1

I have a Verbatim flash drive that I do not know my password for. Most of my searching for a solution has led to me to answers like "take the loss and reformat the drive" (losing all encrypted data). The V-SAFE100.exe on the drive allows you to access your hidden-encrypted partition.

However, I thought someone here might find it to be an interesting experiment to try and bypass the V-SAFE100 encryption program (direct link http://www.verbatim.com/includes/binary_details.php3?show=1&id=2960 ), and at the same time, give me a solution that doesn't forfeit my data. The idea would be to NOP the password comparison. According to this article on pg. 62, (http://content.yudu.com/Library/A1rc91/Hakin9201001/resources/62.htm ) it should be possible. I'm just too new to IDA and OllyDBG to do it myself. Any takers?

Also, I realize that I might not be able to copy and paste a fixed version of the program, but I should be able to replicate the process for my drive's program.
THANKS!

Improve this question
5
  • Have you tried the PoC password extractor linked from the Hakin9 article?
    – Mike Haboustak
    Commented Feb 10, 2016 at 20:18
  • I did not, where exactly?
    – JCeos
    Commented Feb 10, 2016 at 20:28
  • Page 64, "On the 'Net" box, reference [6]. It's cited within the text of the article in the middle column of page 64.
    – Mike Haboustak
    Commented Feb 10, 2016 at 20:33
  • So I just tried it out. No luck, but something interesting. According to the article, they were bypassing the VSafeVista.exe, mine is VSafe100.exe. After running the password extractor on my Vsafe100 it found what it believed to be the password, and no hint. Now although the password is incorrect, I did find that string in my program while attempting to disassemble it. Maybe there is an updated extractor out there for my updated program version.
    – JCeos
    Commented Feb 10, 2016 at 20:36
  • I just wanted to thank you so much for including a link to the old V-SAFE100 program. I deleted it from an old drive, and I was finally able to get it from the link in your post and access the rest of the space in my drive. Verbatim doesn't list it anywhere.
    – Alexander
    Commented Aug 12 at 13:19

1 Answer 1

Reset to default
1

It's not possible to bypass the password protection of V-Safe 100 by patching VSafe100.exe or reversing it's proprietary API.

The linked article about VSafeVista mentions Verbatim drives using a USBest usb flash controller. The UT163 flash controller does not have any integrated encryption or privacy volume support. VSafeVista emulates it in software.

VSafe100.exe works with Phison controllers like the PS2231. These controllers have integrated encryption and support for this concept of a privacy volume.

VSafe100.exe never handles the password that was used to lock the privacy volume. It sends a "switch volume" command with the user supplied password, and the response from the controller is some kind of volume state indicator (0xA0, 0xA1, 0xA2) that tells VSafe100 which volume the controller is currently presenting. Based on the volume state response, VSafe100 knows whether the unlock was successful or not, and it knows which volume is currently mounted.

It may be possible to attack or patch the controller's firmware to bypass or extract the stored password, or to extract the privacy volume encryption keys and read directly from the flash chip. Reversing the firmware would be dependent on the usb flash controller used by your particular flash drive.

There's a tool called GetInfo on the internet for Phison devices that will report the controller model and firmware version.

There's also a project on github with some references to the Phison 2251-03 controller. This is a modern USB3 controller from Phison. So it's not completely unreasonable that the firmware could be deciphered enough to recover the privacy volume.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.