May 1st, 2026, 12:55
May 1st, 2026, 13:03
May 1st, 2026, 13:22
fzabkar wrote:I can extract the CPs from the ROM and test their checksums, at least in earlier models.
The additional ROMs appear to be for power loss data protection, although I would have expected to see a bank of backup capacitors.
May 1st, 2026, 13:55
May 1st, 2026, 14:12
fzabkar wrote:I think it's IC4, probably on both PCBs.
https://ae-pic-a1.aliexpress-media.com/kf/Hfa18982b7eb947d48e7a39c653df0108W.jpg
May 1st, 2026, 15:33
gameboybin wrote:I got my hands on the Donor Drive. Also MG07ACA14TE however the PCB labelled G0044A
May 1st, 2026, 19:00
May 1st, 2026, 19:51
May 3rd, 2026, 7:41
fzabkar wrote:I think it's IC4, probably on both PCBs.
https://ae-pic-a1.aliexpress-media.com/kf/Hfa18982b7eb947d48e7a39c653df0108W.jpg
May 3rd, 2026, 13:42
Offset(h) 00 04 08 0C
00100000 53545550 00000000 00000000 10000000 STUP............
00100010 00000000 00000000 00000000 00000000 ................
00100020 9DABAAAF FFFFFFFF FFFFFFFF FFFFFFFF .«ª¯ÿÿÿÿÿÿÿÿÿÿÿÿ
00100030 FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00100040 5345524E 00000000 00000000 0C000000 SERN............
00100050 5A393430 4130304A 46393447 C01715F0 Z940A00JF94GÀ..ð
00100060 FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00100070 FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00100080 57574E20 00000000 00000000 08000000 WWN ............
00100090 50000399 D8C89AE5 79DF1361 FFFFFFFF P..™ØÈšåyß.aÿÿÿÿ
001000A0 FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿOffset(h) 00 04 08 0C
00100040 5345524E 00000000 00000000 0C000000 SERN............
^^^^^^^^ ^^^^^^^^
name size
00100050 5A393430 4130304A 46393447 C01715F0 Z940A00JF94G....
^^^^^^^^^^^^^^^^^^^^^^^^^^ ========
data checksumOffset(h) 00 04 08 0C
00000000 5647525F 464C4452 00000000 97000000 VGR_FLDR........
00000010 08190021 00000000 00000000 00000000
^^^^
size of loader excluding checksum dword = 0x1908
........
000000E0 38D09FE5 1EFF2FE1 436F7079 72696768 8Пå.ÿ/áCopyrigh
000000F0 74284329 546F7368 69626120 436F7270 t(C)Toshiba Corp
00000100 6F726174 696F6E20 32303135 00000000 oration 2015....
........
00001780 D0000098 0050049E 0A5B4546 5553455D Ð..˜.P.ž.[EFUSE]
00001790 20415653 20566572 73696F6E 20657272 AVS Version err
000017A0 6F722E20 25303858 00000000 0A5B4546 or. %08X.....[EF
000017B0 5553455D 20534153 2D534154 41206469 USE] SAS-SATA di
000017C0 7374696E 6374696F 6E206572 726F722E stinction error.
000017D0 20253038 58000000 0A5B4546 5553455D %08X....[EFUSE]
000017E0 20415653 20636865 636B7375 6D206572 AVS checksum er
000017F0 726F722E 20253038 58000000 0A5B4546 ror. %08X....[EF
00001800 5553455D 20444443 20657272 6F722E20 USE] DDC error.
00001810 25303858 00000000 0A5B4546 5553455D %08X.....[EFUSE]
00001820 20415653 2056616C 75652065 72726F72 AVS Value error
00001830 2E202530 38580000 234910B5 04460868 . %08X..#I.µ.F.h
........
00001900 23F10CC1 94A42880 47EDCE48 00000000
^^^^^^^^
checksum dwordOffset(h) 00 04 08 0C
00010000 5345514C 72C49943 00000000 0008F46C SEQL............
^^^^^^^^
checksum dword ?
00010010 10000000 8000FFFF 00000000 010D010D
........
