Hacking the Salora HDD2510

When trying to write a tool to display the directory info, I found something interesting. Apparently, the harddisk (probably it’s an IDE property) doesn’t like to be seeked or read at addresses that are not 512-byte aligned. After adapting for that the tool worked, but showed some directory entries that had a name but no ‘address’, and some had no name but a valid-like address. The empty directory entries were probably caused by the fact that I deleted some movie clips when it was connected in the Salora. However, the mismatch of no-names and no-addresses and the problem with reading not 512-byte aligned made it all clear: my earlier assumption about where the directory entries start is slightly off. What if we assume it starts at 0×10005600 instead of 0x100054f0? Makes much more sense! First of all, each entry is 512-aligned. Also, the entry starts with the name. This makes the dir-entry structure look like:


typedef struct _tfs2_dir_entry
{
uint16 utf16_name[120];
uint32 unknown1[3];
uint32 address;
uint32 unknown2[64];
} TFS2_DIR_ENTRY;


So, here’s the tool with which you can try it yourself:

tfs2dir.c v1

Compile with gcc -o tfs2dir tfs2dir.c and run (as root) with ./tfs2dir /dev/ad3 or whatever your device is.

This is what the output looks like:

Disk /dev/ad3
entry: 0 address: 0x67002a00 name: /VR_MANGR.IFO
entry: 1 address: 0x5b006300 name: /rtav/VOB00001.ttm
entry: 2 address: 0x59006300 name: /rtav/VOB00001.vtm
entry: 3 address: 0x58006300 name: /rtav/VOB00002.ttm
entry: 4 address: 0x5a006300 name: /rtav/VOB00002.vtm
entry: 5 address: 0xffffffff name:
entry: 6 address: 0xffffffff name:
entry: 7 address: 0x5e006300 name: /rtav/VOB00004.ttm
entry: 8 address: 0x5c006300 name: /rtav/VOB00004.vtm
entry: 9 address: 0x5f006300 name: /rtav/VOB00005.ttm
entry: 10 address: 0x5d006300 name: /rtav/VOB00005.vtm
entry: 11 address: 0x5c006300 name: /rtav/VOB00006.ttm
entry: 12 address: 0x5e006300 name: /rtav/VOB00006.vtm
...


So there is kind of a fake directory structure embedded in the file names. Also the names are not very creative: If associated with an existing movie clip, the file /rtav/VOBx.ttm is stored at entry 2x-1, the file /rtav/VOBx.vtm at entry 2x.

This entry was posted on Tuesday, January 29th, 2008 at 11:15 pm and is filed under The file system. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.