Yet another Hyperdrive 512k Mac with a twist

[snuci]

Well,  this one came from eBay with no indication it was a HyperDrive Mac 512k other than the metal plate on the front and the sticker on the back that said "HyperDrive"  It doesn't say HyperDrive 20 because it's the original 10MB version.

Funny thing is that the ad said it boots to a Sad Mac without a floppy in it.  Well, it does.  Reason being is that the hard disk is password protected!  You can boot from floppy but the hard drive does not show up.  The HyperDrive utilities sees it and even allows you to test the hard drive but I can't mount it or format it because it asks for the password.  Password protected HyperDrives can't boot (there's no where to ask for a password) so it Sad Macs instead.

Unless someone knows how to bypass the HyperDrive password, I'll have to figure out a way to hack into the hard drive.  I'll try a later version of the driver disk but it's too big for a bootable 400k floppy.

Interesting problem.  Too bad they didn't build in a bypass to be able to format it, at least, so the contents would remain a secret.  That's pretty cool for 1984.

 

[unity]

I remember zip disks having this issue. Without the drive or something inserting one would crash the Mac. Of course not bootable either.

 

[bigmessowires]

Install MacsBug. When the "wrong password" dialog box comes up, hit the interrupt switch. Search RAM for the password you just entered. Chances are, the actual password will be located somewhere in nearby RAM. Failing that - look at the stack trace that got you to the "wrong password" dialog. Dig back through the code of the Hyperdrive utility software until you find where it does the password check. Patch it up with some NOPs. It's like the old days of Apple II cracking!

 

[olePigeon]

Is that what 4E71 was in ResEdit?  I noticed that a lot of game cracks required using ResEdit and changing an offset to 4E71.

 

[onlyonemac]

Is that what 4E71 was in ResEdit?  I noticed that a lot of game cracks required using ResEdit and changing an offset to 4E71.

Yes I do believe that 4E71 is a NOP.

 

[snuci]

Alright!  I haven't done any "hacking" in a while.  I'll try to look through memory first and see if that works.  I have never done this on a Mac before but I have been known to snoop around on a PC.  A strategically placed NOP would be next but is there any utilities that fit on a 400k disk that could edit the hard disk?  I could change the Hyperdrive "drawers" and mark them as not password protected too.   
 

 

[bigmessowires]

FEdit is a good sector/hex editor, and it's less than 100K if I recall. But if you're talking about examining/editing the Hyperdrive utility program, you could always do that on another Mac, then copy the modified program to your Mac 512K. 

 

[snuci]

I can't seem to find a working version of Macsbug that works in Finder 4.1.  Would anyone have any pointers?  I tried one that was supposed to be for 68k machines (MacsBug 6.2.2) but that didn't work.  I think I need a really old version.

Thanks in advance.

 

[snuci]

So after much screwing around, I was able to delete the password protected "Startup" drawer.  Removing this stopped the Mac from booting to a "sad mac".  

I tried everything to get Macsbug to work and I did find a version that seemed to work but would go directly to the Macsbug prompt and freeze everything else.  It was very strange but if I copied FEdit to a floppy and boot with the floppy, I could not open the disk to see the apps on the floppy without it "bombing" and being forced to restart.

Anyway, after somehow removing the "Startup" drawer, I recreated it and put the system files in it and it boots.  "Drawers" are like folders so even though I have a password protected "SYSTEM" drawer that will not mount because it's password protected, it's not really taking up any space because there appears to be nothing in the "SYSTEM" drawer because I still have 9+ MB free (it's a 10MB drive).

I can't format the drive because it asks for the password but that's okay because the drive is working fine.  After copying FEdit to the drive, I can see the folders in it but can't do much. The "SYSTEM" drawer doesn't show up so I can't edit it.  Anyway, I will go at this sometime in the future but for now, it's completely operational.

Thanks for the advice. 

 

[olePigeon]

Anyone know if the password is software or firmware based?  You might be able to just pull the HDD out and format it on another computer.