000110D0 010CFF04 0008F465 0C360000 00000000
000110E0 010D6304 0008F46B 0C360000 00000000
000110F0 00000000 00000000 00000000 00000000Offset(h) 00 04 08 0C
00012F00 00000000 00000000 00BFFE00 00064296Offset(h) 00 04 08 0C
0001FF00 464D434C 2020414C 46432020 20202020 FMCL ALFC
0001FF10 71612020 44455432 2D320D0A 436F7079 qa DET2-2..Copy
0001FF20 72696768 74284329 546F7368 69626120 right(C)Toshiba
0001FF30 436F7270 6F726174 696F6E20 32303137 Corporation 2017
0001FF40 2E30332E 31300D0A 45462F46 452F3045 .03.10..EF/FE/0E
0001FF50 2020533A 30626437 20202020 20202020 S:0bd7
0001FF60 20202020 20202020 20202020 20202020
0001FF70 20202020 20202020 20202020 20202020
0001FF80 20202020 20202020 20202020 20202020
0001FF90 20202020 20202020 20202020 20202020
0001FFA0 20202020 20202020 20202020 20202020
0001FFB0 20202020 20202020 20202020 20202020
0001FFC0 20202020 20202020 20202020 20202020
0001FFD0 20202020 20202020 20202020 20202020
0001FFE0 20202020 20202020 200D0A1A 00000000 .......
0001FFF0 00100000 E0C70A00 EFFE0E00 94C60A00 ....àÇ..ïþ..”Æ..Offset(h) 00 04 08 0C
00020000 DC770700 43010000 00240450 1100200E Üw..C....$.P.. .
00020010 30363031 A4250450 31383235 30363232 0601¤%.P18250622
00020020 00141000 04000100 069A0000 B0040E00
00020030 00000000 00000000 E82A0300 120002F1
........
000CFFF0 00000000 00000000 00000000 00000000 ................Offset(h) 00 04 08 0C
000E0000 53434844 BC30ADBC 01000200 00000D01 SCHD¼0.¼........
000E0010 4D473037 00000000 53333544 43000000 MG07....S35DC...
........
000E7FF0 00000000 00000000 00000000 00000000Offset(h) 00 04 08 0C
000E8000 B80BB80B B0040000 00000000 630A0014 ¸.¸.°.......c...
000E8010 46000000 00000000 09143075 F401503C F.........0uô.P<Offset(h) 00 04 08 0C
000E8100 464D4D47 303706E0 00000000 00000000 FMMG07.à........
000E8110 00000808 A2DB1600 4A563380 280EE3FF ....¢Û..JV3€(.ãÿ
........
000EFFF0 00000000 00000000 00000000 00000000Offset(h) 00 04 08 0C
000FBFF0 FFFFFFFF FFFFFFFF 504F4544 01000000 ÿÿÿÿÿÿÿÿPOED....
000FC000 574C4644 01000000 5A820000 02000000 WLFD....Z‚......
........
000FCFE0 00000000 00000000 00000000 00000000Offset(h) 00 04 08 0C
000FCFF0 574C4644 01000000 5A820000 02000000 WLFD....Z‚......
000FD000 574C4644 01000000 59820000 01000000 WLFD....Y‚......
000FD010 0000037C 4850574C 01068806 006488F2 ...|HPWL..ˆ..dˆò
........
000FDFE0 00000000 00000000 00000000 00000000Offset(h) 00 04 08 0C
000FDFF0 574C4644 01000000 59820000 01000000 WLFD....Y‚......
000FE000 0B824404 38240100 8D6B0A00 69943202Offset(h) 00 04 08 0C
000FF000 434C4E54 00000021 00000000 FFFFFFFF CLNT............Offset(h) 00 04 08 0C
000FF010 4D504348 00000008 00000000 B3AFBCAF MPCH............
======== ^^^^^^^^
size including checksum dword checksum dwordOffset(h) 00 04 08 0C
000FF020 4D532020 00000608 4D532020 08000000 MS ....MS ....
========
size including checksum dword
000FF030 00000000 000002D8 00000075 05000000 .......Ø...u....
