ST500LM030 - How to access boot mode

[afuna]

I have a drive with id ST500LM030 with a locked diagnostic. I would like to enter boot mode to dump the ROM, but there is no visible chip to short its pins. Any advice?

[cpm1993]

You can do this without shorting anything, if you have MRT , launch the seagate utility and on the top right corner is an option "Boot Code Mode" then launch the utility and it will read the ROM and save it automatically.

[afuna]

I don't have MRT. On earlier versions I either executed '/1e,f' to enter boot mode or shorted the pins. On this board there are no visible pins to short. How does MRT do it? (via ESLIP/SATA or some other method?)

[cpm1993]

MRT does it via Terminal Adaptor and reads the ROM via terminal.

[afuna]

I know it does it via terminal. I want to know how it forces the hdd into boot mode so I can do it manually. I've written my own tools for dumping/patching the ROM from boot mode. Can you sniff the terminal traffic to see which commands MRT is executing? Thanks!

[fzabkar]

Try invalidating the ROM by shorting its DO (data out) pin to ground during power-on. Alternatively, you could try grounding its Hold pin, but only if it is not hardwired to Vcc.

Would you care to make your tools publicly available?

[afuna]

I would release the tools. They're basically finished - it has a slow mode using the boot mode commands and a fast mode that patches the ROM with a function to dump the memory quickly. I just have to polish them and test them out on other models (that's what I'm trying to do here.)

All of the visible chips are BGA and I don't know where to start. I don't see the ROM chip (some images on the web show a similar PCB with a rom chip but this one doesn't.

[afuna]

All of the chips are BGA and there is no visible ROM chip. (Similar PCBs that I can find online have a ROM chip). I tried attaching an image of my PCB but it's awaiting approval - or maybe it didn't go through.

Regarding the tools, I'd be happy to release them after they're tested and polished - I had wanted to test them on this drive!

[fzabkar]

One of the BGA chips is a ROM.

http://www.hddoracle.com/viewtopic.php?f=100&t=1577&p=18998&hilit=bga+serial+flash+memory#p18998

[afuna]

I've tracked down this link https://forum.hddguru.com/viewtopic.php?f=1&t=34804 that also asks about the rom. The image that is supposed to show the rom is dead unfortunately. Is it the tiny shiny silver thing next to the flash memory?

How/what would I short on it?

[fzabkar]

Here it is:

ROM.jpg (102.77 KiB) Viewed 17568 times

You would need to trace the circuit.

[afuna]

Thanks for your help. I don't have any experience in tracing circuits... don't know where to start. Google doesn't give me results for the chips markings (3A6F S02) and without a datasheet how do I know what's what?

[fzabkar]

It's in my HDD Oracle database.

W25Q80BWBY, Winbond, 8M-bit serial flash memory, 1.8V, marking 3Axx, WLBGA-8:
https://www.macrogroup.ru/docs/1348

[afuna]

What's the worst that can happen if I try shorting any of the connected vias during start up? (Also there's no marking for pin 1?!)

[fzabkar]

Seagate PCBs usually have a dot alongside pin #1. I can't see it in any of the poor photos I've examined, though.

I would start by measuring the voltages at the adjacent vias.

Edit:

Is that a dot to the right of the "M" in "ROM"?

Does the IC have an indent at one of its corners?

[pepe]

you can get into boot mode by sending UU over terminal during powerup.
Ok, you are in boot mode, what to do next?
without tools?
without knowhow?

pepe

[afuna]

@pepe Thanks!

I actually just discovered the 'UU' solution by disassembling the boot ROM. I have my own tools for dumping the ROM, and I hope to create a patch for unlocking Rosewood etc. drives.

[pepe]

yes, unlocking can be done of course, but tools ease our lives. There were no tools able to unlock sg drives at the time i started building a solution, so it was worth (it is still better than Pc3k unlock in that it supports more family, and that i can add a new family with relatively small effort usually).
But i still make use of other fw manipulation features of pc3k which do make life easier.

pepe

[afuna]

@pepe

Are your tools publicly available?

[pepe]

Hello,

i hope not

pepe