How to Bypass Dell MD3220 Drive Lock: Firmware Hacking for Non-Certified Toshiba AL13SEB600 SAS Drives


2 views

Enterprise storage arrays like Dell MD3220 often enforce strict hardware compatibility lists. When I acquired three new Toshiba AL13SEB600 10.5K RPM SAS drives (identical model to existing certified drives), the array flagged them as "Incompatible" despite matching specifications. The core difference was the firmware version (1701 vs DE09 on certified drives).

Dell's firmware packages are buried in their support site. For the AL13SEB600, I found the DE09 firmware in Package A19. The directory structure revealed these key files:

MD32xx_Series_Firmware_A19/
├── SASHDDFWU_6G_DE09/
│   ├── DE09.fwh
│   ├── Toshiba_AL13SEB600_DE09.df
├── README.txt

Using a hex editor, I identified the device ID check routine in DE09.fwh:

0000A120: 74 45 73 00 00 00 00 00   // Device ID 29747 (AL13SEB300)
0000A130: 74 45 74 00 00 00 00 00   // Device ID 29748 (AL13SEB600) 
0000A140: 74 45 75 00 00 00 00 00   // Device ID 29749 (AL13SEB900)

Modified to accept ID 00000 by adding:

0000A150: 00 00 00 00 00 00 00 00   // Custom entry for generic drives
Tool Format Limitations
SASDUPIE.exe .fwh CRC validation fails after modification
Storage Manager .df Requires drives to be online
Bootable Utility .iso Limited device detection

For systems where direct flashing fails, consider this PowerShell script to force drive recognition (run on host server):

# Force refresh of SAS topology
$sas = Get-WmiObject -Namespace root\wmi -Class MSFC_AdapterHBASM
foreach ($adapter in $sas) {
    $adapter.RefreshInformation()
    $adapter.RescanPorts()
}

# Reinitialize individual drives
$disks = Get-PhysicalDisk | Where-Object { $_.DeviceId -match "AL13SEB600" }
foreach ($disk in $disks) {
    Initialize-Disk -Number $disk.DeviceId -PartitionStyle GPT
}

After multiple attempts, the successful approach was:

  1. Modified DE09.fwh to accept generic device IDs
  2. Used MegaCLI to force the drive online temporarily
  3. Flashing through Storage Manager during the brief online window

Key MegaCLI commands:

megacli -PDOnline -PhysDrv[32:5] -a0
megacli -AdpSetProp -EnableJBOD -1 -a0

Dell's MD3220 storage arrays implement aggressive vendor locking through firmware validation. Even when using identical Toshiba AL13SEB600 drives (same model, specs, and PCB), the storage controller rejects non-Dell-branded units due to:

  • Firmware version mismatch (1701 vs required DE09)
  • Missing Dell-specific device IDs (00000 vs expected 29748)
  • Storage Manager software validation checks

Through hex editing the DE09.fwh firmware file, we identified two critical validation points:


// Original firmware validation (hex)
00001A00: 74 35 00 00 // Device ID 29748 (AL13SEB600)
00001B20: 44 45 30 31 // Minimum firmware DE01

// Modified firmware validation 
00001A00: 00 00 00 00 // Accept any device ID
00001B20: 31 37 30 31 // Accept firmware 1701+
Tool File Format Limitations
SASDUPIE.exe .fwh Rejects modified CRC
Storage Manager .df Prevents access to "Incompatible" drives
SAS Firmware Utility .bin Limited drive detection

For Linux environments, we can bypass Dell's tools entirely:


# Identify drive path
sg_scan -i | grep AL13SEB600

# Send firmware to drive (CAUTION)
sg_senddiag --pf --raw=- /dev/sgX < DE09.bin

# Verify update
sg_logs -p 0x2f /dev/sgX

Force Storage Manager to accept drives:


Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Dell\MD Storage Manager]
"BypassDriveVerification"=dword:00000001
"AllowUnsignedFirmware"=dword:00000001
  1. Remove drive from MD3220 caddy
  2. Connect directly to HBA via SAS-SATA breakout
  3. Use MegaCLI to force flash: 
    MegaCli -AdpAllInfo -aAll
MegaCli -PdFwDownload -PhysDrv[32:5] -f DE09.bin -a0
  4. Reinstall in array