Seagate boot ROM dump

[skeeter]

A few years back I used some python code to dump the bootloader ROM from a seagate F3 drive using the AP and RD commands within the bootloader

It was referenced in a slide presentation by Jonas Zaddach (starting on slide 18) and written by Travis Goodspeed
http://s3.eurecom.fr/~zaddach/docs/Recon14_HDD.pdf

I can't find this script.
Can anyone help ?

[fzabkar]

If you can't find the Python code, it shouldn't be too difficult to write a ZOC script to do this. You could modify the ZOC script I wrote for dumping WD's bootloader.

AIUI, the command sequence is …

AP 0<CR>
RD<CR>
RD<CR>
RD<CR>
etc

[E123]

fzabkar,

AP 0<CR>

-bootloader here. BootROM sits at 0x100000.)))
skeeter, What version BootROM you need? I've some dumps.

[fzabkar]

fzabkar,

AP 0<CR>

-bootloader here. BootROM sits at 0x100000.)))

I found this after I posted:

http://s3.eurecom.fr/~zaddach/docs/POC13_zaddach.pdf

Code:

Memory Range             Type

0x00000000 – 0x00008000  Code SRAM
0x00100000 – 0x00120000  ROM
0x00200000 – 0x00400000  Code DRAM
0x04000000 – 0x04004000  Data SRAM
0x40000000 – 0x50000000  IO
0x60000000 – 0x70000000  Data DRAM

[fzabkar]

If you would like to play with WD instead, here is the boot loader from a WD20EADS (uploaded via a ZOC script):

FFFF0000-FFFF2AFF.rar

(7.89 KiB) Downloaded 800 times

@Severence and I have been able to decompress WD's ROM code (@Severence has compiled a Windows version of LZHUF for this purpose). My ROM parsing tool extracts the various code segments.

Seagate's ROM segments are compressed with a different algorithm ("CPRS").

[skeeter]

Thanks for all the ideas, but I want to stick with seagate because it will make it much easier later when I get to the actual firmware code (having messages and diagnostics in text throughout....)

The version I have is:

SEA-3 Yeti Boot ROM 2.0 (12/06/2007)
Copyright Seagate 2007

[E123]

skeeter, https://yadi.sk/d/qMVdXFEuy4zUtg