HddHackr — how it modifies a Western Digital drive for use in an Xbox 360

Introduction


This article is my attempt to understand the method by which HddHackr modifies a Western Digital drive in order to make it compatible with an Xbox 360. As I don't have an Xbox, or a supported WD drive, I'm relying purely on research. Therefore there may be errors.

How HddHackr works

HddHackr reads the HDD firmware version, serial number, model number, and capacity in LBAs from sector 16 of the original Xbox HDD, and then writes this information to a supported WD drive of equal or larger capacity. It does this by using WD's vendor specific commands (VSC) to modify the HDD's firmware. AIUI, in the case of a ROYL drive, the relevant firmware modules are 0D and 02. The result of this hack is that the WD drive then identifies itself in the same way as the original drive, eg Fujitsu MHV2020BH. The WD drive's original modules are backed up in an UNDO.BIN file.

LBAs 16 - 22 are referred to as the Hard Drive Security Sectors and are also copied from the source drive to the target drive. HddHackr backs up these sectors in a HDDSS.BIN file.

The structure of the security sectors is described here:
http://beta.ivc.no/wiki/index.php/Xbox_360_Hard_Drive_Upgrade

Here is an example for a 20GB Fujitsu HDD:
http://beta.ivc.no/xbox360/hddhackr/20GB_HDDSS.rar

Here is a hex dump of sector 16:

HDDSS-20.BIN  --- this file is a backup of LBAs 16 -> 22
0000  20 20 20 20 20 20 20 20-4E 57 35 38 54 35 41 32           NW58T5A2
0010 35 4E 48 50 30 30 39 33-30 30 32 43 46 55 4A 49 5NHP0093002CFUJI
0020 54 53 55 20 4D 48 56 32-30 32 30 42 48 20 20 20 TSU MHV2020BH
0030 20 20 20 20 20 20 20 20-20 20 20 20 20 20 20 20
0040 20 20 20 20 3B 0F D7 3F-82 77 FE 41 C6 F6 A2 5D ;..?.w.A...]
0050 FC 17 2C 17 7A D4 F8 D6-80 29 54 02 D3 79 C9 61 ..,.z....)T..y.a
...

Offset Description Data
00 -> 13 serial number (20 bytes) <8 spaces>NW58T5A25NHP
14 -> 1B firmware version (8 bytes) 0093002C
1C -> 43 model number (40 bytes) FUJITSU MHV2020BH<spaces>
58 -> 5B total LBAs (little endian) 0x02542980 LBAs x 512 bytes/LBA = 20 003 880 960 bytes
5C -> encrypted stuff (256 bytes)


Here are hex dumps of modules 0D and 02 from a WD2500BEKT drive:

MOD 0D --- contains firmware version
0000  52 4F 59 4C 04 00 1E 00-0D 00 01 00 1F FF 0C 3F   ROYL...........?
0010 30 30 30 31 30 30 30 30-00 00 00 00 00 00 00 01 00010000........
0020 31 31 2E 30 31 41 31 31-00 01 03 01 00 00 50 01 11.01A11......P.
0030 4E E2 01 AD 6F FB 00 01-FE FF 00 00 00 00 00 00 N...o...........
0040 01 00 00 00 00 00 00 00-00 00 64 00 00 00 00 00 ..........d.....

MOD 02 --- contains serial number, model number, capacity in LBAs (and passwords?)
0000  52 4F 59 4C 01 00 30 00-02 00 03 00 30 75 7B EC   ROYL..0.....0u{.
0010 30 30 30 38 30 30 30 30-09 1D 09 00 00 00 00 00 00080000........
...
02A0 33 00 4E 04 02 00 00 01-57 44 2D 57 58 45 36 30 3.N.....WD-WXE60
02B0 38 50 4C 37 31 30 39 00-00 00 00 00 00 01 10 3F 8PL7109........?
02C0 00 00 00 00 6F 59 1C 1D-6F 59 1C 1D 6F 59 1C 1D ....oY..oY..oY..
02D0 6F 59 1C 1D 00 01 A4 03-00 00 00 00 07 7F 00 00 oY..............
...
04D0 00 00 00 00 01 57 44 43-20 57 44 32 35 30 30 42 .....WDC WD2500B
04E0 45 4B 54 2D 30 30 46 33-54 30 20 20 20 20 20 20 EKT-00F3T0

Total LBAs = 0x1D1C596F + 1

Capacity = 0x1D1C5970 LBAs x 512 bytes/sector = 250 059 350 016 bytes

(Note to self: Would it be possible to use HddHackr to view the passwords on a WD drive?)


