Get ROM over TTL from a WD SED (USB)

[Roberto]

Anyone knows if it is possible to read ROM over TTL from a SED WD USB HDD?

How are the pin assignments ?

[fzabkar]

I would locate a SATA PCB with the same MCU. Presumably you would know the Tx/Rx jumper pins for this SATA PCB. Now use your eyes or DMM to follow these pins back to the MCU. This will identify the MCU's Tx/Rx UART pins. Now take your USB PCB, locate those same MCU pins, and follow them to the 12-pin header.

[Doomer]

Depends on the model
Some Spyglasses and Palmer and newer models block access to the serial port

[Roberto]

Thank you for your answers.
Model is: WDC WD10JMVW-11AJGS3
I think it is FBLITE series.

Is it possible to read ROM over TTL for FBLITE series?

[Doomer]

Yes, it should be possible

[manager_lg]

Roberto, it's funny that a WD Image Decryption Tool developer asks a question like this Why don't you just use an SPI flashrom programmer? Yes it is possible to read ROM over TTL but as Fzabkar said the best way to locate the RX/TX pins is to compare the USB PCB to SATA compatible one. If you tell us the USB PCB number/MCU we might help you by uploading hi-res. pics of a SATA compatible PCB.

[Roberto]

Roberto, it's funny that a WD Image Decryption Tool developer asks a question like this

Yeah this really seems strange

Why don't you just use an SPI flashrom programmer?

The chip label can not be read by me. The font is somehow blurred. I don't want to burn the chip with wrong settings/connection.

If you tell us the USB PCB number/MCU we might help you by uploading hi-res. pics of a SATA compatible PCB.

PCB number is 2060-771961-001 REV B.
MCU I can tell tomorrow or on sunday.

Thank you for your help.

[fzabkar]

Why don't you just use an SPI flashrom programmer?

The chip label can not be read by me. The font is somehow blurred. I don't want to burn the chip with wrong settings/connection.

Measure the voltage between pins 8 and 4. That's Vcc.

If you tell us the USB PCB number/MCU we might help you by uploading hi-res. pics of a SATA compatible PCB.

PCB number is 2060-771961-001 REV B.

Rev A of the USB 2060-771961 PCB has an 88i9446-NDB2 MCU, as does Rev P1 of the SATA 2060-771933 PCB.
https://www.hdd-parts.com/14111882.html
https://disk-on.ru/img/images/pcb/2060-771933-000_REV_P1__2.jpg

The 2060-771945-001 REV A PCB appears to have the same MCU, even though it is a 3.5" PCB:
https://www.hdd-parts.com/17124424.html

[Roberto]

Measure the voltage between pins 8 and 4. That's Vcc.

Thank you fzabkar, you have (always) good ideas and methods.
Unfortunately, the chip can not be read.
I think it would have to be desoldered from the PCB.

I'll go for the TTL variant.

[HddDonorMarket]

Also 771961-001 rev a (usb ) -771960-001 rev a (sata ) compatible.

I have read Rom and modules directly from with MRT. (11AJGS2)
Mrt doesn't read All model . This model allowed over usb.

[Roberto]

Also 771961-001 rev a (usb ) -771960-001 rev a (sata ) compatible.

I have read Rom and modules directly from with MRT. (11AJGS2)
Mrt doesn't read All model . This model allowed over usb.

Can you also read ROM and modules when HDD is encrypted with unknown password?

[HddDonorMarket]

Also 771961-001 rev a (usb ) -771960-001 rev a (sata ) compatible.

I have read Rom and modules directly from with MRT. (11AJGS2)
Mrt doesn't read All model . This model allowed over usb.

Can you also read ROM and modules when HDD is encrypted with unknown password?

I have discovered that nowadays. I read Rom via usb . Writed to sata pcb. Just now I am cloning that drive.
I haven't tested decrypted disks yet.
Also , I cannot read all usb drives rom and modules from usb connection. This is my second disk that I could get ROM via directly usb without any equipment and any trick.

