Switch to full style
Data recovery and disk repair questions and discussions related to old-fashioned SATA, SAS, SCSI, IDE, MFM hard drives - any type of storage device that has moving parts
Post a reply

Re: WD3200BUDT

March 1st, 2014, 8:06

You need to put the BIN files in the same directory as the script.

Re: WD3200BUDT

March 1st, 2014, 8:32

All your script's is in SCRIPTS folder

Look here. all this thread
http://wdmarvel.com/forum/ru/viewtopic. ... 2076#p2076

Re: WD3200BUDT

March 1st, 2014, 18:06

After reading your thread at the wdmarvel.com forum, ISTM that WD's protections are locking out VSC commands. Nevertheless it appears that Vlad has managed to retrieve a complete resource dump:

http://zalil.ru/34989728/59873b50.5312d ... 085398.rar

IIUC, MOD 0D in the ROM is at least partly responsible for the lockout. The suggestion was that you could gain access to the SA by hotswapping the PCB. Vlad and Tomset appear to know of a way to rewrite the ROM in situ but they have declined to tell you how. However, ISTR that you were able to read your ROM using a programmer. If so, then I propose to patch your ROM with an unprotected copy of MOD 0D and you could then write this patched ROM to your PCB. Assuming we then gain access to the SA via the regular VSCs, we could then rewrite MOD 02 with an unprotected backup.

MOD 02 can be extracted from MOD 802F in your resource dump.

Here are the differences between your "blocked" MOD 02 (MOD_02_locarno_blocked.bin) and the backup copy that I carved out of MOD 802F (MOD_02_from_802F.bin):

Serial Number

Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

000000C0        00 01 57 44 2D 57 58 32 31 41 43 30 38 35    ..WD-WX21AC085
000000D0  33 39 38 00 00 00 00 00 00                       398......

000000C0        00 01 57 44 2D 57 58 32 31 41 43 30 38 35    ..WD-WX21AC085
000000D0  33 39 38 20 20 20 20 20 20                       398     


Max LBAs

Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

000000D0                             00 01 10 3F 00 00 00
000000E0  00 AF EA 42 25 AF EA 42 25 AF EA 42 25 00 00 00
000000F0  00

000000D0                             00 01 10 3F 00 00 00
000000E0  00 FF FF FF FF FF FF FF FF FF FF FF FF 00 00 00
000000F0  00


Model Number

Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

000003B0     00 01 57 44 43 20 57 44 33 32 30 30 42 55 44   ..WDC WD3200BUD
000003C0  54 2D 36 32 44 50 5A 59 30 20 20 20 20 20 20 20  T-62DPZY0       
000003D0  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                 
000003E0  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                 
000003F0  20 20 20 00 00

000003B0     00 01 20 20 20 20 20 20 20 20 20 20 20 20 20
000003C0  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                 
000003D0  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                 
000003E0  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                 
000003F0  20 20 20 20 20                                       


DCM (?) and manufacture (?) date

Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

000003F0                 00 01 53 7C 42 42 4C 7C 50 4E 4D       ..S|BBL|PNM
00000400  4C 48 49 43 53 52 4C 56 59 4B 47 55 4A 00 20 20  LHICSRLVYKGUJ. 
00000410  20 20 20 20 20 20 20 20 20 20 20 31 32 2D 30 38             12-08
00000420  2D 32 30 31 30 00 00 00 00 00 00 00 00 00 00 00  -2010
00000430  00 00 00 00 00 00 00 00 00 00 00

000003F0                 00 01 53 7C 42 42 4C 7C 50 4E 4D       ..S|BBL|PNM
00000400  4C 48 49 43 53 52 4C 56 59 4B 47 55 4A 00 20 20  LHICSRLVYKGUJ. 
00000410  20 20 20 20 20 20 20 20 20 20 20 31 32 2D 30 39             12-09
00000420  2D 32 30 31 30 00 00 00 00 00 00 00 00 00 00 00  -2010
00000430  00 00 00 00 00 00 00 00 00 00 00


User and master password

Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000430                                   00 01 00 00 00
00000440  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000450  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 57  ...............W
00000460  44 43 57 44 43 57 44 43 57 44 43 57 44 43 57 44  DCWDCWDCWDCWDCWD
00000470  43 57 44 43 57 44 43 57 44 43 57 44 43 57 00 62  CWDCWDCWDCWDCW.b
00000480  09 FE FF 65 00                                   .þÿe.

00000430                                   00 01 00 00 00
00000440  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000450  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 57  ...............W
00000460  44 43 57 44 43 57 44 43 57 44 43 57 44 43 57 44  DCWDCWDCWDCWDCWD
00000470  43 57 44 43 57 44 43 57 44 43 57 44 43 57 00 62  CWDCWDCWDCWDCW.b
00000480  09 FE FF 25 00                                   .þÿ%.


Apart from the obvious differences in the capacity and model number records, there also appears to be a significant difference in byte 0x483, ie 0x65 versus 0x25. Perhaps this is a flag byte of some kind?

