All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 54 posts ]  Go to page Previous  1, 2, 3  Next
Author Message
 Post subject: Re: ST2000DM001 corrupt ROM
PostPosted: September 4th, 2015, 14:44 
Offline

Joined: December 5th, 2011, 5:38
Posts: 1173
Location: Italy
I bought external ROM programmer version 2.0, i will do some research

Attachment:
wp_20150904_20_29_15_pro.jpg
wp_20150904_20_29_15_pro.jpg [ 353.24 KiB | Viewed 3173 times ]


Attachment:
wp_20150904_20_28_48_pro.jpg
wp_20150904_20_28_48_pro.jpg [ 315.54 KiB | Viewed 3173 times ]


Top
 Profile  
 
 Post subject: Re: ST2000DM001 corrupt ROM
PostPosted: September 4th, 2015, 18:57 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 10949
Location: Australia
SN74AHC04, hex inverter, marking HA04, 2V - 5.5V supply:
http://www.ti.com/lit/ds/symlink/sn74ahc04.pdf

SN74LVC125A, Quad Bus Buffer with 3-State Outputs, marking LC125A, 1.65V - 3.6V supply, 3.3V/5V inputs:
http://www.ti.com/lit/ds/symlink/sn74lvc125a.pdf

U5 looks like a 3.3V LDO regulator.

U4 could be an LED driver.

Not sure about U1, but it may be a variable LDO regulator.

It would help to know the part markings of U1, U4, and U5.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: ST2000DM001 corrupt ROM
PostPosted: September 4th, 2015, 19:09 
Offline

Joined: December 5th, 2011, 5:38
Posts: 1173
Location: Italy
U1: AB-TOJ
U4: C25R
U5: WV4


Top
 Profile  
 
 Post subject: Re: ST2000DM001 corrupt ROM
PostPosted: September 4th, 2015, 20:07 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 10949
Location: Australia
I can't find the "AB-TOJ" marking code, but ISTM that a Richtek RT9011 300mA Dual LDO Regulator could fit the bill.

The chip enables could be controlled via the hex inverter (U2) to ensure that only one supply is enabled at any time. Both supply outputs could then be safely connected together.

Code:
       |\
EN1  --| >O-- EN2
       |/

       U2


In short, ISTM that this new programming unit might be designed to accommodate two programmming voltages, probably +3.3V and +2.5V. I don't believe that the SN74 logic gates could handle +1.8V logic, though.


marking WV4 = BAT54S, SOT-23, dual Schottky diodes:
http://www.s-manuals.com/pdf/datasheet/ ... es_nxp.pdf

SN74LVC1G125, Single Bus Buffer Gate With 3-State Outputs, marking C25R, 1.65V - 5.5V supply:
http://www.ti.com/lit/ds/symlink/sn74lvc1g125.pdf


Attachments:
RT9011.jpg
RT9011.jpg [ 134.3 KiB | Viewed 3137 times ]

_________________
A backup a day keeps DR away.
Top
 Profile  
 
 Post subject: Re: ST2000DM001 corrupt ROM
PostPosted: September 4th, 2015, 20:25 
Offline

Joined: December 5th, 2011, 5:38
Posts: 1173
Location: Italy
Frank, how do you find datasheets of smd components that are marked with few digits? :?
I couldn't find any datasheet of WV4 component


Top
 Profile  
 
 Post subject: Re: ST2000DM001 corrupt ROM
PostPosted: September 4th, 2015, 20:38 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 10949
Location: Australia
There are quite a few online databases and resources, eg ...

http://www.s-manuals.com/smd/wv
http://www.ti.com/general/docs/partmark ... e=partmark

BTW, could you measure the resistance between pins 1 and 6 of U1, and between these pins and pin 8 of the IC socket? This will confirm or disprove my dual supply hypothesis.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: ST2000DM001 corrupt ROM
PostPosted: September 4th, 2015, 21:40 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 10949
Location: Australia
I just found a Richtek marking code resource at badcaps.net:
http://www.badcaps.net/forum/showthread.php?t=39126
http://www.rom.by/files/Richtek_Marking_Code.PDF

A marking code of "AB-" corresponds to RT9011-GSPJ6.

