How to unlock MMCS

ANY MODIFICATION ON HARD DISK MAY ALTER MMCS CAPABILITY TO LOAD  DATA. DO IT ON YOUR OWN RISK.

The tools needed:
I would try to update my navi using a copy from another disk.
The tools needed to unlock the hard disk are below:
1. One screwdriver
2. One torx size 8 (see img)
3. One IDE adapter from small form to regular IDE (see here and here - both sides) if you use a desktop PC. For laptops, it connects directly.
4. The unlockhd program from iso file (the package is available here or here). You have to write it on CD and boot from it. NO OTHER HDD SHOULD BE ATTACHED EXCEPT THE MMCS' ONE.
5. The unlock key: B2BAB3BCB0DFACBEB1BBBEDFB1ADD2CDC9CEBAB2DFB19E8996DFAA8C9A8DDFDF - for loader version 261EM (or B2BAB3BCB0DFACBEB1BBBEDFB1ADD2CDC9CEAAB2DFB19E8996DFAA8C9A8DDFDF for 261UM)
6. One computer with IDE bus.

Procedure
1. To find out what loader version you have:
    a) hold SET+NAVI for about 5 seconds to enter "Service Mode" menu
    b) press Version Indication
    c) note somewhere the Loader version. The key calculation algorithm is presented below. For example, for 261UM version, the key is B2BAB3BCB0DFACBEB1BBBEDFB1ADD2CDC9CEAAB2DFB19E8996DFAA8C9A8DDFDF (I bolded the difference between 261EM)
2. Flip the screen (push OPEN button in the lower left corner), pull the HDD plastic cover, gently.
3. Unscrew the two screws which holds the hdd. Use the torx. Pull out the hdd.
4. Connect it to IDE bus and power supply.
5. Start the computer, boot from CD, and pick option 3: "Boot linux with locking/unlocking utilities"
6. Wait for root@Xbox-HDM:/1 prompt
7. type unlockhd -p <KEY> (Ex. unlockhd -p B2BAB3BCB0DFACBEB1BBBEDFB1ADD2CDC9CEAAB2DFB19E8996DFAA8C9A8DDFDF). Double check if necessary
8. The key depends from unit to unit. See below.
9. If the operation is successful, running fdisk -l command will show the partitions (very similar as below). (thanks rcpax )
10. Now you may turn off the computer. The disk is unlocked. You may use it with a Windows computer as a regular disk.

ANY MODIFICATION ON HARD DISK MAY ALTER MMCS CAPABILITY TO LOAD  DATA. DO IT ON YOUR OWN RISK.

Key computing algorithm
Thanks to brian360, the string sniffed when MMCS negotiate with the hdd is
    BAB2 BCB3 DFB0 BEAC BBB1 DFBE ADB1 CDD2 CEC9 B2AA B1DF 899E DF96 8CAA 8D9A DFDF

The password is 32 bytes long but transferred at 16 -sixteen-bit words, so the MSB of each byte is high.  It turns out that if you invert all of the bits of the password you get this:
    454D 434C 204F 4153 444E 2041 524E 322D 3136 4D55 4E20 7661 2069 7355 7265 2020
Decoded ASCII is:
    "EMCL OASDN ARN2-16MUN va isUre  "
After swapping the byte ordering around you get:
    4D45 4C43 4F20 5341 4E44 4120 4E52 2D32 3631 554D 204E 6176 6920 5573 6572 2020
which in ASCII is: "MELCO SANDA NR-261UM Navi User  "

MELCO - Mitsubishi Electronics Company
SANDA - the company's Sanda Works facility
NR-261UM - loader ID

The password used with the 'unlockhd' command was actually byte swapped, so if you try it, use this as your password:

b2bab3bcb0dfacbeb1bbbedfb1add2cdc9ceaab2dfb19e8996dfaa8c9a8ddfdf

An excel sheet to exemplify the algorithm is available on PM. It requires Analysis ToolPak from Excel Addins.
The disk is locked again when you insert it in MMCS unit.

