Alternative ways to reflash ROM with SA-generated modules

[transitNFCtech]

I presumably no longer have the original MCU functional from the patient HDD (i.e. MCU presumably damaged from my initial attempt to remove it from patient PCB with soldering iron instead of a heat gun), only have the donor PCB and heads in the patient HDD. How can I generate modules from the SA to flash new modules in the ROM? I want to avoid having to desolder the MCU from patient PCB by calibrating donor MCU to work with the patient HDD (or other means not involving original MCU) instead. All I see is this page for KERMIT family firmware. I rather figure out a way to utilize ATA commands to read SA MODs and generate ROM modules from SA.

Patient HDD

Model: WD10EAVS-00D7B0
S/N: WCAU40285619
DATE: 15-MAY-2008
DCM: HHRNNT2CAB
Drive Parameters: LBA 1953525168 1.0TB
PCB: 2060-701537-004 REV A

Computer for data recovery

Manufacturer: hp
Model: Compaq nc6320
OS: Windows 7
Adapter installed: GXT 2 Port Express Card SATA-II Adapter
Software currently installed: WDMarvel Demo

I recall in the past reading an article about rewriting ROM modules from SA (http://www.disk-imager.com/data-recovery-blog/?p=793) but unfortunately, the domain for the site was released. I also saw guides on ATA commands for WD Marvel HDDs and regenerating a WD ROYL ROM from SA MODs on another forum via this post but I don't fully understand the guides and how to apply them to my case. If I absolutely have no other choice for avoiding original MCU to complete data recovery, I would hopefully assume the original MCU is still functional once I obtain a heat gun to properly transfer the MCU to the donor PCB.

[fzabkar]

You need to dump the SA modules. The demo version of WDMarvel can do this, but you need to find a donor with a ROM that is a reasonably close match. Then I can rebuild the ROM for you.

What was the symptom of the failed drive? Was the PCB subjected to an overvoltage? Is there any visible damage to the motor controller IC (SMOOTH)?

BTW, this is one very clever way to desolder leaded SMT components with a soldering iron:

https://youtu.be/xMXJTLWyBCo

[transitNFCtech]

You need to dump the SA modules. The demo version of WDMarvel can do this, but you need to find a donor with a ROM that is a reasonably close match. Then I can rebuild the ROM for you.

What was the symptom of the failed drive? Was the PCB subjected to an overvoltage? Is there any visible damage to the motor controller IC (SMOOTH)?

BTW, this is one very clever way to desolder leaded SMT components with a soldering iron:

https://youtu.be/xMXJTLWyBCo

Yes, I plugged in a power adapter with a higher voltage than specified which fried the PCB. The MCU, aka motor controller IC, on the fried PCB absolutely had no visible damage. Later, I got into an argument that led to the person I was arguing with (can't disclose my connection with the person for privacy and personal reasons) ripped the PCB board apart. I then later tried to salvage the MCU with a soldering iron. I tried to indirectly heat the board to release the MCU from the fried PCB but by accident, the soldering iron touched one of the MCU's legs which shrunk from the outside. I'm concerned that the MCU got ruined inside so I didn't go any further in salvaging the MCU but rather pursue methods involving SA modules and rewriting the ROM.

Donor HDD

DATE: 30-JUL-2008
DCM: HHNNHT2CBB
S/N: WCAU41396378
Everything else is exactly the same as Patient HDD.

[fzabkar]

Yes, I plugged in a power adapter with a higher voltage than specified which fried the PCB. The MCU, aka motor controller IC, on the fried PCB absolutely had no visible damage.

Those are two different ICs. If the motor controller was damaged on the 5V side, then there is a real risk that the preamp on the headstack is also damaged.

Catastrophic failures in Western Digital PCBs:
http://www.hddoracle.com/viewtopic.php?f=59&t=1119

[transitNFCtech]

Yes, I plugged in a power adapter with a higher voltage than specified which fried the PCB. The MCU, aka motor controller IC, on the fried PCB absolutely had no visible damage.

Those are two different ICs. If the motor controller was damaged on the 5V side, then there is a real risk that the preamp on the headstack is also damaged.

Catastrophic failures in Western Digital PCBs:
http://www.hddoracle.com/viewtopic.php?f=59&t=1119

There is no damage on that IC either as according to the link you provided.

[fzabkar]

Normally when you overvolt an external enclosure, the 12V TVS diode is shorted. If the associated zero-ohm resistor is not open circuit, then the simple fix is to remove the shorted diode.

TVS Diode FAQ:
http://www.hddoracle.com/viewtopic.php?f=100&t=86

[transitNFCtech]

Normally when you overvolt an external enclosure, the 12V TVS diode is shorted. If the associated zero-ohm resistor is not open circuit, then the simple fix is to remove the shorted diode.

TVS Diode FAQ:
http://www.hddoracle.com/viewtopic.php?f=100&t=86

I see. Anyway, I already said earlier that the PCB was ripped apart by someone during an argument I had with that person:

Later, I got into an argument that led to the person I was arguing with (can't disclose my connection with the person for privacy and personal reasons) ripped the PCB board apart.