[maximus]

I have discovered that nowadays. I read Rom via usb . Writed to sata pcb. Just now I am cloning that drive.
I haven't tested decrypted disks yet.
Also , I cannot read all usb drives rom and modules from usb connection. This is my second disk that I could get ROM via directly usb without any equipment and any trick.

The reason you can't read the ROM on all drives through USB is that some of the SED locked drives do not allow it. Trust me, I tried to even see if I could put one in safe "kernel" mode and send direct USB commands, but the board would reject all commands with a device not ready error. I think that is why Roberto is asking about reading over TTL, USB won't work on that drive.

[HddDonorMarket]

I have discovered that nowadays. I read Rom via usb . Writed to sata pcb. Just now I am cloning that drive.
I haven't tested decrypted disks yet.
Also , I cannot read all usb drives rom and modules from usb connection. This is my second disk that I could get ROM via directly usb without any equipment and any trick.

The reason you can't read the ROM on all drives through USB is that some of the SED locked drives do not allow it. Trust me, I tried to even see if I could put one in safe "kernel" mode and send direct USB commands, but the board would reject all commands with a device not ready error. I think that is why Roberto is asking about reading over TTL, USB won't work on that drive.

I am not sure .
My another experience is
I had a usb drive. I cannot read Rom from original pcb. But I replaced another rom chip by soldering. I can read second Rom over same usb pcb. Both drive doesn't have SED.

A)1 TB usb 3 2060 771961 001 RevA WD10JMVW 11AJGS1
B)1 TB Sata 2060 771960 000 RevA WD10JPVX 22JC3T0

I replaced B Rom to A usb PCB .
MRT read all modules and ROM over only USB connection to computer. Also read and write module working. And I tried to convert it to sata 771959 pcb. I cannot get modules and rom. But I get them from 771961 usb pcb.

I tried with A original ROM . MRT Not read modules and rom over usb connection
It's very very strange.

So there must be a way to read WD USB drives modules over usb

[Roberto]

I haven't tested decrypted disks yet.

It's a big difference when the HDD is encrypted.

Also , I cannot read all usb drives rom and modules from usb connection. This is my second disk that I could get ROM via directly usb without any equipment and any trick.

Yes, but this (most times) only works over USB connection if the HDD is not password protected and encrypted.
If the HDD is protected you have to unlock it first, before you can access ROM, MODULES, TRACKS, etc. over USB.

[Roberto]

The reason you can't read the ROM on all drives through USB is that some of the SED locked drives do not allow it. Trust me, I tried to even see if I could put one in safe "kernel" mode and send direct USB commands, but the board would reject all commands with a device not ready error. I think that is why Roberto is asking about reading over TTL, USB won't work on that drive.

Yes this SEDs protect themselves if you don't unlock them first. At least that's also my experience.
Thanks for your support

[HddDonorMarket]

I have read Rom and all modules from USB
WD20NMVW-11AV3S2 2060 771961 001 REV A

Nothing read from USB
WD20NMVW-11EDZS7 2060 771961 001 REV B

[HddDonorMarket]

This is a theory about my last post.
If H0 and H1 (both) died, not possible read ROM and modules over USB port with MRT
If one of them H0 or H1 working , possible to read .

Because now H0 and H7 was died initial
WD20NMVW-11AV3S2 2060 771961 001 REV A .
Now H1 died when getting data from working head.

I tried again get ROM and modules over USB but now I cannot get .


For
WD20NMVW-11EDZS7 2060 771961 001 REV B

I did remove capacitor and wire to esterma Sata connector. I can get ROM properly.

[Amarbir[CDR-Labs]]

Well,
I Did Not Read The Whole Stuff Written But .....

FBlite : Non SED Or SED Can Be Read By TTL ,There is No Issue Like Blocking Etc , Keep PCB Alone By Giving Power And Attaching Com Port To Pins For 6 Minutes And Voila Its Done ,I Have Recovered Hundreds of Drives ,PCB Has To Be Removed And Connected To Tool Alone