........
000FF620 00000000 00000000 43010000 70ABD9D7
^^^^^^^^
checksum dwordMay 3rd, 2026, 23:31
fzabkar wrote:This model has a new architecture. The CPs, assuming that's what they are still called, appear to begin at offset 0x100000.
- Code:
Offset(h) 00 04 08 0C
00100000 53545550 00000000 00000000 10000000 STUP............
00100010 00000000 00000000 00000000 00000000 ................
00100020 9DABAAAF FFFFFFFF FFFFFFFF FFFFFFFF .«ª¯ÿÿÿÿÿÿÿÿÿÿÿÿ
00100030 FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00100040 5345524E 00000000 00000000 0C000000 SERN............
00100050 5A393430 4130304A 46393447 C01715F0 Z940A00JF94GÀ..ð
00100060 FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00100070 FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00100080 57574E20 00000000 00000000 08000000 WWN ............
00100090 50000399 D8C89AE5 79DF1361 FFFFFFFF P..™ØÈšåyß.aÿÿÿÿ
001000A0 FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
They appear to have a 16-byte header, a body of data, and a 32-bit checksum.
This appears to be the serial number:
- Code:
Offset(h) 00 04 08 0C
00100040 5345524E 00000000 00000000 0C000000 SERN............
^^^^^^^^ ^^^^^^^^
name size
00100050 5A393430 4130304A 46393447 C01715F0 Z940A00JF94G....
^^^^^^^^^^^^^^^^^^^^^^^^^^ ========
data checksum
The size dword reflects the size of the data, not the whole CP.
The checksum is calculated so that the sum of all 32-bit little-endian dwords, including the checksum dword, is 0x00000000.
I still have an ongoing medical emergency (not mine), so it will take me some time to write a new tool to extract and verify the CPs.
That said, doesn't the fact that the drive spins up suggest that the ROM is OK? Surely if the ROM was bad the firmware would produce a no-spin symptom?
The area from 0 to 0xFFFF appears to be reserved for a flash loader. The checksum dword is calculated so that the sum of all 32-bit little-endian dwords, including the checksum dword, is 0x00000000.
- Code:
Offset(h) 00 04 08 0C
00000000 5647525F 464C4452 00000000 97000000 VGR_FLDR........
00000010 08190021 00000000 00000000 00000000
^^^^
size of loader excluding checksum dword = 0x1908
........
000000E0 38D09FE5 1EFF2FE1 436F7079 72696768 8Пå.ÿ/áCopyrigh
000000F0 74284329 546F7368 69626120 436F7270 t(C)Toshiba Corp
00000100 6F726174 696F6E20 32303135 00000000 oration 2015....
........
00001780 D0000098 0050049E 0A5B4546 5553455D Ð..˜.P.ž.[EFUSE]
00001790 20415653 20566572 73696F6E 20657272 AVS Version err
000017A0 6F722E20 25303858 00000000 0A5B4546 or. %08X.....[EF
000017B0 5553455D 20534153 2D534154 41206469 USE] SAS-SATA di
000017C0 7374696E 6374696F 6E206572 726F722E stinction error.
000017D0 20253038 58000000 0A5B4546 5553455D %08X....[EFUSE]
000017E0 20415653 20636865 636B7375 6D206572 AVS checksum er
000017F0 726F722E 20253038 58000000 0A5B4546 ror. %08X....[EF
00001800 5553455D 20444443 20657272 6F722E20 USE] DDC error.
00001810 25303858 00000000 0A5B4546 5553455D %08X.....[EFUSE]
00001820 20415653 2056616C 75652065 72726F72 AVS Value error
00001830 2E202530 38580000 234910B5 04460868 . %08X..#I.µ.F.h
........
00001900 23F10CC1 94A42880 47EDCE48 00000000
^^^^^^^^
checksum dword
This SEQL area also has a checksum of 0x00000000.
- Code:
Offset(h) 00 04 08 0C
00010000 5345514C 72C49943 00000000 0008F46C SEQL............
^^^^^^^^
checksum dword ?
