A very odd WD10SMZM-59WKCS0.

[WebClaw]

Data is being recovered; but I wanted to get some insight - I've been doing this 15+ years and never seen a case like this.

Drive is a Palmer w/USB C PCB.
Read out the ROM with peg reader. Performed unlock using PC3000 and noted that modules 4F, 30, and 0A were damaged.

Removed ROM from USB PCB and dumped ROM again using programmer (thinking there was an issue with the peg reader).
Same CRC before and after unlock (reading w/peg reader).

So without 30, 0A, and 4F drive will spin, but a loader will not work.

Found donor FW online and extracted 30, 0A, and 4F.

4F is unique to the drive, so I was purely testing to see if PC3000 would provide an error when reviewing ROM dump info.

Used a loader w/donor ROM modules, got SA access.
Wrote drives original ROM modules to a new ROM and after fixing 190, we're recovering data.

How in the hell does a ROM module have a damaged 30, 0A, and 4F - but still spin and not click? How would this possibly happen?
Further, you'd think I've have a better chance winning the lottery than finding a compatible 4F module...

I was thinking another lab may have done something, but client states I am the first company he brought it too. We removed it from the plastic chassis.

This is baffling to me and I've not seen this exact problem before. Those are pretty specific modules to be damaged.

BTW: drive has firmware issues aside from 190, I suspect a weak head or surface damage.

Oddly enough, even with MOD190 fixed, I cannot do HM and the drive just resets with init SMR zone.

As said in 1st sentence, reading data back with just block UA. Using SATA PCB. SEDv2 is not active on this HDD.

[fzabkar]

Can you upload your ROM and SA modules 0x109 and 0x129? I have written my own tool to regenerate the ROM from 0x109 and 0x129.

BTW, I recall another thread where one of the code (?) modules in the ROM had a bad checksum, but the drive still was able to spin.

[WebClaw]

fzabkar, it would be my pleasure.

Attachments

WO45503-Original.zip

(663.03 KiB) Downloaded 149 times

[WebClaw]

For comparison, here is my fixed up ROM.

Attachments

WO45503-Repaired.zip

(663.42 KiB) Downloaded 154 times

[fzabkar]

Here is that other strange case:

https://forum.hddguru.com/viewtopic.php?p=311783#p311783

[fzabkar]

PC3000 (and my own tool) detects 0x20B as the active module directory, whereas it should be 0x0B. Directory 0x20B has several uninitialised modules, so that's why PC3000 complains. However, it would appear that the drive ignores its own active/inactive flags and uses the good directory instead.

Code:

Analysing WO45503-Original.bin ...

Searching for LDSCs and verifying PCMBlocks ...

