Hacking Drive Status says "Unknown" in Ustealth

Cross2031

Member
OP
Newcomer
Joined
Nov 29, 2022
Messages
9
Trophies
0
Age
24
XP
71
Country
United States
So like,

I use this external hard drive to play my wii games in the vwii (via USB Loader GX) and for a while it was all fine, until one day where I went to play a new game on the USB Loader GX, and 10 minutes into the new game, the whole console just froze, and so I restarted it and went back to the USB Loader GX, and upon returning to it gave me this error: “USB Device not initialized. Switching to channel list mode.”
I have never gotten this error before, so when I saw that, I had to go check what was happening on my external hard drive, I took the hard drive, plugged it into my computer, then I launched U-stealth to unhide the drive, but when look at the status, it said, “Unknown”, and when I tried to unhide it, it said, “Cannot make changes to an unknown boot sector!”
Not sure on what to do now, so if anyone could help me with this, that would be greatly appreciated :)
 

Sypherone

Gaming Ninja
Member
GBAtemp Patron
Joined
Apr 28, 2019
Messages
1,655
Trophies
2
Age
44
XP
2,812
Country
Germany
The Master Boot Record might be corrupted, which stores information about the drive and the files on it. It worst case all data on it is lost. This can happen by using Ustealth and/or when unplugging the drive to fast when still operation are running on PC, instead of ejecting it first. Or removing it while in USBLGX. And because of the drive cant be recognized, the data on it cant be backuped that easely.

There exist possibilitys to restore the MBR. BUT the drive is hidden with Ustealth. By using the wrong tool the hole MBR can be destroyed snd all data is lost!

The only idea i have atm is trying USBhide on WiiU. There also exist some Tools on Linux like wiiunhide or to manually extract the MBR like dd or sfdisk and change manually with a hex editor the last byte of sector 0 from 55 AA (tells its MBR) to 55 AB or inverse.

The easy way is simple by reformating the device and reinstalling all stuff.
 
Last edited by Sypherone,
  • Like
Reactions: Blythe93

V10lator

Well-Known Member
Member
Joined
Apr 21, 2019
Messages
2,632
Trophies
1
Age
36
XP
5,473
Country
Germany
@Sypherone is right, this is a corrupted MBR. The very first thing to do is to dump a 1:1 raw image from the disc. That way you can't corrupt the data even further.

Now to the good news: All filesystems I know about have MBR backups for exactly this reason, so in the best case a simple filesystem check will restore the drive. At best make a copy of the image and fschk that from a Linux PC.
In case that won't work try different recovery tools but always use them on a fresh copy of the image, leaving the drive and the 1:1 raw image you made untouched. Only after you restored and verified the filesystem in a image copy restore that fixed copy to the drive.
 

Sypherone

Gaming Ninja
Member
GBAtemp Patron
Joined
Apr 28, 2019
Messages
1,655
Trophies
2
Age
44
XP
2,812
Country
Germany
The MBR and GPT are co-existent on the drive. But the MBR is only stored in the first sector of a drive. GPT is stored in the second sector and has a backup in the last sector of the drive.
1669885607414.png



If you want to restore the data. On Linux exist dd or dd_rescue to create 1:1 raw images of the drive, it will copy it bit by bit independent of the used filesystem. Then you might try restore the MBR and have a backup in case it goes wrong.
In case the MBR is corrupted Testdisk on Linux can be used to resore it.

Manual methodes to hide/unhide a drive for WiiU beside Ustealth/USBHide :


Check the Signature value of the MBR :

  1. First you may use on Windows fsutils, on Linux (WSL?) blockdev or fdisk to verify the used secor size (512 or 4096).
  2. Then run on Linux : # dd if=/dev/sdX of=mbr.dmp bs=512 count=1
    • (if=/dev/hdX) = your drive, (of=mbr.dmp) = output file, (bs=512) = sectorsize, (count=1) = 1 Block to read
  3. View the hole file : # od -t x1 mbr.dmp | less
  4. Or view only the last six lines : # od -t x1 mbr.dmp | tail -6 55AA tells the system its a MBR.
    1669887818245.png
  5. A hex editor can be used to edit the data and finally writing it back with dd.

