All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 16 posts ] 
Author Message
 Post subject: Anyone knows which family is this?
PostPosted: April 10th, 2018, 6:34 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2785
Location: Kuwait
Hello Guys...

Anyone knows which Fam. is it?

WD10SMZW-11Y0TS0

WD10SPZX-22Z10T0


Thank you...

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein


Top
 Profile  
 
 Post subject: Re: Anyone knows which family is this?
PostPosted: April 10th, 2018, 9:07 
Offline
User avatar

Joined: July 12th, 2010, 4:38
Posts: 1418
Location: Portugal
You can't go into module 5C?

_________________
http://www.pclab.com.pt facebook.com/PCLAB.A.T
ACELab partner


Top
 Profile  
 
 Post subject: Re: Anyone knows which family is this?
PostPosted: April 10th, 2018, 10:25 
Offline
User avatar

Joined: September 29th, 2005, 12:02
Posts: 3561
Location: Chicago
It's Palmer

_________________
SAN, NAS, RAID, Server, and HDD Data Recovery.


Top
 Profile  
 
 Post subject: Re: Anyone knows which family is this?
PostPosted: April 10th, 2018, 11:02 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2785
Location: Kuwait
pclab wrote:
You can't go into module 5C?


Drive is SED Locked (no SA Access) and correction its C5 :wink:

Doomer wrote:
It's Palmer


Thank you Doomer & pclab

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein


Top
 Profile  
 
 Post subject: Re: Anyone knows which family is this?
PostPosted: June 11th, 2018, 7:08 
Offline

Joined: February 18th, 2015, 3:50
Posts: 36
Location: Malasia
Quote:
Drive is SED Locked (no SA Access)



Does Any one have a solution to the above problem
I have a similar drive probably "Palmer" Family with a SLOW READING problem
Need to clear Relo
Has Anyone managed to Unlock and resolve this issue
Thanks


Top
 Profile  
 
 Post subject: Re: Anyone knows which family is this?
PostPosted: June 13th, 2018, 10:34 
Offline

Joined: March 7th, 2009, 12:43
Posts: 1080
Location: Angel Data Recovery
DR_COMPULAB wrote:
Quote:
Drive is SED Locked (no SA Access)



Does Any one have a solution to the above problem
I have a similar drive probably "Palmer" Family with a SLOW READING problem
Need to clear Relo
Has Anyone managed to Unlock and resolve this issue
Thanks

This drives are very different to previuse families. There is double layer translator and still no way to deal with SA.
If you are able to image it slowly, check what data are you getting. There is a chance it is only zerois.

_________________
Angel Data Recovery


Top
 Profile  
 
 Post subject: Re: Anyone knows which family is this?
PostPosted: September 10th, 2018, 17:16 
Offline
User avatar

Joined: June 11th, 2013, 17:01
Posts: 1710
Location: Phoenix, AZ USA
I have just had one of these drives in WD20SMZW. Here is a copy of the ROM FYI. I have heard a few people say the ROM is encrypted, but this one is not. However its certainly a strange layout.


Attachments:
ROM.7z [615.53 KiB]
Downloaded 840 times

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group
Top
 Profile  
 
 Post subject: Re: Anyone knows which family is this?
PostPosted: September 10th, 2018, 23:23 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
The significant differences that I can see are ...

    4 new adaptive ROYL modules (181h, 1A2h, 1B0h and 1B6h)
    4-byte CRC for boot loader (previously was 1-byte or 2-byte checksum)
    new encrypted/compressed (?) 0x108-byte block at end of boot loader
    new encrypted/compressed (?) 0x100-byte block at end of PCMBlk 01h

new encrypted/compressed (?) 0x108-byte block at end of boot loader

Code:
Offset(h) 00   02   04   06   08   0A   0C   0E

00001EF0                      A7EB 0DC7 3FFA E0CA
00001F00  1B1F E96C ED65 5EBB F1B4 30EE 607E 4936
00001F10  8575 8E73 1CEC B5D5 90DE 6737 040F 106E
00001F20  19B2 9903 F13F CE39 642B AC16 1331 6CED
00001F30  2F18 5772 A7EF 3F1E 9DA5 69CA EE57 7E4A
00001F40  FA07 414D 0611 CC7A 746D A86A 15A9 0745
00001F50  3D5B 79B6 D1A9 16EE 2773 40BF 260C BB5D
00001F60  8230 2E50 40E0 98B3 A6A6 8255 B7C7 A93A
00001F70  A810 BFCD 4C5D 67DF 012A C648 D40C 0324
00001F80  5C0F CFAB 4E47 C0DD A1A3 7D3F 3C8C 7786
00001F90  6E03 4430 63C3 E2F6 D7FE 59A3 3F0F 53A6
00001FA0  69C6 F556 762F 8FCA C3B7 1E08 298D 9A99
00001FB0  5C50 F21C 702A C63A B1F5 1F38 9ACB 7CBB
00001FC0  5DF7 9DAC 2938 6A64 8DFB DD9D 56D3 DD15
00001FD0  BA9C BF55 C88A 05EF D116 BEDE C19F 96CE
00001FE0  394E E71C A926 2677 6192 DECA 4C73 2D56
00001FF0  55F1 DFE6 54B7 5EE1 0000 0000 0100 0100

