Data recovery and disk repair questions and discussions related to old-fashioned SATA, SAS, SCSI, IDE, MFM hard drives - any type of storage device that has moving parts
September 4th, 2015, 14:44
I bought external ROM programmer version 2.0, i will do some research
September 4th, 2015, 18:57
SN74AHC04, hex inverter, marking HA04, 2V - 5.5V supply:
http://www.ti.com/lit/ds/symlink/sn74ahc04.pdfSN74LVC125A, Quad Bus Buffer with 3-State Outputs, marking LC125A, 1.65V - 3.6V supply, 3.3V/5V inputs:
http://www.ti.com/lit/ds/symlink/sn74lvc125a.pdfU5 looks like a 3.3V LDO regulator.
U4 could be an LED driver.
Not sure about U1, but it may be a variable LDO regulator.
It would help to know the part markings of U1, U4, and U5.
September 4th, 2015, 19:09
U1: AB-TOJ
U4: C25R
U5: WV4
September 4th, 2015, 20:07
I can't find the "AB-TOJ" marking code, but ISTM that a Richtek RT9011 300mA Dual LDO Regulator could fit the bill.
The chip enables could be controlled via the hex inverter (U2) to ensure that only one supply is enabled at any time. Both supply outputs could then be safely connected together.
- Code:
|\
EN1 --| >O-- EN2
|/
U2
In short, ISTM that this new programming unit might be designed to accommodate two programmming voltages, probably +3.3V and +2.5V. I don't believe that the SN74 logic gates could handle +1.8V logic, though.
marking WV4 = BAT54S, SOT-23, dual Schottky diodes:
http://www.s-manuals.com/pdf/datasheet/ ... es_nxp.pdfSN74LVC1G125, Single Bus Buffer Gate With 3-State Outputs, marking C25R, 1.65V - 5.5V supply:
http://www.ti.com/lit/ds/symlink/sn74lvc1g125.pdf
- Attachments
-
September 4th, 2015, 20:25
Frank, how do you find datasheets of smd components that are marked with few digits?
I couldn't find any datasheet of WV4 component
September 4th, 2015, 20:38
There are quite a few online databases and resources, eg ...
http://www.s-manuals.com/smd/wvhttp://www.ti.com/general/docs/partmark ... e=partmarkBTW, could you measure the resistance between pins 1 and 6 of U1, and between these pins and pin 8 of the IC socket? This will confirm or disprove my dual supply hypothesis.
September 4th, 2015, 21:40
I just found a Richtek marking code resource at badcaps.net:
http://www.badcaps.net/forum/showthread.php?t=39126http://www.rom.by/files/Richtek_Marking_Code.PDFA marking code of "AB-" corresponds to RT9011-
GSPJ6.
According to the datasheet, G = 1.8V and S = 3.3V.
October 26th, 2015, 4:48
I recently received a Seagate Grenada ROM dump that was produced by MRT's Programming Unit. As expected, it was corrupt (dropped dwords), and only half of the ROM was dumped (512KB of 1MB). Worse still, the user wrote this corrupt image back to the drive, and the drive now reports a checksum error. My recommendation is to read the ROM several times and compare the copies.
October 26th, 2015, 5:16
fzabkar wrote:and only half of the ROM was dumped (512KB of 1MB).
why do you think the ROM supposed to be 1MB ? see
here,
here and
here all of them are grenada's and all of them are 512KB
October 26th, 2015, 8:33
This is why I love my PC-3000 read via boot ROM code. Even most burned PCB's can still read the ROM code without ever putting an iron to it.
October 26th, 2015, 9:00
data-medics wrote:This is why I love my PC-3000 read via boot ROM code. Even most burned PCB's can still read the ROM code without ever putting an iron to it.
+1
Also on PC3K reading a ROM off a usb PCB and programming to a SATA board is handy without touching an iron.
Even the jobs where the PCB has been bricked with writing the wrong ROM to the board, PC3K will have no problem reprogramming it.
