Reverse Engineering the IronKey: How We Unlocked a $165 Paperweight on Linux

The pitch

Kingston sells the IronKey Locker+ 50G2 as enterprise-grade encryption: FIPS-ish vibes, brute-force lockout, the works. They also, quietly, do not support Linux. Their own unlocker is Windows and macOS only. If you run Linux, your $165 encrypted drive is a paperweight, and that is the kindest word for it.

What we did about it

Two weeks of Wireshark captures, a Ghidra pull-apart of the Windows unlocker, and LLDB sessions that went later than they should have. The drive speaks a custom protocol over USB HID: RSA-512 for the key exchange, AES-128 for authentication, and a command set nobody has published. The full protocol documentation is in the repo, along with the tool.

One missing command — commit, 0x89 — was the entire difference between a drive that unlocks and a drive that mocks you. Finding it took ten days. Understanding it took ten minutes.

The result

ironkey-unlocker is open source. It unlocks the Locker+ 50G2 on Linux, no Windows VM, no vendor software. The full teardown is in the video, and the protocol writeup doubles as a case study in reversing undocumented hardware.

• Video: Kingston Sent Me a $165 Paperweight, So I Reverse Engineered It
• Tool: github.com/wltechblog/ironkey-unlocker

The part that still annoys us

Nothing about the hardware requires Windows. The protocol is fully workable from a modern Linux kernel with stock HID tooling. This was a software decision, made to sell a support contract, that turns a paid product into a brick for anyone outside the walled garden. Don't buy hardware that hates your OS.