new encrypted/compressed (?) 0x100-byte block at end of PCMBlk 01h

Code:
Offset(h) 00   02   04   06   08   0A   0C   0E

000049A0    2E E51F EA0C C246 B8A8 26EF 9BF1 32C6
000049B0  9296 9877 6EED 1543 6132 2685 99AE 6D92
000049C0  A7A4 6046 9196 1616 A25D 69F6 C0AE 5064
000049D0  4624 B182 D704 51B6 D8A4 00E1 B284 43F2
000049E0  5EF6 5429 9FF7 9E38 4EDE 56E5 D4E0 D6FB
000049F0  D889 12C9 DAB7 B79B 6CAE CBE2 C362 F68F
00004A00  7E8C DAED 53D2 94E4 23F4 B456 0365 0AFF
00004A10  6700 7E98 95AC D6CF CC81 83A5 5BE8 5B27
00004A20  6A21 1D1C A6DA 7DCE 5406 A66F 8269 C707
00004A30  F15C B5EC 48A2 B22C 4B70 6420 D66B 47D0
00004A40  6E05 C6C6 BC9D 2319 E2EE C1E3 8A27 0D63
00004A50  D561 F14A 9708 FE45 23B8 9181 F37B B77B
00004A60  3468 AC7E 3A86 ACD7 E4D0 72BE 0ADB 96E2
00004A70  B782 8494 1D23 1E18 F3A0 C766 75B6 8F88
00004A80  F4E8 E8F9 0529 9461 5E04 5247 3D9B 9BD7
00004A90  A0CD 150A 9206 5751 B7F0 B7CC AB6D 6FA2
00004AA0  CD

Code:
Analysing ROM.bin ...

Searching for LDSCs and verifying PCMBlocks ...

LDSC   LDSC    PCMBLock       PCMBlk CS
Start  ID CS   Start - End     Exp/Act
---------------------------------------
00000  5A ED   00000 - 1FFFF  3E8E23F7 / ???   (cksm/CRC computed over 0x20 + 0x1B24)
02000  01 49   02180 - 04AA0    84   84   OK   (cksm computed over 0x2180 + 0x2820)
02020  02 9B   04AA1 - 08B31    4F   4F   OK
02040  03 92   08B32 - 08F26    D3   D3   OK
02060  04 39   08F27 - 0DCAF    C8   C8   OK
02080  05 AF   0DCB0 - 0E7BC    FA   FA   OK
020A0  06 A0   0E7BD - 0EC5D    79   79   OK
020C0  07 16   0EC5E - 14AF6    A0   A0   OK
020E0  08 51   14AF7 - 14F17    81   81   OK
02100  09 48   14F18 - 175A0    26   26   OK
02120  0A 91   175A1 - 17981    93   93   OK
02140  0B BE   17982 - 2FBFA    D7   D7   OK
02160  0C 2B   2FBFB - 553D3    8A   8A   OK

82000  01 49   82180 - 84AA0    96   96   OK   (cksm computed over 0x82180 + 0x2820)
82020  02 9B   84AA1 - 88B31    4F   4F   OK
82040  03 92   88B32 - 88F26    D3   D3   OK
82060  04 D9   88F27 - 8DCFF    21   21   OK
82080  05 00   8DD00 - 8E80C    82   82   OK
820A0  06 F1   8E80D - 8ECAD    79   79   OK
820C0  07 56   8ECAE - 94B3A    C0   C0   OK
820E0  08 9A   94B3B - 94F5B    75   75   OK
82100  09 84   94F5C - 975E0    A4   A4   OK
82120  0A D1   975E1 - 979C1    49   49   OK
82140  0B 69   979C2 - AFCFA    61   61   OK
82160  0C 37   AFCFB - D552B    B3   B3   OK

LDSC   = PM Loader Config String (32 bytes)
ID     = ID byte of LDSC (byte #0)
CS     = Checksum byte or word
PCMBlk = Program Code Memory Block
Exp    = Expected checksum for PCMBLock
Act    = Actual checksum for PCMBLock


ROYL directory module 0x000B found at 0x0007F43E

Active directory flag = 0x03

Identifying SA regions ...

Reg#  Reg size    Reg loc
----------------------------
0x00  0x000A6338  0x000AA497
0x01  0x000A6338  0x00154933

Verifying ROYL modules ...

