HD103SJ dead

[eNDi]

I resoldered the flash but nothing changed - flash contents are still zeroes.

[eNDi]

Should I try to read the flash? Is it possible to access it in-circuit by shorting a reset-line or osc, or do I have to remove the IC from the PCB?

[BGman]

Could you post the response of your drive to "DV" terminal command and/or the startup output.
Have you tried any sort of burnin procedure (downloading any kind of BI code) ?

[eNDi]

I didn't try anything with this drive, these are very my first steps.

Startup output is:

Code:

*PA VID=0000 PN=0004 Rev=0002- 785x Found*PA VID=0000 PN=0004 Rev=0002- 785x FoundChipRev = 63B0U
S_0
[DEBUG HALT @MDL_RSRC_BufferAlloc():10034A95 L0 1003A451]

RV En Sensor Circuit
En Shock Sensor Circuit


response of "DV":

Code:

DV
[SHOS2:1AJc3suM.d26|c3su_.009u_ HPCSF:3.26.1.7.0 0MB SoC:63B0 Ch:0920]
[FLAGs:00000000 00000000][CMD:00000000][RESET:00000000][TIME:38 38]

   ID     EVENT_WAIT_FLAGS  ST PR CODEADDR STACKPTR RET_ADDR FREESTACK
Serial  : 00000000_00000000 00 00 00000376 040061A0 040061EC 000000D8<-
HostXfr : 00000800_00000000 01 01 10034A2B 04006640 04005ED8 00000038
CmdDisp : 00000000_00000020 01 01 00002398 04006A60 0000853F 00000018
RdWr    : 00000800_00000000 01 01 10034A2B 04006DC8 0001C138 000000B0
BkGrnd  : 00000800_00000000 01 01 10034A2B 04007400 00014000 00000078
Partol  : 00000000_00000000 02 01 0000858A 040075F0 A5A5A5A5 00000008
EV:00000004_00200000
[DEBUG HALT @MDL_RSRC_BufferAlloc():10034A95 L0 1003A451]


[einstein9]

[SHOS2: 1AJc3suM.d26 |c3su_.009u_ HPCSF:3.26.1.7.0 0MB SoC:63B0 Ch:0920]

[BGman]

I see a problem. The drive reports 0MB DRAM instead of 32MB. Maybe DRAM chip is damaged. This could explain why FIPS is all zeroes (during the startup drive copies FLASH to DRAM). The solution is to find a good PCB and to transfer the FLASH chip.

[eNDi]

Ok, thank you!
On the PCB is written "3_2D", "REV.05 R00" and "BF41-00353A 00". A PCB without a working Flash would be sufficient, right?
If I can't find a suitable PCB, should I try to replace the DRAM (K4H561638N) - I have a different donor PCB with a K4H561638J.

[fzabkar]

The "0MB" report bothered me, too. However, the MCU cannot execute code in serial flash memory. The code needs to be unpacked into RAM, and then executed from RAM. Since the "DI" command exists in ROM, and since the following strings also exist in ROM, then this would suggest that the ROM code is executing in RAM.

*PA VID=0000 PN=0004 Rev=0002- 785x Found*PA VID=0000 PN=0004 Rev=0002- 785x FoundChipRev = 63B0U
S_0

One solution would be to desolder the ROM, dump its contents, patch the FIPS if necessary, and reinstall it. Alternatively the ROM could be dumped and reprogrammed in-circuit via an IC clip.

Try the demo version of SHTR. It may be able to dump the ROM.

http://www.hddoracle.com/viewtopic.php?f=149&t=1084

http://www.hddoracle.com/download/file.php?id=9235 (SHT/SHTR manual - EN)

[BGman]

The "0MB" report bothered me, too. However, the MCU cannot execute code in serial flash memory. The code needs to be unpacked into RAM, and then executed from RAM. Since the "DI" command exists in ROM, and since the following strings also exist in ROM, then this would suggest that the ROM code is executing in RAM.

The MCU has its own "Mask ROM" able to do some basic functions like Read/Write to Flash, DDR, etc....
It could be able to execute some terminal commands (like DI, MI, EI, etc.) as well.