Hide/unhide the drive under Linux:

Verify you choose the correct drive by using # df command. The driveletter is displayed as /dev/sdX (use without number, instead of /dev/sdx1 /dev/sdx2 etc...). /dev/sda is most likely your boot disk, so NEVER use that one!
  1. First creae a lokal backup of the MBR by running as root (sudo) :
    dd if=/dev/sdX of=/home/username/mbr.bin bs=512 count=1
  2. Next edit the mbr.bin with an hex editor, eg. use ghex. And change the last byte at the end of the file in offset 0x1FF from 55 AA to 55 AB and save it as mbrhidden.bin .
    Run # ghex mbr.bin -> go Edit Option -> Substitute -> Find string (AA 55) / Substitue (55 AB) -> Verify the red marker is at correct position, else klick "keep search" - > Subsitute and save the file as mbrhidden.bin
  3. Write it back to the drive again to make it hidden, be absolutely sure you are using the correct drive or you will end up with an unbootable system.
    dd if=/home/username/mbrhidden.bin of=/dev/sdX bs=512 count=1
    And unplug the drive.
  4. If you want to unhide it again simply write the original mbr.bin:
    dd if=/home/username/mbr.bin of=/dev/sdX bs=512 count=1
    And unplug/plug the drive

Hide/unhide the drive under Windows:

Active drive editor is tool with GUI to view and edit the bootsector, is available under Windows and Linux and edits the MBR directly on the drive without creating a local backup.
Change the last value (yellow value in offset line ..00496) to 55 AA to unhide it, or to 55 AB to hide it
  • Open the tool -> open the CORRECT disk -> Right Klick -> Allow edit content -> mark the value with mouse -> right klick -> Fill block -> Enter HEX value 55 AA or 55 AB and hit OK -> Save, it will write the changes to the drive -> unplug and replug it.
    1670332495682.png
 
Last edited by Sypherone,
  • Like
Reactions: Blythe93

V10lator

Well-Known Member
Member
Joined
Apr 21, 2019
Messages
2,632
Trophies
1
Age
36
XP
5,473
Country
Germany
@Sypherone Wait, wait, wait, we're mixing up MBR and Superblock. MBR = Master Boot Record, this is basically the partition table and filesystem independent. You're right that normally there is no MBR backup! The Superblock on the other side is from the filesystem. Linux for example doesn't read what filesystem is used from the MBR but parses the Superblock instead. This Superblock indeed does have backups.
Restoring an MBR is damn simple through: Just create a new one (from Linux, WITHOUT formatting the drive, so use low-level software like fdisk), assuming there's only one partition with the size of the whole drive. Even if this assumption is wrong (which I doupt) you should have access to the first partition of the drive now. ;)

Anyway, we can't tell if this is a corrupted MBR or a corrupted Superblock without diagnosting the drive. My guess would be more like a corrupted Superblock as this gets written to while the drive is in use while the MBR should be read only (except you format the drive or something like that). To restore the superblock have a look at https://superuser.com/questions/593792/fat-filesystem-bad-superblock , for example, but keep in mind to take a raw disc image before attempting anything. On Linux you take such an image with sudo dd if=/dev/sdX of=/path/to/the/file.img bs=4k (exchange X with the letter of the drive. hdX isn't used anymore, today all is sdX. The bs=4k is optional but speeds up the dumping by aligning the read chunks to the drives blocksize (which is either 512b or 4kb. Choosing 4kb with a 512b blocksize doesn't hurt)). Mac might be similiar. On Windows you need special software for this.

//EDIT: Keep in mind that dumping will take some time and that dd won't give any output except at the end: There will be an error message, this is ignoreable as it just means the end of the drive has been reached, so dd can't read any more data.

//EDIT²: LOL, I'm having the exact same issue as described at the superuser link right now: Android fails to mount the SD card. From a first look the MBR is just fine but the Superblock damaged. Taking a dd backup while we speak. Will keep you informed how this works out. Will take a lot of time through as this is a big sized card and I'm dumping via USB2.0. Current state: Around 4 of 128 GB backuped.

//EDIT³: Damn, dd failed to create the backup. I hate this card reader, would need a new one... Still let's try to recover that superblock. First step: fscking the drive. The good thing is that it correctly identifies a FAT filesystem but the bad thing is that it shows a one bit difference between the superblock (also called boot sector on FAT) and its backup, so let's try to overwrite the superblock with the backup. The whole fsck process needs a lot of time, too, and also failed with an I/O error. So we go a bit more low level by executing sudo fsck.vfat -w /dev/sdk1 and interrupting execution after the superblock had been copied:
Code:
$ sudo fsck.vfat -w /dev/sdk1
fsck.fat 4.2 (2021-01-31)
There are differences between boot sector and its backup.
This is mostly harmless. Differences: (offset:original/backup)
  65:01/00
1) Copy original to backup
2) Copy backup to original
3) No action
[123?q]? 2
^C
Okay, now let's try to mount the partition but keep it read-only to not corrupt any more data (remember that I broke my own advise by not taking a raw backup) :
Code:
$ sudo mkdir /tmp/tmpmount
$sudo mount -o ro /dev/sdk1 /tmp/tmpmount
The -o ro keeps it read only and this worked like a charm: All files and folders seem to be present. So unmount (sudo umount /dev/sdk1 or sudo eject /dev/sdk) and put the SD card back into the mobile phone: It doesn't work. Now this is weird and my next try will be to mount the card read-only again, backup all files and folders, formatting the card and put the backups back... Still I start to guess this is a hardware issue, so probably won't work, too... :(
 
Last edited by V10lator,

Sypherone

Gaming Ninja
Member
GBAtemp Patron
Joined
Apr 28, 2019
Messages
1,655
Trophies
2
Age
44
XP
2,812
Country
Germany
@V10lator I will check this by time, tommorow morning. Iam still thinking about a secure way to get, so that might work flawless to repair the MBR/Superblock. But i need to research...
 

