When you click on links to various merchants on this site and make a purchase, this can result in this site earning a commission. Affiliate programs and affiliations include, but are not limited to, the eBay Partner Network.
Just passing along some information. I would be curious to see if there are any performance gains because of this. I know first hard the benefits of a SSD over a traditional HDD, although the bottleneck here might not be the I/O of a HD, but the Nav's processor as tejanp rightfully pointed out.
~ Im2bz2p345
Very cool, just saw this link. I'm sure it wouldn't be that hard to break into if I had the time to play around with a unit I wasn't concerned about. I'm curious about what has been attempted thus far with the Toyota/Lexus ECU's, and what method people have used for trying to access it and what road blocks they ran into. The ECU is back from 2013 and methods have changed over time that could make it less trivial. I work with with engineering/security on linux systems but have never mess around with car stuff before. There would be no performance gain with getting into the hard drive, that drive is more around the entertainment and apps on the car, but I'm sure being able to access it would be interesting to see what other files are stored on it.
Edit: Found this, pretty cool, no idea if this can be applied for our cars but a good read nonetheless. http://opengarages.org/handbook/ebook/
Bad news: the Toshiba drives are not locked using the default Toshiba 32 spaces master password.
I pulled mine out after stumbling upon this thread, connected it directly to a SATA port, used UBCD on a thumb drive to boot and launch MHDD.
MHDD sees the Toshiba MK1060GSC drive, and it knows that it's locked.
But issuing the unlock command and the password as 32 spaces failed.
It's quite frustrating to know that this part is likely to fail during the life of the car, and while the replacement part gets cheaper every year, we are (for the moment) prevented from producing suitable replacements.
Bad news: the Toshiba drives are not locked using the default Toshiba 32 spaces master password.
I pulled mine out after stumbling upon this thread, connected it directly to a SATA port, used UBCD on a thumb drive to boot and launch MHDD.
MHDD sees the Toshiba MK1060GSC drive, and it knows that it's locked.
But issuing the unlock command and the password as 32 spaces failed.
It's quite frustrating to know that this part is likely to fail during the life of the car, and the replacement part gets cheaper every year, but we are...for the moment...prevented from producing suitable replacements.
I wonder what kind of password it is, it can probably be brute forced depending on the encryption.
So...I have discovered a method to mount and back up the data on your radio's hard drive.
It isn't easy, and it isn't pretty, but it is possible.
Here's the logic:
The radio knows the passcode to unlock the drive. It must send this to the drive every time the drive powers up; that's how ATA Lock works.
Hypothesis: Leaving the drive powered on while you disconnect it from the radio and connect it to a computer should allow the drive to be mounted and read.
Hypothesis test results: SUCCESS!!
Need:
2x SATA Extension cables (https://smile.amazon.com/gp/product/B00O077B4W worked great)
1x usb3 sata drive adapter
Computer running drive imaging software (AOMEI Backupper Standard works great on Windows to create a whole drive image)
How:
Remove Radio
Remove bracket covering Drive
Remove Drive
Install sata extension cable 1 inside Radio
Install sata extension cable 2 on usb3 sata adapter
Connect power cable from sata extension 2 to drive
Connect sata cable from sata extension 1 to drive
Turn on usb3 sata adapter to supply power to the drive
Turn on car to acc mode
Wait ten seconds for Radio to boot fully
Remove sata cable from drive (leave power connected)
Connect sata cable from usb3 sata adapter to drive
Connect usb3 sata adapter usb cable to computer
Drive partitions should be seen by Windows
Optional: turn off car
Use drive imaging software to back up drive image
Use that image file and the imaging software to restore backup, perhaps to SSD (not yet tested)
Drive Info: Toshiba MK1060GSC
Layout
Pri 25GB FAT32 MAP (navigation map files)
Pri 25GB FAT32 WORK (for map update staging?)