I just put all this stuff together to be easier to understand. Thanks brian360, otaku, GPSeek, oly_57mpg and all the others I could omit.


Thumbnail Image

Respects dude.... thanks for the share.

-edit-: Just saw this:

quote:

9. If the operation is successful, running fdisk -l command will (??) the partitions (very similar as below).

I think a word is missing.

Good luck and keep us updated. Hope get my hands on the updated files too.

You are right, I corrected. The missing word was "show" 
Thanks

Ah, I somehow missed this thread and several other replies in other threads (didn't get e-mail notifications).  Thanks for posting this tutorial!

So what cool stuff can we do with the hdd unlocked?
 
Ghost it to, and use a bigger hdd?
 
Add start up images and mabe background images?
 
Make music transfers more convenient?
 
Great work guys, all respect too u :)

Greetings! My name is Igor, and I live in Germany. I have brought Outlander II of USA. Now I have some problems in which I hope, that you can help me... Whether Probably on MMCS to remember European maps? Whether probably to change Fahrenheits, miles and gallons to kilometers, litres and Celsius? Whether to remove protection of zone DVD? You do not know, who could make it to me for money?
If it is possible, I know some potential clients!
Thanks!!!!!

Hello Igor! I'm Lukasz from Poland. I've also imported 07 XLS Outlander from USA :) I think we have the same problem!!!
 
Navigation is to USA Only, i've found MMSC from EU Outlander and now i'm waiting for delivery. I've spended hours on finding how to upgrade MAPS to Europe...even Mitsubishi Service in Poland doesn't know how to do it. You can order an upgrade DVD, but it costs about 600 EURO, and you dont have warranty that Your maps will be upgraded to EU!!! :(
 
You can change Miles to KM and FH to Celcius in MMSC Options, this is not a problem. Just Press SET - SYSTEM - UNITS :)
 
I have problem how to change Clock Time!!!! This is terrible, there's no such thing like "adjust time/clock" !!!!! Only i can change Time Zone, and DayTime.
 
Maybe rdenis can help us!!!!!!
 
 

I can send you a clone image from my disk (Outlander '07 Europe). The operation needs an extra ATA notebook disk, not SATA (just to be sure you don't screw yours with incompatible data).
Disconnect the battery for about 30 minutes, restore that new disk from clone, put it inside MMCS, reconnect battery, restart the unit and see if everything is ok. If you are satisfied, overwrite the original disk (is a little bit more special that an ordinary notebook disk - automotive grade - so in real life you should use that one) and use it. If don't, put the original hard drive back as it was before.

ATTENTION
After placing a disk inside MMCS, it will be locked with the same pass. To use it further, you need to unlock it.

PS
To unlock the DVD there are 2 ways:
1. Rewrite firmware in DVD player itself (not MMCS but the DVD)
2. Trick the MMCS' operating system to fool the player that the disk is the correct region (kind of AnyDVD for PC)

Both are a little (more) difficult to implement

Regards,
Costin

Clone of disk would be helpfull. I have another ATA 2,5" Disk, and also i have external USB (ATA) adapter. But tell me does Norton Ghost or any other clone program will read that disc? When i'm plugging in my 30GB Toshiba Disk - Windows does not recognize partitions (disk is locked, i've read about it).
 
Please write more about Unlocking DVD, or upgrading firmware! Also do you have any Idea how to change Time?
 
Thank You for any help!!!
 

Just put in my 2 cents worth, I belive rcostin use Linux to unlock the MMCS drive first before cloning.

quote:

ORIGINAL: Outie08

Just put in my 2 cents worth, I belive rcostin use Linux to unlock the MMCS drive first before cloning.

Is it a sin? Then I'm proud
Indeed, the host operating system is Linux, but it runs from a bootable CD, the ISO being no larger than few megs. And once you start the program, running Linux or Windows is no difference.
BUT after you unlock the disk, you may use any operating system you wish and ANY cloning tool you like.

To unlock the disk, you need a direct connection between disk and PC. No usb adapters, but directly ATA cable. And better that disk be the only disk attached.

