Unlocking Mitsubishi MMCS
May 21, 2008, 06:14 PM
#1
Newbie
Thread Starter
Join Date: Oct 2005
Location: Ft. Walton Beach, FL
Posts: 59
Likes: 0
Received 0 Likes
on
0 Posts
Unlocking Mitsubishi MMCS
this is courtesy of another forum and the link below leads to the original thread. by doing this process it looks like you should be able to swap out for a larger hard drive and be able to play video while driving. i'm sure there are some other things you can do as well, but none of this is for the technically handicapped. hope this helps.
http://www.mitsubishiforum.com/m_208034/tm.htm
ANY MODIFICATION ON HARD DISK MAY ALTER MMCS CAPABILITY TO LOAD DATA. DO IT ON YOUR OWN RISK.
The tools needed:
I would try to update my navi using a copy from another disk.
The tools needed to unlock the hard disk are below:
1. One screwdriver
2. One torx size 8 (see img)
3. One IDE adapter from small form to regular IDE (see here and here - both sides) if you use a desktop PC. For laptops, it connects directly.
4. The unlockhd program from iso file (the package is available here). You have to write it on CD and boot from it. NO OTHER HDD SHOULD BE ATTACHED EXCEPT THE MMCS' ONE.
5. The unlock key: B2BAB3BCB0DFACBEB1BBBEDFB1ADD2CDC9CEBAB2DFB19E8996 DFAA8C9A8DDFDF - for loader version 261EM (or B2BAB3BCB0DFACBEB1BBBEDFB1ADD2CDC9CEAAB2DFB19E8996 DFAA8C9A8DDFDF for 261UM)
6. One computer with IDE bus.
Procedure
1. To find out what loader version you have:
a) hold SET+NAVI for about 5 seconds to enter "Service Mode" menu
b) press Version Indication
c) note somewhere the Loader version. The key calculation algorithm is presented below. For example, for 261UM version, the key is B2BAB3BCB0DFACBEB1BBBEDFB1ADD2CDC9CEAAB2DFB19E8996 DFAA8C9A8DDFDF (I bolded the difference between 261EM)
2. Flip the screen (push OPEN button in the lower left corner), pull the HDD plastic cover, gently.
3. Unscrew the two screws which holds the hdd. Use the torx. Pull out the hdd.
4. Connect it to IDE bus and power supply.
5. Start the computer, boot from CD, and pick option 3: "Boot linux with locking/unlocking utilities"
6. Wait for root@Xbox-HDM:/1 prompt
7. type unlockhd -p <KEY> (Ex. unlockhd -p B2BAB3BCB0DFACBEB1BBBEDFB1ADD2CDC9CEAAB2DFB19E8996 DFAA8C9A8DDFDF). Double check if necessary
8. The key depends from unit to unit. See below.
9. If the operation is successful, running fdisk -l command will show the partitions (very similar as below). (thanks rcpax )
10. Now you may turn off the computer. The disk is unlocked. You may use it with a Windows computer as a regular disk.
ANY MODIFICATION ON HARD DISK MAY ALTER MMCS CAPABILITY TO LOAD DATA. DO IT ON YOUR OWN RISK.
Key computing algorithm
Thanks to brian360, the string sniffed when MMCS negotiate with the hdd is
BAB2 BCB3 DFB0 BEAC BBB1 DFBE ADB1 CDD2 CEC9 B2AA B1DF 899E DF96 8CAA 8D9A DFDF
The password is 32 bytes long but transferred at 16 -sixteen-bit words, so the MSB of each byte is high. It turns out that if you invert all of the bits of the password you get this:
454D 434C 204F 4153 444E 2041 524E 322D 3136 4D55 4E20 7661 2069 7355 7265 2020
Decoded ASCII is:
"EMCL OASDN ARN2-16MUN va isUre "
After swapping the byte ordering around you get:
4D45 4C43 4F20 5341 4E44 4120 4E52 2D32 3631 554D 204E 6176 6920 5573 6572 2020
which in ASCII is: "MELCO SANDA NR-261UM Navi User "
MELCO - Mitsubishi Electronics Company
SANDA - the company's Sanda Works facility
NR-261UM - loader ID
The password used with the 'unlockhd' command was actually byte swapped, so if you try it, use this as your password:
b2bab3bcb0dfacbeb1bbbedfb1add2cdc9ceaab2dfb19e8996 dfaa8c9a8ddfdf
An excel sheet to exemplify the algorithm is available on PM. It requires Analysis ToolPak from Excel Addins.
The disk is locked again when you insert it in MMCS unit.
http://www.mitsubishiforum.com/m_208034/tm.htm
ANY MODIFICATION ON HARD DISK MAY ALTER MMCS CAPABILITY TO LOAD DATA. DO IT ON YOUR OWN RISK.
The tools needed:
I would try to update my navi using a copy from another disk.