According to the datasheet, G = 1.8V and S = 3.3V.

:?

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: ST2000DM001 corrupt ROM
PostPosted: October 26th, 2015, 4:48 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 10949
Location: Australia
I recently received a Seagate Grenada ROM dump that was produced by MRT's Programming Unit. As expected, it was corrupt (dropped dwords), and only half of the ROM was dumped (512KB of 1MB). Worse still, the user wrote this corrupt image back to the drive, and the drive now reports a checksum error. My recommendation is to read the ROM several times and compare the copies.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: ST2000DM001 corrupt ROM
PostPosted: October 26th, 2015, 5:16 
Offline

Joined: March 19th, 2015, 15:01
Posts: 1405
Location: isreal
fzabkar wrote:
and only half of the ROM was dumped (512KB of 1MB).

why do you think the ROM supposed to be 1MB ? see here, here and here all of them are grenada's and all of them are 512KB


Top
 Profile  
 
 Post subject: Re: ST2000DM001 corrupt ROM
PostPosted: October 26th, 2015, 8:33 
Offline
User avatar

Joined: April 3rd, 2011, 0:19
Posts: 1870
Location: Providence, RI
This is why I love my PC-3000 read via boot ROM code. Even most burned PCB's can still read the ROM code without ever putting an iron to it.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company


Top
 Profile  
 
 Post subject: Re: ST2000DM001 corrupt ROM
PostPosted: October 26th, 2015, 9:00 
Offline
User avatar

Joined: January 6th, 2015, 2:21
Posts: 186
Location: Germany
data-medics wrote:
This is why I love my PC-3000 read via boot ROM code. Even most burned PCB's can still read the ROM code without ever putting an iron to it.


+1

Also on PC3K reading a ROM off a usb PCB and programming to a SATA board is handy without touching an iron.

Even the jobs where the PCB has been bricked with writing the wrong ROM to the board, PC3K will have no problem reprogramming it.

_________________
Web: https://www.day1data.de


Top
 Profile  
 
 Post subject: Re: ST2000DM001 corrupt ROM
PostPosted: October 26th, 2015, 10:04 
Online
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9854
Location: Portugal
day1data wrote:
data-medics wrote:
This is why I love my PC-3000 read via boot ROM code. Even most burned PCB's can still read the ROM code without ever putting an iron to it.


+1

Also on PC3K reading a ROM off a usb PCB and programming to a SATA board is handy without touching an iron.

Even the jobs where the PCB has been bricked with writing the wrong ROM to the board, PC3K will have no problem reprogramming it.


Sure, but you still need for the MCU, RAM and power to be ok at pcb level ! If pcb is shorted or burned this will not work !

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: ST2000DM001 corrupt ROM
PostPosted: October 26th, 2015, 11:38 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 2538
Location: CDRLabs @ Chandigarh [ India ]
Hi everyone
MRT Pro Can Also Read/Write Rom In Boot Mode .Possibly You Folks Should Try It Out .Michael Now You Have Board Version 2.0 .MRT Should Be Sending You This Free [ Why did You Buy It ] . And Frank/Slipdit The Latest Update of MRT Have Done Some Improvements To The Programmer Also Read Here -> http://forum.mrtlab.com/showthread.php?tid=353 .

PS : Michael I Am Assuming You Have Given All Hope Up On MRT Pro .Buck Up Its Chinese And Takes Time To Research [ PC 3000 ] Code and Approach Lol :lol: .Its Pays To Have All PC 3000 UDMA/PCI/ISA And DFL/MRT Oops I Forgot Salvation DATA .

