SATA adapters » History » Version 1
Karsten, 11/11/2014 03:27 PM
| 1 | 1 | Karsten | h1. SATA adapters |
|---|---|---|---|
| 2 | 1 | Karsten | |
| 3 | 1 | Karsten | USB sata bridges (small dongles up to small desktop boxes) can be expected to have upgradable firmware in general. By specification they are required to have 1 ctrl + 2 bulk endpoints. |
| 4 | 1 | Karsten | |
| 5 | 1 | Karsten | h2. Controllers |
| 6 | 1 | Karsten | |
| 7 | 1 | Karsten | *Notes Legend* |
| 8 | 1 | Karsten | img: firmware image available |
| 9 | 1 | Karsten | viaUSB: firmware update via usb bus (according to advertisement) |
| 10 | 1 | Karsten | |
| 11 | 1 | Karsten | |_.Company |_.Models |_.Notes | |
| 12 | 1 | Karsten | |JMicron |JMS539,JSM559,JMS567,JMS551,... |img 8051 viaUSB | |
| 13 | 1 | Karsten | |ASMedia |1153 |img 8051 viaUSB | |
| 14 | 1 | Karsten | |TI |TUSB9 260 |cortexM3 viaUSB | |
| 15 | 1 | Karsten | |Fujitsu |MB86C30A |img ARM7 TDMI-S viaUSB| |
| 16 | 1 | Karsten | |Prolific |PL2571,PL2771,PL2773,PL2775 |img 8051 viaUSB | |
| 17 | 1 | Karsten | |VIA |VL700,VL701 |img 8051 viaUSB | |
| 18 | 1 | Karsten | |Genesys |GL3310,GL3321G |? | |
| 19 | 1 | Karsten | |Norelsys |NS1066 |img 8051 viaUSB | |
| 20 | 1 | Karsten | |LucidPort |USB300,USB302 |? | |
| 21 | 1 | Karsten | |
| 22 | 1 | Karsten | h2. Disassembled devices |
| 23 | 1 | Karsten | |
| 24 | 1 | Karsten | h3. LogiLink AU0028A |
| 25 | 1 | Karsten | |
| 26 | 1 | Karsten | * ASMedia 1051e |
| 27 | 1 | Karsten | * Windows firmware updater .exe available |
| 28 | 1 | Karsten | * Extracting exe file with binwalk results in firmware binary |
| 29 | 1 | Karsten | * Contains valid 8051 code with interrupt table and USB Descriptors |
| 30 | 1 | Karsten | * => %{color:red}Most likely vulnerable% |
| 31 | 1 | Karsten | |
| 32 | 1 | Karsten | h3. Buffalo HD-HXU3 |
| 33 | 1 | Karsten | |
| 34 | 1 | Karsten | * Fujitsu MB86C30A USB 3.0 to SATA Storage Controller |
| 35 | 1 | Karsten | * Google images shows SPI flash on PCB |
| 36 | 1 | Karsten | * No leaked tools available but a user manual on Baidu mentions that the chip has a maintenance mode, which can probably be used for upgrading the firmware |
| 37 | 1 | Karsten | * => %{color:red}Most likely vulnerable% |
| 38 | 1 | Karsten | |
| 39 | 1 | Karsten | h3. Unitek Y-3322 |
| 40 | 1 | Karsten | |
| 41 | 1 | Karsten | * JMicron JMS551 SuperSpeed USB to 2 ports SATA II 3.0G Bridge |
| 42 | 1 | Karsten | * Leaked tools for JMS551 chip are available |
| 43 | 1 | Karsten | * No PCB Photo found, it is unclear whether the device has an SPI Flash or not |
| 44 | 1 | Karsten | * * => %{color:orange}Probably vulnerable% |
| 45 | 1 | Karsten | |
| 46 | 1 | Karsten | h3. Unknown USB 2.0 to SATA Adapter [from lab, case already missing] |
| 47 | 1 | Karsten | |
| 48 | 1 | Karsten | * JMicron JM20329 chip with ATML H820\n46d |
| 49 | 1 | Karsten | * Support external NVRAM for vendor specific VID/PID of USB Device Controller |
| 50 | 1 | Karsten | => %{color:green}Most likely not vulnerable% |
| 51 | 1 | Karsten | |
| 52 | 1 | Karsten | h3. LogiLink AU0006D USB IDE & SATA Adapter wit OTB function |
| 53 | 1 | Karsten | |
| 54 | 1 | Karsten | * JM20337, no external flash/eeprom |
| 55 | 1 | Karsten | * Chip supports external EEPROM for configuration only |
| 56 | 1 | Karsten | => %{color:green}Most likely not vulnerable% |
| 57 | 1 | Karsten | |
| 58 | 1 | Karsten | h3. External 2.5 case USB + ESATA: |
| 59 | 1 | Karsten | |
| 60 | 1 | Karsten | * Sunplus SPIF225A-HL239, second chip is just a voltage regulator for SATA 3.3V |
| 61 | 1 | Karsten | * 8051 Controller with 32K ROM and 768B RAM |
| 62 | 1 | Karsten | => %{color:green}Most likely not vulnerable% |
| 63 | 1 | Karsten | |
| 64 | 1 | Karsten | h3. ORICO 3 SATA HDD USB2.0 Adapter |
| 65 | 1 | Karsten | |
| 66 | 1 | Karsten | * APM4435 (MOSFET) |
| 67 | 1 | Karsten | * AX3121 (Step-Down Convertor) |
| 68 | 1 | Karsten | * Pm25LD512 (64 KiB SPI Flash) |
| 69 | 1 | Karsten | * JMB352U (USB Sata Bridge) |
| 70 | 1 | Karsten | * 60MIPS 8051 with 64k-byte mask ROM |
| 71 | 1 | Karsten | * Official datasheet says that external storage is used for configuration data |
| 72 | 1 | Karsten | * But: http://www.jmicron.com/solution06.html |
| 73 | 1 | Karsten | The first application of the JMB352U: a 1:1 HDD duplicator. The USB 2.0 port is utilized to update the JMB352U firmware only, while the eSATA port can be used to access the data in the two SATA devices |
| 74 | 1 | Karsten | => Firmware is upgradeable via USB |
| 75 | 1 | Karsten | => Could not find any leaked firmware files/tools but it is not too difficult to unsolder and read out the SPI flash |
| 76 | 1 | Karsten | => %{color:red}Most likely vulnerable% |