The tools needed to unlock the hard disk are below:
1. One screwdriver
2. One torx size 8 (see img)
3. One IDE adapter from small form to regular IDE (see here and here - both sides) if you use a desktop PC. For laptops, it connects directly.
4. The unlockhd program from iso file (the package is available here). You have to write it on CD and boot from it. NO OTHER HDD SHOULD BE ATTACHED EXCEPT THE MMCS' ONE.
5. The unlock key: B2BAB3BCB0DFACBEB1BBBEDFB1ADD2CDC9CEBAB2DFB19E8996 DFAA8C9A8DDFDF - for loader version 261EM (or B2BAB3BCB0DFACBEB1BBBEDFB1ADD2CDC9CEAAB2DFB19E8996 DFAA8C9A8DDFDF for 261UM)
6. One computer with IDE bus.
Procedure
1. To find out what loader version you have:
a) hold SET+NAVI for about 5 seconds to enter "Service Mode" menu
b) press Version Indication
c) note somewhere the Loader version. The key calculation algorithm is presented below. For example, for 261UM version, the key is B2BAB3BCB0DFACBEB1BBBEDFB1ADD2CDC9CEAAB2DFB19E8996 DFAA8C9A8DDFDF (I bolded the difference between 261EM)
2. Flip the screen (push OPEN button in the lower left corner), pull the HDD plastic cover, gently.
3. Unscrew the two screws which holds the hdd. Use the torx. Pull out the hdd.
4. Connect it to IDE bus and power supply.
5. Start the computer, boot from CD, and pick option 3: "Boot linux with locking/unlocking utilities"
6. Wait for root@Xbox-HDM:/1 prompt
7. type unlockhd -p <KEY> (Ex. unlockhd -p B2BAB3BCB0DFACBEB1BBBEDFB1ADD2CDC9CEAAB2DFB19E8996 DFAA8C9A8DDFDF). Double check if necessary
8. The key depends from unit to unit. See below.
9. If the operation is successful, running fdisk -l command will show the partitions (very similar as below). (thanks rcpax )
10. Now you may turn off the computer. The disk is unlocked. You may use it with a Windows computer as a regular disk.
ANY MODIFICATION ON HARD DISK MAY ALTER MMCS CAPABILITY TO LOAD DATA. DO IT ON YOUR OWN RISK.
Key computing algorithm
Thanks to brian360, the string sniffed when MMCS negotiate with the hdd is
BAB2 BCB3 DFB0 BEAC BBB1 DFBE ADB1 CDD2 CEC9 B2AA B1DF 899E DF96 8CAA 8D9A DFDF
The password is 32 bytes long but transferred at 16 -sixteen-bit words, so the MSB of each byte is high. It turns out that if you invert all of the bits of the password you get this:
454D 434C 204F 4153 444E 2041 524E 322D 3136 4D55 4E20 7661 2069 7355 7265 2020
Decoded ASCII is:
"EMCL OASDN ARN2-16MUN va isUre "
After swapping the byte ordering around you get:
4D45 4C43 4F20 5341 4E44 4120 4E52 2D32 3631 554D 204E 6176 6920 5573 6572 2020
which in ASCII is: "MELCO SANDA NR-261UM Navi User "
MELCO - Mitsubishi Electronics Company
SANDA - the company's Sanda Works facility
NR-261UM - loader ID
The password used with the 'unlockhd' command was actually byte swapped, so if you try it, use this as your password:
b2bab3bcb0dfacbeb1bbbedfb1add2cdc9ceaab2dfb19e8996 dfaa8c9a8ddfdf
An excel sheet to exemplify the algorithm is available on PM. It requires Analysis ToolPak from Excel Addins.
The disk is locked again when you insert it in MMCS unit.
Last edited by robbie2883; May 21, 2008 at 06:24 PM.
May 21, 2008, 09:26 PM
#2
Newbie
Join Date: Apr 2008
Location: Australia
Posts: 1
Likes: 0
Received 0 Likes
on
0 Posts
this is courtesy of another forum and the link below leads to the original thread. by doing this process it looks like you should be able to swap out for a larger hard drive and be able to play video while driving. i'm sure there are some other things you can do as well, but none of this is for the technically handicapped. hope this helps.
http://www.mitsubishiforum.com/m_208034/tm.htm
ANY MODIFICATION ON HARD DISK MAY ALTER MMCS CAPABILITY TO LOAD DATA. DO IT ON YOUR OWN RISK.
The tools needed:
I would try to update my navi using a copy from another disk.
The tools needed to unlock the hard disk are below:
1. One screwdriver
2. One torx size 8 (see img)
3. One IDE adapter from small form to regular IDE (see here and here - both sides) if you use a desktop PC. For laptops, it connects directly.
