corrupted ROM

Hi Everyone,

I have a WD drive (WD10SPSZ-24Z10T1) to recover after what seems to be an overvoltage or shortcircuit on the motherboard...

I've found the HDD not spinning. replacing the PCB with another one made the drive turn and windows recognized it uninitialiazed.

I've tied to dump the ROM from the orginal PCB into the new PCB but then the HDD didn't want to spin anymore...

As far as I went through i realized that the F/W version was different on the 2 drives but i also think that their is a chance for the datas in the original ROM was corrupted because i was able to read it only once and after it doesn't worked anymore...

I have looked in both BIN files and realized that their was a "missing part" in the original ROM (perhaps a reading issue...)...

I am quite new in this kind of troubleshooting and I can't really find a clue on my case, i am a bit afraid of going further without any advices.

Do you guys think i can recover my datas with a ROM coming from a drive with another F/W version ? Or maybe i is posssible to fix the original ROM file by filling the "missing part" ?

Attachments

ROMs.rar: the two bin files extracted from the ROMs; (1.24 MiB) Downloaded 472 times

This is my WD ROM analysis tool:

http://users.on.net/~fzabkar/FreeBasic_W32/WD/wdROMv17.bas
http://users.on.net/~fzabkar/FreeBasic_W32/WD/wdROMv17.exe

Code:: Analysing damaged drive FW version 05,01A05.bin ... Searching for LDSCs and verifying PCMBlocks ... LDSC LDSC Att PCMBlock RAM size PCMBlk CS Start ID CS Start - End address RAM / ROM Exp/Act ----- -- -- -- ----- ----- -------- ------ ----- --------- 0 5A ED 04 20 - 1B47 1000 1B24 1B24 467D8B41 000B23BD BAD (not digitally signed) 000AA428 000AA693 BAD (digitally signed) 2000 01 49 04 2180 - 4AA0 49688 2820 2820 EC 3C BAD 2020 02 58 11 4AA1 - 8B6D 30080000 c 5600 40CC E4 57 BAD 2040 03 CE 0C 8B6E - 8F62 24000000 3F4 3F4 D8 D8 OK 2060 04 29 40 8F63 - E33F FFE00200 53DC 53DC 12 80 BAD 2080 05 1C 01 E340 - EE4C 38265E00 c D48 B0C 46 AA BAD 20A0 06 0D 04 EE4D - F2ED 38266E00 4A0 4A0 FF 59 BAD 20C0 07 CB 01 F2EE - 15236 0 c 7968 5F48 66 A2 BAD 20E0 08 EA 01 15237 - 15657 DF8C c 4EC 420 47 47 OK 2100 09 13 03 15658 - 17CFC 40340 c 3198 26A4 B9 55 BAD 2120 0A C2 03 17CFD - 180D9 60267E00 c 9BC 3DC 30 30 OK 2140 0B 19 01 180DA - 30582 3834EE00 c 20840 184A8 F2 06 BAD 2160 0C 1D 01 30583 - 561CB 38008230 c 33460 25C48 99 0C BAD 82040 03 66 0C 88B06 - 88EFA 24000000 3F4 3F4 D8 51 BAD 82060 04 4A 40 88EFB - 8E31B FFE00200 5420 5420 B0 3E BAD 820C0 07 3F 01 8F2CA - 95242 0 c 79A0 5F78 46 00 BAD 820E0 08 BA 01 95243 - 95663 DF50 c 4EC 420 BF 29 BAD 82140 0B 83 01 980E2 - B05FA 3834EE00 c 208C0 18518 92 6F BAD 82160 0C 99 01 B05FB - D6263 38008230 c 33424 25C68 7F 43 BAD LDSC = PM Loader Config String (32 bytes) ID = ID byte of LDSC (byte #0) CS = Checksum byte or word Att = Attributes PCMBlk = Program Code Memory Block Exp = Expected checksum for PCMBLock Act = Actual checksum for PCMBLock c = compressed PCMBlock size = size of decompressed (in RAM) and compressed (in ROM) PCMBlock in bytes No ROYL directory modules (0x0B or 0x20B) found in ROM