ID          Size (bytes)         Address    Checksum
dir   hdr    dir       hdr
-----------------------------------------------------
0001  N/A    00004000  N/A        00000000             N/A
000A  OK     0000004E  00000200   0007E000   00000000  OK
000B  OK     0000013D  00000200   0007F43E   00000000  OK
020B  OK     0000013D  00000200   0007D43E   00000000  OK
0030  OK     00000400  OK         000FE000   00000000  OK
0047  OK     000006A4  00000800   0007E556   00000000  OK
000D  OK     00000108  00000200   0007E04E   00000000  OK
004F  OK     00000400  OK         0007E156   00000000  OK
0181  OK     00000C00  00000C00   000FE400   00000000  OK
01A2  OK     0000007E  00000200   0007EBFA   00000000  OK
01B6  OK     0000069E  00000800   0007EC78   00000000  OK
01B0  OK     00000128  00000200   0007F316   00000000  OK

ROYL directory module 0x020B found at 0x0007D43E

Active directory flag = 0x02

Identifying SA regions ...

Reg#  Reg size    Reg loc
----------------------------
0x00  0x000A6338  0x000AA497
0x01  0x000A6338  0x00154933

Verifying ROYL modules ...

ID          Size (bytes)         Address    Checksum
dir   hdr    dir       hdr
-----------------------------------------------------
0001  N/A    00004000  N/A        000A5024             N/A
000A  OK     0000004E  00000200   0007C000   00000000  OK
000B  OK     0000013D  00000200   0007F43E   00000000  OK
020B  OK     0000013D  00000200   0007D43E   00000000  OK
0181  OK     00000C00  00000C00   000FE400   00000000  OK
0030  OK     00000400  OK         000FE000   00000000  OK
0047  OK     000006A4  00000800   0007C556   00000000  OK
000D  OK     00000108  00000200   0007C04E   00000000  OK
004F  OK     00000400  OK         0007C156   00000000  OK
01A2  OK     0000007E  00000200   0007CBFA   00000000  OK
01B6  OK     0000069E  00000800   0007CC78   00000000  OK
01B0  OK     00000128  00000200   0007D316   00000000  OK


dir  -  Module ID/Size as reported in directory module (0x20B or 0x0B)
hdr  -  Module ID/Size as reported in module's header
N/A  -  Not Applicable
BAD  -  Module has invalid checksum. This may be due to non-existent or uninitialised module.

ROM modules saved to Flash$$$\000Bmods and Flash$$$\020Bmods

Active directory is 0x0B

Analysing active 0x0A module ...

Head map checksum (Expected / Actual) = 0x0000 / 0x0000 - OK
Number of heads (physical / in use) = 4/4
Head map #1 = 0x000F / 0b0000000000001111
Head map #2 = 0x000F / 0b0000000000001111

DCM = | R | N Z 7 A 1 N S
      : : : : : : : : : :
      : : : : : : : : : unknown
      : : : : : : : : top VCM
      : : : : : : : ACA
      : : : : : : bottom VCM
      : : : : : HSA
      : : : : media
      : : : preamp
      : : latch
      : base
      spindle motor

Analysing active 0x0D module ...

Firmware Version = 01.01A01
World Wide Name = 50014EE608B04EA3
Model Number = WDC WD20SMZW-11YFCS0
Serial Number =


Analysing active 0x4F module ...

ROM version = 0005000J

Analysing active 0x47 module ...

Preamp values
-----------
0  01300573
1  012A057E
2  0130057E
3  012E047E

Microjogs
-------
0  0000
1  0000
2  0000
3  0000

Head/Media DCM = 7Z

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Anyone knows which family is this?
PostPosted: September 11th, 2018, 17:59 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
PCMBlk 0x06 (ROM offsets 0xE7BD - 0xEC5D) is ROYL module 0xDDDD (plus checksum byte at end). The 32-bit checksum of the ROYL module is 0x00000000.

Module offsets 0x34 - 0x13B are a copy of the new encrypted/compressed (?) 0x108-byte block at the end of the boot loader. This block is preceded by an "sp01" header.

Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  52 4F 59 4C 03 80 30 00 DD DD 03 00 A3 F9 49 7A  ROYL.€0.ÝÝ..£ùIz
00000010  30 30 30 35 30 30 30 38 07 07 07 00 00 00 55 AA  00050008......Uª
00000020  00 00 A0 04 00 00 00 00 00 00 00 00 00 00 00 00  .. .............
00000030  73 70 30 31 A7 EB 0D C7 3F FA E0 CA 1B 1F E9 6C  sp01............
                      ^^ start of block
00000040  ED 65 5E BB F1 B4 30 EE 60 7E 49 36 85 75 8E 73
........
00000120  A9 26 26 77 61 92 DE CA 4C 73 2D 56 55 F1 DF E6
00000130  54 B7 5E E1 00 00 00 00 01 00 01 00
                                           ^^ end of block


Attachments:
ROM_part_06.rar [1.23 KiB]
Downloaded 773 times

_________________
A backup a day keeps DR away.
Top
 Profile  
 
 Post subject: Re: Anyone knows which family is this?
PostPosted: September 11th, 2018, 18:13 
Offline
User avatar

Joined: June 11th, 2013, 17:01
Posts: 1710
Location: Phoenix, AZ USA
@fzabkar, what did you use to break down this ROM?