4. The unlockhd program from iso file (the package is available here). You have to write it on CD and boot from it. NO OTHER HDD SHOULD BE ATTACHED EXCEPT THE MMCS' ONE.
5. The unlock key: B2BAB3BCB0DFACBEB1BBBEDFB1ADD2CDC9CEBAB2DFB19E8996 DFAA8C9A8DDFDF - for loader version 261EM (or B2BAB3BCB0DFACBEB1BBBEDFB1ADD2CDC9CEAAB2DFB19E8996 DFAA8C9A8DDFDF for 261UM)
6. One computer with IDE bus.
Procedure
1. To find out what loader version you have:
a) hold SET+NAVI for about 5 seconds to enter "Service Mode" menu
b) press Version Indication
c) note somewhere the Loader version. The key calculation algorithm is presented below. For example, for 261UM version, the key is B2BAB3BCB0DFACBEB1BBBEDFB1ADD2CDC9CEAAB2DFB19E8996 DFAA8C9A8DDFDF (I bolded the difference between 261EM)
2. Flip the screen (push OPEN button in the lower left corner), pull the HDD plastic cover, gently.
3. Unscrew the two screws which holds the hdd. Use the torx. Pull out the hdd.
4. Connect it to IDE bus and power supply.
5. Start the computer, boot from CD, and pick option 3: "Boot linux with locking/unlocking utilities"
6. Wait for root@Xbox-HDM:/1 prompt
7. type unlockhd -p <KEY> (Ex. unlockhd -p B2BAB3BCB0DFACBEB1BBBEDFB1ADD2CDC9CEAAB2DFB19E8996 DFAA8C9A8DDFDF). Double check if necessary
8. The key depends from unit to unit. See below.
9. If the operation is successful, running fdisk -l command will show the partitions (very similar as below). (thanks rcpax )
10. Now you may turn off the computer. The disk is unlocked. You may use it with a Windows computer as a regular disk.
ANY MODIFICATION ON HARD DISK MAY ALTER MMCS CAPABILITY TO LOAD DATA. DO IT ON YOUR OWN RISK.
Key computing algorithm
Thanks to brian360, the string sniffed when MMCS negotiate with the hdd is
BAB2 BCB3 DFB0 BEAC BBB1 DFBE ADB1 CDD2 CEC9 B2AA B1DF 899E DF96 8CAA 8D9A DFDF
The password is 32 bytes long but transferred at 16 -sixteen-bit words, so the MSB of each byte is high. It turns out that if you invert all of the bits of the password you get this:
454D 434C 204F 4153 444E 2041 524E 322D 3136 4D55 4E20 7661 2069 7355 7265 2020
Decoded ASCII is:
"EMCL OASDN ARN2-16MUN va isUre "
After swapping the byte ordering around you get:
4D45 4C43 4F20 5341 4E44 4120 4E52 2D32 3631 554D 204E 6176 6920 5573 6572 2020
which in ASCII is: "MELCO SANDA NR-261UM Navi User "
MELCO - Mitsubishi Electronics Company
SANDA - the company's Sanda Works facility
NR-261UM - loader ID
The password used with the 'unlockhd' command was actually byte swapped, so if you try it, use this as your password:
b2bab3bcb0dfacbeb1bbbedfb1add2cdc9ceaab2dfb19e8996 dfaa8c9a8ddfdf
An excel sheet to exemplify the algorithm is available on PM. It requires Analysis ToolPak from Excel Addins.
The disk is locked again when you insert it in MMCS unit.
http://www.mitsubishiforum.com/m_208034/tm.htm
ANY MODIFICATION ON HARD DISK MAY ALTER MMCS CAPABILITY TO LOAD DATA. DO IT ON YOUR OWN RISK.
The tools needed:
I would try to update my navi using a copy from another disk.
The tools needed to unlock the hard disk are below:
1. One screwdriver
2. One torx size 8 (see img)
3. One IDE adapter from small form to regular IDE (see here and here - both sides) if you use a desktop PC. For laptops, it connects directly.
4. The unlockhd program from iso file (the package is available here). You have to write it on CD and boot from it. NO OTHER HDD SHOULD BE ATTACHED EXCEPT THE MMCS' ONE.
