All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 35 posts ]  Go to page Previous  1, 2
Author Message
 Post subject: Re: st1000lx015
PostPosted: January 12th, 2018, 2:54 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 10503
Location: Australia
Other Seagate SSHDs use an ST1L05CPU33R 3.3V LDO regulator to power the NAND flash. Its pinout looks very similar. Perhaps the NAND could be disabled by driving the regulator's EN pin low.

ST1L05CPU33R, ST Microelectronics, LDO regulator, 3.3V, 1.3A, marking 1L05C33, DFN6:
http://www.st.com/web/en/resource/techn ... 186925.pdf


Attachments:
3V3_LDO_reg.jpg
3V3_LDO_reg.jpg [ 75.9 KiB | Viewed 1895 times ]

_________________
A backup a day keeps DR away.
Top
 Profile  
 
 Post subject: Re: st1000lx015
PostPosted: January 12th, 2018, 5:55 
Offline

Joined: May 29th, 2011, 8:47
Posts: 91
Location: Russia
fzabkar wrote:
Perhaps the NAND could be disabled by driving the regulator's EN pin low.

Are you joking?
Take Kahuna drives for example (drives which are much more simple than Rosewood ones). If you know the field well, you might remember that the solution is far from hardware modifications. Why do you advice to do the things which 100% will not help? To make people spoil their drives?


Top
 Profile  
 
 Post subject: Re: st1000lx015
PostPosted: January 12th, 2018, 8:43 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 10503
Location: Australia
Masterclass wrote:
Why do you advice to do the things which 100% will not help? To make people spoil their drives?

How will disabling the NAND "spoil" the drive?

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: st1000lx015
PostPosted: January 12th, 2018, 23:24 
Offline

Joined: May 29th, 2011, 8:47
Posts: 91
Location: Russia
Mind that you advice to short something to a non-skilled person. 99% he may short something wrong. Beginning with “short with what?” Gnd, 5v or even 12v can be shorted anywhere. In any case, misfeeding nand chip has nothing to do with disabling it in code


Top
 Profile  
 
 Post subject: Re: st1000lx015
PostPosted: January 13th, 2018, 10:00 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9426
Location: Portugal
Masterclass wrote:
Mind that you advice to short something to a non-skilled person. 99% he may short something wrong. Beginning with “short with what?” Gnd, 5v or even 12v can be shorted anywhere. In any case, misfeeding nand chip has nothing to do with disabling it in code


Would those drives allow ROM reading and writting by boot code mode even if terminal is locked and NAND is bad ?

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: st1000lx015
PostPosted: January 13th, 2018, 15:26 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 10503
Location: Australia
Masterclass wrote:
Mind that you advice to short something to a non-skilled person.

The OP's statements would suggest that s/he is not a "non-skilled person".

Masterclass wrote:
99% he may short something wrong. Beginning with “short with what?” Gnd, 5v or even 12v can be shorted anywhere.

It appears that you do not understand the following statement:

fzabkar wrote:
Perhaps the NAND could be disabled by driving the regulator's EN pin low.

Masterclass wrote:
In any case, misfeeding nand chip has nothing to do with disabling it in code

Correct. We want to know how the firmware will respond when it fails to detect a NAND chip. Intuitively one would expect that an intelligent programmer would have accounted for such a scenario by at least allowing the drive to operate as a normal HDD, if only in read-only mode. Our experiment will at least determine whether the design was an intelligent one.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: st1000lx015
PostPosted: January 13th, 2018, 16:18 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 10503
Location: Australia
Masterclass wrote:
Gnd, 5v or even 12v can be shorted anywhere.

@"Masterclass", are you aware that this is a 2.5" drive?

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: st1000lx015
PostPosted: January 13th, 2018, 16:45 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 10503
Location: Australia
Spildit wrote:
Would those drives allow ROM reading and writting by boot code mode even if terminal is locked and NAND is bad ?

I would think so, otherwise how would you program a blank ROM at manufacturing time?

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: st1000lx015
PostPosted: January 13th, 2018, 17:13 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9426
Location: Portugal
fzabkar wrote:
Spildit wrote:
Would those drives allow ROM reading and writting by boot code mode even if terminal is locked and NAND is bad ?

I would think so, otherwise how would you program a blank ROM at manufacturing time?


Seagate would "know" how to operate the drive even with locked terminal access and at manufacturing NAND wouldn't be bad ....

Because NAND is bad it might be sending that error message "in loop" to terminal and blocking further operations with terminal. Hopefully it's still possible to place the drive in boot code mode.

Drive doesn't have external ROM to short as well.

On F3 arch if you short some external ROM legs the drive will not be able to read ROM at boot and will go to boot code mode.

At factory if you have a blank ROM the drive will go to boot code mode right away.

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: st1000lx015
PostPosted: January 13th, 2018, 22:01 
Offline
User avatar

Joined: August 5th, 2008, 7:00
Posts: 111
Location: Hong Kong
@Masterclass, is entitled to his opinion.

I commend "fzabkar" for the information which is MOST helpful.
fzabkar does not know me from "adam", and I could be an 11 year old and a complete tos**r, but he still took the time to provide the information.
This is how communities are built.

now some background.....

The drive actually belongs to my wife... god bless her, It's the second one she has "destroyed" , simply by shutting down the apple computer it is installed in. (interesting in of its self)
Apart from her cat pictures, its not really that important.

I was looking for an interesting "reverse engineering project".. since I just did a Xyratex 5412 array... and this Seagate seems interesting....
Particularly because this is not the first time this Seagate "locked mode" has pissed me off.
Professionally I don't recover disk drives or work in the recovery business.

