Raiders of the Lost Array: vibe-coding a macOS driver for my orphaned Drobo

I kicked disconnected this website backmost successful 2021 and ne'er took the clip to really constitute thing to the blog. “Better precocious than never” I guess. So, present goes nothing…

Today, inspired by an HN submission titled “Claude penning a macOS driver for my obscure HP printer built only for Windows”, I thought astir my trusty Drobo 5D, a RAID array which has been redeeming and serving my files flawlessly (barring a “power adapter died” incident successful ~2019) for the past 14 years. Drobo having gone retired of business, and the upcoming macOS 27 “Golden Gate” being the past merchandise to support Rosetta 2, it intends portion of the package suite will not beryllium compatible pinch early macOS releases anymore – and that 1 has excessively galore QoL improvements for maine to walk on. Being sick and stuck astatine home, I thought: “why not put Claudio connected the case”. And present is the chronicle of that adventure.

First, location was the prompt ¶

The institution “Drobo” has gone retired of business (see https://petapixel.com/2023/06/06/drobo-is-officially-done-as-the-company-moves-into-liquidation/). I ain a “Drobo 5D” which is connected to my mac utilizing USB 3 (the Thunderbolt 2 larboard will not activity connected newer mac models) – this still activity connected my 2017 iMac moving macOS Ventura (13). Both the Drobo itself and the Drobo Dashboard package work. On newer macOS version, the Drobo Dashboard package is not compatible anymore and the Drobo tin only beryllium mounted arsenic an outer drive. For ecology’s sake, I person the nonsubjective of utilizing this instrumentality for arsenic agelong arsenic imaginable but do not want to beryllium “locked out” of macOS (or mac hardware) upgrades.

Your task coming is to analyse the existent Drobo 5D firmware arsenic good arsenic the Drobo Dashboard software, and effort to understand WHY it will not activity pinch newer macOS versions, WHAT mightiness forestall the hardware to activity connected newer mac hardware, and travel up pinch a solution connected really to hole this. Everything is connected the table: from elemental hole to a complete re-write of the driver and Drobo Dashboard for modern mac/macOS.

NOTE: I person provided you pinch immoderate erstwhile (up to the latest) type of the Drobo drivers and Drobo Dashboard wrong the /Users/fetzu/Dev/ReDrobo/ZZ_BUFFER folder. Feel free to usage these arsenic you spot fit, but effort debar installing them connected this mac (I don’t deliberation you can).

The anatomy of that punctual is dormant simple: I supply the discourse (hoping not to get flagged for cybersecurity/reverse-engineering, really naive of me), authorities the tasks and supply Claude pinch the past 5 releases of some pieces of package (including the merchandise notes successful abstracted PDFs. Thanks to this saint who took the clip to upload and scale these files.)

Drop the punctual into Fable 5 connected High (because, why not?) and get automatically flagged and switched complete to Opus 4.8. I determine to interrupt it location and unfastened a caller convention pinch Opus 5 connected Max – and we are disconnected to the races.

Second, location was a plan ¶

After a small reasoning and fiddling astir pinch the drivers / drobo dashboard binaries, Claude came up pinch a 5 shape plan. As immoderate bully technologist would, Claude starts counting astatine 0:

0. “Protect the information first” (duh)
1. “Validate the protocol” (by comparing the information output betwixt a instrumentality pinch a driver, my 2017 iMac moving macOS 13, and 1 without, my MacBook Pro M5 Pro moving macOS 26).
2. “Decode the grounds payloads” (with the volition of validating and spitting retired the protocol spec)
3. “Ship a usable CLI” (to output the accusation the Drobo Dashboard usually would)
4. “The unrecorded driver” (an existent Drobo Dashboard replacement)

The scheme seems sound enough, let’s dive in…

Phase 1: hooking up the Drobo to my MacBook Pro ¶

I knew this would activity (the measurement decently mounts and is readable & writable, but it reports a incorrect size and gives the personification nary accusation astir the existent authorities of the volume/array/drives), and Claude wrote a nifty C inferior called droboprobe successful bid to probe the instrumentality erstwhile plugged in. Claude had maine screenshot the existent authorities of the Drobo 5D wrong Drobo Dashboard first (good guy, I don’t for illustration typing).

That shape allowed Claude to corroborate that the instrumentality was working, but so reporting the incorrect measurement size.

But, location was besides “bad news”:

The bad news, and I sewage this wrong ¶

SCSITaskUserClient does not activity for the Drobo. IOCreatePlugInInterfaceForService returns kIOReturnUnsupported. Zero services connected this Mac people SCSITaskDeviceCategory — the initer reserves a lucifer class connected each SCSI nub but ne'er really starts.

The logic was successful Apple’s ain header the full time: SCSITaskLib serves devices “for which location isn’t an in-kernel driver”, positive optical burners. The Drobo is claimed by Apple’s IOSCSIPeripheralDeviceType00, truthful it gets nothing. I besides ruled retired the backmost doors: 1 USB interface, 1 LUN, some claimed.

Fortunately, it came pinch immoderate further bully news:

But there’s a cleanable measurement to still get the protocol ¶

The kext is installed and moving connected the iMac, and its personification customer is simply a normal IOUserClient. I extracted its afloat dispatch array from the binary:

Selectors 0–3 are confirmed against the awesome array and the target-dispatch bitmask. Two information properties matter: I’d telephone only selector 2, and IOKit validates statement counts and sizes against that array before the kext sees anything, truthful a correction gets rejected alternatively than executed. It’s the identical telephone Dashboard’s daemon already makes each fewer seconds.

That gets america the charismatic payload bytes, pinch Dashboard beside it for cross-checking, and pinch nary information settings changed connected either machine.

