Analysis of Seagate F3 Firmware UpdateThis tutorial is my attempt to understand Seagate's firmware updates. I will be analysing the
Moose SD1A update that was issued to address the
7200.11 BSY bug.
Firmware Update for ST3500320AS, ST3500620AS, ST3500820AS, ST3640330AS, ST3640530AS, ST3750330AS, ST3750630AS, ST31000340AS:
http://knowledge.seagate.com/articles/e ... Q/207951enIn particular, I will be using the following bootable CD ISO package which targets 2-platter models such as the
ST3500320AS:
http://www.seagate.com/staticfiles/supp ... 6-32MB.isoIMHO the easiest way to extract the files from the ISO is to use 7-Zip. Alternatively one could use IsoBuster in combination with WinImage.
The ISO contains a file named
Bootable_1.44M.img which is a virtual image of a 1.44MB floppy diskette. This floppy image is of a bootable
FreeDOS OS. The AUTOEXEC.BAT creates a RAM drive (Turbodsk), copies the files from the CD to the RAM drive, UNZIPs them and then executes FLASH.BAT.
SD1A2D.ZIP contains the actual payload for the update.
It includes
SD1A2D.LOD which is the firmware image file.
FLASH.BAT is the batch file that controls the update.
FDL464.EXE is the executable that downloads the firmware to the drive. It is an updated version of Seagate's original
SeaFlash utility, and has been packed with UPX.
After unpacking FDL464.EXE, we find the following embedded documentation:
http://www.users.on.net/~fzabkar/FLD464_usage.txtCode:
Usage: %s <port|#> <0|1|#> [options]
<port|#> Flash devices located at the specified base or any, '#',
port address. Port address must be in hexadecimal.
<0|1|#> Flash master, '0', slave, '1', or both, '#', devices.
-f <file> Specify the filename prefix of the flash files.
This defaults to 'seaflash' if not provided. Filename
extensions '.fls', '.ovl', '.crt', and '.tbl' are assumed.
-c Send a congen file, fully specified by -f.
-r Include the serial flash file when flashing.
-s Only send a single file, fully specified by -f.
-e <rev> Exclude firmare if this version exists.
-v Toggles verbose mode on/off. Default is off.
-l List supported models.
-u Feature spin up
Usage: %s <port|#> <0|1|#> [options]
<port|#> Flash devices located at the specified base or any, '#',
port address. Port address must be in hexadecimal.
<0|1|#> Flash master, '0', slave, '1', or both, '#', devices.
-e <rev> Exclude firmare if this version exists.
-v Toggles verbose mode on/off. Default is off.
-l List supported models.
-u Feature spin up
-k <UID> Specify the unique descriptor to flash
-z Spin down after flashing (Standby Immediate)
Usage: %s -m <name> [options]
-m <name> Specify the model family to flash.
-f <file> Specify the filename prefix of the flash files.
This defaults to 'seaflash' if not provided. Filename
extensions '.fls', '.ovl', '.crt', and '.tbl' are assumed.
-g <file> read a configuration file to get information on whether the
firmware should be downloaded to the specified model drive,
please refer to 'cfgreadme.txt'.
-h <file> read a configuration file to check valid drive model,
firmware version(full name)and firmware file name line by
line.if match all the parameters, starts downloading.
please refer to 'hcfgreadme.txt'
-j <file> encrypt the config file for -h option from *.cfg to *.cfs.
-o <file> decrypt the config file for -h option from *.cfs to *.cfg.
-c Send a congen file, fully specified by -f.
-r Include the serial flash file when flashing.
-s Only send a single file, fully specified by -f.
-p <port> Only flash devices located at the specified base
port address. Port address must be in hexadecimal.
-d <0|1> Only flash master, '0', or slave, '1', devices.
-e <rev> Exclude firmare if this version exists.
-v Toggles verbose mode on/off. Default is off.
-l List supported family names and models.
-u Feature spin up
-n Disable Promise 66/100/133 card.
-b Segmented download of DLDxx.BIN files , or
the -f <file> if specified.
-w SMART Clear Logs.
-t Diagnostics Unlock Of M2TD.
-i <Model> Tolerent or Explicit Model Check.
-k <UID> Specify the unique descriptor to flash
-a <seconds> Specify how long to delay after download complete
-z Spin down after flashing (Standby Immediate)
Usage: %s -<target> <datafile> -m <name> [options]
-<target> pm, ps, sm, ss (pm = primary master, etc..)
-m <name> Specify the model family to flash.
-c Send a congen file.
-r Include the serial flash file when flashing.
-s Only send a single file, fully specified by -f.
-v Toggles verbose mode on/off. Default is off.
-l List supported family names and models.