October 26th, 2015, 11:38
Hi everyone
MRT Pro Can Also Read/Write Rom In Boot Mode .Possibly You Folks Should Try It Out .Michael Now You Have Board Version 2.0 .MRT Should Be Sending You This Free [ Why did You Buy It ] . And Frank/Slipdit The Latest Update of MRT Have Done Some Improvements To The Programmer Also Read Here ->
http://forum.mrtlab.com/showthread.php?tid=353 .
PS : Michael I Am Assuming You Have Given All Hope Up On MRT Pro .Buck Up Its Chinese And Takes Time To Research [ PC 3000 ] Code and Approach Lol
.Its Pays To Have All PC 3000 UDMA/PCI/ISA And DFL/MRT Oops I Forgot Salvation DATA .
October 26th, 2015, 13:58
Michael Now You Have Board Version 2.0 .MRT Should Be Sending You This Free [ Why did You Buy It ]
What?
It should be free? Are u sure?
So why they have told me that it cost $25
October 26th, 2015, 15:39
data-medics wrote:This is why I love my PC-3000 read via boot ROM code.
The user tells me that neither PC3K nor MRT was able to read this particular ROM in boot mode.
data-medics wrote:Even most burned PCB's can still read the ROM code without ever putting an iron to it.
That's ridiculous.
jermy wrote:why do you think the ROM supposed to be 1MB ? see
here,
here and
here all of them are grenada's and all of them are 512KB
I'm relying on the user to identify the family. He sent me a 1MB ROM dump from his own ST2000DM001-1ER164 with a DOM of 08182015. If that is a Grenada, and if the dump is valid, then the ROM is in fact an 8Mbit part. However, he also sent me a dump from an HDD.15 which he initially claimed was a 512KB ROM, but it was clearly 1MB. In neither case did he provide me with the part number of the ROM, so I cannot verify it physically.
In any case the MRT ROM dump was definitely bad.
This is the index/header section:
- Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000 34 0F 00 00 F0 08 00 00 00 00 00 00 DA 60 04 00 4...ð.......Ú`..
00000010 63 73 69 44 01 00 CA 50 48 7F 00 00 20 FF FF FF csiD..ÊPH... ÿÿÿ
00000020 1D 00 00 00 22 00 01 00 03 00 10 02 05 00 B0 03 ....".........°.
00000030 1D 00 00 04 23 00 01 04 0B 00 10 06 06 00 21 06 ....#.........!.
00000040 04 00 21 08 17 10 23 08 1E 10 33 08 00 10 03 09 ..!...#...3.....
00000050 A5 09 00 00 FF FF FF FF FF FF FF FF FF FF FF FF ¥...ÿÿÿÿÿÿÿÿÿÿÿÿ
Here are the ROM modules:
- Code:
ID Start Loc Description
---------------------------------------------------------------------------------------
1D 0x0 module index
22 0x100 code
03 0x21000 code
05 0x3B000 Servo Adaptive Parameters (SAP)
1D 0x40000 backup of module index
23 0x40100 backup of ID#22
0B 0x61000
06 0x62100 Read Adaptive Parameters (RAP)
----------------- 0x7FFFF - 512KB
04 0x82100 Controller Adaptive Parameters (CAP) - serial number, model number, DOM
17 0x82310 data - adaptive?
1E 0x83310
00 0x90310 end of ROM modules
Notice that module ID 06 (RAP) extends beyond 512KB (0x7FFFF), as does the CAP (ID 04).
Notice also that modules 1D and 23 should be located at 0x40000 and 0x40100, but they are in fact at 0x3FE44 and 0x3FF40. This means that 0x1C0 bytes have been lost at this point.
- Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
0003FE30 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0003FE40 28 30 00 00 2E 0F 00 00 F0 08 00 00 00 00 00 00 (0......ð.......