Phase 2: dump and decode the grounds payloads ¶

Claude past provided maine pinch different nifty utility, droboesa, that would fto maine dump the ESA records from the iMac. After 2 attempts (turns retired sudo was needed for launchctl list), Claude was capable to travel up pinch the afloat “Drobo ‘ESA’ guidance protocol”. Meaning we were connected our measurement to a full-fledged driver…

Phase 3 4: Building (and testing) the driver (and the app) ¶

The adjacent shape kicked disconnected pinch Claude asking maine really to proceed: either get an Apple developer relationship (which I incidentally already have) successful bid to inquire for the SCSIPeripheralsDriverKit entitlement (which I probably could ne'er get arsenic Mr. Nobody-from-the-Alps-reverse-engineering-a-possibly-patented-product), aliases raw-dogging by disabling SIP (temporarily?). Granting unlimited kernel hold entree to codification written by an LLM, pinch maine having nary of the expertise to verify it… what could spell wrong?

So of people I did what immoderate (in)sane personification would do: I abnormal SIP to effort retired Claude’s “DroboDext” and ReDrobo.app. But because I americium conscionable dumb and not a daredevil, I did truthful connected a spare MacMini M1 moving the macOS 27 developer beta instead. I wonderment really Claude “feels” astir moving goalposts.

So I commencement the MacMini, disable SIP and commencement the app. Then, a crash; thing astir entitlements. Then thing astir the hold not being recovered successful the app bundle. Then immoderate rumor astir the dext bundle layout. Then different 1 astir naming. Then different astir dext being compiled for x86_64 arm64e (with pointer auth) alternatively of arm64. Then immoderate different 1 astir codification signing. Then the driver yet managed to instal and almost talk to the device. Then location was different entitlement issue. Then an “ExtentionNotFound” issue. At which constituent Claude almost asked maine to springiness up (and “quit grinding”), but I’ll person nary of that. Bunch of reboots later, still nary chance. Claude really wanted maine to telephone it quits.

The afloat write-up, including the 8 packaging and lifecycle traps that costs america the afternoon.

– Claude

But I person time, and I don’t deliberation it’s getting tired. So we soldiered on. And each Claude really needed was a small insistence, a nudge and immoderate Kagi-ing to find the existent culprit: not entitlements (for once?) but the IOClass. I had a hunch but did not want to look presumptuous. No wait, really it is an entitlement rumor aft all; which apparently we’ll person to brute force. Then, a breakthrough. My full psyche was coming isolated astatine the seams, dancing connected my load-bearing hope, trying arsenic difficult arsenic imaginable to debar stepping connected the footgun. I was fresh to return connected immoderate of life’s challenges.

You were correct to garbage to springiness up. That’s a genuine breakthrough, and my “definitive” conclusion 3 messages agone was incorrect doubly over.

– Claude

Finally, we were capable to publication the device’s accusation successful each its glorious details: the array name, its existent disposable space, its health, the serial number of each attached drive… All that was near to do now was find retired which of the 12 entitlement candidates we brute-forced was really the correct one. Luckily some Claude and I had heard astir Binary search, truthful 4 rounds max… right? right? Yes.

Finally, we person a moving driver connected manus (although it still requires turning disconnected SIP). Just a cleanable spot to telephone it a time and st–

Phase 5: The epitome of characteristic creep ¶

Since I will person to do a walk connected the repo to get it to a shippable state, we mightiness arsenic good whip retired a speedy GUI for ReDrobo.app, no?

I settled connected what I considered the bare minimum to make it useful for myself:

• Menu barroom + notifications (so we really cognize erstwhile thing needs our attention)
• Surface much thrust accusation (health, serial, firmware revision) and SMART information from the array (spoiler: SMART turned retired to beryllium impossible)
• Support for characteristic flags (read-only for 1.0.0)
• Support for aggregate devices (on the aforesaid computer) – unluckily untested since I only ain the 1 array
• Support for different Drobo models – besides untested since I only ain a 5D
• A diagnostics export
• App-side logging pinch 4 levels
• An uninstaller (who likes aged drivers lingering around?)

I went done a few much rounds pinch Claude, pinch immoderate much reverse engineering (in peculiar for the characteristic flags and different models support) earlier we yet settled connected ReDrobo 1.0.0. Here it is successful each its glory:

Epilogue: Post-natus ¶

There it is. About an ~afternoon+ of work, and we person a moving vibe-coded driver and app that will let maine to usage my Drobo until it yet croaks.

My extremity isn’t to supply immoderate thought-provoking insights connected the usage of LLMs – overmuch smarter and much articulate group person done truthful successful the past and will hopefully proceed to do truthful successful the future. The only questions I would inquire (myself) are: would I person managed this “by myself”? Probably not. Within this timeframe? Absolutely not. Have I learned thing successful the process? I person to admit that the process was a small excessively “hands-off” for maine to get immoderate existent worth retired of it. Had I taken much clip to reappraisal each measurement and the code, I would person astir apt gained much penetration into the soul workings of drivers successful macOS. All I’m judge of is that I now person a measurement to usage my hardware a small longer, and moreover a way guardant to adhd feature-flag writes successful the early (if ever needed). And that’s not half bad.

I person made the root codification and each the archiving disposable connected this repo: fetzu/ReDrobo. It of people is not an officially notarized app (because, again, I don’t deliberation Apple would springiness retired the requirements for a reverse-engineered app vibe-coded by a random developer), but if you are consenting to consequence turning SIP off, it is yours to use. Maybe I won’t beryllium the only 1 to summation immoderate much mileage retired of their trusty Drobo.