Code:: Analysing donor drive FW version 04,01A04.BIN ... Searching for LDSCs and verifying PCMBlocks ... LDSC LDSC Att PCMBlock RAM size PCMBlk CS Start ID CS Start - End address RAM / ROM Exp/Act ----- -- -- -- ----- ----- -------- ------ ----- --------- 0 5A ED 04 20 - 1B47 1000 1B24 1B24 000AA37C 000AA37C OK (digitally signed) 2000 01 49 04 2180 - 4AA0 49688 2820 2820 3A 3A OK 2020 02 9B 11 4AA1 - 8B31 30080000 c 55BC 4090 4F 4F OK 2040 03 92 0C 8B32 - 8F26 24000000 3F4 3F4 D8 D8 OK 2060 04 ED 40 8F27 - E303 FFE00200 53DC 53DC 12 12 OK 2080 05 E0 01 E304 - EE10 38265E00 c D48 B0C B7 B7 OK 20A0 06 D1 04 EE11 - F2B1 38266E00 4A0 4A0 79 79 OK 20C0 07 4F 01 F2B2 - 15232 0 c 79B8 5F80 2C 2C OK 20E0 08 BA 01 15233 - 15653 DF60 c 4EC 420 C5 C5 OK 2100 09 DB 03 15654 - 17CE8 40340 c 3184 2694 F4 F4 OK 2120 0A AE 03 17CE9 - 180C5 60267E00 c 9BC 3DC 2A 2A OK 2140 0B 0E 01 180C6 - 3035A 3834EE00 c 20578 18294 B6 B6 OK 2160 0C B0 01 3035B - 55F4B 38008230 c 333D0 25BF0 88 88 OK 82000 01 49 04 82180 - 84AA0 49688 2820 2820 EC EC OK 82020 02 58 11 84AA1 - 88B6D 30080000 c 5600 40CC E4 E4 OK 82040 03 CE 0C 88B6E - 88F62 24000000 3F4 3F4 D8 D8 OK 82060 04 29 40 88F63 - 8E33F FFE00200 53DC 53DC 12 12 OK 82080 05 1C 01 8E340 - 8EE4C 38265E00 c D48 B0C 46 46 OK 820A0 06 0D 04 8EE4D - 8F2ED 38266E00 4A0 4A0 79 79 OK 820C0 07 CB 01 8F2EE - 95236 0 c 7968 5F48 66 66 OK 820E0 08 EA 01 95237 - 95657 DF8C c 4EC 420 47 47 OK 82100 09 13 03 95658 - 97CFC 40340 c 3198 26A4 B9 B9 OK 82120 0A C2 03 97CFD - 980D9 60267E00 c 9BC 3DC 30 30 OK 82140 0B 19 01 980DA - B0582 3834EE00 c 20840 184A8 F2 F2 OK 82160 0C 1D 01 B0583 - D61CB 38008230 c 33460 25C48 99 99 OK LDSC = PM Loader Config String (32 bytes) ID = ID byte of LDSC (byte #0) CS = Checksum byte or word Att = Attributes PCMBlk = Program Code Memory Block Exp = Expected checksum for PCMBLock Act = Actual checksum for PCMBLock c = compressed PCMBlock size = size of decompressed (in RAM) and compressed (in ROM) PCMBlock in bytes ROYL directory module 0x000B found at 0x7F39A Active directory flag = 0x03 Identifying SA regions ... Reg# Reg size Reg loc ---- ---------- ---------- 0x00 0x000E95F0 0x00000000 0x01 0x000E95F0 0x000EEBA8 Verifying ROYL modules ... ID Size (bytes) Address Checksum dir hdr dir hdr ---- ---- -------- -------- -------- -------- 0001 N/A 00004000 N/A 00000000 N/A 000A OK 0000004E 00000200 0007E000 00000000 OK 000B OK 0000013D 00000200 0007F39A 00000000 OK 020B OK 0000013D 00000200 0007D39A 00000000 OK 0030 OK 00000400 OK 000FE000 00000000 OK 0047 OK 00000600 OK 0007E556 00000000 OK 000D OK 00000108 00000200 0007E04E 00000000 OK 004F OK 00000400 OK 0007E156 00000000 OK 0181 OK 00000C00 OK 000FE400 00000000 OK 01A2 OK 0000007E 00000200 0007EB56 00000000 OK 01B6 OK 0000069E 00000800 0007EBD4 00000000 OK 01B0 OK 00000128 00000200 0007F272 00000000 OK ROYL directory module 0x020B found at 0x7D39A Active directory flag = 0x02 Identifying SA regions ... Reg# Reg size Reg loc ---- ---------- ---------- 0x00 0x000E95F0 0x00000000 0x01 0x000E95F0 0x000EEBA8 Verifying ROYL modules ... ID Size (bytes) Address Checksum dir hdr dir hdr ---- ---- -------- -------- -------- -------- 0001 N/A 00004000 N/A 000E82CD N/A 000A OK 0000004E 00000200 0007C000 00000000 OK 000B OK 0000013D 00000200 0007F39A 00000000 OK 020B OK 0000013D 00000200 0007D39A 00000000 OK 0181 OK 00000C00 OK 000FE400 00000000 OK 0030 OK 00000400 OK 000FE000 00000000 OK 0047 OK 00000600 OK 0007C556 00000000 OK 000D OK 00000108 00000200 0007C04E 00000000 OK 004F OK 00000400 OK 0007C156 00000000 OK 01A2 OK 0000007E 00000200 0007CB56 00000000 OK 01B6 OK 0000069E 00000800 0007CBD4 00000000 OK 01B0 OK 00000128 00000200 0007D272 00000000 OK dir - Module ID/Size as reported in directory module (0x20B or 0x0B) hdr - Module ID/Size as reported in module's header N/A - Not Applicable BAD - Module has invalid checksum. This may be due to non-existent module. ROM modules saved to Flash_01\000Bmods and Flash_01\020Bmods Active directory is 0x0B Analysing active 0x0A module ... Head map checksum (Expected / Actual) = 0x0000 / 0x0000 - OK Number of heads (physical / in use) = 2/2 Head map #1 = 0x0003 / 0b0000000000000011 Head map #2 = 0x0003 / 0b0000000000000011 DCM = | R | G Z P B K G S : : : : : : : : : : : : : : : : : : : unknown : : : : : : : : top VCM : : : : : : : ACA : : : : : : bottom VCM : : : : : HSA : : : : media : : : preamp : : latch : base spindle motor Analysing active 0x0D module ... Firmware Version = 04.01A04 World Wide Name = 50014EE2BB876E5B Model Number = WDC WD10SPZX-24Z10 Serial Number = Analysing active 0x4F module ... ROM version = 00050066 Analysing active 0x47 module ... Preamp values ----------- 0 01320573 1 012A037E Microjogs ------- 0 0000 1 0000 Head/Media DCM = PZ