Currently i'm deciding on my next action....

1. Use the new drive for comparison voltage measurements etc....
2. Just swap the flash chips over and prey to my gods.
3. Desolder the chips and build a reader using pogo pins to get into the microscopically small pads.
4. just swap the PCB over WITHOUT changing the Flash, to see that the motor/heads are not jammed

5. something else interesting (maybe use one of the 20 ~ FPGA development boards I have, to build a "flash emulator" to replace the parameter flash chips on seagate drives)
Something I have already done for NAND-Flash chips........
Perhaps the only one on the planet that allows a FLASH binary sparse image to be presented to a device as a "real" flash chip in real time. (track NAND commands & memory array changes)
it allows a history of modifications & changes to that image to be tracked and modified in real time. (now how cool is that?, and something I built to analyze USB stick controllers)
Part of a dissertation paper I wrote to "debunk" the bullshit that write blockers can forensically "protect" a forensic image from modification. (yep... so I went over the top)

Now @Masterclass (or anyone else) you can call me out on this, but I'm going to demand a penalty if you do..... some hddguru forum penalty decided by members
https://99percentspace.files.wordpress. ... udster.jpg ...
I have a vicious sense of humor....

The whole point? , basically to make it clear to people
1. don't judge others by your own ability......
2. find out WHAT you are dealing with before shooting your mouth off.
3.
Quote:

There are some, but qualified diagnostics is required.

is NOT
Quote:
In fact, my advice is much more useful than posting pseudo-useful pictures and "datasheets".


So what would be MOST useful to the community out of 1-4?

_________________
Universal Declaration of Human Rights: Article 19


Top
 Profile  
 
 Post subject: Re: st1000lx015
PostPosted: January 14th, 2018, 5:56 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 2524
Location: CDRLabs @ Chandigarh [ India ]
Brother ,
This is a Little Complicated Drive ,Give It To Someone Who Has The Tools And Knowledge To Handle These ,These Are a Little Different Then General Drives

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com


Top
 Profile  
 
 Post subject: Re: st1000lx015
PostPosted: January 15th, 2018, 1:25 
Offline

Joined: May 29th, 2011, 8:47
Posts: 91
Location: Russia
code_slave wrote:
I commend "fzabkar" for the information which is MOST helpful.

I see you guys are really hilarious...
Can you point out a single advice of "fzabkar" which helped you to make a little step forward to get the data??
My advice was to address to a skilled person, which is the only correct way if you really needed data. If there's nothing important you can play with it as you wish, but there's no chance you will get to data yourself.


Top
 Profile  
 
 Post subject: Re: st1000lx015
PostPosted: January 15th, 2018, 1:26 
Offline

Joined: May 29th, 2011, 8:47
Posts: 91
Location: Russia
fzabkar wrote:
Masterclass wrote:
Gnd, 5v or even 12v can be shorted anywhere.

@"Masterclass", are you aware that this is a 2.5" drive?

Does that mean 12v is not present in molex connector??


Top
 Profile  
 
 Post subject: Re: st1000lx015
PostPosted: January 21st, 2018, 17:30 
Offline

Joined: October 3rd, 2005, 0:40
Posts: 2595
Location: Hungary
There is no way this drive would start just by shorting nand pins. Please do understand it. It just will not help. There is a reason i say this which i won't really explain here.
It is great to understand electronics but it won't help you get closer to the solution, except if there is a regulator for the nand which is malfunctioning.
I have never met such issue, but i can't exclude it can happen. It's just not very probable, something like 0.1% or bellow. This can be sorted out easily.
All the rest is hardcore and i think you won't get useful information about it very soon. These drives are not supported by commercial tools either AFAIK, so there are not too many people able to handle the problem.
Correct me if i am wrong.

pepe

_________________
Adatmentés - Data recovery
No bitcoin donations :)


Top
 Profile  
 
 Post subject: Re: st1000lx015
PostPosted: January 28th, 2018, 4:55 
Offline
User avatar

Joined: August 5th, 2008, 7:00
Posts: 111
Location: Hong Kong
Ok...
Well seems the vitriol has been flying whilst I have been away.
Let me make it very clear, I consider ANY data supplied , be it solid advice, data-sheets or website links or code repositories to have been very helpful. (* ANYTHING that saves me time)

for those who "give advice" but clearly know Sweet FA about reverse engineering, it is VERY common in well designed system roms, for "disabled" corrupted" devices to put systems into debug or bypass mode. (say deliberately blocking NAND/RAM chip address lines/chip id's), it is by testing such hypothesis that we may find new modes of device recovery.

I've enclosed a picture with the SPI EEPROM removed, so other members can see the tracks under the device.
Picture was via Digital camera and not via optical rework station.also EEProm is on its BACK so pin 1 is shown top right )

Yep the quality of the PCB really is like the picture

These devices are difficult to remove, I would recommend pre-heating the PCB from underneath masked off with Polyimide tape.
Aslong as your air rework pencil is not set to high it is easy to remove the device without blowing the resistors near by off the PCB.

Re-balling seems to be necessary once the device & PCB have been cleaned up.

Also it is clear that Seagate have at-least two PCB manufacturers, one of which is complete GARBAGE...............

The "Defective" PCB , is clearly over exposed and the resist out of focus, also the copper mask is poorly defined & etched as well as corroded under the solder & plating, it's the kind of cheap assed PCB I would expect in a Chinese made set top box


Attachments:
eeprom.jpg
eeprom.jpg [ 71.24 KiB | Viewed 1385 times ]

_________________
Universal Declaration of Human Rights: Article 19
Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 35 posts ]  Go to page Previous  1, 2

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 30 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group