Here are the HddHackr files, as I understand them:
EC.bin     —  original WD 512-byte Identify Device data (ATA command ECh)
SD.bin — hacked WD module 0D ("sector D")
S2.bin — hacked WD module 02 ("sector 2")
UNDO.BIN — original WD module 0D plus module 02
HDDSS.BIN — backup of LBAs 16 -> 22 on original Xbox drive

Here are examples of WD modules after they have been hacked:

MOD 02 after hack (S2.BIN)
0100  52 4F 59 4C 01 00 30 00-02 00 02 00 49 FB A3 F2   ROYL..0.....I...
0110 30 30 30 38 30 30 30 30-08 1B 09 00 00 00 00 00 00080000........
...
01A0 02 00 00 01 4E 5A 32 58-54 37 32 32 45 4A 39 32 ....NZ2XT722EJ92
01B0 00 00 00 00 00 00 00 00-00 01 10 3F 00 00 00 00 ...........?....
01C0 AF 4B F9 0D AF 4B F9 0D-AF 4B F9 0D AF 4B F9 0D .K...K...K...K..
...
0380 03 01 00 01 00 00 00 00-00 00 00 01 46 55 4A 49 ............FUJI
0390 54 53 55 20 4D 48 57 32-31 32 30 42 48 00 00 00 TSU MHW2120BH...

MOD 0D after hack (SD.BIN)
0100  52 4F 59 4C 04 00 1E 00-0D 00 01 00 43 16 C7 B6   ROYL........C...
0110 30 30 30 37 30 30 33 38-00 00 00 00 00 00 00 01 00070038........
0120 30 30 39 33 30 30 31 33-00 01 01 01 00 00 50 01 00930013......P.

Here are the text strings which I extracted from hddhackr.com (v0.91):
http://www.users.on.net/~fzabkar/HDD/HDDHACKR.txt


References

Xbox 360 Hard Drive Upgrade - Drive Structure:
http://beta.ivc.no/wiki/index.php/Xbox_360_Hard_Drive_Upgrade

HDDHackr home page (downloads and command syntax):
http://www.xboxhacker.org/index.php?topic=11813.0

How to hack a 250gb or 320gb sata drive to work in the Xbox 360 and Xbox 360 Slim:
http://digiex.net/guides-reviews/console-guides/xbox-360-guides/3152-how-hack-250gb-320gb-sata-drive-work-xbox-360-xbox-360-slim.html

Collection of WD UNDO.BIN files:
http://digiex.net/attachments/guides-reviews/console-guides/xbox-360-guides/7416d1317194998-how-hack-250gb-320gb-sata-drive-work-xbox-360-xbox-360-slim-undo.bins-wd.zip

Fujitsu Hard Drive Security Sectors:
http://beta.ivc.no/xbox360/hddhackr/120GB_HDDSS.rar
http://beta.ivc.no/xbox360/hddhackr/60GB_HDDSS.rar
http://beta.ivc.no/xbox360/hddhackr/20GB_HDDSS.rar

Xbox 360 250GB Hard Drive Security Sector:
http://digiex.net/attachments/downloads/download-center-2-0/consoles-homebrew/3814d1265962341-xbox-360-250gb-hard-drive-security-sector-download-hddss-bin-hddss_250gb-bin-hddss_250gb.zip

Xbox 360 320GB Hard Drive Security Sector:
http://digiex.net/attachments/downloads/download-center-2-0/consoles-homebrew/7395d1316560295-xbox-360-320gb-hard-drive-security-sector-download-hddss-bin-hddss320-bin-hddss320.zip

HddHackr v1.30 Build 20110303 and earlier:
http://www.one-winged-angelz.eu/XBOX360/Apps/HddHackr/HddHackr_v1.30_Build_20110303.rar
http://www.one-winged-angelz.eu/XBOX360/Apps/HddHackr/HddHackr_v1.25_Build_20101114.rar
http://www.one-winged-angelz.eu/XBOX360/Apps/HddHackr/HddHackr_v1.24_Build_20100904.rar

Xplorer 360 250gb Edition:
http://digiex.net/attachments/downloads/download-center-2-0/consoles-homebrew/3816d1265962341-xbox-360-250gb-hard-drive-security-sector-download-hddss-bin-hddss_250gb-bin-xplorer360-250gb-edition.zip

Salvation Data article showing structure of WD modules:
http://www.salvationdata.com/blog/wp-content/uploads/2009/08/081909_0942_FixIdentifi5.png
http://www.salvationdata.com/blog/fix-identification-problem-caused-by-corruption-of-ata-overlay-module-or-rom-content/