LDSC   LDSC    Att   PCMBlock          RAM         size      PCMBlk CS
Start  ID CS        Start -  End     address     RAM / ROM    Exp/Act
-----  -- --   --   -----   -----   --------   ------ -----  ---------
    0  5A ED   04      20 -  1B47       1000     1B24  1B24  000AA428 000AA428 OK (digitally signed)
2000  01 49   04    2180 -  4AA0      49688     2820  2820    EC   EC   OK
2020  02 58   11    4AA1 -  8B6D   30080000 c   5600  40CC    E4   E4   OK
2040  03 CE   0C    8B6E -  8F62   24000000      3F4   3F4    D8   D8   OK
2060  04 29   40    8F63 -  E33F   FFE00200     53DC  53DC    12   12   OK
2080  05 1C   01    E340 -  EE4C   38265E00 c    D48   B0C    46   46   OK
20A0  06 0D   04    EE4D -  F2ED   38266E00      4A0   4A0    79   79   OK
20C0  07 CB   01    F2EE - 15236          0 c   7968  5F48    66   66   OK
20E0  08 EA   01   15237 - 15657       DF8C c    4EC   420    47   47   OK
2100  09 13   03   15658 - 17CFC      40340 c   3198  26A4    B9   B9   OK
2120  0A C2   03   17CFD - 180D9   60267E00 c    9BC   3DC    30   30   OK
2140  0B 19   01   180DA - 30582   3834EE00 c  20840 184A8    F2   F2   OK
2160  0C 1D   01   30583 - 561CB   38008230 c  33460 25C48    99   99   OK
82000  01 49   04   82180 - 84AA0      49688     2820  2820    EC   EC   OK
82020  02 58   11   84AA1 - 88B6D   30080000 c   5600  40CC    E4   E4   OK
82040  03 CE   0C   88B6E - 88F62   24000000      3F4   3F4    D8   D8   OK
82060  04 29   40   88F63 - 8E33F   FFE00200     53DC  53DC    12   12   OK
82080  05 1C   01   8E340 - 8EE4C   38265E00 c    D48   B0C    46   46   OK
820A0  06 0D   04   8EE4D - 8F2ED   38266E00      4A0   4A0    79   79   OK
820C0  07 CB   01   8F2EE - 95236          0 c   7968  5F48    66   66   OK
820E0  08 EA   01   95237 - 95657       DF8C c    4EC   420    47   47   OK
82100  09 13   03   95658 - 97CFC      40340 c   3198  26A4    B9   B9   OK
82120  0A C2   03   97CFD - 980D9   60267E00 c    9BC   3DC    30   30   OK
82140  0B 19   01   980DA - B0582   3834EE00 c  20840 184A8    F2   F2   OK
82160  0C 1D   01   B0583 - D61CB   38008230 c  33460 25C48    99   99   OK

LDSC   = PM Loader Config String (32 bytes)
ID     = ID byte of LDSC (byte #0)
CS     = Checksum byte or word
Att    = Attributes
PCMBlk = Program Code Memory Block
Exp    = Expected checksum for PCMBLock
Act    = Actual checksum for PCMBLock
c      = compressed PCMBlock
size   = size of decompressed (in RAM) and compressed (in ROM) PCMBlock in bytes


ROYL directory module 0x000B found at 0x7F39A

Active directory flag = 0x01

Identifying SA regions ...

Reg#    Reg size     Reg loc
----  ----------  ----------
0x00  0x000E95F0  0x00000000
0x01  0x000E95F0  0x000EEBA8

Verifying ROYL modules ...

ID          Size (bytes)         Address    Checksum
dir   hdr        dir       hdr
----  ----   --------  --------   --------   --------
0001  N/A    00004000  N/A        00000000             N/A
000A  OK     0000004E  00000200   0007E000   00000000  OK
000B  OK     0000013D  00000200   0007F39A   00000000  OK
020B  OK     0000013D  00000200   0007D39A   00000000  OK
0030  OK     00000400  OK         0007B000   00000000  OK
0047  OK     00000600  OK         0007E556   00000000  OK
000D  OK     00000108  00000200   0007E04E   00000000  OK
004F  OK     00000400  OK         0007E156   00000000  OK
0181  OK     00000C00  OK         0007B400   00000000  OK
01A2  OK     0000007E  00000200   0007EB56   00000000  OK
01B6  OK     0000069E  00000800   0007EBD4   00000000  OK
01B0  OK     00000128  00000200   0007F272   00000000  OK

ROYL directory module 0x020B found at 0x7D39A

Active directory flag = 0x02

Identifying SA regions ...

Reg#    Reg size     Reg loc
----  ----------  ----------
0x00  0x000E95F0  0x00000000
0x01  0x000E95F0  0x000EEBA8

Verifying ROYL modules ...