 

[snuci]

I was thinking about doing that because the disk is MFM but it is a bit of a pain to have to set up to do that so I will wait before tying something else.  For now the drive works completely fine as long a I don't need to format it.  If it should become unreadable, it will probably corrupt where the password is stored so I could format it anyway  

I believe the password is stored on the drive itself because various "drawers" can be password protected and there is an overall system password to recover lost drawer passwords and to back up the whole drive.  There is a default password in the documentation that I don't have at the moment.  I did buy this recently so I'll see if it's listed in the manual when it arrives:  http://www.ebay.ca/itm/161114811958

This manual is for my original 10MB HyperDrive with the same original logos on the front and back of the Mac 512k. This latest example has the new "HyperDrive" logo on the front and back but doesn't say "HyperDrive 20" because it's only 10mb.  The 10mb mechanisms are almost the same between the two examples so this manual should be relevant to to this newer model too.  I'm crossing my fingers that a default system password is listed.

I already tried to snoop around the software in a hex editor to see if one was there but there didn't seem to be.  I did find a chilling message while snooping.  It said within the code, "Remember, you are a guest in someone elses house"   I guess the developers don't want you to mess around while loking

 

[snuci]

The HyperDrive manual came today.  What a great manual!  It was printed in 1984 and also came with an inserted addendum.  Included in the manual was the default system password.  To give some background, I was asked for the system password to format the entire disk.  I tried "SYSTEM" and "PASSWORD" but neither worked.  Oddly enough, the default system password is "SYSTEM PASSWORD"  Luckily the original owner didn't change that password!  I'm glad I bought the manual anyway and my hard disk is merrily being formatted as I type.

Here's another little nugget that someone looking may want to know (or me in the future).

How to Bypass the System Password on a HyperDrive disk:

If the disk becomes corrupt and no longer accepts the "system password", there's a way around this.  olePigeon, this indicates that the system password is stored on the hard drive.  Anyway, the manual tells you to do the following:

It is possible for the HyperDrive to lose all of its data so that you cannot open or create any Drawers.  When you try to choose Initialize Disk in the Manager the HyperDrive asks for s System Password, but won't accept whatever you type in. (Remember, it's lost it's data, including the passwords). How can you make the Manager let you initialize the disk without using passwords?

Boot the HyperDrive from floppy disk.  As you start the Manager application from the desktop, it's name "Manager" will appear in the middle of the menu bar.  As soon as this appears, hold down the Command and period (.) together.  Keep holding them down.  Once the program comes up, a new dialog box will appear telling you the HyperDrive has not been initialized properly.  You may only Format or Initialize.

The manual goes on to tell you that Initialize is a quick format but Format "re-writes the lowest level information (track and sector headers)".  So now we know that Format does a low level format.

Case closed  That manual is a wealth of information!

 

[Paralel]

Thanks for providing the information. You never know when someone will pop up looking for that info.

 

[ScutBoy]

Yup - that's the kind of post that will save someone's bacon some day

 

[olePigeon]

Good to know.  I figured it was software based, but with an actual hardware upgrade, I didn't know if maybe they stored it on a ROM someplace on the Hyperdrive card itself.

 

[museum_services]

"'that's the kind of post that will save someone's bacon some day"

bacon officially saved.

I could not remember that for the life of me but I knew this machine likely had no customization.  A very nice undocumented HYPER20 just walked in and I was able to confirm both the default system password and "Command-." trick during Manager load on this machine.  

I needed to reformat it and get past some faded system software that would not completely boot.  After format, initialization errors went to zero.

So I joined just to say thanks.  

And I'll pay it forward with another trick from working on many many of these a few years ago when I collected them.  If you have an MFM drive that can't seem to successfully format and hold your software image, I have found that if I put in in a PC and have spinrite or similar LLF tool pound on it for a day or so that the targeted machine's LLF and follow-on drive organization requests will then write without problems.  The only exceptions in my history are drives that can't survive the physical rigors of this.  It has killed marginal drives.  So it's not advised for anything irreplaceable, but perfect for common drives that are at the resurrect-or-replace threshold.  It works so well that I started doing this on machines before putting them back in deep storage with a restored HD image on them.  Take care.