0

I have a Verbatim flash drive that I do not know my password for. Most of my searching for a solution has led to me to answers like "take the loss and reformat the drive" (losing all encrypted data). The V-SAFE100.exe on the drive allows you to access your hidden-encrypted partition.

However, I thought someone here might find it to be an interesting experiment to try and bypass the V-SAFE100 encryption program (direct link http://www.verbatim.com/includes/binary_details.php3?show=1&id=2960 ), and at the same time, give me a solution that doesn't forfeit my data. The idea would be to NOP the password comparison. According to this article on pg. 62, (http://content.yudu.com/Library/A1rc91/Hakin9201001/resources/62.htm ) it should be possible. I'm just too new to IDA and OllyDBG to do it myself. Any takers?

Also, I realize that I might not be able to copy and paste a fixed version of the program, but I should be able to replicate the process for my drive's program.
THANKS!

  • Have you tried the PoC password extractor linked from the Hakin9 article? – Mike Haboustak Feb 10 '16 at 20:18
  • I did not, where exactly? – JCeos Feb 10 '16 at 20:28
  • Page 64, "On the 'Net" box, reference [6]. It's cited within the text of the article in the middle column of page 64. – Mike Haboustak Feb 10 '16 at 20:33
  • So I just tried it out. No luck, but something interesting. According to the article, they were bypassing the VSafeVista.exe, mine is VSafe100.exe. After running the password extractor on my Vsafe100 it found what it believed to be the password, and no hint. Now although the password is incorrect, I did find that string in my program while attempting to disassemble it. Maybe there is an updated extractor out there for my updated program version. – JCeos Feb 10 '16 at 20:36
1

It's not possible to bypass the password protection of V-Safe 100 by patching VSafe100.exe or reversing it's proprietary API.

The linked article about VSafeVista mentions Verbatim drives using a USBest usb flash controller. The UT163 flash controller does not have any integrated encryption or privacy volume support. VSafeVista emulates it in software.

VSafe100.exe works with Phison controllers like the PS2231. These controllers have integrated encryption and support for this concept of a privacy volume.

VSafe100.exe never handles the password that was used to lock the privacy volume. It sends a "switch volume" command with the user supplied password, and the response from the controller is some kind of volume state indicator (0xA0, 0xA1, 0xA2) that tells VSafe100 which volume the controller is currently presenting. Based on the volume state response, VSafe100 knows whether the unlock was successful or not, and it knows which volume is currently mounted.

It may be possible to attack or patch the controller's firmware to bypass or extract the stored password, or to extract the privacy volume encryption keys and read directly from the flash chip. Reversing the firmware would be dependent on the usb flash controller used by your particular flash drive.

There's a tool called GetInfo on the internet for Phison devices that will report the controller model and firmware version.

There's also a project on github with some references to the Phison 2251-03 controller. This is a modern USB3 controller from Phison. So it's not completely unreasonable that the firmware could be deciphered enough to recover the privacy volume.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.