writing to write-protected usb key/thumb drive

[k9boy]

Sorry if this is not the right place for this.

I got a cheap 8MB promotional USB key/thumb drive at a convention. It's
write-protected, so I can't add/delete/format it.

I realize it's only 8MB (I have a real 256MB thumb drive already), but
it just annoyed the heck out of me. I mean, if they could put the file
on, surely it can be writable (either thru software or hardware hack).
Is anyone familiar with these promotional usb keys and know if it can
be realistically written to?

 

[Eric Gisin]

Did you open it up, check for jumpers?

The name on the chip may help you find extra software.

 

[J. Clarke]

Sorry if this is not the right place for this.

I got a cheap 8MB promotional USB key/thumb drive at a convention. It's
write-protected, so I can't add/delete/format it.

I realize it's only 8MB (I have a real 256MB thumb drive already), but
it just annoyed the heck out of me. I mean, if they could put the file
on, surely it can be writable (either thru software or hardware hack).
Is anyone familiar with these promotional usb keys and know if it can
be realistically written to?

Might be a mask-programmed ROM. Or they might have simply cut the
write-enable line.

You basically need to open it up, find out what chip is on it, pull the data
sheet, figure out how to write to the chip, if it is in fact
field-programmable at all, and then make whatever mods you need to make.

Of course they probably ground the markings off.

 

[Al Dykes]

Might be a mask-programmed ROM. Or they might have simply cut the
write-enable line.

You basically need to open it up, find out what chip is on it, pull the data
sheet, figure out how to write to the chip, if it is in fact
field-programmable at all, and then make whatever mods you need to make.

Of course they probably ground the markings off.

Are you on a w/98 system? AFAIK USB fobs need a software driver that
is standard in w2k and XP but requires setup on w/98. I have no idea
if that explains your symptoms.

 

[Arno Wagner]

Sorry if this is not the right place for this.

I got a cheap 8MB promotional USB key/thumb drive at a convention. It's
write-protected, so I can't add/delete/format it.

I realize it's only 8MB (I have a real 256MB thumb drive already), but
it just annoyed the heck out of me. I mean, if they could put the file
on, surely it can be writable (either thru software or hardware hack).
Is anyone familiar with these promotional usb keys and know if it can
be realistically written to?

Might be OTP (one-time programmable). The "hardware-hack" might
require tools you cannto afford.

Arno

 

[Rod Speed]

Might be OTP (one-time programmable). The "hardware-hack" might
require tools you cannto afford.

Rather unlikely anyone would have done it that way.

Its much more likely to be some simple kludge which prevents writes instead.

 

[k9boy]

Okay, so I cracked it open:

Large pics:
Front: http://homepages.nyu.edu/~tn282/usb/pica.jpg
Back: http://homepages.nyu.edu/~tn282/usb/picb.jpg

The memory is Samsung K9F6408U0C-TCB0 8MB x 8 bit NAND
http://www.samsung.com/Products/Semiconductor/Flash/NAND/64Mbit/K9F6408U0C/ds_k9f6408u0c_rev10.pdf

The controller looks like it says Freedik PP220242, but I can't see it
clearly enough.

Based on the memory datasheet (page4), the WRITE ENABLE (WE) line is
the 4th from the alignment dot.

Well, that's all I know. I don't have the engineering background to
make sense of it though :-(. If anyone can make sense of it and doesn't
mind explaining it, I would greatly appreciate it. But don't bother
investing too much effort - like I said, it's only an 8MB stick... and
if it requires more than a old cheap radioshack soldering iron to do,
it's probably a lost cause anyway.

 

[Rod Speed]

Okay, so I cracked it open:

I'd have you publicly flogged if you hadnt
enjoyed that so much the last time...

Large pics:
Front: http://homepages.nyu.edu/~tn282/usb/pica.jpg
Back: http://homepages.nyu.edu/~tn282/usb/picb.jpg

Much too dark to be able to see much, try it again with better lighting.

The memory is Samsung K9F6408U0C-TCB0 8MB x 8 bit NAND
http://www.samsung.com/Products/Semiconductor/Flash/NAND/64Mbit/K9F6408U0C/ds_k9f6408u0c_rev10.pdf

The controller looks like it says Freedik PP220242,
but I can't see it clearly enough.

Based on the memory datasheet (page4), the WRITE
ENABLE (WE) line is the 4th from the alignment dot.

Well, that's all I know. I don't have the engineering background
to make sense of it though :-(. If anyone can make sense of it
and doesn't mind explaining it, I would greatly appreciate it.

Not possible to see from those very dark pics if a track has
been cut etc. Thats the most common way to make it read only.

That would likely be a track associated with that WE line.

But don't bother investing too much effort - like I said, it's only an
8MB stick... and if it requires more than a old cheap radioshack
soldering iron to do, it's probably a lost cause anyway.

That may be all you need if a track has been cut.

 

[Rod Speed]

I'd have you publicly flogged if you hadnt
enjoyed that so much the last time...


Much too dark to be able to see much, try it again with better lighting.





Not possible to see from those very dark pics if a track has
been cut etc. Thats the most common way to make it read only.

That would likely be a track associated with that WE line.

The blobs just off some of the legs of the controller look suspicious.

 

[Daniel Lang]

On picb, at the very upper right corner, the trace looks cut.
If it is, try soldering a jumper over it.

Daniel Lang

 

[Arno Wagner]

Okay, so I cracked it open:

Large pics:
Front: http://homepages.nyu.edu/~tn282/usb/pica.jpg
Back: http://homepages.nyu.edu/~tn282/usb/picb.jpg

Does not look like anything was done to the hardware
to write-protect it. Cutting a wire would also
requite a pull-up or pull-down resistor, since
this is CMOD and inputs float if uncinected.

The memory is Samsung K9F6408U0C-TCB0 8MB x 8 bit NAND
http://www.samsung.com/Products/Semiconductor/Flash/NAND/64Mbit/K9F6408U0C/ds_k9f6408u0c_rev10.pdf

Does not look like this chip supports write-protecting it, except
under unstable power condition (i.e. only temporarily)

The controller looks like it says Freedik PP220242, but I can't see it
clearly enough.

If this thing is indeed write protected then it is a function of the
controller. Identifying the controller and getting its documentation
is the key in that case.

Arno

 

[Rod Speed]

(e-mail address removed) wrote

Does not look like anything was done to the hardware
to write-protect it. Cutting a wire would also
requite a pull-up or pull-down resistor, since
this is CMOD and inputs float if uncinected.

Not if they dont care about bulletproof engineering.

Does not look like this chip supports write-protecting it,
except under unstable power condition (i.e. only temporarily)

Oh bullshit, the WE is there for a reason.

If this thing is indeed write protected then it is a function of the
controller.

Not if WE is disabled.

Identifying the controller and getting
its documentation is the key in that case.

Thats just one way of doing it.