-b Segmented download of DLDxx.BIN files or the -f <file> if specified.
-w SMART Clear Logs.
-f <file> Specify the filename prefix of the flash files.
This defaults to 'seaflash' if not provided. Filename
extensions '.fls', '.ovl', '.crt', and '.tbl' are assumed.
-k <UID> Specify the unique descriptor to flash.
FLASH.BAT calls FDL464.EXE in either of two ways.
It can either explicitly specify the drive's parameters as follows:
FDL464.EXE -m %family% -f %firmware% -i %model% %options%... or it can make use of a configuration file to automatically select suitable candidates for the update:
FDL464.EXE -h %cfgfile% %options%Examples are ...
FDL464.EXE -m Moose -f SD1A2D.LOD -i ST3500320AS -s -x -b -v -a 20FDL464.EXE -h ms-sd1a.cfs -s -x -b -v -a 20Seagate's configuration files are encrypted. I don't know why they do this because the encryption algorithm is trivial. It simply involves substituting one ASCII character for another in a consistent manner.
Attached is my decoder software (
cfsdecod.exe). It is also available here:
http://www.users.on.net/~fzabkar/HDD/cfsdecod.exeSeagate uses two encryption schemes which I have identified as "old" and "new".
The subject CD ISO does not include a configuration file, but the original version of this update did.
This was the original "ms-sd1a.cfs" file:
http://www.users.on.net/~fzabkar/ms-sd1a.cfsCode:
092881
#Vttxj =866.77 Mnxy~ \MM7 gwfshm
#Vttxj =866.77 : mjfi
\]9;66986J\AV\67BB.\MM7.JMBBBB.BMBB.L6OBA8M\M7J.UXMAV\676L.\MM7.JZ7=66.\M7J.L6OO
\]9;66986J\AV\67BB.\MM7.JZ7966.\M7J.L6OOA8M\M7J.UXMAV\676L.\MM7.JZ7=66.\M7J.L6OO
\]9;66986J\AV\67BB.\MM7.M\BBBB.BMBB.L6OBA8M\M7J.UXMAV\676L.\MM7.JZ7=66.\M7J.L6OO
\]9;66986J\AV\67BB.\MM7.MbBBBB.BMBB.L6OBA8M\M7J.UXMAV\676L.\MM7.JZ7=66.\M7J.L6OO
\]9;66<86J\AV\67BB.\MM7.JMBBBB.BMBB.L6OBA8M\M7J.UXMAV\676L.\MM7.JZ7=66.\M7J.L6OO
\]9;66<86J\AV\67BB.\MM7.JZ7966.\M7J.L6OOA8M\M7J.UXMAV\676L.\MM7.JZ7=66.\M7J.L6OO
\]9;66<86J\AV\67BB.\MM7.M\BBBB.BMBB.L6OBA8M\M7J.UXMAV\676L.\MM7.JZ7=66.\M7J.L6OO
\]9;66<86J\AV\67BB.\MM7.MbBBBB.BMBB.L6OBA8M\M7J.UXMAV\676L.\MM7.JZ7=66.\M7J.L6OO
\]9;66>86J\AV\67BB.\MM7.JMBBBB.BMBB.L6OBA8M\M7J.UXMAV\676L.\MM7.JZ7=66.\M7J.L6OO
\]9;66>86J\AV\67BB.\MM7.JZ7966.\M7J.L6OOA8M\M7J.UXMAV\676L.\MM7.JZ7=66.\M7J.L6OO
\]9;66>86J\AV\67BB.\MM7.M\BBBB.BMBB.L6OBA8M\M7J.UXMAV\676L.\MM7.JZ7=66.\M7J.L6OO
\]9;66>86J\AV\67BB.\MM7.MbBBBB.BMBB.L6OBA8M\M7J.UXMAV\676L.\MM7.JZ7=66.\M7J.L6OO
#Vttxj =866.77 < mjfi
\]9=;6996J\AV\67BB.\MM7.JMBBBB.BMBB.KBBBA9M:M\M7J.UXMAV\677K.\MM7.JZ7=66.\M7J.K766
\]9=;6996J\AV\67BB.\MM7.JZ7966.\M7J.K766A9M:M\M7J.UXMAV\677K.\MM7.JZ7=66.\M7J.K766
\]9=;6996J\AV\67BB.\MM7.M\BBBB.BMBB.KBBBA9M:M\M7J.UXMAV\677K.\MM7.JZ7=66.\M7J.K766
\]9=;6<96J\AV\67BB.\MM7.JMBBBB.BMBB.KBBBA9M:M\M7J.UXMAV\677K.\MM7.JZ7=66.\M7J.K766
\]9=;6<96J\AV\67BB.\MM7.JZ7966.\M7J.K766A9M:M\M7J.UXMAV\677K.\MM7.JZ7=66.\M7J.K766