Here are your "blocked" MOD 0D (MOD_0D_locarno_blocked_ROM.bin) and the backup copy that I carved out of MOD 109 (MOD_0D_from_109.bin):

Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  52 4F 59 4C 04 00 1E 00 0D 00 01 00 BC 68 9D F3  ROYL........¼h.ó
00000010  30 30 30 31 30 30 30 30 00 00 00 00 00 00 00 01  00010000........
00000020  30 31 2E 30 31 41 30 31 00 00 03 02 00 00 50 01  01.01A01......P.
00000030  4E E2 05 54 2C 18 00 01 FE FF 00 00 00 00 02 00  Nâ.T,...þÿ......
00000040  01 01 00 01 00 00 57 44 43 20 57 44 33 32 30 30  ......WDC WD3200
00000050  42 55 44 54 2D 36 32 44 50 5A 59 30 20 20 20 20  BUDT-62DPZY0   
00000060  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                 
00000070  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                 
00000080  20 20 00 00 00 00 00 00 32 00 00 00 00 00 00 00    ......2.......

00000000  52 4F 59 4C 04 00 1E 00 0D 00 01 00 CC 0B C3 09  ROYL........Ì.Ã.
00000010  30 30 30 31 30 30 30 30 00 00 00 00 00 00 00 00  00010000........
00000020  30 30 2E 30 30 30 30 30 00 01 03 02 00 00 00 00  00.00000........
00000030  00 00 00 00 00 00 00 01 FE FF 00 00 00 00 20 00  ........þÿ.... .
00000040  01 01 00 01 00 00 20 20 20 20 20 20 20 20 20 20  ......         
00000050  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                 
00000060  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                 
00000070  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                 
00000080  20 20 00 02 00 00 00 00 32 00 00 00 00 00 00 00    ......2.......


I suspect that offsets 0x2E - 0x35 may contain a 32-bit key that is somehow locking you out of the drive.

I propose to patch your ROM code as follows (ROM_152G_locarno_patched.bin):

Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  52 4F 59 4C 04 00 1E 00 0D 00 01 00 36 62 D5 49  ROYL........6bÕI
00000010  30 30 30 31 30 30 30 30 00 00 00 00 00 00 00 00  00010000........
00000020  30 31 2E 30 31 41 30 31 00 01 03 02 00 00 00 00  01.01A01........
00000030  00 00 00 00 00 00 00 01 FE FF 00 00 00 00 20 00  ........þÿ.... .
00000040  01 01 00 01 00 00 57 44 43 20 57 44 33 32 30 30  ......WDC WD3200
00000050  42 55 44 54 2D 36 32 44 50 5A 59 30 20 20 20 20  BUDT-62DPZY0   
00000060  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                 
00000070  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                 
00000080  20 20 00 00 00 00 00 00 32 00 00 00 00 00 00 00    ......2.......


Note that the 32-bit checksum in bytes 0x0C - 0x0F has been recomputed.

Can you write the patched ROM to your PCB, or preferably to a donor PCB?
Attachments
patches.zip
(687.04 KiB) Downloaded 484 times

Re: WD3200BUDT

March 1st, 2014, 18:42

fzabkar,
Code:
Vlad and Tomset appear to know of a way to rewrite the ROM in situ but they have declined to tell you how.

He starts. Newbie.
Description and training, take a few weeks, and him need a bunch of donor experiences.
I downloaded resource made ​​Vlad.
Filled it in donor.
Recorded copy of 802F for 02 place.
HDD stayed is locked.
So your idea does not work.

Re: WD3200BUDT

March 1st, 2014, 19:01

Me with a great experience of repair, it took a couple of months to sort out how to access locked SA.
Novice to understand this, even with the tips, will be very difficult.

Re: WD3200BUDT

March 1st, 2014, 19:03

Tomset wrote:fzabkar,
Code:
Vlad and Tomset appear to know of a way to rewrite the ROM in situ but they have declined to tell you how.

He starts. Newbie.
Description and training, take a few weeks, and him need a bunch of donor experiences.
I downloaded resource made ​​Vlad.
Filled it in donor.
Recorded copy of 802F for 02 place.
HDD stayed is locked.
So your idea does not work.

"My idea" was actually your idea, namely to first rewrite MOD 0D in ROM with a copy from an "unblocked" donor. Or did I misunderstand you? Your post in this thread makes no mention of this.

Re: WD3200BUDT

March 1st, 2014, 19:12

Alas 0D module is not affected.
This idea was voiced by analogy with HP discs that are not allowed to change the serial number.

Re: WD3200BUDT

March 2nd, 2014, 19:57

Tomset wrote:Alas 0D module is not affected.
This idea was voiced by analogy with HP discs that are not allowed to change the serial number.

I see that the drive has been unlocked. Congratulations to the team at wdmarvel.com.

Re: WD3200BUDT

March 3rd, 2014, 9:19

Spildit,
resources laid out there.
To find out all you need three copies of 02 module compare.
But as always - there is no time.

Re: WD3200BUDT

March 19th, 2014, 17:09

Next question is: How to unlock HGST drive ?

HCC545032B9A300

Re: WD3200BUDT

March 19th, 2014, 19:22

how many do you have for sale?

Re: WD3200BUDT

March 22nd, 2014, 6:36

Not for sale.
I have 4 HGST locked drives.

Moltke trying write tool for WD drives.
Hitachi is for unlock, but we don't know how.

Re: WD3200BUDT

March 30th, 2014, 8:56

Have WD or Hitachi locked? I would like to buy some of the locked drives as well (Europe/Poland)
Post a reply