Switch to full style
In-depth technology research: finding new ways to recover data, accessing firmware, writing programs, reading bits off the platter, recovering data from dust.

Forum rules

Please do not post questions about data recovery cases here (use this forum instead). This forum is for topics on finding new ways to recover data. Accessing firmware, writing programs, reading bits off the platter, recovering data from dust...
Post a reply

Develop the new software for writing ROM for Seagate F3

November 11th, 2013, 23:32

Hello everybody,
I'm going to create a software for writing Seagate ROM for Seagate F3 drive. But I have a problem: when i modify any data on ROM file, i have to recalculate checksum. I have spent a lot of time for analysis checksum on Seagate F3 but i cannot understand.
Can anyone please help to give me any advices ?
Thank you very much.

Re: Develop the new software for writing ROM for Seagate F3

November 12th, 2013, 3:12

My Advice:

Start where Others Stopped (after gathering ENOUGH info. about what you are PLANNING to do)

there are MANY cheap tools which does the same the question is: What is your point of making this?

In Addition, another TIP/Advice, read more about Seagate ROM and how does it effect the Data/Repair

good luck

Re: Develop the new software for writing ROM for Seagate F3

November 12th, 2013, 3:20

Hello einstein9,
Thanks for your advice.
I have already determined the location of checksum, the number of word for checksum calculator.
There are some tools of calculator checksum with 96 different methods but it does not match with checksum that PC3000 calculated.
The engineer of ACE has really good skill for analysis :lol:

Re: Develop the new software for writing ROM for Seagate F3

December 12th, 2013, 17:52

Maybe you located a checksum of a ROM block :wink: :?:

Re: Develop the new software for writing ROM for Seagate F3

December 19th, 2013, 2:15

deftrue wrote:Maybe you located a checksum of a ROM block :wink: :?:


Tried a lot of but nothing :( .
Is it a common checksum algorithm ?

Re: Develop the new software for writing ROM for Seagate F3

November 7th, 2016, 13:47

Hi
Its very hard to calculate check sum

By boot code mode ROM write need calculate check sum after every 512 bytes, then proceed to next byte.

If you found the algorithm, please share with me.

Regards
Waqas Ali

Re: Develop the new software for writing ROM for Seagate F3

November 8th, 2016, 21:00

https://github.com/eurecom-s3/hdd_firmware_tools
https://github.com/eurecom-s3/hdd_firmware_tools/archive/master.zip
http://www.hddoracle.com/download/file.php?id=2731
http://www.hddoracle.com/viewtopic.php?f=109&t=1219&p=7976


"This library implements the CRC16 checksum as used by Seagate hard drive firmware":
https://github.com/eurecom-s3/hdd_firmware_tools/blob/master/scripts/hdd_crc.py

Re: Develop the new software for writing ROM for Seagate F3

November 11th, 2016, 10:14

Hi


Proper Python Script for Calculate Seagate F3 drive Check sum.

Please note , Firmware check sum calculation and ROM write by boot code mode check sum calculation is different.

For rom write by boot code mode, need to calculate check sum after every 512 byte, then check sum, then next 512 byte, until finish. This CRC calculation Equation i am searching. if any one have it please Share with me.


FW CRC code


# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Calculate a CRC the same way the CM/script code & self-test/IO code does
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
def calcCRC(data,sizein,crc):
for i in range(0,sizein):
c1 = crc & 0x00AA
c2 = c1 ^ ord(data[i])
crc = crc + (c2 & 0x00FF)
return crc


def parseTestResultsNewHeader(data,currentTemp,drive5,drive12,collectParametric):
"""
Parser callback for DBLOG data parsing.
"""
global dblData
if 'dexParserOn' in globals():
global dexHandler
if dexHandler == None:
dexHandler = getDexHandler()
dexHandler(data,currentTemp,drive5,drive12,collectParametric)
dbLogBlockCodes = [ 11000, 11002]
dblDelim = ','

tableNameOff = 0
colOff = 1
colWidthOff = 2
tableTypeOff = 5

tableInfoBlock = {
'codes':[11000],
'format':"H"
}
tableDataRowBlock = {
'codes':[9002,10002, 11002],
'format':"HH"
}
try:
from dex.tabledictionary import tableHeaders
except:
print "Unable to find tabledictionary for translation in paths %s" % (sys.path,)
DBlogParserOff()
return

# Cut off the one byte results key
resultsSector = data[1:]

# Assume this is a new 5 byte firmware header
# Every firmware header has 2 bytes test number, 2 bytes error code and 1 byte block type
firmareHeaderFormat = ">hHb"
firmareHeaderSize = struct.calcsize(firmareHeaderFormat)