Time zone is set up in so called "time zone file". The zone file will be changed if you rewrite the disk. Unfortunately, unocking the DVD, I have no clue where you can find a RPC1 firmware...

Not at all, you should be pround.
Respects from the Great White North. Now, what is your next project, maybe cracking the code to update the Navi map ??

Honestly, I was thinking about this. But I am stuck with an extractor from the kwi files.

Good News, at least you're thinking about it, If you can unlock the MMCS Hdd, its just a matter of time that we can download a iso file from you to update our navi.
 
I look forward and will keep watching posts by you.

If anybody wants to sponsor some updated map info (i.e. the upgrade kit), I'd be willing to look into it.

Many thanks for clarifications! Unfortunately in this question I Looser; (.... Mitsubishi sells in Europe Ubdate for MMCS (Maps). How you think, if I such shall buy, whether it will be possible to put it on American MMSC? Thanks

quote:

ORIGINAL: rcostin

Honestly, I was thinking about this. But I am stuck with an extractor from the kwi files.

Really ?
I thought I'd fixed it .. :(
Whats it doing/not doing now ?
O.

Problem solved. I had the old version from the web page but brian sent me an updated version. It's working like a charm :))
Already extracted NR261EM.MLD, NR261EM.SCN and NR261EM.SHx
Thank you very much for the program :))

Costin

quote:

ORIGINAL: Igor

Many thanks for clarifications! Unfortunately in this question I Looser; (.... Mitsubishi sells in Europe Ubdate for MMCS (Maps). How you think, if I such shall buy, whether it will be possible to put it on American MMSC? Thanks

That is why you should test with a spare disk. If it boots, is ok. The equipment is the same, the MMCS unit is same.

quote:

ORIGINAL: rcostin

Problem solved. I had the old version from the web page but brian sent me an updated version. It's working like a charm :))
Already extracted NR261EM.MLD, NR261EM.SCN and NR261EM.SHx
Thank you very much for the program :))

Costin

:)
No worries.
I've updated the site a couple of days ago.
Got bored and wrote an extractor for the filesystem image.
The NR261UM has its own section now.
atb.
O.

Thanks Otaku!  Your efforts are _greatly_ appreciated.

Regarding from your website:

quote:

I have had a preliminary shuftie : I might try knocking together a new firmware image if I can find someone (brave|stupid|willing) enough to install it .. :)

Count me in as (brave && stupid && willing) :)

quote:

ORIGINAL: brian360

Thanks Otaku!  Your efforts are _greatly_ appreciated.

Regarding from your website:

quote:

I have had a preliminary shuftie : I might try knocking together a new firmware image if I can find someone (brave|stupid|willing) enough to install it .. :)

Count me in as (brave && stupid && willing) :)

Heh.. :)
Will do..
If I can knock together a Platform Builder BSP, I'll shove it up on the site as a starting point..

Oh, also, FYI..
The unlock keys are stored in ata_hdd.dll
The one from the firmware image I unpacked appears to have 2

B2 BA B3 BC B0 DF AC BE B1 BB BE DF B1 AD D2 CD C9 CE AA B2 DF B1 9E 89 96 DF AA 8C 9A 8D DF DF
B2 BA B3 BC B0 DF AC BE B1 BB BE DF B1 AD D2 CD C9 CE AA B2 DF B1 9E 89 96 DF B2 9E 8C 8B 9A 8D

One is a User key, the other is a Master key.

atb
O.

quote:


I have had a preliminary shuftie : I might try knocking together a new firmware image if I can find someone (brave|stupid|willing) enough to install it .. :)

For the 261EM version (Outlander 07) I can also test an image. I don't think there is something to screw as long as I use another disk. So, count on me :)

quote:


I have had a preliminary shuftie : I might try knocking together a new firmware image if I can find someone (brave|stupid|willing) enough to install it .. :)

For the 261EM version (Outlander 07) I can also test an image. I don't think there is something to screw as long as I use another disk. So, count on me :)