V10lator

Well-Known Member
Member
Joined
Apr 21, 2019
Messages
2,632
Trophies
1
Age
36
XP
5,473
Country
Germany
@Sypherone Well, forensic rule 101: Don't work on the drive directly but take a backup, put the drive into storage, copy the backup and work on that copy... This is a real hardcore rule (not touching the first backup you made but working on a copy of that prevents further corruptions thanks to hardware errors which could occur even when just reading out the image from the drive, for example) but it is the best one can do as, well, it prevents any further corruption and you have all the time of the universe to try to fix it.

I'm in no way an expert on that topic but restored a lot of corruptions in my lifetime + am using Linux for more than 15 years (so I know the low level details by heart) as my main OS on almost all hardware I own.
 

Sypherone

Gaming Ninja
Member
GBAtemp Patron
Joined
Apr 28, 2019
Messages
1,655
Trophies
2
Age
44
XP
2,812
Country
Germany
@V10lator Ya thanks for tip, sure thats understandable. Iam also not a friend of losing data. But first i will check some logic behind the stuff, then i have two corrupt drives where i can test it.

One thing is the backuped Superblock to restore the MBR, the other idea that i have is, there is also the GPT table in the other sector. If the GPT is uptodate with its drive information, by changing the desired value maybe the GPT can be used to make the drive correct recognized again, then restoring the MBR. Or extracting the GPT and converting to MBR if maybe possible.
 

V10lator

Well-Known Member
Member
Joined
Apr 21, 2019
Messages
2,632
Trophies
1
Age
36
XP
5,473
Country
Germany
there is also the GPT table in the other sector.
No, most likely there isn't. Drives < 2 TB generally get an MBR but no GPT. In other words: Having an MBR on a GPT disc is part of the GPT standart: This is a fallback for devices not understanding GPT... But having a GPT on a MBR drive? That would be an exotic case you won't find in real live.

Also you're still mixing up MBR and Superblock: Restoring the MBR from the superblock might be possible but to find the superblock you need the MBR, so it would be pretty hard to go this route (esp. when there's more than one partition on the drive).

//EDIT: Then again the simplest way to restore an MBR is to, well, not restore it but recreate it from scratch. When there's just one partition on the drive this is plain stupid, when there are multiple you should remember the exact size of each partition... So restoring the MBR of a multi-patition disc is way more hard but on a single parition disc, like the one for vWii, it is damn simple. Again: Just use a low-level tool like fdisk which creates partitions without formatting them (or touching the data inside of the partitions in any other way). All the MBR is is a map, it maps the starting and ending point of the partitions on the drive... In 99% of cases a one partition drive has this single partition spanned from the beginning (ofc. after the MBR + some offset defined by the drives blocksize) of the drive until the end, so really, really simple to recreate.

//EDIT²: But even if the partition wouldn't span over the whole drive this is no problem as long as it begins where expected: A partition is allowed to be larger than the filesystem it holds. ;)

//EDIT³: And even if the beginning of the partiton isn't where expected recreating the MBR with fdisk won't hurt, it will just put you into the exact same state you where before: Having a MBR which missmatches with the real partition layout... So a corrupted MBR... ;)
 
Last edited by V10lator,

V10lator

Well-Known Member
Member
Joined
Apr 21, 2019
Messages
2,632
Trophies
1
Age
36
XP
5,473
Country
Germany
Test disk might be able to fix it.
Yes, it might... Still you shouldn't lazily run it as in the worst case it might corrupt more data... So, for the thousands time: Always dump a raw disc image of the drive, copy that image and work (so in this example run test disc) on this copy only.

//EDIT: And in case this work failed delete the copy and take a fresh copy of the raw disc image for your next try.
 