I have no choice but to work with a donor PCB. Are you saying that on the donor PCB, I should remove the TVS diode at the same location where the shorted TVS diode on the patient PCB located?

[fzabkar]

Are you saying that on the donor PCB, I should remove the TVS diode at the same location where the shorted TVS diode on the patient PCB located?

No, why would you think that?

[transitNFCtech]

Are you saying that on the donor PCB, I should remove the TVS diode at the same location where the shorted TVS diode on the patient PCB located?

No, why would you think that?

Ah, I misunderstood what you meant. I wasn't fully sure what to do based on what I currently have. Regardless, I can only work with a donor PCB from this point forward.

[transitNFCtech]

Are you saying that on the donor PCB, I should remove the TVS diode at the same location where the shorted TVS diode on the patient PCB located?

No, why would you think that?

Also, I didn't fully understand the relevance of removing the shorted diode if I'm already working with only a donor PCB.

You need to dump the SA modules. The demo version of WDMarvel can do this, but you need to find a donor with a ROM that is a reasonably close match. Then I can rebuild the ROM for you.

Furthermore, I was wondering how you will (further) assist me in rebuilding the ROM. A remote desktop software such as AnyDesk? Instructions and advice in this thread and/or via PM?

[fzabkar]

Sorry, all I'm saying is that the original problem may have been solved simply by removing the shorted 12V TVS diode (on the patient PCB). Of course, that is moot now.

You need to access the SA and dump the required modules. Hopefully, WDMarvel and your donor PCB can do this. WDMarvel should also be able to regenerate the ROM. However, when I went through this process with another user, we found that WDMarvel had a bug. Instead, I wrote my own tool to rebuild the ROM.

http://users.on.net/~fzabkar/FreeBasic_W32/WD/wdROMreg.bas
http://users.on.net/~fzabkar/FreeBasic_W32/WD/wdROMreg.exe

[transitNFCtech]

Instead, I wrote my own tool to rebuild the ROM.

http://users.on.net/~fzabkar/FreeBasic_W32/WD/wdROMreg.bas
http://users.on.net/~fzabkar/FreeBasic_W32/WD/wdROMreg.exe

I downloaded the EXE application and BAS file onto the computer for HDD repair but how do I use the tool? I ran the tool as an admin multiple times and unblocked the tool yet can’t figure out what I’m missing.

[fzabkar]

You need to retrieve the SA modules from your drive using WDMarvel. Then you point my program at the directory which contains the relevant modules.

My program runs from the command line in a CMD window. Just type the name of the tool to see the built-in documentation.

[transitNFCtech]

Thanks, was able to launch the tool in command prompt and read the built-in guide.

While using WDMarvel Demo to obtain the SA modules, despite already swapping out HDD heads, I still get this error message upon opening the S/A modules window:

Received SERVO_ERROR_CODE_BASE_SvirActSync despite swapping heads.

After running Modules > Check all modules, this is what I see:

All modules scanned successfully with module 20 indicating problems despite successful scan.

Would there be problems after dumping the SA modules including module 20 when I use the tool? Is it necessary for module 20 be "Ok"?

[fzabkar]

Sorry, I don't think I can help you.

[pepe]

it is most probably head related. The modules marked green in the above screenshot come from the flash, 20 is on disk, as another 2-300 modules not even listed in your tool.

pepe

[fzabkar]

@transitNFCtech, you need to recover SA modules in the range from $0102 to $0109, from either head 0 or head 1. However, who knows what new problems have been introduced by your head swap.

[transitNFCtech]

@transitNFCtech, you need to recover SA modules in the range from $0102 to $0109, from either head 0 or head 1. However, who knows what new problems have been introduced by your head swap.

Previously, in another thread and in another forum, I was told that I can't work with dead heads. So, I watched this video on swapping heads on an WD HDD, acquired the donor HDD, and carefully performed a head swap. I was very careful in handling the donor head and the patient HDD especially the platters. Yet so far, there's no difference after the head swap.

Sorry, I don't think I can help you.

I was mainly asking about if the tool you shared would have problems operating with at least one faulty module which in the case is ROM module 20.

[fzabkar]

I don't understand how you came to the conclusion that the original heads were bad. Anyway, that's a moot point now.

My tool requires SA modules 0x102 - 0x107 and 0x109. These modules contain the ROM components. However, these components are tuned to the patient's heads, so using them to rebuild the ROM is now pointless.

[transitNFCtech]

I don't understand how you came to the conclusion that the original heads were bad. Anyway, that's a moot point now.

My tool requires SA modules 0x102 - 0x107 and 0x109. These modules contain the ROM components. However, these components are tuned to the patient's heads, so using them to rebuild the ROM is now pointless.

I still have the original heads BTW. I see so the patient heads are also in tune with the patient HDD. I just swapped back to the original heads.