Repository navigation
Western Digital Marvell
Western Digital Marvell is a drive architecture family introduced in 2003 with the Mammoth family when WD began using controllers manufactured by Marvell for their drives, in contrast to drives using their own in-house controllers (WDC MCU WD70Cxx series). This architecture continues to be used up to their latest hard drives being produced today.
Early Marvell drives used a firmware architecture similar to the WDC MCU drives, with the same System Area (SA) structure and module format. However by 2006 the new ROYL architecture was introduced, a new SA design specific to the Marvell architecture. As such Marvell and ROYL are often used as synonyms for the same drive architecture, though technically pre-ROYL drives with Marvell controllers exist. All Marvell architecture drives, regardless of being ROYL or pre-ROYL, use the same Vendor Unique Command (VUC) system with the same functionality.
Standard consumer WD Marvell drives allow unsecured VUC access, up to and including current production models being sold today. However, Self-Encrypting Drive (SED) models such as the Spyglass (My Passport) family have security features requiring an unlock handshake before most VUCs can be used.
DiskSec performs the following checks for WD Marvell drives:
Physical Parameters is a table accessed through a VUC operation containing general information about the drive, such as the firmware version and manufacture date. This VUC should always succeed even for SED models with restricted VUC access.
The WD Marvell architecture System Area (SA) is structured like a file system, with SA modules referred to as files in WD's internal terminology, each identified by an integer ID. This check reads and parses file ID 1, the directory of all files in the SA. If successful, it outputs the total number of files and their total size.
Similar to the above Read System Area check, but for modules (files) in the drive's flash ROM instead of the SA. If successful, it outputs the total number of files and their total size.
This check attempts to read memory directly from controller RAM. It does this by reading from memory address 0, a fixed address where an ARM exception vector should always be located. It then parses the returned data, validates that it is a valid ARM exception vector, and outputs success if so.
This check scans the drive for Indicators of Compromise (IOCs) of the firmware implant with official cover name IRATEMONK. It emulates the logic of the implant's installation and management tool, performing the same checks that tool uses to locate the implant's data-storage location within an infected drive. If successful, it outputs the Cylinder-Head-Sector (CHS) location where the implant's data is stored in the drive's System Area.