Printable View
to put on a USB stick. much like SanDisk did with their U3 drives.
i have a sandisk u3 disk with the u3 software removed.
fdisk and cfdisk (i'm using linux and windows) have no options to create a partition as cdrom filesystem (cdfs i believe).
anyone know how to create a cd-rom partition on a USB drive?
thanks.
The filesystem on a cd is called ISO-9660.
You can create an iso image using mkisofs.
I am afraid that I don't quite ubderstand what you have done?
AFAIK those smart devices have a small CD partition and a large data partition. This is how they manage to autoboot? Is this the "software" you have removed?
This article may help:
http://cse.msstate.edu/~rwm8/hackingU3/
Good luck :)
i know how to make iso'sQuote:
Originally posted here by SirDice
The filesystem on a cd is called ISO-9660.
You can create an iso image using mkisofs.
i want to make a partition on my USB drive that looks like a cd-rom drive to windows and everything else. and if i understand right it has to be a CDFS partition, windows see's it as ISO-9660 partition.
so using mkisofs wouldn't work, maybe if i wanted to make an ISO to put on a USB i could do that i guess?
i want a cd partition on it though.
yah i read that the other day on Digg.Quote:
Originally posted here by nihil
I am afraid that I don't quite ubderstand what you have done?
AFAIK those smart devices have a small CD partition and a large data partition. This is how they manage to autoboot? Is this the "software" you have removed?
This article may help:
http://cse.msstate.edu/~rwm8/hackingU3/
Good luck :)
and that would work....except i already removed that partition and its no longer there, and the removal of that partition SanDisk said is irreversible.
soooo....they created the partition somehow, i want to know how and do it again.
thanks though.
OK, gotcha (I think :) ) We have this usb drive and the opening partition has been removed. You want to restore it so that the drive will autostart again?
Have you used any drive recovery software on it yet?
Have you had a look at the SanDisk resource kit or whatever they call it. It is software for creating applications and such for distribution via a usb drive?
Actually, I think that it is the U3 resource kit?
EDIT:
http://www.torosoftware.com/autorun.asp
http://www.simtel.net/product.php%5B...D%5Dfilebasket
Not quite, but as close as I could find
nihil: there is no recovery and the process cannot be redone (says SanDisk on their site when removing the cd-rom partition).
but...they put a cd-rom partition (cdfs) on the usbkey to make their software (U3 crap) autorun everytime you plugged the usb key in to a computer.
soooo....i wanna know how to remake that partition (cdfs) on the usb key.
they did it somehow so i know its not impossible.
those links are in the right direction...but the AutoRun software has to be installed on EVERY computer you plug the usb key into to autorun the usb key.
so it kind of defeats the purpose.
You never know until you try. I personally, am sceptical when it comes to manufacturer's claims.Quote:
there is no recovery and the process cannot be redone (says SanDisk on their site when removing the cd-rom partition).
Intel and AMD program their processors with microcode....................hard drive manufacturers have their hidden partitions? Not impossible, but you won't be able to do it ;)Quote:
they did it somehow so i know its not impossible
You must realise that some things are done during the manufacturing/production process, and you can't mess with them afterwards, other than to perhaps obliterate them.
As I said, check out the U3 resource kit. That might let you modify the partition contents, but I don't know about creating one.
It could have something to do with the original programming of the drive.. the chip could have been parrallel programed, rather tha via the serial link.. and certain addresses are not accessable via the serial link..
the idea had caught my imagination and have been doing a little research.. no joy so far.. most links regarding the U3 software/cdfs formatting etc lead to people wanting to remove the same.. but DT12 you would already be aware of that :) ..
I am sure that you are right undies~,
I have looked at several "solutions" and they require you to load an application onto the target machine.
Otherwise there is this solution:
http://www.udrw.com/en/tech/index.php
You have to buy their drives and developers' kit, which indicates that it is a hardware/firmware approach.
:)
thanks d00ds
i'll continue trying to find out somehow.
almost wish i hadn't _removed_ the whole partition, just overwritten it with whatever i wanted.
thanks anyways.
Hi,
I am on the same quest as you. I also wiped the U3 crap and am working on putting a CDFS partition back on, but with an autorun that will run my little AutoIt routine. I'd like for this to happen on simple insertion of the USB drive without user interaction being required. Just stick it in, count to five, and yank it.
I also came across this page you saw:
http://cse.msstate.edu/~rwm8/hackingU3/
There, I learned about the LPInstaller.exe and the cruzer-autorun.iso files, and how to spoof my local server to appear as the U3 website so it will load in my own version of the iso file, theoretically then, being set to run whatever files I want it to...
I am still playing with the mkisofs.exe program, and not quite understanding how to do what I want it to do... this is new stuff to me. I DO believe that the LPInstaller.exe file creates the CDFS partition on the USB drive- but if you know differently for certain, let me know.
Since it seems we're both on the same quest, I'm happy to share whatever I find with you, and I'd like to ask if you would be able to do the same? I have a boatload of files and info that I've collected in this quest, which I'm trimming down to useful stuff. Here's another tidbit that may be useful:
This is from MicroSoft:
Q: What must I do to trigger Autorun on my USB storage device?
