How to transform a read-only USB key into a writable one

Why

Once upon a time, we distributed USB keys to our students at back to school time.

The keys were nice and branded with the custom school's logos, metallic body, etc.

The contents, pre-"flashed" by the provider was an installation medium for an old Ubuntu distribution. Thus students would be able to use them during a GNU/Linux "install-party".

We had a bunch of left-over keys, that could be distributed again, instead of rusting in a drawer.

This was all nice, but the contained Ubuntu distribution medium was getting quite old. And the keys appear as read-only keys, much like a CD-ROM, to the computers.

No apparent way to reformat the content with a regular OS.

It appears that it is possible to "reflash" the flash contents so as to make it useable as a regular USB key.

Here's how I managed to do so.

Disclaimer

Don't do this if you understand what you're doing. This may be misleading, illegal in you country and otherwise not something smart to do, security-wise.

Note that I performed this under a VirtualBox Windows system, running so as to access the USB, for greater security (?).

The following procedure may not just work with other models, and there are plenty of forum discussions for various models requiring various tools. But maybe this post gives you useful hints for finding your own needed hacks.

Initial USB key state

When inserted on a GNU/Linux system, a very similar key (bug 8GB) appeared as:

[  105.800488] usb 3-6: new high-speed USB device number 7 using xhci_hcd
[  105.953816] usb 3-6: New USB device found, idVendor=090c, idProduct=1000, bcdDevice=11.00
[  105.953831] usb 3-6: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  105.953836] usb 3-6: Product: Flash Disk
[  105.953840] usb 3-6: Manufacturer: USB
[  105.953844] usb 3-6: SerialNumber: SCY2108281100005
[  105.957533] usb-storage 3-6:1.0: USB Mass Storage device detected
[  105.957832] scsi host6: usb-storage 3-6:1.0
[  107.147916] scsi 6:0:0:0: CD-ROM            USB      Flash Disk       1100 PQ: 0 ANSI: 2
[  107.148865] scsi 6:0:0:1: Direct-Access     USB      Flash Disk       1100 PQ: 0 ANSI: 4
[  107.150769] sr 6:0:0:0: [sr1] scsi3-mmc drive: 0x/0x caddy
[  107.161475] sr 6:0:0:0: Attached scsi CD-ROM sr1
[  107.162511] sr 6:0:0:0: Attached scsi generic sg2 type 5
[  107.162684] sd 6:0:0:1: Attached scsi generic sg3 type 0
[  107.169300] sd 6:0:0:1: [sdb] 10104832 512-byte logical blocks: (5.17 GB/4.82 GiB)
[  107.170562] sd 6:0:0:1: [sdb] Write Protect is off
[  107.170565] sd 6:0:0:1: [sdb] Mode Sense: 43 00 00 00
[  107.171436] sd 6:0:0:1: [sdb] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
[  107.199054]  sdb: sdb1
[  107.199194] sd 6:0:0:1: [sdb] Attached SCSI removable disk

This appears as a multi-disk device containing two drives, the first "sr1" being a CD-ROM, and the second "sdb" a "regular" drive (Write Protect is off).

How

Checking the USB key model

Using the ChipGenius tool, I got this for the first 4GB keys:

Description: [E:]Périphérique de stockage de masse USB(SMI USB DISK)
Device Type:  Mass Storage Device

Protocal Version: USB 2.00
Current Speed: High Speed
Max Current: 300mA

USB Device ID: VID = 090C PID = 2000
Serial Number: AA20072905000076

Device Vendor: SMI Corporation
Device Name: USB DISK
Device Revision: 1100

Manufacturer: SMI
Product Model: USB DISK
Product Revision: 1100

Chip Vendor: SMI
Chip Part-Number: SM3270ABS - ISP 200421-1AC
Flash ID Code: ECD784C3 - Samsung - 1CE/Single Channel [MLC] -> Total Capacity = 4GB

Tools on web:  http://dl.mydigit.net/special/up/smi.html

Which looks like a "SM3270AB" model, in the wider "SMI" branded devices (VID/PID 0x090C:0x2000)

The 8GB key:

Description: [D:][F:]Dispositif de stockage de masse USB(USB/USB Flash Disk/Flash Disk)
Device Type:  Mass Storage Device

Protocal Version: USB 2.00
Current Speed: High Speed
Max Current: 300mA

USB Device ID: VID = 090C PID = 1000
Serial Number: SCY2108281100005

Device Vendor: USB
Device Name: Flash Disk
Device Revision: 1100

Manufacturer: USB/USB
Product Model: Flash Disk/Flash Disk
Product Revision: 1100/1100

Chip Vendor: SMI
Chip Part-Number: SM3270ABS - ISP 180907-0AC
Flash ID Code: 2C64444B - Micron - 1CE/Single Channel [MLC]

Tools on web:  http://dl.mydigit.net/special/up/smi.html

Quite similar indeed.

Choosing the right tool

Alright, this means that one may use the uDiskToolBar tool to modify the USB Flash Drive's behaviour.