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group


Top
 Profile  
 
 Post subject: Re: Anyone knows which family is this?
PostPosted: September 11th, 2018, 18:18 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
I used my own tool (plus manual edits), but I gleaned much of the information from research done by NazYura many years ago.

Analysis of the "ROM" code on a Western Digital WD2500BB-55RDA0 PCB:
http://www.hddoracle.com/viewtopic.php?f=59&t=181

Analysis of the "ROM" on a Western Digital ROYL HDD:
http://www.hddoracle.com/viewtopic.php?f=59&t=225

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Anyone knows which family is this?
PostPosted: September 11th, 2018, 18:28 
Offline
User avatar

Joined: June 11th, 2013, 17:01
Posts: 1710
Location: Phoenix, AZ USA
fzabkar wrote:
I used my own tool (plus manual edits), but I gleaned much of the information from research done by NazYura many years ago.

Analysis of the "ROM" code on a Western Digital WD2500BB-55RDA0 PCB:
http://www.hddoracle.com/viewtopic.php?f=59&t=181

Analysis of the "ROM" on a Western Digital ROYL HDD:
http://www.hddoracle.com/viewtopic.php?f=59&t=225

Many thanks for sharing.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group


Top
 Profile  
 
 Post subject: Re: Anyone knows which family is this?
PostPosted: September 27th, 2018, 16:49 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
PMCBlock 05 is compressed. When I decompress it, I find a second, but larger copy of ROYL module 0xDDDD (checksum = 0x00000000). :o :?

Code:
Offset(h) 00   02   04   06   08   0A   0C   0E

00000000  524F 594C 0380 3000 DDDD 0700 2F26 01CD  ROYL.€0.ÝÝ../&.Í
00000010  3030 3035 3030 3038 0707 0700 0000 55AA  00050008......Uª
00000020  0000 480D 0000 0000 0000 0000 0000 0000  ..H.............
00000030  7370 3031 A7EB 0DC7 3FFA E0CA 1B1F E96C  sp01............

See my attachment.

    PCMBlknn_nnnnn.bin -- non-compressed sections of the ROM
    revBlknn_nnnnn.bin -- compressed sections of the ROM (converted to big endian)
    decBlknn_nnnnn.bin -- decompressed sections of the ROM

These are the tools I'm using:

http://www.users.on.net/~fzabkar/temp/wdROMv12.exe
http://www.users.on.net/~fzabkar/temp/wdROMv12.bas

http://www.hddoracle.com/download/file.php?id=7412 (LzHuf.7z)
http://www.hddoracle.com/download/file.php?id=7414 (LZHUFDOS.7z)

How to decompress PMCBlocks:
http://www.hddoracle.com/viewtopic.php?f=59&t=181&p=18963#p18963


Attachments:
WD20SMZW_ddrecovery.rar [668.2 KiB]
Downloaded 779 times

_________________
A backup a day keeps DR away.
Top
 Profile  
 
 Post subject: Re: Anyone knows which family is this?
PostPosted: September 27th, 2018, 16:54 
Offline
User avatar

Joined: September 29th, 2005, 12:02
Posts: 3561
Location: Chicago
DDDD is a security overlay for initial security initialization and digital signature (of code modules) checking

_________________
SAN, NAS, RAID, Server, and HDD Data Recovery.


Top
 Profile  
 
 Post subject: Re: Anyone knows which family is this?
PostPosted: September 27th, 2018, 17:41 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
I notice that the decompressed 0xDDDD module is identical with the one in the following thread, except for the version number (00050006 versus 00050008):

http://forum.hddguru.com/viewtopic.php?f=24&t=37429&p=264102#p264102 (wd10spzx-22z10t1)

This would suggest that the digital signature is not unique to each HDD.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Anyone knows which family is this?
PostPosted: September 27th, 2018, 18:17 
Offline
User avatar

Joined: September 29th, 2005, 12:02
Posts: 3561
Location: Chicago
fzabkar wrote:
This would suggest that the digital signature is not unique to each HDD.

Digital signature depends on the content(code content), if content is the same then the signature is the same.

Usual digital signature is SHA hash of the code and then RSA encryption of the SHA hash

_________________
SAN, NAS, RAID, Server, and HDD Data Recovery.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 16 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Google [Bot] and 89 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group