Seagate Exos 16TB ST16000NM001G

[crashpcberlin]

Hello Guys,

as you know, these helium drives are not supported by any DR-Solution. But with a few Seagate Helium Drive Models the F3 Utilility of PC3K is capable to edit headmap in ROM. It is unfortunately not possible with this model.

This Drive makes constantly calibrating sounds and sounds like it will become readable. It gets full ID but as i know, this is only ROM related. After some seconds it gets ready state, keeps spinning, but there is no sector-access or anything else possible. Terminal Output as follows:

Boot0x0100MAA0053SN03Motor startedHeads loadedHPSR[LBA=0x0000000000000105]N??+
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler[LBA=0x0000000000000105]NO0;
SimError-RemaininginBootFW
Performadoubledownloadwithoutapowercycle

When i load the ROM-Image i get "WARNING! Segment used space check sum is invalid!" message of PC3K. When i patch the ROM to unlock techmode, then drive doesn't spin on and Terminal shows constantly:

Flash boot code Digital Signature Verification failure!

Flash boot code checksum failure!

SEA3 Boot ROM 2.0 (08/01/2016)
Copyright Seagate 2016

So question is: please see the attachment, maybe there is any chance to edit headmap or unlock techmode...?! Or somebody wants to share their experiences regarding headswap for this model?! Any chance without reinsert helium and seal it again?

Thanks in advance.

Attachments

ROM.zip

(259.05 KiB) Downloaded 328 times

[fzabkar]

Is this the original ROM dump? I ask this because the "RAP" segment (0xA0000 - 0x13FFFF) isn't a real RAP. Instead it looks like the power loss data protection NVCache in earlier models.

If this is the correct ROM dump, then this is a new architecture with no RAP, in which case the RAP data must be SA-resident.

Are you aware of the following?

https://forum.hddguru.com/viewtopic.php?f=26&t=43991

[pepe]

probably there are 2 flash chips and OP dumped only one.
btw, i would check wether pcb is native...

[fzabkar]

probably there are 2 flash chips and OP dumped only one.
btw, i would check wether pcb is native...

The ID of the "RAP" segment is 06h, and the size of the ROM, as reported in the csiD table, is 0x140000.

:-?

[pepe]

i checked some similar drives and seen roms having the rap segment (based on flash dir) similar data. These had 2 rom chips, i also didn't bother to read both atm, but i will...

[crashpcberlin]

Is this the original ROM dump? I ask this because the "RAP" segment (0xA0000 - 0x13FFFF) isn't a real RAP. Instead it looks like the power loss data protection NVCache in earlier models.

If this is the correct ROM dump, then this is a new architecture with no RAP, in which case the RAP data must be SA-resident.

Are you aware of the following?

https://forum.hddguru.com/viewtopic.php?f=26&t=43991

Hello fzabkar, this is the ROM i initially readed via bootcode and terminal via PC3K.

I was not aware that there are 2 ROMs. So i checked the PCB and yes, those 2 small little ones right beside the heads connector are most likely the ROM-Chips (see the attachment).

Any idea how to read both? I think they are too small for our pin reader / programmar.

Attachments

[fzabkar]

The chips are 16Mbit (2MB) memories. I wonder what would happen if you told PC3K to dump a 4MB ROM instead of 2MB? Would that work, or would it just dump the first ROM twice?

[fzabkar]

FWIW, I noticed this:

crooked_inductor.jpg (36.86 KiB) Viewed 7942 times

[Dejan_HddSurgery]

Hello Guys,

as you know, these helium drives are not supported by any DR-Solution. But with a few Seagate Helium Drive Models the F3 Utilility of PC3K is capable to edit headmap in ROM. It is unfortunately not possible with this model.

This Drive makes constantly calibrating sounds and sounds like it will become readable. It gets full ID but as i know, this is only ROM related. After some seconds it gets ready state, keeps spinning, but there is no sector-access or anything else possible. Terminal Output as follows:

Boot0x0100MAA0053SN03Motor startedHeads loadedHPSR[LBA=0x0000000000000105]N??+
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler
UnrecoveredSeekHandler[LBA=0x0000000000000105]NO0;
SimError-RemaininginBootFW
Performadoubledownloadwithoutapowercycle

When i load the ROM-Image i get "WARNING! Segment used space check sum is invalid!" message of PC3K. When i patch the ROM to unlock techmode, then drive doesn't spin on and Terminal shows constantly:

Flash boot code Digital Signature Verification failure!

Flash boot code checksum failure!

SEA3 Boot ROM 2.0 (08/01/2016)
Copyright Seagate 2016

So question is: please see the attachment, maybe there is any chance to edit headmap or unlock techmode...?! Or somebody wants to share their experiences regarding headswap for this model?! Any chance without reinsert helium and seal it again?

Thanks in advance.

Good day to you.
We have the solution for unlocking the firmware on the specified hard drive. Please check out our blog for more information.
https://hddsurgery.com/blog/new-article-1705917859

[crashpcberlin]

The chips are 16Mbit (2MB) memories. I wonder what would happen if you told PC3K to dump a 4MB ROM instead of 2MB? Would that work, or would it just dump the first ROM twice?

I've set minimum image size to 400000 and now the ROM has size 4096 KB and seems to have now 2 containers. Please see the attachment.

Attachments

ROM.zip

(518.13 KiB) Downloaded 323 times

[fzabkar]

The second half of the 4MB ROM dump is identical to the first half, so my suggestion didn't work, or at least the result is inconclusive.

[Doomer]

AFAIK the flashes are read as separate devices. IDK if PC3000 supports device selection.

[fzabkar]

I notice that the SFW segment in the second container is empty. Strange ...

[pepe]

the 2nd container has invalid flash header anyway...

[fzabkar]

You could at least determine which of the two chips is being accessed by PC3K by measuring the voltage on CS* (pin #1) during the ROM dump. CS will be low for the active chip and high for the inactive one.

[Doomer]

I notice that the SFW segment in the second container is empty. Strange ...

that's normal for newer Seagate drives. Only one segment has the code now.

[Doomer]

The 2nd flash has adaptives only, no code

[crashpcberlin]

You could at least determine which of the two chips is being accessed by PC3K by measuring the voltage on CS* (pin #1) during the ROM dump. CS will be low for the active chip and high for the inactive one.

Hello fzabkar, thanks again for your helpful effort and your support. We will do solder wiring those 2 ROMs and try to read them seperately with our programmer.

[fzabkar]

You only need to identify the second ROM and dump that. However, I can't see how that will help you. It would be interesting, though.

[pepe]

Hello fzabkar, thanks again for your helpful effort and your support.

yeah, never mind thanking other contributors, it is normal ...

anyway, have you read my first post? did you check if pcb is native?

pepe