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com


Top
 Profile  
 
 Post subject: Re: ST2000DM001 corrupt ROM
PostPosted: October 26th, 2015, 13:58 
Offline

Joined: December 5th, 2011, 5:38
Posts: 1173
Location: Italy
Quote:
Michael Now You Have Board Version 2.0 .MRT Should Be Sending You This Free [ Why did You Buy It ]

What?
It should be free? Are u sure?

So why they have told me that it cost $25 :?


Top
 Profile  
 
 Post subject: Re: ST2000DM001 corrupt ROM
PostPosted: October 26th, 2015, 15:39 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 10949
Location: Australia
data-medics wrote:
This is why I love my PC-3000 read via boot ROM code.

The user tells me that neither PC3K nor MRT was able to read this particular ROM in boot mode.

data-medics wrote:
Even most burned PCB's can still read the ROM code without ever putting an iron to it.

That's ridiculous.

jermy wrote:
why do you think the ROM supposed to be 1MB ? see here, here and here all of them are grenada's and all of them are 512KB

I'm relying on the user to identify the family. He sent me a 1MB ROM dump from his own ST2000DM001-1ER164 with a DOM of 08182015. If that is a Grenada, and if the dump is valid, then the ROM is in fact an 8Mbit part. However, he also sent me a dump from an HDD.15 which he initially claimed was a 512KB ROM, but it was clearly 1MB. In neither case did he provide me with the part number of the ROM, so I cannot verify it physically.

In any case the MRT ROM dump was definitely bad.

This is the index/header section:

Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  34 0F 00 00 F0 08 00 00 00 00 00 00 DA 60 04 00  4...ð.......Ú`..
00000010  63 73 69 44 01 00 CA 50 48 7F 00 00 20 FF FF FF  csiD..ÊPH... ÿÿÿ
00000020  1D 00 00 00 22 00 01 00 03 00 10 02 05 00 B0 03  ....".........°.
00000030  1D 00 00 04 23 00 01 04 0B 00 10 06 06 00 21 06  ....#.........!.
00000040  04 00 21 08 17 10 23 08 1E 10 33 08 00 10 03 09  ..!...#...3.....
00000050  A5 09 00 00 FF FF FF FF FF FF FF FF FF FF FF FF  ¥...ÿÿÿÿÿÿÿÿÿÿÿÿ

Here are the ROM modules:

Code:
ID   Start Loc  Description
---------------------------------------------------------------------------------------
1D   0x0        module index
22   0x100      code
03   0x21000    code
05   0x3B000    Servo Adaptive Parameters (SAP)
1D   0x40000    backup of module index
23   0x40100    backup of ID#22
0B   0x61000
06   0x62100    Read Adaptive Parameters (RAP)
----------------- 0x7FFFF - 512KB
04   0x82100    Controller Adaptive Parameters (CAP) - serial number, model number, DOM
17   0x82310    data - adaptive?
1E   0x83310
00   0x90310    end of ROM modules

Notice that module ID 06 (RAP) extends beyond 512KB (0x7FFFF), as does the CAP (ID 04).

Notice also that modules 1D and 23 should be located at 0x40000 and 0x40100, but they are in fact at 0x3FE44 and 0x3FF40. This means that 0x1C0 bytes have been lost at this point.

Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0003FE30  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0003FE40  28 30 00 00 2E 0F 00 00 F0 08 00 00 00 00 00 00  (0......ð.......
0003FE50  DA 60 04 00 63 73 69 44 00 00 D1 50 48 7F 00 00  Ú`..csiD..ÑPH...
0003FE60  20 FF FF FF 1D 00 00 00 22 00 01 00 03 00 10 02   ÿÿÿ....".......
0003FE70  05 00 B0 03 1D 00 01 04 0B 00 10 06 06 00 21 06  ..°...........!.
0003FE80  04 00 21 08 17 10 23 08 1E 10 33 08 00 10 03 09  ..!...#...3.....
0003FE90  A5 09 00 00 FF FF FF FF FF FF FF FF FF FF FF FF  ¥...ÿÿÿÿÿÿÿÿÿÿÿÿ
0003FEA0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
........
0003FF20  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0003FF30  FF FF FF FF FF FF FF FF FF FF FF FF 8A 3D 00 00  ÿÿÿÿÿÿÿÿÿÿÿÿŠ=..
0003FF40  2E 0F 00 00 F0 07 00 00 00 00 00 00 56 4C 04 00  ....ð.......VL..
0003FF50  63 73 69 44 00 00 55 66 48 7F 00 00 20 FF FF FF  csiD..UfH... ÿÿÿ
0003FF60  16 38 00 00 15 40 00 00 18 70 07 00 10 E8 07 00  .8...@...p...è..
0003FF70  00 08 0B 02 00 00 00 00 19 F7 00 00 64 00 01 00  .........÷..d...
0003FF80  FF FF FF 7F 17 06 03 13 88 13 00 00 80 79 00 00  ÿÿÿ.....ˆ...€y..
0003FF90  00 28 11 8C 00 00 08 00 18 21 02 00 27 05 25 08  .(.Œ.....!..'.%.
0003FFA0  05 27 14 20 08 00 04 02 00 00 00 00 42 52 44 42  .'. ........BRDB
0003FFB0  25 08 21 00 00 00 00 00 00 00 00 00 03 00 01 00  %.!.............
0003FFC0  00 00 00 00 A2 00 02 00 FF FF FF 7F FF FF FF FF  ....¢...ÿÿÿ.ÿÿÿÿ
0003FFD0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
........
00040030  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00040040  FF FF FF FF FF FF FF FF FF FF FF FF E0 00 19 00  ÿÿÿÿÿÿÿÿÿÿÿÿà...

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: ST2000DM001 corrupt ROM
PostPosted: October 26th, 2015, 16:00 
Online
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9854
Location: Portugal
Thanks, Frank !!!
ST2000DM001 is a DM series so yes, it's a "Grenada".
Regards.

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: ST2000DM001 corrupt ROM
PostPosted: October 26th, 2015, 16:36 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 10949
Location: Australia
The information I'm getting is third hand. I still don't know the model number of the patient drive. Initially I was told that it was a HDD.15, but then I was told that it was a Grenada. In any case the CAP is missing from the dump, so I can't see for myself.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: ST2000DM001 corrupt ROM
PostPosted: October 26th, 2015, 16:45 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 10949
Location: Australia
Here is my analysis of the 1MB Grenada ROM dump that was sent to me. The ROM modules appear to fit within the first 512KB, but there is more "stuff" in the second 512KB.

The first 0x100 bytes of the Grenada ROM appear to constitute an index for the ROM.

Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  43 0D 00 00 60 07 00 00 00 00 00 00 EF 5B 04 00
00000010  63 73 69 44 01 00 36 49 48 8F 00 00 20 FF FF FF  csiD............
00000020  1D 00 00 00 22 00 01 00 05 00 00 03 1E 00 50 03
00000030  1D 00 00 04 23 00 01 04 06 00 00 07 17 00 E0 07
00000040  04 00 F0 07 00 10 F2 07 95 14 00 00 FF FF FF FF
00000050  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
........
000000F0  FF FF FF FF FF FF FF FF FF FF FF FF 5B 46 00 00

The first 0x20 bytes should checksum to 0x0000 (little endian).

That is ...

    0x0D43 + 0x0000 + 0x0760 + ... + 0xFFFF = 0x0000

The checksum word for the first 0x20 bytes appears to be located at offset 0x16-17.

Code:
00000000  43 0D 00 00 60 07 00 00 00 00 00 00 EF 5B 04 00
00000010  63 73 69 44 01 00 36 49 48 8F 00 00 20 FF FF FF  csiD............

Offset 0x20 is the beginning of an index of ROM modules.

