RBZ radio disk unlock and ssd swap

A few days ago, my radio bricked, so I bought a used one, and found out that at the back of the unit, there is a hard-disk slot, so I changed it to SSD.

Brian360 MMCS HDD Unlock -- Success! - Mitsubishi Forum - Mitsubishi Enthusiast Forums found out MMCS applied ATA password to lock the driver.

In RHB-RBZ firmware update file "MAIN_API_CPU0.mbi" which is not encrypted, CPU is SH-4A maybe IDA could disassembly it, searching for "BA B2 BC B3", easy found
"B2 BA B3 BC B0 DF AC BE B1 BB BE DF AD BD A5 DF BE 8A 9B 96 90 DF AA 8C 9A 8D DF DF DF DF DF DF", the ATA password in hex.

I am a daily Linux user, it makes things easy for me.
To unlock the disk
#hdparm --user-master u --security-unlock hex:b2bab3..... /dev/sdb

if your hdparm is an old version, without hex support,
#hdparm --user-master u --security-unlock $(printf '\xB2\xBA\xB3.....') /dev/sdb

Actually, you can also copy ASCII string "²º³¼°ß¬¾±»¾ß½¥ß¾Š›–ߪŒšßßßßßß²º³¼°ß¬¾±»¾ß²¾¬¼ß" to unlock, for software like Victoria for windows.

Then copy an image of this disk
#dd if=/dev/sdb conv=sync,noerror bs=64K | gzip -c > ./Rbz-image.gz

Burn the image to SSD
#gunzip -c Rbz-image.gz | dd of=/dev/sdb conv=sync,noerror bs=64K

The music partition is the first one, it could be enlarged by fdisk/parted moving all other partitions aligned to the end of the disk.