Hacking Castella-Loaded IOCell USB Drives

by Adrian <adrian@weasel.net>
If you are familiar with the Sandisk Cruzer line of U3 enabled USB flash drives, you may know that they have built-in AutoRun functionality, and are hackable and customizable. Using a program called U3 Universal Customizer you can replace the default U3 Launchpad software with anything you want, and it will inherit the autorun capabilities provided by the U3 bootstrap.

For those new to U3 technology, here is how it works: when you plug in a USB drive with U3, it will show up as not one, but two USB devices; a USB mass-storage device and a CD-ROM drive. Windows will only execute the AutoRun feature on CD-ROMs and certain other removable drives, but not USB flash drives. U3 aims to implement this functionality by emulating a CD-ROM drive with the AutoRun instructions on it. Not long after the release of U3-based flash drives, it was discovered that the U3 flash update software supplied by the manufacturer used an ISO-based filesystem to write the contents of the emulated CD-ROM device. This enabled hacking through the procedure of running the flash update utility after replacing the stock embedded ISO with a custom user-supplied image.

Recently, I discovered that IOCell also manufactures a line of AutoRun-enabled USB flash drives, utilizing a nearly identical technology known as the Castella platform. Here I will describe how to achieve the same level of hackability with the IOCell/Castella as with the Sandisk/U3 flash drives. The process is a bit more involved; maybe someday I or someone else will write an all-in-one application to do this. And now for the disclaimer:

Your mileage may vary. This worked for me, but it may not work for you. I make ABSOLUTELY NO GUARANTEES that you won't accidentally turn your USB drive into a tiny little brick and as such, I assume NO LIABILITY if you do.

Needed Tools:


  • The Castella Update Tool - Found here (or mirrored here)
       for the process of flashing / modifying your IOCell USB drive

  • U3 Universal Customizer - Found here (or mirrored here)
       for the included ISO building tools

  • Resource Hacker - Found here (or mirrored here)
       for replacing the ISO embedded in the Castella Update Tool

  • Any ZIP-capable archiver - I found that 7-Zip works best, and it's free!
       also for replacing the ISO embedded in the Castella Update Tool

    How To Do It:


    1:Create a temporary folder somewhere.

    2:Extract the U3 Universal Customizer to a folder in it:



    3:Place the desired files into the U3CUSTOM folder (which is in the Universal Customizer folder). Note that there is a size limit. I don't know exactly what it is but I assume that, like the U3 drives, there is one.

    4:Run the ISOCreate.cmd script (in the Universal Customizer folder) by double-clicking on it. A console window should open and display the progress. After it finishes, press any key to continue and then find your created ISO file in the BIN folder as U3CUSTOM.ISO. Copy this file to your temporary folder.

    5:Extract the t1_patch.zip file into the temporary folder: this will leave you with Type 1 Builder.exe



    6:Rename U3CUSTOM.ISO to Image.iso and place it into a ZIP file. It doesn't matter what you name the ZIP.



    7:Run Resource Hacker and open the Type 1 Builder.exe file. Note the HIDDEN resource section!



    If you navigate into it, to resource 1042, you'll see a hex dump. This is what led me to discover the zipped ISO image: that capital "PK" which occupies the first two bytes of the resource, those are a telltale indicator of a ZIP archive! The "PK" comes from the initials of the inventor of ZIP, Phil Katz.



    8:Right-click on the 1042 resource, and select Replace Resource...



    In the following window, click on Open file with new resource... and locate the zipped ISO you created in step 6. Under "Resource Type", enter HIDDEN. Under "Resource Name", enter 132 and under "Resource Language", enter 1042. It should look like this:

    <-- When ready, click on the Replace button to continue.

    9:Finally, save the file (preferably with a different filename) and close Resource Hacker. Note the much smaller file size:



    10:Run the modified file. It is in Korean, so it probably won't display correctly (like this):



    Insert your IOCell USB drive, then press the "SCAN" button. If it finds your USB drive, it will present a drop-down list (again in Korean):



    11:Select the drive which shows up as a CD-ROM in My Computer, then click on the "UPDATE" button to apply your custom ISO image to the USB drive. DO NOT press "INIT" unless you wish to unformat your drive and remove Castella functionality! When it completes, it will look like this (and may have launched an explorer window with your USB drive's contents..) Click on the only available button to close.



    12:Unplug and reinsert your IOCell USB flash drive if necessary. It should now be fully working, with the customized bootstrap in place!