Cross2031

Member
OP
Newcomer
Joined
Nov 29, 2022
Messages
9
Trophies
0
Age
24
XP
71
Country
United States
@V10lator @Sypherone I've been reading your replies for a while and tbh, I have no idea what you guys are talking about. 💀
It's fine if I lose all my data, I just want to be able to use my drive again, but I'm really not sure how to perform any of those solutions you guys mentioned, so if I could get a more simplified (or step-by-step) solution to this, that would be much appreciated :)
 

mrmagicm

Well-Known Member
Member
Joined
May 27, 2018
Messages
792
Trophies
0
Age
49
XP
1,215
Country
France

Cross2031

If you don't mind losing the data on the drive, I recommend using "WD Dlg 1.37" from western digital and wipe your drive with it, then reformat it in FAT32 (also, what was the format of your drive already?)
If you wish to recover the drive, you'll never manage to do it with them, you must have a certain level or you'll only get an headache I thing ^^ just understand that putting using U-stealth on the drive as make recovery by far much uneasier.
Only easy way I would say like sypherone did...try using USBhide, then use PartitionGuru for repairing Mbr, if the wiiU Homebrew "usbhide" doesn't work on the drive, you are dead meat for recovering it.

V10lator I don't think there is need for a damp of an hdd with games only , you do this to all your data/life on a disk ^^​

 

Sypherone

Gaming Ninja
Member
GBAtemp Patron
Joined
Apr 28, 2019
Messages
1,655
Trophies
2
Age
44
XP
2,812
Country
Germany
@Cross2031 Sorry, we dont have atm a finally solution that is that simple to use for everyone to restore this drive. Its at the moment research and possibilitys testing to restore the drive without losing its data. If we might have one we will post it, as its in interest of everyone.
As your drive has for sure a corrupt Master Boot Record which holds the basic information of your drive (e.g partitions, filesystem) it could be repaired by a tool. BUT the drive is hidden by changing a specific value with Ustealth, which means this MBR is not recognized as MBR anymore which could result by restoring in a empty MBR.

//EDIT: You might try this first :
Make the drive appear :
Use this tool Activ Disk Editor below to view the MBR details of the drive, if the last value is 55 AB (yellow value in offset line ..00496) it can be edit to 55 AA and maybe the drive will work again if there is not another issue.
Open the tool -> open the CORRECT disk -> Right Klick -> Allow edit content ->mark the value with mouse -> right klick -> Fill block -> Enter HEX value 55 AA and hit OK -> Save, it will write the changes to the drive -> unplug and replug it, the drive and its partition should appear as normal. If issues persist, NOW a repair of the MBR e.g. by Windows can be tryed.

Restoring the drive for new use (data loss) :
If its just that using your drive again and the data dont cares you. You can use every available tool/application to reformat it. You might run on Windows in Powershell bootsect /nt60 X: /mbr (X = driveletter) to restore the MBR, but every data will be gone. If you dont have a driveletter just go to Windows drivemanagement, choose the drive, choose MBR and format it. Then run chkdsk X: /r to check for filesystem and sectors for errors which will be corrected. Additonal you might run h2testw (write + verify) to verify the drive is not corrupted. The checks will take some time. There exist multiple applications to format a drive, e.g. Windows Diskmanager, Aomei Partition Manger oder Minitool Partition Wizard, Linux Gparted or other.


55 aa is fat iirc 55 ab is stealthed
Some correction. 55AA is the identifier to tell the OS its a MBR, the filesystem type is stored in another position. In this case 0x0B is Fat32 (no LBA), 0x07 is NTFS and 0x83 is ext4. With Active Disk Editor you can shown the Details of the MBR and it has also access to it if the drive is unrecognized .
1669996283680.png
 
Last edited by Sypherone,

mrmagicm

Well-Known Member
Member
Joined
May 27, 2018
Messages
792
Trophies
0
Age
49
XP
1,215
Country
France
* when there as been a sector corruption like this, I recommend a high format on the drive first to be sure it will work nice.
It's the only way to be sure it's worth putting data again on the drive, as the drive could be "dead" with multiple sector corrupted. A simple format is sometime not enough to discover dead sectors.
 

Cross2031

Member
OP
Newcomer
Joined
Nov 29, 2022
Messages
9
Trophies
0
Age
24
XP
71
Country
United States
Open the tool -> open the CORRECT disk -> Right Klick -> Allow edit content
I just tried it now but I get this weird thing shown on my screen:
E4ADEA70-19FE-497A-994A-9390B21EA7C3.jpeg

Not sure what happened, but everything says 0 and I can’t edit anything :(

just go to Windows drivemanagement, choose the drive, choose MBR and format it
I tried to do that as well, but then I get this error:
22EE6CC9-4383-4B26-897B-55A61745783C.jpeg


This is all kinda worrying me, though hopefully there’s a workaround to this :)
 

godreborn

Welcome to the Machine
Member
Joined
Oct 10, 2009
Messages
38,471
Trophies
3
XP
29,136
Country
United States
something is definitely wrong with that drive then. can you create a volume on it? do note, this will remove everything from the drive.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
    Psionic Roshambo @ Psionic Roshambo: @SylverReZ, Indeed lol