# Validate the size
if len(resultsSector) < firmareHeaderSize:
print "Invalid firmware header. received: %s bytes, expected: >= %s bytes." % (len(resultsSector),firmareHeaderSize)
return

testNumber, errorCode, blockType = struct.unpack(firmareHeaderFormat,resultsSector[:firmareHeaderSize])

# Is this a new style firmware header?
if blockType in (1,):
# On a new style record, the firmware CRC is the last 2 bytes of the firmware record
crcFormat = ">H"
crcSize = struct.calcsize(crcFormat)
firmwareCRCCheck = struct.unpack(crcFormat,resultsSector[len(resultsSector)-crcSize:])[0]

# Calculate the firmware CRC
# First two bytes (test num) and last two bytes (firmware CRC) are not included in the CRC calculation
rec = resultsSector[2:-crcSize]
# Pass the same arbitrary seed value (604 == throwing missiles) as firmware & tester do to ensure a CRC of 0's does not equal 0
crc = calcCRC(rec,len(rec),604)
# Our function returns a 32 bit value, but firmware function returns a 16 bit value so mask it to get a 16 bit value
crc = crc & 0xFFFF

# There is a slim chance an old header would be in this loop by mistake. Compare our calculated CRC with the firmware calculated CRC
# If the CRC check fails, try to process the old style header
if firmwareCRCCheck != crc:
# Initialize index of binary data stream to 25 jump over the command portion of the results.
# For all binary results, the first 25 bytes are made up of a single byte block code,
# Two bytes containing the test number, Two bytes containing the Error code,
# and Two bytes for each of the Ten Parameters, totaling 25 bytes.
data = data[25:]

# New style 5 byte firmware record
else:
# From the data set, remove the firmware header from the beginning and the firmware CRC check at the end
data = resultsSector[firmareHeaderSize:-crcSize]

# Old style 24 byte firmware header
# Initialize index of binary data stream to 25 jump over the command portion of the results.
# For all binary results, the first 25 bytes are made up of a single byte block code,
# Two bytes containing the test number, Two bytes containing the Error code,
# and Two bytes for each of the Ten Parameters, totaling 25 bytes.
else: data = data[25:]

length = len(data) # Obtains Length of binary data stream

index = 0

while index < (length-4):

format = "HH"
Block_Size,Block_Value = struct.unpack(format,data[index:index+struct.calcsize(format)])
if DEBUG > 0:
print("Block_Value: %s" % str(Block_Value))
if Block_Value not in dbLogBlockCodes:
if Block_Size == 0:
Block_Size = 1 #Prevent the case of bad block header causing an infinite loop

else:
if Block_Value in tableInfoBlock['codes'] or Block_Value in tableDataRowBlock['codes']:
if Block_Value in tableInfoBlock['codes']:
formatA = tableInfoBlock['format'] # Establishes the format for the Struct module to unpack the data in.
tableCode, = struct.unpack(formatA,data[index+4:index+4+struct.calcsize(formatA)]) # unpaks the revision Type from the data list
DriveVars['tableCode'] = tableCode
binDataStartLoc = index+struct.calcsize(format)+struct.calcsize(formatA)
else:
tableCode = DriveVars['tableCode']
binDataStartLoc = index + struct.calcsize(format)

binData = data[binDataStartLoc:index+Block_Size]

if DEBUG >1:
print("Table Info: tableCode=%s" % str(tableCode))
print("row data: %s" % (binData,))

try:
tableName = tableHeaders[tableCode][tableNameOff]
abort = 0
except KeyError:
tableName = ''
print("DBLOG Block code %s not defined in tabledictionary.py" % str(tableCode))
abort = 1

if not abort:
rowData = binData.split(dblDelim)

tableColumns = tableHeaders[tableCode][colOff].split(dblDelim)

if len(rowData) > len(tableColumns):
#expand tableColumns with dummy cols so user has some access to data.
dummyCols = ['dummyCol%s' % (i,) for i in range(len(tableColumns),len(rowData))]
tableColumns.extend(dummyCols)

#expand with nuls if more cols than row output
rowData.extend(range(len(rowData),len(tableColumns)))

## Old Data Format
## dblData['P010_FORCE_CONSTANT'] = [
## {'ITER': '255', 'ZTAB': '9598', 'BDRAG': '0', 'FORCE_CONSTANT': '0', 'POINT': '0'},
## {'ITER': '255', 'ZTAB': '7638', 'BDRAG': '0', 'FORCE_CONSTANT': '0', 'POINT': '1'},
## {'ITER': '0', 'ZTAB': '5878', 'BDRAG': '0', 'FORCE_CONSTANT': '0', 'POINT': '2'},
## {'ITER': '0', 'ZTAB': '4503', 'BDRAG': '0', 'FORCE_CONSTANT': '0', 'POINT': '3'},
## ]
#dblData.setdefault(tableName,[]).append(dict(zip(tableColumns,rowData)))