5. The unlock key: B2BAB3BCB0DFACBEB1BBBEDFB1ADD2CDC9CEBAB2DFB19E8996 DFAA8C9A8DDFDF - for loader version 261EM (or B2BAB3BCB0DFACBEB1BBBEDFB1ADD2CDC9CEAAB2DFB19E8996 DFAA8C9A8DDFDF for 261UM)
6. One computer with IDE bus.
Procedure
1. To find out what loader version you have:
a) hold SET+NAVI for about 5 seconds to enter "Service Mode" menu
b) press Version Indication
c) note somewhere the Loader version. The key calculation algorithm is presented below. For example, for 261UM version, the key is B2BAB3BCB0DFACBEB1BBBEDFB1ADD2CDC9CEAAB2DFB19E8996 DFAA8C9A8DDFDF (I bolded the difference between 261EM)
2. Flip the screen (push OPEN button in the lower left corner), pull the HDD plastic cover, gently.
3. Unscrew the two screws which holds the hdd. Use the torx. Pull out the hdd.
4. Connect it to IDE bus and power supply.
5. Start the computer, boot from CD, and pick option 3: "Boot linux with locking/unlocking utilities"
6. Wait for root@Xbox-HDM:/1 prompt
7. type unlockhd -p <KEY> (Ex. unlockhd -p B2BAB3BCB0DFACBEB1BBBEDFB1ADD2CDC9CEAAB2DFB19E8996 DFAA8C9A8DDFDF). Double check if necessary
8. The key depends from unit to unit. See below.
9. If the operation is successful, running fdisk -l command will show the partitions (very similar as below). (thanks rcpax )
10. Now you may turn off the computer. The disk is unlocked. You may use it with a Windows computer as a regular disk.
ANY MODIFICATION ON HARD DISK MAY ALTER MMCS CAPABILITY TO LOAD DATA. DO IT ON YOUR OWN RISK.
Key computing algorithm
Thanks to brian360, the string sniffed when MMCS negotiate with the hdd is
BAB2 BCB3 DFB0 BEAC BBB1 DFBE ADB1 CDD2 CEC9 B2AA B1DF 899E DF96 8CAA 8D9A DFDF
The password is 32 bytes long but transferred at 16 -sixteen-bit words, so the MSB of each byte is high. It turns out that if you invert all of the bits of the password you get this:
454D 434C 204F 4153 444E 2041 524E 322D 3136 4D55 4E20 7661 2069 7355 7265 2020
Decoded ASCII is:
"EMCL OASDN ARN2-16MUN va isUre "
After swapping the byte ordering around you get:
4D45 4C43 4F20 5341 4E44 4120 4E52 2D32 3631 554D 204E 6176 6920 5573 6572 2020
which in ASCII is: "MELCO SANDA NR-261UM Navi User "
MELCO - Mitsubishi Electronics Company
SANDA - the company's Sanda Works facility
NR-261UM - loader ID
The password used with the 'unlockhd' command was actually byte swapped, so if you try it, use this as your password:
b2bab3bcb0dfacbeb1bbbedfb1add2cdc9ceaab2dfb19e8996 dfaa8c9a8ddfdf
An excel sheet to exemplify the algorithm is available on PM. It requires Analysis ToolPak from Excel Addins.
The disk is locked again when you insert it in MMCS unit.
Two things......
Firstly: WTF?!
Secondly: WOW! how the hell do you figure that stuff out?!!!!
May 22, 2008, 06:04 AM
#3
Newbie
Thread Starter
Join Date: Oct 2005
Location: Ft. Walton Beach, FL
Posts: 59
Likes: 0
Received 0 Likes
on
0 Posts
LOL i can't take credit for that. i can build anything all day long but i'm no programmer. this came from some of the guys on another forum messing with their outlanders which uses the same nav/hard drive system as the evo.
Trending Topics
May 28, 2008, 09:18 AM
#12
Evolved Member
iTrader: (4)
Join Date: Feb 2008
Location: Edmonton, Alberta
Posts: 610
Likes: 0
Received 0 Likes
on
0 Posts
Not at this time. This allows you to swap out your hard drive for something that will your "Music Server" partition to be a LOT bigger. It does open the doors for understanding and modification of the MMCS OS itself, which may eventually lead to some hacks that can be applied.
Rolling video (I think) could be solved by having a DPST switch spliced into the green wire and the GPS antennae. Typoist might be able to give some direction here, as I don't actually have Nav. I know that only having a switch for the green doesn't work, as it failsafes to the GPS.
Rolling video (I think) could be solved by having a DPST switch spliced into the green wire and the GPS antennae. Typoist might be able to give some direction here, as I don't actually have Nav. I know that only having a switch for the green doesn't work, as it failsafes to the GPS.
May 28, 2008, 01:55 PM
#13
Evolving Member
iTrader: (9)
Join Date: Apr 2007
Location: In the Middle of Everywhere
Posts: 434
Likes: 0
Received 1 Like
on
1 Post
So technically someone could buy this Automotive Grade Seagate 80gb drive for $199 and clone our existing drive to this and have approximately 56gb of music, give or take.
http://www.buy.com/retail/product.as...mp&dcaid=15890
Hmm...
http://www.buy.com/retail/product.as...mp&dcaid=15890
Hmm...
May 29, 2008, 08:42 PM
#15
Newbie
Thread Starter
Join Date: Oct 2005
Location: Ft. Walton Beach, FL
Posts: 59
Likes: 0
Received 0 Likes
on
0 Posts