[eNDi]

So I would go this way:
1. read ROM
2. if FIPS is ok: DRAM is broken - replace DRAM, or find a working PCB and put the ROM on it

With command "DL" I dumped 128kByte several times and compared the results:
between two power-cycles the contents are always the same.
After a power-cycle only some specific bits in these areas are changing:
0x1c860 - 0x1c9df
0x1cfe0 - 0x1d1ff
0x1e880 - end

For example: addresses 0x1c860, 0x1c8e0 and 0x1c960 read 5 times (read, power-cycle, read, power-cycle, ...):

Code:

L:0001C860 00320032 00320032 EB9151EF 15668C89
L:0001C860 00320032 00320032 EF1141EE 15668489
L:0001C860 00320032 00320032 EB115166 1D668489
L:0001C860 00320032 00320032 EF1151EE 0566CC89
L:0001C860 00320032 00320032 EB11516E 15668C89

Code:

L:0001C8E0 D06A4376 D0CC6F22 6C93D1E0 448934F7
L:0001C8E0 D06A417E D48C4F22 6C1BC1E0 448930FF
L:0001C8E0 506A457E D4C44F22 6C97D1E0 448934F7
L:0001C8E0 D062417E D1CC6F22 6C13D1E0 54C934FF
L:0001C8E0 50624176 D1C44F22 6C13D1E0 448934FF

Code:

L:0001C960 8BAA14F1 E4ED9E24 D39C76EE 4D2DB54B
L:0001C960 9BAA16F0 A4ED9E24 F39D7666 5C2DB14F
L:0001C960 9BAA14E0 A4ED8E24 D38A76EC 5D2DB54B
L:0001C960 8BAA14F0 E4ED9E24 F39C766E 4D2DB14B
L:0001C960 9BAA14F0 E4ED9E24 F39D766C 4D2DB54F

For me it looks like bad memory cells - is it Flash or DRAM?

[BGman]

"DL" (or DW, DB ) dumps content of MCU memory which is OK.
"DI" dumps the Image of Flash content into DRAM (known as FIPS)

Could you try two more commands - "LB" and "LD".
What's the drive part number P/N ?????

[eNDi]

Drives P/N A7773-C741-A0DJZ, S/N S246J9KB426221, HDD P/N HD103SJ

'LB' gives the following line and stops responding to commands:

Code:

[DEBUG HALT @MDL_RSRC_BufferAlloc():10034A21 L0 10039669]

'LD' gives:

Code:

| LZ | PZ | HD |TYPE| StartABA | StartLBA | NumDefect|
+----+----+----+----+----------+----------+----------+
| 00 | 01 | 00 | 00 | 00000000 | 00000000 | 00000000 |
| 01 | 01 | 01 | 00 | 01870748 | 018706F3 | 00000000 |
| 02 | 01 | 02 | 00 | 030E0E90 | 030E0DE6 | 00000000 |
...
| 8D | 18 | 03 | 00 | ADCFA7DA | ADCF7909 | 00000000 |
| 8E | 18 | 04 | 00 | AE9CB9A0 | AE9C8A7A | 00000000 |
| 8F | 18 | 05 | 00 | AF69CB66 | AF699BEB | 00000000 |


Complete output of 'LD':

20191213153600.log

(8.45 KiB) Downloaded 312 times

[BGman]

It looks like that the PCB is either damaged or not original (wrong maincode downloaded)....
Are you saving some information?

[eNDi]

Are you saving some information?

What do you mean by that? (the drive is not accessible over SATA, but I'd like to rescue the data from it).

[BGman]

Did you change the PCB? Did you download a new maincode? Did you use some unknown for you terminal commands like "EU" for example?

[eNDi]

As for me: I did none of the things you mentioned - I have written down everything I know and what I've done yet here: just "harmless" things.
However, the drive was at a computer store before to rescue the data from it. As quick as I got it back with the result "it can't be recovered by us", I assume they haven't gone that far as we are now.

I really appreciate the professional help of all of you - thank you!

[eNDi]

I will make a ROM dump next week, maybe this brings new insights.

[eNDi]

It looks like that the PCB is either damaged or not original (wrong maincode downloaded)....
Are you saving some information?

On specific inquiry I just got the information, that the "computer expert" indeed made some modifications!
Tomorrow I will hopefully have the ROM dump.

[BGman]

Say "danke" to your "computer expert"...

[eNDi]

Attached is the dump of the W25X40BL of my dead HD103SJ.
Thanks for looking at it!

Attachments

HD103SJ_dump.zip

512kB flash dump of the dead HD103SJ.

(168.54 KiB) Downloaded 329 times