Pri 8MB RAW
Extended Partition
Log 8MB RAW
Log 8MB RAW
Log 8MB RAW
Log 8MB RAW
Log 8MB RAW
Log 2.1GB FAT32 RFDBMNG (metadata for usb drives?)
Log 3.58GB FAT32 HD9 (Nav history, fuel finder, phonebook, ringtones, screen interfaces, enform apps)
Log 8MB RAW
Log 1GB FAT32 HD11 (Gracenote CDDB)
Log 3.51GB FAT32 HD12 (logs, diagnostics)
Log 1.62 FAT32 104137-8211 (custom images)
Log 8MB RAW
Sadly, the apps and interfaces are compiled and monolithic. I was hoping to find interfaces using some modern interface markup framework that would be customizable, but it's not so.
Things seem messy in general. For example:
Message tones are in HD9/RING_TONE/MESSAGE encoded as .pcm.
Ring tones are in HD9/RING_TONE/PHONE encoded as .mp3.
Wow, nice breakthrough, never thought of powering up the drive in the car and then connecting it to a computer while it's powered to read it.
Looking forward to your update.
Instead of backing up the drive why not use software to clone it in the unlocked state?
I'm hoping the car will accept the new drive that not locked.
Originally Posted by jonathancl
So...I have discovered a method to mount and back up the data on your radio's hard drive.
It isn't easy, and it isn't pretty, but it is possible.
Here's the logic:
The radio knows the passcode to unlock the drive. It must send this to the drive every time the drive powers up; that's how ATA Lock works.
Hypothesis: Leaving the drive powered on while you disconnect it from the car and connect it to a computer should allow the drive to be mounted and read.
Hypothesis test results: SUCCESS!!
Need:
2x SATA Extension cables (https://smile.amazon.com/gp/product/B00O077B4W worked great)
1x usb3 sata drive adapter
Computer running drive imaging/backup software (AOMEI Backupper Standard works great on Windows)
How:
Remove Radio
Remove bracket covering Drive
Remove Drive
Install sata extension cable 1 inside Radio
Install sata extension cable 2 on usb3 sata adapter
Connect power cable from sata extension 2 to drive
Connect sata cable from sata extension 1 to drive
Turn on usb3 sata adapter to supply power to the drive
Turn on car to acc mode
Wait ten seconds for Radio to boot fully
Remove sata cable from drive (leave power connected)
Connect sata cable from usb3 sata adapter to drive
Connect usb3 sata adapter usb cable to computer
Drive partitions should be seen by Windows
Optional: turn off car
Use drive imaging software to clone drive image
Use that image file and the imaging software to build new drives (not yet tested)
Drive Info: Toshiba MK1060GSC
Layout
Pri 25GB FAT32 MAP
Pri 25GB FAT32 WORK (for upgrade staging?)
Pri 8MB RAW
Extended Partition
Log 8MB RAW
Log 8MB RAW
Log 8MB RAW
Log 8MB RAW
Log 8MB RAW
Log 2.1GB FAT32 RFDBMNG (metadata for usb drives?)
Log 3.58GB FAT32 HD9 (Nav history, fuel finder, phonebook, ringtones, screen interfaces, enform apps)
Log 8MB RAW
Log 1GB FAT32 HD11 (Gracenore CDDB)
Log 3.51GB FAT32 HD12 (logs, diagnostics)
Log 1.62 FAT32 104137-8211 (custom images)
Log 8MB RAW
Unallocated
Sadly, the apps and interfaces are compiled and monolithic. I was hoping to find interfaces using some modern interface markup framework that would be customizable, but it's not so.
Things seem messy in general. For example:
Message tones are in HD9/RING_TONE/MESSAGE encoded as .pcm.
Ring tones are in HD9/RING_TONE/PHONE encoded as .mp3.
So...I have discovered a method to mount and back up the data on your radio's hard drive.
It isn't easy, and it isn't pretty, but it is possible.
