Unauthenticated disk support - #1
Open
Angelpro09xd wants to merge 4 commits into
Open
Conversation
Lets a disk that never passed the security-sector check be used as internal storage on retail 17559. SataDiskInitialize creates all twelve hard disk device objects before the authentication gate, and only fills in their geometry and clears DO_DEVICE_INITIALIZING after it. When authentication fails the gate branches straight to the epilogue, so the devices exist but stay half-initialised -- which is why ObReferenceObjectByName answers STATUS_NO_SUCH_DEVICE for them while PhysicalDisk, completed before the gate, keeps working. Patching SataDiskAuthenticateDevice cannot help: the gate is evaluated once at boot, and XeUnshackle already applies that patch anyway. So instead of fighting authentication, finish the initialisation it skipped -- walk the \Device\Harddisk0 object directory to reach the devices, write each partition's geometry, clear the flag, and announce the disk. The geometry is what SataDiskInitialize's own post-gate block computes, recovered by disassembling it. The resulting layout is contiguous and Partition1 lands on 0x130EB0000, the offset Bad Storage already hardcodes. Tested on real hardware with a Kingston SA400S37 240GB.
When the unauthenticated path fails, the disk is not necessarily formatted wrongly, so telling the user to reflash with FATXplorer was misleading. Say what actually happened instead, and keep that advice only where it still applies. On success, state plainly that the bypass ran and the disk mounted, so it is obvious from the console that the feature is doing something.
Recovers a drive already flashed by SSD Maker without needing its undo.bin. Such a drive authenticates as whatever official model it was flashed as, so the console only ever sees that model's capacity - a 240GB SSD flashed as 120GB yields 107GiB of content partition instead of 218GiB. Writing fresh filesystems alone would not help, because the security sector still declares the flashed model and SataDiskInitialize sizes the partitions from it on every boot. So this invalidates that sector as well, after which the disk stops authenticating and the bypass lays the partitions out across the whole drive. The sector is at byte offset 0x2000 on PhysicalDisk, read straight out of SataDiskAuthenticateDevice. It is not sixteen sectors from the end of the drive - that figure appears in some notes, and wiping there changes nothing. Also reports the wasted space when it detects a flashed drive it is not being asked to reformat, instead of silently skipping it. Confirmed on hardware: 107GiB -> 218GiB on a Kingston SA400S37 240GB.
Testing now covers a 240GB SSD plus older mechanical drives at 300GB, 500GB and several sizes in between, up to 1TB, all mounting at full capacity. That also removes the ~500GB ceiling the notes previously claimed. It never applied here: the partition map is computed from the drive's reported sector count, not from a declared model size, so there is nothing bounding it the way retail is bounded. Also record that a disk set up this way cannot serve an entry point that reads from the internal drive, such as BadAvatarHDD. The requirements are mutually exclusive - the entry point has to be readable in a stock state, and an unauthenticated disk has no published filesystem until the bypass has run, which itself needs an exploit already running. USB-based entry points are unaffected.
Angelpro09xd
force-pushed
the
unauthenticated-disk-support
branch
from
August 8, 2026 13:55
cfd103d to
24719e7
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.