The Autorun capabilities are restricted to CD-ROM drives and fixed disk drives. If you need to make a USB storage device perform Autorun, the device must not be marked as a removable media device and the device must contain an Autorun.inf file and a startup application.
The removable media device setting is a flag contained within the SCSI Inquiry Data response to the SCSI Inquiry command. Bit 7 of byte 1 (indexed from 0) is the Removable Media Bit (RMB). A RMB set to zero indicates that the device is not a removable media device. A RMB of one indicates that the device is a removable media device. Drivers obtain this information by using the StorageDeviceProperty request.
Hmmm..... So the question is... How?
Anyway, hopefully between the two of us we can figure this out.
Also- if you have a good hex editor, you might find some interesting info in the .iso file as well as the LPInstaller.exe. I'm still poking around in there and see some potentials.
What can you tell me about mkisofs?
Thanks & good luck,
Dave Xanatos
sorry i didn't reply to your email sooner.
only thing i disagree with is the LPInstaller.exe. that just downloads the iso file i believe, and then burning the ISO image to the already created cd-rom "drive" on the usb stick.
as far as i know they haven't released a tool to re-create the cd-rom "drive" on the stick.
what you could do with mkisofs is gather all the files and executables you want, and make an image of them (ISO) and then have a program like LPInstaller download it and "burn" it on the so caled cdrom drive.
windows/usbdrive see that partition as a cd-rom drive so its able to burn that image onto the partition, which you normally wouldn't be able to do.
so since your cdrom "drive" is still there i believe? you could use mkisofs to make an image of your choice or whatever you want to autorun, and put it on a webserver, then edit your hosts file to spoof the sandisk site so it downloads your image instead of the real one on sandisks site.
it'd do what you want, autorun the file of your choice, just still we have no way of recreating the cd-drive.
only bad thing is you're limited to 6mb looks like, until someone or one of us finds out how to recreate that drive.
sorry if you already knew this or is no help, its what i know of now.
you're in a better position than i am though, i already used U3's utility to remove the cd-drive from mine, and they say its irreversible. :(
Short of fire or running over by large vehicles, not too much is irreversible- at least with software changes! :)
I also had run the uninstaller, so we're both in the same boat. I'm going to try the installer on another thumb drive I have and see what happens. I'll let you know.
I KNOW this must be possible. I like that info about the Removable Media bit (0/1)... that may be a line to persue. If I can get the USB to answer the query with just that one bit changed, all of our troubles will magically melt away! :)
Dave
yes but changing that i believe would require to edit the firmware.
http://www.experts-exchange.com/Oper..._21847909.html
someone else had the same idea, not much help though.
i'll keep looking on finding a way to edit that.
Thanks for the link, interesting reading. I'll continue my investigations as well.
Besides creating a CDFS partition, or changing the RMB, can you think of any other way to create an autorun for our USB drives? Too bad there isn't something like "Hold the U key down when you insert the drive to autorun"!!!
I'll let you know if I find anything of value.
DX
there is one way that shows up a lot on google searches but it requires autorun software to be installed on the client machines you want it to autorun on, but having to install all that software on them kind of defeats the purpose.
after reading about the removable media device bit, that seems a little bit nicer than having to create a cd-rom partition, because you wouldn't be losing space on your usb drive (having 2 partitions).
i'll look into changing that bit or try to find a how-to.
You're right about the "defeats the purpose" thought! Not so concerned about space savings... they make these things up to 4 or 6G now, so I can spare a few meg if I get the function... but that RM bit is really interesting. If it's not a hardcoded thing, it'd be really nice!
Still looking around, nothing useful yet.
DX
on msndn's page, it says this:
The STORAGE_DEVICE_DESCRIPTOR structure is used in conjunction with the IOCTL_STORAGE_QUERY_PROPERTY request to retrieve the storage device descriptor data for a device.
so, the STORAGE_DEVICE_DESCRIPTOR structure where the removable device bit is stored should be on the usb drive, is there a way you could open the usb stick in a hex editor or look at its firmware and grep for 'RemovableMedia' and set it to false?
i have no experience in dealing with device firmware.
That's an interesting idea... but I also am not too familiar with Firmware manipulation on USB devices.
In the interim... here's what I AM looking at that seems promising- at least for using on XP machines:
http://reviews.cnet.com/4520-3513_7-6296529-1.html
ANd I quote:
The researchers found fault with the way Windows XP drivers handle USB autorun and USB raw sockets.
The Windows autorun feature of Plug and Play is interesting. By default, the Windows autorun driver works only with nonremovable media. However, the researchers played around with the idea and wondered whether they could create a faux USB device that would appear to Microsoft Windows to be a nonremovable DVD drive. Sure enough, they were able to do so by taking advantage of a flaw in which USB drivers handle raw sockets. Specifically, the researchers were able to fool Windows into thinking their faux USB device was a nonremovable drive by identifying themselves with the vendor ID and product ID for a known DVD drive.
With their faux USB device in hand, the researchers demonstrated how they could attach it to a Windows XP machine and force a Kernel Heap buffer overflow, which would then allow the machine to run their malicious code
Research continues....