Here's the logic:
The radio knows the passcode to unlock the drive. It must send this to the drive every time the drive powers up; that's how ATA Lock works.
Hypothesis: Leaving the drive powered on while you disconnect it from the car and connect it to a computer should allow the drive to be mounted and read.
Hypothesis test results: SUCCESS!!
Need:
2x SATA Extension cables (https://smile.amazon.com/gp/product/B00O077B4W worked great)
1x usb3 sata drive adapter
Computer running drive imaging/backup software (AOMEI Backupper Standard works great on Windows)
How:
Remove Radio
Remove bracket covering Drive
Remove Drive
Install sata extension cable 1 inside Radio
Install sata extension cable 2 on usb3 sata adapter
Connect power cable from sata extension 2 to drive
Connect sata cable from sata extension 1 to drive
Turn on usb3 sata adapter to supply power to the drive
Turn on car to acc mode
Wait ten seconds for Radio to boot fully
Remove sata cable from drive (leave power connected)
Connect sata cable from usb3 sata adapter to drive
Connect usb3 sata adapter usb cable to computer
Drive partitions should be seen by Windows
Optional: turn off car
Use drive imaging software to back up drive image
Use that image file and the imaging software to restore backup, perhaps to SSD (not yet tested)
Drive Info: Toshiba MK1060GSC
Layout
Pri 25GB FAT32 MAP (navigation map files)
Pri 25GB FAT32 WORK (for map update staging?)
Pri 8MB RAW
Extended Partition
Log 8MB RAW
Log 8MB RAW
Log 8MB RAW
Log 8MB RAW
Log 8MB RAW
Log 2.1GB FAT32 RFDBMNG (metadata for usb drives?)
Log 3.58GB FAT32 HD9 (Nav history, fuel finder, phonebook, ringtones, screen interfaces, enform apps)
Log 8MB RAW
Log 1GB FAT32 HD11 (Gracenore CDDB)
Log 3.51GB FAT32 HD12 (logs, diagnostics)
Log 1.62 FAT32 104137-8211 (custom images)
Log 8MB RAW
Unallocated
Sadly, the apps and interfaces are compiled and monolithic. I was hoping to find interfaces using some modern interface markup framework that would be customizable, but it's not so.
Things seem messy in general. For example:
Message tones are in HD9/RING_TONE/MESSAGE encoded as .pcm.
Ring tones are in HD9/RING_TONE/PHONE encoded as .mp3.
Excellent work! Do you think you could upload that complete image to Mega / Google Drive / Dropbox? I think this is a great step forward and could lead to finding a way to update the software or even updating the GPS. I would love to take a crack at it!
Oh wow, very very clever use of SATA hotswap capabilities.
If cloning to SSD ends up working I will probably do this since I can hear the whirring of the hard drive and it bothers me because my GS450h is otherwise incredibly silent.
My thing is that now if we can use and ssd, this means we can replicate these drives and also get updated firm ware for our systems and even create backs up when eventually the HDD fails. The other thing is that we can now possibly find ways to update the gps, which IMO is the main thing for me. Since there is a way now, I'll have to pull an image of my own.
I think that really is a great idea with the SSD, but I really do think that the hard drive that is used in vehicles are slightly different than the ones off the shelf since it has to be made to withstand extreme temperatures and whatnot...
Nice job... can't wait to see what you can do with it
Originally Posted by jonathancl
Bad news: the Toshiba drives are not locked using the default Toshiba 32 spaces master password.
I pulled mine out after stumbling upon this thread, connected it directly to a SATA port, used UBCD on a thumb drive to boot and launch MHDD.
MHDD sees the Toshiba MK1060GSC drive, and it knows that it's locked.
But issuing the unlock command and the password as 32 spaces failed.
It's quite frustrating to know that this part is likely to fail during the life of the car, and while the replacement part gets cheaper every year, we are (for the moment) prevented from producing suitable replacements.