ID          Size (bytes)         Address    Checksum
dir   hdr        dir       hdr
----  ----   --------  --------   --------   --------
0001  N/A    00004000  N/A        00000000             N/A
000A  FFFF   0000004E  01FFFE00   0007C000   0000FFEC  BAD
000B  OK     0000013D  00000200   0007F39A   00000000  OK
020B  OK     0000013D  00000200   0007D39A   00000000  OK
0181  OK     00000C00  OK         000FE400   00000000  OK
0030  OK     00000400  OK         000FE000   00000000  OK
0047  FFFF   00000600  01FFFE00   0007C556   FFFFFE80  BAD
000D  FFFF   00000108  01FFFE00   0007C04E   FFFFFFBE  BAD
004F  FFFF   00000400  01FFFE00   0007C156   FFFFFF00  BAD
01A2  FFFF   0000007E  01FFFE00   0007CB56   0000FFE0  BAD
01B6  FFFF   0000069E  01FFFE00   0007CBD4   5514A0B3  BAD
01B0  OK     00000128  00000200   0007D272   00000000  OK

dir  -  Module ID/Size as reported in directory module (0x20B or 0x0B)
hdr  -  Module ID/Size as reported in module's header
N/A  -  Not Applicable
BAD  -  Module has invalid checksum. This may be due to non-existent module.

ROM modules saved to Flash_00\000Bmods and Flash_00\020Bmods

Active directory is 0x20B

Analysing active 0x0A module ...

Module has bad checksum -- processing aborted

Analysing active 0x0D module ...

Module has bad checksum -- processing aborted

Analysing active 0x4F module ...

Module has bad checksum -- processing aborted

Analysing active 0x47 module ...

Module has bad checksum -- processing aborted

Module 0x0B

Code:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  52 4F 59 4C 04 80 1E 00 0B 00 01 00 ED DC 7F 82  ROYL.€......íÜ.‚
00000010  30 30 30 33 30 30 30 30 00 00 00 01 01 00 0C 12  00030000........
                                           ^^^^^
                                           active flag

Module 0x20B

Code:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  52 4F 59 4C 04 80 1E 00 0B 02 01 00 6B 14 7E 38  ROYL.€......k.~8
00000010  30 30 30 33 30 30 30 30 00 00 00 02 02 00 0C 12  00030000........
                                           ^^^^^
                                           active flag

As for regenerating the ROM, I need SA modules 0x109 and 0x129.

[unknown]

4F is unique to the drive

Not in this family.

[WebClaw]

Interesting...

Here is 109 and 129.

Attachments

mods.zip

(336.9 KiB) Downloaded 145 times

[fzabkar]

Attached is the ROM which I have rebuilt from 0x109 and 0x129.

The ROM has two halves. The second half of the regenerated ROM is mostly empty because the code in 0x109 only accounts for the first half. I think the two halves correspond to different firmware versions.

This is my ROM regeneration tool:

https://www.hddoracle.com/viewtopic.php?p=24701#p24701

I would be interested to know if it works.

Attachments

regrom.7z

(331.91 KiB) Downloaded 164 times

[WebClaw]

Works just fine fzabkar. Well done!

[WebClaw]

Just a FYI:

Rebuilt using PC3000:
05-66B-WDC WD10SMZM-59WKCS0-05-04B-6-WD-WXR1AA8E3CJH

Your ROM rebuild tool:
05-66B-WDC WD10SMZM-59WKCS0-01-01A01-WD-WXR1AA8E3CJH

Model : WDC WD10SMZM-59WKCS0
Serial : WD-WXR1AA8E3CJH
Firmware : 01.01A01 <-- This is now generic, guessing related to creating the ROM from the template you spoke about.
Capacity : 1 000 GB (1 953 459 632)

[fzabkar]

The templates for module 0x0D in 0x109 are empty:

Code:

Firmware Version = 00.00000
World Wide Name = 0000000000000000
Model Number =                                         
Serial Number =

Module 0x0D in 0x129 contains ...

Code:

Firmware Version = 01.01A01
World Wide Name = 50014EE6B3D5DC86
Model Number = WDC WD10SMZM-59WKCS0                   
Serial Number =