SATA adapters¶

USB sata bridges (small dongles up to small desktop boxes) can be expected to have upgradable firmware in general. By specification they are required to have 1 ctrl + 2 bulk endpoints.

Controllers¶

Notes Legend
img: firmware image available
viaUSB: firmware update via usb bus (according to advertisement)

Company	Models	Notes
JMicron	JMS539,JSM559,JMS567,JMS551,...	img 8051 viaUSB
ASMedia	1153	img 8051 viaUSB
TI	TUSB9 260	cortexM3 viaUSB
Fujitsu	MB86C30A	img ARM7 TDMI-S viaUSB
Prolific	PL2571,PL2771,PL2773,PL2775	img 8051 viaUSB
VIA	VL700,VL701	img 8051 viaUSB
Genesys	GL3310,GL3321G	?
Norelsys	NS1066	img 8051 viaUSB
LucidPort	USB300,USB302	?

Disassembled devices¶

LogiLink AU0028A¶

• ASMedia 1051e
• Windows firmware updater .exe available
• Extracting exe file with binwalk results in firmware binary
• Contains valid 8051 code with interrupt table and USB Descriptors
• => Most likely vulnerable

Buffalo HD-HXU3¶

• Fujitsu MB86C30A USB 3.0 to SATA Storage Controller
• Google images shows SPI flash on PCB
• No leaked tools available but a user manual on Baidu mentions that the chip has a maintenance mode, which can probably be used for upgrading the firmware
• => Most likely vulnerable

Unitek Y-3322¶

• JMicron JMS551 SuperSpeed USB to 2 ports SATA II 3.0G Bridge
• Leaked tools for JMS551 chip are available
• No PCB Photo found, it is unclear whether the device has an SPI Flash or not
• * => Probably vulnerable

Unknown USB 2.0 to SATA Adapter [from lab, case already missing]¶

• JMicron JM20329 chip with ATML H820\n46d
• Support external NVRAM for vendor specific VID/PID of USB Device Controller
  => Most likely not vulnerable

LogiLink AU0006D USB IDE & SATA Adapter wit OTB function¶

• JM20337, no external flash/eeprom
• Chip supports external EEPROM for configuration only
  => Most likely not vulnerable

External 2.5 case USB + ESATA:¶

• Sunplus SPIF225A-HL239, second chip is just a voltage regulator for SATA 3.3V
• 8051 Controller with 32K ROM and 768B RAM
  => Most likely not vulnerable

ORICO 3 SATA HDD USB2.0 Adapter¶

• APM4435 (MOSFET)
• AX3121 (Step-Down Convertor)
• Pm25LD512 (64 KiB SPI Flash)
• JMB352U (USB Sata Bridge)
• 60MIPS 8051 with 64k-byte mask ROM
• Official datasheet says that external storage is used for configuration data
• But: http://www.jmicron.com/solution06.html
  The first application of the JMB352U: a 1:1 HDD duplicator. The USB 2.0 port is utilized to update the JMB352U firmware only, while the eSATA port can be used to access the data in the two SATA devices
  => Firmware is upgradeable via USB
  => Could not find any leaked firmware files/tools but it is not too difficult to unsolder and read out the SPI flash
  => Most likely vulnerable