DX
i've inserted my u3 usbstick and opened up my 1gb of memory/computer ram and searched for "removable" and have found a couple results that look like the removable device bit.
how i would change that idk.
i want to find some way of editing the firmware and changing that RMB bit from true to false.
i hope that possible.
i tried changing the media descriptor in the boot sector of the usb stick from f8 (hard disk/fixed disk) but i don't know what to change it to. i don't know what hex value would represent a cdrom.
Now that sounds interesting. It might translate into breaking the boot sector down into individual bits- some may be boolean flags... f8 would be 1111 1000 in binary, and if I recall correctly (if you're looking at the right thing), the removable media bit needs to be set from 1 to 0 (I'd have to review the posting for the exact position and value). Say for example it was bit 2 of the f8 code... if f8 is 1111 1000, and we needed to change bit 2 (assuming we're talking from R to L), that would change it to 1111 1010, or fa, so fa would become the new boot sector media descriptor...
Now how exactly ARE you managing to see and edit the boot sector of the USB stick??? That is a part of the puzzle I haven't come across yet...
i downloaded a hex editor and loaded the RAM/memory and looked at it after plugging in the usb stick hoping to see and be able to grep for the removable media bit.
a couple results did come up for "DEVICE REMOVABLE" and another one i can't recall (i'll do it again and post it) that looked like what we're looking for.
a co-worker said try getting the firmware of the usbkey and going from there.
i was able to open the e:\ (usb key drive) in the hex editor and i was lookin at the boot sector.
CD's don't seem to have the same thing though, there is no boot sector i was able to look at.
i was going to copy the media descriptor from the cd-rom and change the usb-key's to it.
That's what I'm referring to. My hex editor will open any file I see in the directory under my usb drive- but I don't see any firmware files to edit/open.... just the files I've put in there myself. What am I mising?Quote:
Originally posted here by deftones12
i was able to open the e:\ (usb key drive) in the hex editor and i was lookin at the boot sector.
i used winhex, i've used it in the past and remember grepping and searching for passwords in memory.
yahoo messenger used to store passwords in plain text in memory and i was playing around with it.
google winhex.
Actually I'm using Hexplorer, and I found I can examine the disk directly by sector (in NT/2000/XP). I was on a ME box before, it didn't have that option there. I've been able to view the disk sectors directly, have found what I think is a boot sector... I'm looking into info to translate what I'm seeing as best as I can... will advise.
the media descriptor in the boot sector doesn't change anything sadly :(
Still playing... So far, the only interesting change I can make (that does anything noticable) is that I have changed the name of the drive (one of them, anyway). So now when I insert it instead of saying TravelDrive, it says XanaDrive. Lame, I know, but at least I could change SOMETHING! :)
I'm pretty sure the answer exists somewhere within the code I can see at the very beginning of sector 0 on my drives... when I figure that bunch of code out, I should be able to make the drive do pretty much whatever I want.
Big IF though...
More as I find it.
I've been trying to accomplish the same goal, and have come to the same brick wall. Have you had any developments lately? Some of the tips you give here are great, thanks.
I also pursued making a jump drive bootable, thinking that would get me closer. It worked, but still no autorun capabilities. Here are the two utilities I found to do it (if you don't already have them). This is the one made by HP (follow link), and the other is a Lexar utility (file attached), but it is my understanding that they will work on any drive.
What is very interesting is that the Lexar utility has a "Flip Removable Bit" button. I know, seems like exactly what we are looking for, but I have not been able to get it to make the drive autorun when inserted. Maybe you will have better results. Let me know what you find out.
Hi LA, thanks for the info. Shortly after my last posts to this thread, I got a HUGE influx of work, and have spent very little time doing further research on that aspect. I've been fairly happy just running the executable I made to sequentially access the individual apps. I will, however, need to revisit these issues in the not-too-distant future.
The Lexar "flip removable bit" item sounds interesting, but I don't have a sandbox set up on this computer, so nothing personal, but I won't be downloading that until I have a safe place to open it and crawl around in it's innards before letting it loose anywhere important! :)
I do thank you for making it available, and I look forward to investigating what part of the app controls that removable bit and what it is really talking to and changing to make that happen.
If/when I find anything, I'll post here. It may be a few months... but it'll show.
DX
Has anyone been able to figure this out? This would really help me. :) I need to be able to create a CDFS partition on a standard USB memory stick along with a FAT partition. Thanks!
Why not just buy a U3 enabled drive............they are not that expensive.
http://www.u3.com/
I have never heard of anyone getting it to work on a standard USB drive so I guess that it is part of the manufacturing process. I know that you can customise the software but AFAIK you need an enabled drive first.
You wrote something about the Lexar Utility, but I can't find an atachment.Quote:
Originally Posted by LewisAudio
has anyone a link for me where I can get this util?
btw: I'm working at the same problem that is discussed in this thread!
I found it here:Quote:
Originally Posted by Ephi
http://www.911cd.net/forums//index.p...pe=post&id=369
This is the full post, where I found it:
http://www.911cd.net/forums//index.p...t=#entry103213