I've downloaded uDiskToolBar_v10270.rar, the latest version of uDiskToolBar (v. 1.0.2.70) from https://www.usbdev.ru/files/smi/udisktoolbar/ which is described at https://flashboot.ru/files/file/685/ like this (translated from russian) :

Utility for partitioning, creating CD-ROM partition, creating password-protected flash drive, locking computer for flash drives on SMI controllers. Supported controllers: SMI SM325AC/SM321U, SM3252A, SM3252B, SM3252C, SM321BB, SM3211BC1, SM3211BC, SM334AC, SM3254AC, SM3254AD, SM3254AE, SM3255AA, SM3255AB, SM3255AC, SM3255ENAA, SM3257AA, SM3257ENAA, SM3257ENLT, SM3257ENBA, SM3257ENBB, SM3255ENA1, SM3260AA, SM3260AB, SM3260AD, SM3261AA, SM3261AB, SM3263AA, SM3263AB, SM3267AA, SM3267AB, SM3267AC, SM3267AE, SM3269AA, SM3268AA, SM3268AB, SM3280AA, SM3280AB, SM3280BA, SM3280BB, SM3281AB, SM3281BA, SM3281BB, SM3282BB, SM3270AA, SM3270AB, SM3259AA, SM3259AB, SM3271AA, SM3270AC, SM3271AD and SM3271AB.

Note that "SM3270AB" is present in the list above, so supposedly it works for that key.

Using the tool

The tool's manual "SM32X USB Flash Disk Utility User`s Manual Rev.1.1 EN" (SM32x USB Flash Disk Utility_English.pdf) provides the following instructions:

AutoRun Manager

Check “Single Partition” option, only one partition will be shown in left side.

After re-plug the UFD, only one “Removable Disk” will appear in “My Computer”

Here's the icon of that "AutoRun Manager" feature we'll need, highlighted in the screenshot:

uDiskToolBar-1.png
Figure 1: uDiskToolBar main "popup" window

When first clicked, it displays the current layout of the UFD:

uDiskToolBar-2.png
Figure 2: Partitions layout

As you can see, it means everything will appear as a CD-ROM image (kinda).

It seems there are three physical spaces : "Public" (set to unused (?) at 0 MB), "Security" (also unused at 0 MB), and "CD-ROM", the one using the flash's full size.

Now it's time to change it to "Single Partition", press "Burn", and see what happens:

uDiskToolBar-3.png
Figure 3: Success

Unplug and replug the USB key, and voila:

uDiskToolBar-4.png
Figure 4: Final layout

The "Public" space now uses the entirety of the flash space, and the 2 others are unused.

Results

The 4GB key now appears as:

[  122.556228] usb 1-6: new high-speed USB device number 6 using xhci_hcd
[  122.706459] usb 1-6: New USB device found, idVendor=090c, idProduct=2000, bcdDevice=11.00
[  122.706479] usb 1-6: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  122.706487] usb 1-6: Product: USB DISK
[  122.706492] usb 1-6: Manufacturer: SMI Corporation
[  122.706498] usb 1-6: SerialNumber: AA20072905000076
[  122.708271] usb-storage 1-6:1.0: USB Mass Storage device detected
[  122.708457] usb-storage 1-6:1.0: Quirks match for vid 090c pid 2000: 800000
[  122.708493] scsi host7: usb-storage 1-6:1.0
[  123.767168] scsi 7:0:0:0: Direct-Access     SMI      USB DISK         1100 PQ: 0 ANSI: 4
[  123.768052] sd 7:0:0:0: Attached scsi generic sg6 type 0
[  123.772298] sd 7:0:0:0: [sdf] 7831552 512-byte logical blocks: (4.01 GB/3.73 GiB)
[  123.773051] sd 7:0:0:0: [sdf] Write Protect is off
[  123.773058] sd 7:0:0:0: [sdf] Mode Sense: 43 00 00 00
[  123.773635] sd 7:0:0:0: [sdf] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
[  123.780182]  sdf: sdf1
[  123.780277] sd 7:0:0:0: [sdf] Attached SCSI removable disk

Regular USB drive with "Write Protect is off" :-)

4GB isn't enough for the Ubuntu 24.04 LTS image to be put back on the key (but letting the user reformat, this time), but LUbuntu 24.04 was small enough.

The 8GB key as:

[    3.823816] sd 6:0:0:0: [sdb] 15730688 512-byte logical blocks: (8.05 GB/7.50 GiB)
[    3.825126] sd 6:0:0:0: [sdb] Write Protect is off
[    3.825151] sd 6:0:0:0: [sdb] Mode Sense: 43 00 00 00
[    3.826131] sd 6:0:0:0: [sdb] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
[    3.836852]  sdb: sdb1
[    3.836983] sd 6:0:0:0: [sdb] Attached SCSI removable disk

I used f3 (Fight Flash Fraud) to check the flash, and it appeared in excellent condition.

I even managed to write the Ubuntu Desktop 24.04 image to the key and now I have an updated installation medium that can be distributed again to newer students. And if they prefer using it as a regular USB key, they are free to reformat.

I've not used the keys a lot after that so I can't promise it'll be reliable, but hey, we recycled a bunch of old keys like this.

Author: Olivier Berger

Created: 2024-08-29 jeu. 09:02

Validate