0003FE50 DA 60 04 00 63 73 69 44 00 00 D1 50 48 7F 00 00 Ú`..csiD..ÑPH...
0003FE60 20 FF FF FF 1D 00 00 00 22 00 01 00 03 00 10 02 ÿÿÿ....".......
0003FE70 05 00 B0 03 1D 00 01 04 0B 00 10 06 06 00 21 06 ..°...........!.
0003FE80 04 00 21 08 17 10 23 08 1E 10 33 08 00 10 03 09 ..!...#...3.....
0003FE90 A5 09 00 00 FF FF FF FF FF FF FF FF FF FF FF FF ¥...ÿÿÿÿÿÿÿÿÿÿÿÿ
0003FEA0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
........
0003FF20 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0003FF30 FF FF FF FF FF FF FF FF FF FF FF FF 8A 3D 00 00 ÿÿÿÿÿÿÿÿÿÿÿÿŠ=..
0003FF40 2E 0F 00 00 F0 07 00 00 00 00 00 00 56 4C 04 00 ....ð.......VL..
0003FF50 63 73 69 44 00 00 55 66 48 7F 00 00 20 FF FF FF csiD..UfH... ÿÿÿ
0003FF60 16 38 00 00 15 40 00 00 18 70 07 00 10 E8 07 00 .8...@...p...è..
0003FF70 00 08 0B 02 00 00 00 00 19 F7 00 00 64 00 01 00 .........÷..d...
0003FF80 FF FF FF 7F 17 06 03 13 88 13 00 00 80 79 00 00 ÿÿÿ.....ˆ...€y..
0003FF90 00 28 11 8C 00 00 08 00 18 21 02 00 27 05 25 08 .(.Œ.....!..'.%.
0003FFA0 05 27 14 20 08 00 04 02 00 00 00 00 42 52 44 42 .'. ........BRDB
0003FFB0 25 08 21 00 00 00 00 00 00 00 00 00 03 00 01 00 %.!.............
0003FFC0 00 00 00 00 A2 00 02 00 FF FF FF 7F FF FF FF FF ....¢...ÿÿÿ.ÿÿÿÿ
0003FFD0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
........
00040030 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00040040 FF FF FF FF FF FF FF FF FF FF FF FF E0 00 19 00 ÿÿÿÿÿÿÿÿÿÿÿÿà...
October 26th, 2015, 16:36
The information I'm getting is third hand. I still don't know the model number of the patient drive. Initially I was told that it was a HDD.15, but then I was told that it was a Grenada. In any case the CAP is missing from the dump, so I can't see for myself.
October 26th, 2015, 16:45
Here is my analysis of the 1MB Grenada ROM dump that was sent to me. The ROM modules appear to fit within the first 512KB, but there is more "stuff" in the second 512KB.
The first 0x100 bytes of the Grenada ROM appear to constitute an index for the ROM.
- Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000 43 0D 00 00 60 07 00 00 00 00 00 00 EF 5B 04 00
00000010 63 73 69 44 01 00 36 49 48 8F 00 00 20 FF FF FF csiD............
00000020 1D 00 00 00 22 00 01 00 05 00 00 03 1E 00 50 03
00000030 1D 00 00 04 23 00 01 04 06 00 00 07 17 00 E0 07
00000040 04 00 F0 07 00 10 F2 07 95 14 00 00 FF FF FF FF
00000050 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
........
000000F0 FF FF FF FF FF FF FF FF FF FF FF FF 5B 46 00 00
The first 0x20 bytes should checksum to 0x0000 (little endian).
That is ...
0x0D43 + 0x0000 + 0x0760 + ... + 0xFFFF = 0x0000
The checksum word for the first 0x20 bytes appears to be located at offset 0x16-17.
- Code:
00000000 43 0D 00 00 60 07 00 00 00 00 00 00 EF 5B 04 00
00000010 63 73 69 44 01 00 36 49 48 8F 00 00 20 FF FF FF csiD............