\]9=;6<96J\AV\67BB.\MM7.M\BBBB.BMBB.KBBBA9M:M\M7J.UXMAV\677K.\MM7.JZ7=66.\M7J.K766
#Vttxj =866.77 > mjfi
\]976669:6J\AV\67BB.\MM7.JMBBBB.BMBB.KBBBA9M:M\M7J.UXMAV\677K.\MM7.JZ7=66.\M7J.K766
\]976669:6J\AV\67BB.\MM7.JZ6BBB.BMBB.KBBBA9M:M\M7J.UXMAV\677K.\MM7.JZ7=66.\M7J.K766
\]976669:6J\AV\67BB.\MM7.JZ7966.\M7J.K766A9M:M\M7J.UXMAV\677K.\MM7.JZ7=66.\M7J.K766
\]976669:6J\AV\67BB.\MM7.MbBBBB.BMBB.KBBBA9M:M\M7J.UXMAV\677K.\MM7.JZ7=66.\M7J.K766
Here is the decoded version:
http://www.users.on.net/~fzabkar/MS-SD1A.TXTCode:
092881
;Moose 7200.11 Disty SDD1 branch
;Moose 7200.11 4 head
ST3500320AS MS01??.SDD1.AD????.?D??.C0F? 2DSD1A.LOD MS010C.SDD1.AQ1700.SD1A.C0FF
ST3500320AS MS01??.SDD1.AQ1300.SD1A.C0FF 2DSD1A.LOD MS010C.SDD1.AQ1700.SD1A.C0FF
ST3500320AS MS01??.SDD1.DS????.?D??.C0F? 2DSD1A.LOD MS010C.SDD1.AQ1700.SD1A.C0FF
ST3500320AS MS01??.SDD1.DY????.?D??.C0F? 2DSD1A.LOD MS010C.SDD1.AQ1700.SD1A.C0FF
ST3500620AS MS01??.SDD1.AD????.?D??.C0F? 2DSD1A.LOD MS010C.SDD1.AQ1700.SD1A.C0FF
ST3500620AS MS01??.SDD1.AQ1300.SD1A.C0FF 2DSD1A.LOD MS010C.SDD1.AQ1700.SD1A.C0FF
ST3500620AS MS01??.SDD1.DS????.?D??.C0F? 2DSD1A.LOD MS010C.SDD1.AQ1700.SD1A.C0FF
ST3500620AS MS01??.SDD1.DY????.?D??.C0F? 2DSD1A.LOD MS010C.SDD1.AQ1700.SD1A.C0FF
ST3500820AS MS01??.SDD1.AD????.?D??.C0F? 2DSD1A.LOD MS010C.SDD1.AQ1700.SD1A.C0FF
ST3500820AS MS01??.SDD1.AQ1300.SD1A.C0FF 2DSD1A.LOD MS010C.SDD1.AQ1700.SD1A.C0FF
ST3500820AS MS01??.SDD1.DS????.?D??.C0F? 2DSD1A.LOD MS010C.SDD1.AQ1700.SD1A.C0FF
ST3500820AS MS01??.SDD1.DY????.?D??.C0F? 2DSD1A.LOD MS010C.SDD1.AQ1700.SD1A.C0FF
;Moose 7200.11 6 head
ST3750330AS MS01??.SDD1.AD????.?D??.B??? 3D4DSD1A.LOD MS011B.SDD1.AQ1700.SD1A.B100
ST3750330AS MS01??.SDD1.AQ1300.SD1A.B100 3D4DSD1A.LOD MS011B.SDD1.AQ1700.SD1A.B100
ST3750330AS MS01??.SDD1.DS????.?D??.B??? 3D4DSD1A.LOD MS011B.SDD1.AQ1700.SD1A.B100
ST3750630AS MS01??.SDD1.AD????.?D??.B??? 3D4DSD1A.LOD MS011B.SDD1.AQ1700.SD1A.B100
ST3750630AS MS01??.SDD1.AQ1300.SD1A.B100 3D4DSD1A.LOD MS011B.SDD1.AQ1700.SD1A.B100
ST3750630AS MS01??.SDD1.DS????.?D??.B??? 3D4DSD1A.LOD MS011B.SDD1.AQ1700.SD1A.B100
;Moose 7200.11 8 head
ST31000340AS MS01??.SDD1.AD????.?D??.B??? 3D4DSD1A.LOD MS011B.SDD1.AQ1700.SD1A.B100
ST31000340AS MS01??.SDD1.AQ0???.?D??.B??? 3D4DSD1A.LOD MS011B.SDD1.AQ1700.SD1A.B100
ST31000340AS MS01??.SDD1.AQ1300.SD1A.B100 3D4DSD1A.LOD MS011B.SDD1.AQ1700.SD1A.B100
ST31000340AS MS01??.SDD1.DY????.?D??.B??? 3D4DSD1A.LOD MS011B.SDD1.AQ1700.SD1A.B100
Each line of the configuration file has the following syntax:
<
model number> <
original firmware package version> <
firmware file> <
final package version>
The SD1A update is intended to be applied to drives with the following firmware versions:
AD14, SD15, SD16, SD17, SD18, SD19, SD81However, as can be seen in the configuration file, there are certain SD1A package versions that are themselves updated by the SD1A update.