Code:
00000020  1D 00 00 00 22 00 01 00 05 00 00 03 1E 00 50 03
00000030  1D 00 00 04 23 00 01 04 06 00 00 07 17 00 E0 07
00000040  04 00 F0 07 00 10 F2 07

Here is my interpretation of the index:

Code:
ID    Start Loc  Description
---------------------------------------------------------------------------------------
1D    0x0        module index
22    0x100      code
05    0x30000    Servo Adaptive Parameters (SAP)
03    0x35000    code
1D    0x40000    backup of module index, but differs in a few bytes
23    0x40100    backup of ID#22 - differs in only byte at offset 0x5A2 (0x03 versus 0xFF)
06    0x70000    Read Adaptive Parameters (RAP)
17    0x7E000    data - adaptive?
04    0x7F000    Controller Adaptive Parameters (CAP) - serial number, model number, DOM
00    0x7F210    end of ROM modules

Each module, including the module index, has a word at the very end which appears to be a CRC of some kind. (That said, module ID 23 has the same CRC word as module ID 22, but differs in 1 byte at offset 0x5A2. How is that possible? Have I misunderstood the CRC word?)

Is offset 0x28-29 (immediately after the module list) a CRC word for the module list (0x20 - 0x47)?

There is more "stuff" at these locations ...

Code:
0x7F210   end of ROM modules at 0x7F20F
0x958E0
0x95CF0
0xA8B10
0xAC910
0xACDF0
0xAD000
0xB9D00
0xC0000

At the moment I have no idea what the "stuff" contains.

Module ID#22 has its own index (similar to ID#23 index).

Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000100  43 0D 00 00 60 06 00 00 00 00 00 00 78 6A 04 00
00000110  63 73 69 44 00 00 AE 3B 48 8F 00 00 20 FF FF FF  csiD............
00000120  16 40 00 00 15 48 00 00 0E 48 02 00 10 58 06 00
00000130  03 00 8E 01 0B 00 EE 02 00 00 FF 02 00 00 00 00
00000140  00 00 00 00 36 1A 00 00 62 00 01 00 FF FF FF 7F
00000150  17 06 03 13 23 00 00 00 80 58 00 00 00 00 26 84
00000160  28 20 10 00 08 21 01 00 26 06 07 15 06 26 15 20
00000170  08 00 10 02 68 20 10 00 43 43 44 32 07 15 B8 00
00000180  00 00 00 00 00 00 00 00 00 00 00 00 00 00 BE B9
00000190  A0 00 02 00 FF FF FF 7F FF FF FF FF FF FF FF FF

Code:
ID       Start Loc
      relative  absolute
-------------------------
16    0x40      0x140
15    0x48      0x148
0E    0x248     0x348
10    0x658     0x758
03    0x18E00   0x18F00
0B    0x2EE00   0x2EF00
00    0x2FF00   0x30000

I notice that the backup of the module index (at 0x40000) is very similar to the main index.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: ST2000DM001 corrupt ROM
PostPosted: March 2nd, 2016, 7:28 
Offline

Joined: April 16th, 2008, 4:50
Posts: 257
Hello All,
I have a similar Drive ST2000DL001 with FW :CC98 which with a corrupt ROM. I managed to read it using Programmer and attached a file here.
Expecting experts give their Analysis. And also if it can be patched.
Also if anyone can help me with the Loader and ROM.

Thanks


Attachments:
ST2000DL001.zip [333.66 KiB]
Downloaded 85 times
Top
 Profile  
 
 Post subject: Re: ST2000DM001 corrupt ROM
PostPosted: March 2nd, 2016, 8:02 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 10949
Location: Australia
Which is the serial number, 6YD0S954 or 5YD63XQD?

_________________
A backup a day keeps DR away.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 54 posts ]  Go to page Previous  1, 2, 3  Next

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Google Adsense [Bot], purenoise, Spildit and 22 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group