## New Data Format
## dblData['P010_FORCE_CONSTANT'] = {
## 'ITER' : ['255', '255', '0', '0'],
## 'ZTAB' : ['9598', '7638', '5878', '4503'],
## 'BDRAG': ['0', '0', '0', '0'],
## 'FORCE_CONSTANT': ['0', '0', '0', '0'],
## 'POINT' : ['0', '1', '2', '3']
## }
dblData.setdefault(tableName,{})
for key,val in map(None,tableColumns,rowData):
dblData[tableName].setdefault(key, []).append(val)

# Block Size, So index will now reference the start of the next data block.
index = index+Block_Size

Re: Develop the new software for writing ROM for Seagate F3

February 23rd, 2018, 14:34

i know post is old
but i would like to say included winfof Script is not code for recalc 512 Block in Seagate
Algorithm is totally different and Block is not only 512 + CRC
there are other bytes added to Block
if you still need the Algorithm Let Me know

Re: Develop the new software for writing ROM for Seagate F3

February 23rd, 2018, 15:04

hpw333 wrote:i know post is old
but i would like to say included winfof Script is not code for recalc 512 Block in Seagate
Algorithm is totally different and Block is not only 512 + CRC
there are other bytes added to Block
if you still need the Algorithm Let Me know


i check it use Character not Byte like others , code is correct
but if you Follow winfof it use Byte sending with different alghorithm
other tools use above code by sending block as array of character with FOF aalghorithm

Re: Develop the new software for writing ROM for Seagate F3

March 4th, 2018, 11:25

alghorithm you attach is useless and not what seagate use in Read or write Rom Process

Re: Develop the new software for writing ROM for Seagate F3

March 21st, 2018, 17:46

Then what is the real crc can you post here

Re: Develop the new software for writing ROM for Seagate F3

June 20th, 2020, 8:36

i have sniffed this code( one side(not both) serial communication) from costly machine and software,
i don't know what command given to com port,but output log copied ,may it help someone

thanks

Repair_Master

Re: Develop the new software for writing ROM for Seagate F3

June 20th, 2020, 10:22

i have sniffed this code( one side(not both) serial communication) from costly machine and software,
i don't know what command given to com port,but output log copied ,may it help someone

thanks

Repair_Master
Attachments
Write rom_sniffed LOG_ST3500418AS_5VMHN11P_CC49.zip
(1014.65 KiB) Downloaded 1010 times

Re: Develop the new software for writing ROM for Seagate F3

June 21st, 2020, 2:22

@Repair_master, have you sniffed the serial communication during a ROM read?

Re: Develop the new software for writing ROM for Seagate F3

June 21st, 2020, 3:13

The CRC16 algorithm is "CRC-16/ARC":

https://crccalc.com/

You can use HxD (freeware hex editor) or the online calculator to calculate this CRC.

For example, a block of 0x200 x 0xFF produces a CRC of 0xB441.

Code:
Algorithm       Result      Check       Poly        Init        RefIn     RefOut    XorOut
CRC-16/ARC      0xB441      0xBB3D      0x8005      0x0000      true      true      0x0000

Re: Develop the new software for writing ROM for Seagate F3

June 22nd, 2020, 17:05

@Repair_master, very interesting code!
Could you also attach following memory dumps from this drive:
1) 0x0-0x40 from boot mode
2) 0x100000-0x10FFFF from normal diagnostic terminal mode
3) 0x80010000-0x80020000 from normal diagnostic terminal mode
4) output of Ctrl-I
Then the research can begin
Last edited by eaxi on June 22nd, 2020, 17:12, edited 1 time in total.

Re: Develop the new software for writing ROM for Seagate F3

June 22nd, 2020, 17:11

@Frank, CRC16/ARC both binary and sources are also available at:
https://github.com/moe123/www.wolfgang- ... -11-29.zip
https://github.com/moe123/www.wolfgang- ... -06-18.zip
and also a lot of other interesting crypto stuff

Re: Develop the new software for writing ROM for Seagate F3

June 22nd, 2020, 17:23

what research?

this is just stealing others' code, not research.
If you want to do real research, use the drive and not a dump of other people's code.

period.

pepe

Re: Develop the new software for writing ROM for Seagate F3

June 22nd, 2020, 17:45

This is what I found:

LibCRC – Open Source CRC Library in C:
https://www.libcrc.org/

This is Python code for calculating Seagate CRCs:
https://github.com/eurecom-s3/hdd_firmware_tools

Note that the you need to reverse the endianness of the dwords before calculating the CRC.

FWIW, I have written a FreeBasic version of this code:
http://www.users.on.net/~fzabkar/temp/ST_CRC16.bas
http://www.users.on.net/~fzabkar/temp/ST_CRC16.exe
Post a reply