Offset 0x20 is the beginning of an index of ROM modules.
- Code:
00000020 1D 00 00 00 22 00 01 00 05 00 00 03 1E 00 50 03
00000030 1D 00 00 04 23 00 01 04 06 00 00 07 17 00 E0 07
00000040 04 00 F0 07 00 10 F2 07
Here is my interpretation of the index:
- Code:
ID Start Loc Description
---------------------------------------------------------------------------------------
1D 0x0 module index
22 0x100 code
05 0x30000 Servo Adaptive Parameters (SAP)
03 0x35000 code
1D 0x40000 backup of module index, but differs in a few bytes
23 0x40100 backup of ID#22 - differs in only byte at offset 0x5A2 (0x03 versus 0xFF)
06 0x70000 Read Adaptive Parameters (RAP)
17 0x7E000 data - adaptive?
04 0x7F000 Controller Adaptive Parameters (CAP) - serial number, model number, DOM
00 0x7F210 end of ROM modules
Each module, including the module index, has a word at the very end which appears to be a CRC of some kind. (That said, module ID 23 has the same CRC word as module ID 22, but differs in 1 byte at offset 0x5A2. How is that possible? Have I misunderstood the CRC word?)
Is offset 0x28-29 (immediately after the module list) a CRC word for the module list (0x20 - 0x47)?
There is more "stuff" at these locations ...
- Code:
0x7F210 end of ROM modules at 0x7F20F
0x958E0
0x95CF0
0xA8B10
0xAC910
0xACDF0
0xAD000
0xB9D00
0xC0000
At the moment I have no idea what the "stuff" contains.
Module ID#22 has its own index (similar to ID#23 index).
- Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000100 43 0D 00 00 60 06 00 00 00 00 00 00 78 6A 04 00
00000110 63 73 69 44 00 00 AE 3B 48 8F 00 00 20 FF FF FF csiD............
00000120 16 40 00 00 15 48 00 00 0E 48 02 00 10 58 06 00
00000130 03 00 8E 01 0B 00 EE 02 00 00 FF 02 00 00 00 00
00000140 00 00 00 00 36 1A 00 00 62 00 01 00 FF FF FF 7F
00000150 17 06 03 13 23 00 00 00 80 58 00 00 00 00 26 84
00000160 28 20 10 00 08 21 01 00 26 06 07 15 06 26 15 20
00000170 08 00 10 02 68 20 10 00 43 43 44 32 07 15 B8 00
00000180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BE B9
00000190 A0 00 02 00 FF FF FF 7F FF FF FF FF FF FF FF FF
- Code:
ID Start Loc
relative absolute
-------------------------
16 0x40 0x140
15 0x48 0x148
0E 0x248 0x348
10 0x658 0x758
03 0x18E00 0x18F00
0B 0x2EE00 0x2EF00
00 0x2FF00 0x30000
I notice that the backup of the module index (at 0x40000) is very similar to the main index.
March 2nd, 2016, 7:28
Hello All,
I have a similar Drive ST2000DL001 with FW :CC98 which with a corrupt ROM. I managed to read it using Programmer and attached a file here.
Expecting experts give their Analysis. And also if it can be patched.
Also if anyone can help me with the Loader and ROM.
Thanks
- Attachments
-
- ST2000DL001.zip
- (333.66 KiB) Downloaded 592 times
March 2nd, 2016, 8:02
Which is the serial number, 6YD0S954 or 5YD63XQD?
March 2nd, 2016, 8:42
Hi Guys
Sorry for my ignorance. I have UDMA express but not done much work on ROM /electronics.
can you pls. let me know how can I read and transfer ROM from Seagate / WD drives without desoldering ROM physically ?
(patient PCB might be burned or have some issues).
Thank you in advance
March 2nd, 2016, 8:49
Which is the serial number, 6YD0S954 or 5YD63XQD?
Its 5YD63XQD
Powered by phpBB © phpBB Group.