I think ATA password is not correct for my mmcs.

 

No news of God

 

I just noticed few things:
"MELCO SANDA NR-261UM Navi User "
MELCO - Mitsubishi Electric Corp. (MELCO)
SANDA - the company's Sanda Works facility

Does NR-261UM have any connection with something written on the unit itself ?
Could be very interesting to see if the password is not changed from the unit to unit.
Costin

 

Yes, that's the platform it was compiled for. The kwi data on the disk shows that there are many other models that it's been compiled for. Check some older messages from the thread... That's why we're asking folks to give this a try. We have a proven method, but we'd like to know if it is universal. It could be that units produced at different times/locations could have a different password. For anyone that has some time or doesn't have access to 16 bit logic analyzers, here's a 'howto' build your own logic analyzer using your parallel port: http://www.xs4all.nl/~jwasys/old/diy2.html The downside with the DIY analyzer is that you'll have to sniff three or four times since you are hard limited to eight data lines.

 

So, for Outlander/Pajero, where the system is NR-261EM (according the box label) the string should be:

B2BAB3BCB0DFACBEB1BBBEDFB1ADD2CDC9CEBAB2DFB19E8996 DFAA8C9A8DDFDF

Hmmm, anyone trying ?
Costin

 

Good catch. Hopefully someone with the EM model can check this out. One easy way to check is probably this:

[ol][*]Hold SET+NAVI for a few seconds to bring up the service menu[*]Touch "Versions Indication"[*]Note the version string for the "Loader"[/ol]This is what my screen shows:

 

...and as I have that version on my outie (I noticed on the box the mmcs came with) I just tried.
And I can confirm: THAT IS THE ALGORITHM THE PASSWORD IS CREATED !
I unlocked my drive and right now I am making an image from it. News, soon ...

Later Edit
1: The disk drive is locked again when reinserted in MMCS
2: Looks like the bitmaps/GIFs are not loaded directly on runtime. (I changed the logo, but when started, it was the same)
3: The music tracks, stored as .sc files, are RIFF files (wav, stereo, 41khz) encoded with a (yet) unknown codec.
4. Looks like the OS is on flash, not on disk. Good to see what mmcs displays without disk.

For kwi files, please read this: http://www.kiwi-w.org/format_english/format_kihon.html

 

Hi
I unlocked the disk from Outlander 2007 and I would like to dissasemble loading.kwi. Unfortunately, the unpack.kwi keeps crashing. Any help ?

Thank you
Costin

 

Check out Otaku's posts above and his website http://www.takingthingsapart.org/
He updated his tool to unpack the loading.kwi files on the MMCS, but I'm not sure if he posted the updated "unpackkwi" tool to his website yet (the old version there would always crash with the MMCS kwi file).

If my memory serves me correctly, once you extract loading.kwi you then need to extract the resulting .BIN images with a tool called "Bysin" to get the Windows CE firmware filesystem.

I'm curious if the MMCS would load the new images from the hard drive after a cold-boot? Have you tried removing power for a few seconds, then turning it on? It will cause the MMCS to go through some sort of initialization stage.

 

Hola this it is the number of series of my equipment, Spanish model. It she wanted to unblock the HDD but I am not the great understood one with computer science, podeis to say to me like to do it. I have to remove the Hdd and install it in the PC or it is realized of another form. Thank you.




[IMG]local://upfiles/14478/44609B1A622B46309A498C238949E258.jpg[/IMG]