patch hdd firmware to read failed drive

[PAKComputers]

Anyone interested in collaborating on a project to decompile/patch a drives firmware to skip the factory initialization and boot with some reasonable defaults.

The patched fw could keep changing the adaptives to determine what will work for each head.

What I am trying to accomplish is reading the user area of a drive with the SA tracks are scratched off the platter.

I am even open to controlling the drive via JTAG (http://www.malwaretech.com/2015/04/hard ... art-1.html)

[data-medics]

Yes, I don't think this is really a new idea. Just one that most people who investigated found would be nearly impossible. Even if WD were willing to share their source code, it'd still be a massive undertaking.

[PAKComputers]

I agree that each manufacturer/family would be different.
It seems so simple to me.....

determine the head positioning and raw read routines in the firmware.
get the firmware to boot in a crippled state and dump the data sequentially that it can read.
afterward, build a virtual translator, or even scan the raw data as-is to get the users data.

I understand that this is over-simplifing a very complex task, but if raw track data
was available, there are a lot of very capable people that could reassemble the files.
Keep in mind that these are worst case scenarios that assume the translator is unavailable.

does anyone know of any firmware that has been decompiled ?

[guru]

Nice, can't wait to see your efforts.

This may be a task for Spildit & Franc.

[HaQue]

does anyone know of any firmware that has been decompiled ?

search term:

decompile hard disk firmware

https://spritesmods.com/?art=hddhack&page=4
http://www.s3.eurecom.fr/slides/bh13us_zaddach.slides.pdf

Steps same as any other firmware:

1. unpack/unzip/deobfuscate an update, download a firmware. look on hddguru files, for example
2. decompile, you will need to be familiar, or learn Arm/Thumb and have relevant tools

recompiling/patching will probably be quite a hurdle

[Dmitri]

Anyone interested in collaborating on a project to decompile/patch a drives firmware to skip the factory initialization and boot with some reasonable defaults.

To reverse engineer a hard drive down to the initialization level you'll need to be able to read it like a book first. That's prior to any interference in the process.

The patched fw could keep changing the adaptives to determine what will work for each head.

Should you succeed, you'll be a pioneer in this area, I haven't heard anyone did this before.

I am even open to controlling the drive via JTAG

JTAG doesn't care where it is, it doesn't depend on device type, it's just a tunnel to the processor mind.
JTAG isn't something to intervene in a hard drive operation, but to intervene in a CPU work. And CPU isn't equal to whole device.

Anyway, that's a good ambition. Should it born a specialist of such a high level, I'm for it.

[guru]

@Spildit To gain knowledge you need to practice. Put some effort into it and you shall be rewarded. I don't see why you cannot try, you have a thirst to learn.

I always prefere to eat my own grown vegetables.


I agree with Dmitri.

[Suitsof]

Actually, I agree with Dmitri. Moreover, most drive operations runs in memory, anyway you have to know necessary vendor commands to work with memory. And whatever you do, usually it's impossible to prevent contact between a heads and damaged surfaces. Theoretically, it's possible to do by filling scratches by neutral sliding material and/or edit DFH parameter, but it's really a LOT of work, and I don't know about any strong successful methods.
I don't know about other vendors, but Seagate company made a special firmware, where is all background processes (SMART, pending, reallocation etc.) are switched off to help drive ignore problems with initialization. Of course, not for share...

[Amarbir[CDR-Labs]]

Actually, I agree with Dmitri. Moreover, most drive operations runs in memory, anyway you have to know necessary vendor commands to work with memory. And whatever you do, usually it's impossible to prevent contact between a heads and damaged surfaces. Theoretically, it's possible to do by filling scratches by neutral sliding material and/or edit DFH parameter, but it's really a LOT of work, and I don't know about any strong successful methods.
I don't know about other vendors, but Seagate company made a special firmware, where is all background processes (SMART, pending, reallocation etc.) are switched off to help drive ignore problems with initialization. Of course, not for share...

Question ,
How Do You Know Seagate Has that ? .

[pepe]

I am doing DFH, bias and gain tuning on the fly ... that's a good thing, especially with the new drives being picky about heads...