CORRUPT Seagate ROM after using an external ROM programmer

[sosrecup]

Hello,

I have a Seagate that spins well, and reaches readiness, but impossible to unlock it. it says that the bootcode is protected and I need to use an external ROM programmer.

I used a ROM programmer to read the ROM and unlock it using PC3000.

Then I wrote the unlocked ROM back to the Patient PCB using the external programmer, but I don't know what happened, the ROM became empty (maybe an issue with the external programmer).

I used another donor PCB/ROM (same Model/FW...) to write the unlocked ROM using PC3000. which worked as expected.

But when I power off/on the drive, the PCB remains OFF.

In Terminal, it shows output like:

Code:

Flash boot code Digital Signature Verification failure!
0x00000020
0x00000020
0x00000020
0x00000020
0x00000020
SEA5 Boot ROM 1.0 (06/01/2017)
Copyright Seagate 2017-VM000

Flash boot code Digital Signature Verification failure!
0x00000040
0x00001200
0x00000001
0x00000001
0x00000001
Flash boot code Digit>

Then PC3000 support suggested transferring the CAP+RAP+SAP+IAP adaptives from this ROM to a compatible donor ROM, which didn't work either. I don't know why I need to transfer the ROM adaptive, the same PCB REF should be sufficient.

Then the PC3000 support asked their Dev team, which replied that the Patient ROM would not work on the donor PCB and I need to either use the original patient PCB or move the MCU chip as well (Donor PCB with the patient ROM and MCU).

Any insight/help please?

I attached:
- The patient ROM (I did 2 different reads and got the same result)
- The unlocked ROM

Thank you in advance for your support.

Attachments

PATIENT ROM Patched by PC3000.rar

(256.2 KiB) Downloaded 845 times

PATIENT ROM - read 2.rar

(254.26 KiB) Downloaded 821 times

PATIENT ROM - read 1.rar

(254.26 KiB) Downloaded 808 times

[fzabkar]

The BOOTFW segment contains a digital signature which is matched to a key in the CPU. The adaptives are not included in the signature.

Here are the two signatures in the two BOOTFW containers:

Code:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00007A80  33 22 11 00 00 00 00 00 00 00 00 00 00 00 00 00
00007A90  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00007AA0  00 00 00 00 32 32 32 32 32 32 32 32 32 32 32 32
00007AB0  32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32
00007AC0  32 32 32 32 31 31 31 31 31 31 31 31 31 31 31 31
00007AD0  31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31
00007AE0  31 31 31 31

Code:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00047A80  02 00 00 00 02 6A 3A C3 24 A5 0C E8 53 5C 72 CB
00047A90  D5 2C A3 A5 F6 85 66 DA CE 99 32 F6 75 6F CA AA
00047AA0  00 29 E3 80 95 BD 98 BD 8F CC E4 8F 80 52 E8 3A
00047AB0  EF 53 0C 12 37 A2 8E B6 34 08 84 0F 34 45 9C 5C
00047AC0  48 E9 45 FF 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A
00047AD0  0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A
00047AE0  0A 0A 0A 0A

The signature in the inactive segment is a dummy.

Here are the SMART data:

Code:

ID  Flg  Cur  Wor  Raw             Description
------------------------------------------------------------------------
  1  0F    69   58  0000000086427E  Raw Read Error Rate
  3  03   100  100  00000000000000  Spin Up Time
  4  32    98   98  00000000000947  Start/Stop Count
  5  33    99   99  00000000000368  Reallocated Sector Count
  7  0F    69   60  000001006DD392  Seek Error Rate
  9  32    99   99  21C229000003F5  Power-On Hours Count
10  13   100  100  00000000000000  Spin Retry Count
12  32   100  100  0000000000014E  Drive Power Cycle Count
184  32   100  100  00000000000000  End to End Error Det/Corr Count
187  32   100  100  00000000000000  Reported Uncorrectable Errors
188  32   100   99  00000100010022  Command Time Out
189  3A   100  100  00000000000000  High Fly Writes
190  22    61   50  000000271B0027  Airflow Temperature
191  32   100  100  0000000000002C  Shock Sense
192  32   100  100  010000000000D6  Emergency Retract Cycle Count
193  32    96   96  000000000025BD  Load/Unload Cycle Count
194  22    39   50  00000F00000027  HDA Temperature
197  12   100  100  00000000000000  Current Pending Sector Count
198  10   100  100  00000000000000  Offline Uncorrectable Sector Count
199  3E   200  200  00000000000000  UltraDMA CRC Error Rate
240  00   100  253  321AD4000000B6  Head Flying Hours
241  00   100  253  000000F7EDED9F  Total LBAs written
242  00   100  253  0000018917E2B5  Total LBAs read
254  32   100  100  00000000000000  Free Fall Sensor

[sosrecup]

@fzabkar Thank you for your help.

What I'm supposed to do? how to fix this issue? is there any data I need to change in the ROM?

When a disk has a faulty PCB, we change the PCB and transfer the ROM, why do we need to transfer the MCU for this case?

Thank you in advance for your support.

[fzabkar]

Other people have said that transferring adaptives to a compatible donor PCB should work. Can you upload your donor ROM?

I'm thinking that Ace's ROM patch is flawed. I would start by transferring the adaptives to a compatible unpatched donor PCB and then see if this spins up the patient drive. That will at least prove that the adaptives can be transferred.

Ace's patch modifies the BOOTFW segment. In doing so, it probably disturbs and invalidates the digital signature.

[sosrecup]

I already transferred the Adaptive parameters but it didn't work (the PC3000 support said that I need to transfer the MCU too).

Why do I need to transfer the Adaptive parameters and/or MCU? Is it because of the Unlocking process?

Thank you for your help.

[fzabkar]

I don't understand why you need a donor PCB at all, and I don't understand why you can't reprogram the patient ROM. Nothing makes sense to me.

[sosrecup]

I don't understand why you need a donor PCB at all

I just suspected a PCB problem, that's why I tried to transfer the ROM to a donor PCB.

why you can't reprogram the patient ROM.

That's what I'm going to do.

Thank you for your help.

[Data-Salvage]

I don't understand why you need a donor PCB at all

I just suspected a PCB problem, that's why I tried to transfer the ROM to a donor PCB.

why you can't reprogram the patient ROM.

That's what I'm going to do.

Thank you for your help.

hello could you fix the rom?