and get control over the processor, that would open up all kinds of possibilities. :) I think I read somewhere here where somebody posted the processor type. That would be a good start. There should be all kinds of documentation detailing the JTAG in the processor data sheets.