Are you trying to read your ROM with a 3.3V programmer?

Hello fzabkar,

As far as i can see (and understand) the original ROM file is bad.

I've tried both with 1.8V and 3.3V on two different readers I can't remember on wich case i achieved to read it... i also tried to solder it on a pcb instead of using a clamp to avoid bad contacts...

to answer your question in my other thread wich was a false issue, my PCB is 2060-800066 which is "MCU locked".

As I understand i need to be able to recover the datas frome the original ROM in order to get my HDD back to life, right ? In this case i don't believe it will be a success I wll try one more time to read this chip with the slowest baudrate i can do.

Is their anyway to "clone" the raw datas on the drive and trying to rebuild files from this ?

If you use a hex editor (eg HxD freeware) to compare offsets 0x2000+ against offsets 0x82000+, you will find that, whenever the second half of the ROM differs from the first half, the bits in the second half have gone high. This means that your reader is performing worse the longer it runs. Unfortunately all the adaptive sections (ROYL header) are in the second half of the ROM, and they all appear to be bad.

Please refrain from trying to read a 1.8V ROM with a 3.3V reader, if that is indeed what is happening.

I suggest you obtain a multimeter (~US$5). Also, show us a photo of the PCB.

TVS Diode FAQ:
http://www.hddoracle.com/viewtopic.php?f=100&t=86

Hi,

I've already performed the basic electrical tests on the PCB and it appears to be good.

I am not testing the original board as the drive failed after what seems to be a power failure on the PCB motherboard (the computer was off and i discover the audio codec hot as hell and as i opened the case it started to burn...) and also while desoldering the ROM chip my hot air flow was a bit to strong and the tiniest IC on the board decided to fly out, it must be a decoupling capacitor but as i dont't have the schematic i prefer to use a new PCB

I do use 3.3V sometimes instead of 1.8V in a "last chance" try for chips that might need a "little punch" to start working. I know this is not a good practice but in some cases i was able to get what i need.

Attached, a picture of the new PCB with it's original ROM.

Attachments

I do use 3.3V sometimes instead of 1.8V in a "last chance" try for chips that might need a "little punch" to start working. I know this is not a good practice but in some cases i was able to get what i need.

This is not only not good practice but can easily fry the chip (Been there, done that). If you are doing this more often consider buying a programmer with adjustable voltage. So you can increase it in small steps beyond what is allowed officially. This can still fry the chip but the chance is lower than using 3.3V for a 1.8V chip.
Also try to first read the chip without desoldering, iirc this also works better with a better programmer.

Hi,

I only tied with 3.3V as i wasn't able to get any good extract from the chip...

After some trials I realized that the issue was in fact the programmer itself, I've flashed another ROM on a second programmer then try to read it with my first programmer but it didn't worked, worst of all when i tried to read the datas with my second programmer they were bad...

So I guess that I've messed up my ROM at the very first time I tried to read it with my crappy programmer...

Try to read the unique "adaptive" components of the ROM instead of the entire ROM.

These are the ROYL modules:

Code:: Address Size (bytes) -------- ------------ 0007C000 0000004E 0007C556 00000600 0007C04E 00000108 0007C156 00000400 0007CB56 0000007E 0007CBD4 0000069E 0007D272 00000128 0007D39A 0000013D 0007E000 0000004E 0007E04E 00000108 0007E156 00000400 0007E556 00000600 0007EB56 0000007E 0007EBD4 0000069E 0007F39A 0000013D 000FE000 00000400 000FE400 00000C00

Also carve out the range from 0 to 0x1FFF.

These are the critical areas. The rest can be recovered from resource dumps.

Don't discard the original PCB. You will need it.

Hi,

Well... the chip is not giving any sign of life even with slow baudrate and withour any data validation...
I think it is totally burnt...

Can you please reupload the 2 files. Many thanks Fzabkar

You can find my files at the Wayback Machine.

corrupted ROM

corrupted ROM

Re: corrupted ROM

Re: corrupted ROM

Re: corrupted ROM

Re: corrupted ROM

Re: corrupted ROM

Re: corrupted ROM

Re: corrupted ROM

Re: corrupted ROM

Re: corrupted ROM

Re: corrupted ROM

Re: corrupted ROM