Here are other examples of decoded configuration files:
http://www.users.on.net/~fzabkar/6HSD4B.TXThttp://www.users.on.net/~fzabkar/BR-SD1B.TXThttp://www.users.on.net/~fzabkar/Brinks_3D6H_SD3B.txthttp://www.users.on.net/~fzabkar/dell_fw_cfg.txthttp://www.users.on.net/~fzabkar/HDD/4HCFGPRE.TXThttp://www.users.on.net/~fzabkar/HDD/6HSD4B.TXThttp://www.users.on.net/~fzabkar/HDD/8HCFGSD1.TXThttp://www.users.on.net/~fzabkar/HDD/AN-SD23.TXThttp://www.users.on.net/~fzabkar/HDD/AN-SD23X.TXThttp://www.users.on.net/~fzabkar/HDD/AN-SD24.TXThttp://www.users.on.net/~fzabkar/HDD/AN-SD25.TXThttp://www.users.on.net/~fzabkar/HDD/AN-SD26.TXThttp://www.users.on.net/~fzabkar/HDD/AN-SD28.TXThttp://www.users.on.net/~fzabkar/HDD/BG-CC32.TXThttp://www.users.on.net/~fzabkar/HDD/BR4HSD3B.TXThttp://www.users.on.net/~fzabkar/HDD/BRNKMOOS.TXThttp://www.users.on.net/~fzabkar/HDD/Brinks_1HSD2B.TXThttp://www.users.on.net/~fzabkar/HDD/Brinks_2HSD2B.TXThttp://www.users.on.net/~fzabkar/HDD/GR-CC4H.TXThttp://www.users.on.net/~fzabkar/HDD/GRCC4CD9.TXThttp://www.users.on.net/~fzabkar/HDD/JC47.TXThttp://www.users.on.net/~fzabkar/HDD/JC49.TXThttp://www.users.on.net/~fzabkar/HDD/JC49_STANDARD.TXThttp://www.users.on.net/~fzabkar/HDD/JC4A.TXThttp://www.users.on.net/~fzabkar/HDD/PH-CC3D.TXThttp://www.users.on.net/~fzabkar/HDD/PH-CC3E.TXThttp://www.users.on.net/~fzabkar/HDD/PH-CC46.TXThttp://www.users.on.net/~fzabkar/HDD/PH-CC49.TXThttp://www.users.on.net/~fzabkar/HDD/SN06BCFG.TXThttp://www.users.on.net/~fzabkar/HDD/SN06CCFG.TXThttp://www.users.on.net/~fzabkar/HDD/SN16BCFG.TXThttp://www.users.on.net/~fzabkar/HDD/SN16CCFG.TXTUsers will sometimes find that a drive which appears to be a suitable candidate for an update will be rejected by the updater. This is because its existing firmware package version isn't a match for any that are called out in the configuration file.
For example, see the qualifying entries for
ST2000DM001 models with firmware version
CC49 in the following update matrix:
http://www.users.on.net/~fzabkar/HDD/GRCC4CD9.TXTST2000DM001-9YN164;GR75?C.CCD4.BD01AR.
CC49.C399;GRCC4C4H.LOD;GR753C.CCD4.BD02AR.CC4C.C39A
ST2000DM001-9YN164;GR75?D.CCD4.BD01AR.
CC49.D399;GRCC4C6H.LOD;GR753D.CCD4.BD02AR.CC4C.D39A
ST2000DM001-9YN164;GR75?C.CCD4.BD01AR.
CC49.D399;GRCC4C6H.LOD;GR753D.CCD4.BD02AR.CC4C.D39A
CC49 firmware that doesn't match any of the above 3 entries will not qualify for the update and will be rejected.
References:
UPX: the Ultimate Packer for eXecutables:
http://upx.sourceforge.net/7-Zip:
http://www.7-zip.org/IsoBuster:
http://www.isobuster.com/WinImage:
http://www.winimage.com/Original article:
http://malthus.zapto.org/viewtopic.php? ... 3165#p3165