00010010 10000000 8000FFFF 00000000 010D010D
........
000110D0 010CFF04 0008F465 0C360000 00000000
000110E0 010D6304 0008F46B 0C360000 00000000
000110F0 00000000 00000000 00000000 00000000
I don't know what this is:
- Code:
Offset(h) 00 04 08 0C
00012F00 00000000 00000000 00BFFE00 00064296
This section appears to identify the firmware in some way. It is absent in the patient.
- Code:
Offset(h) 00 04 08 0C
0001FF00 464D434C 2020414C 46432020 20202020 FMCL ALFC
0001FF10 71612020 44455432 2D320D0A 436F7079 qa DET2-2..Copy
0001FF20 72696768 74284329 546F7368 69626120 right(C)Toshiba
0001FF30 436F7270 6F726174 696F6E20 32303137 Corporation 2017
0001FF40 2E30332E 31300D0A 45462F46 452F3045 .03.10..EF/FE/0E
0001FF50 2020533A 30626437 20202020 20202020 S:0bd7
0001FF60 20202020 20202020 20202020 20202020
0001FF70 20202020 20202020 20202020 20202020
0001FF80 20202020 20202020 20202020 20202020
0001FF90 20202020 20202020 20202020 20202020
0001FFA0 20202020 20202020 20202020 20202020
0001FFB0 20202020 20202020 20202020 20202020
0001FFC0 20202020 20202020 20202020 20202020
0001FFD0 20202020 20202020 20202020 20202020
0001FFE0 20202020 20202020 200D0A1A 00000000 .......
0001FFF0 00100000 E0C70A00 EFFE0E00 94C60A00 ....àÇ..ïþ..”Æ..
This is the main code section. It also has a checksum of 0x00000000.
- Code:
Offset(h) 00 04 08 0C
00020000 DC770700 43010000 00240450 1100200E Üw..C....$.P.. .
00020010 30363031 A4250450 31383235 30363232 0601¤%.P18250622
00020020 00141000 04000100 069A0000 B0040E00
00020030 00000000 00000000 E82A0300 120002F1
........
000CFFF0 00000000 00000000 00000000 00000000 ................
I haven't worked out what these are:
- Code:
Offset(h) 00 04 08 0C
000E0000 53434844 BC30ADBC 01000200 00000D01 SCHD¼0.¼........
000E0010 4D473037 00000000 53333544 43000000 MG07....S35DC...
........
000E7FF0 00000000 00000000 00000000 00000000
- Code:
Offset(h) 00 04 08 0C
000E8000 B80BB80B B0040000 00000000 630A0014 ¸.¸.°.......c...
000E8010 46000000 00000000 09143075 F401503C F.........0uô.P<
- Code:
Offset(h) 00 04 08 0C
000E8100 464D4D47 303706E0 00000000 00000000 FMMG07.à........
000E8110 00000808 A2DB1600 4A563380 280EE3FF ....¢Û..JV3€(.ãÿ
........
000EFFF0 00000000 00000000 00000000 00000000
- Code:
Offset(h) 00 04 08 0C
000FBFF0 FFFFFFFF FFFFFFFF 504F4544 01000000 ÿÿÿÿÿÿÿÿPOED....
000FC000 574C4644 01000000 5A820000 02000000 WLFD....Z‚......
........
000FCFE0 00000000 00000000 00000000 00000000
- Code:
Offset(h) 00 04 08 0C
000FCFF0 574C4644 01000000 5A820000 02000000 WLFD....Z‚......
000FD000 574C4644 01000000 59820000 01000000 WLFD....Y‚......
000FD010 0000037C 4850574C 01068806 006488F2 ...|HPWL..ˆ..dˆò
........
000FDFE0 00000000 00000000 00000000 00000000
- Code:
Offset(h) 00 04 08 0C
000FDFF0 574C4644 01000000 59820000 01000000 WLFD....Y‚......
000FE000 0B824404 38240100 8D6B0A00 69943202
- Code:
Offset(h) 00 04 08 0C
000FF000 434C4E54 00000021 00000000 FFFFFFFF CLNT............
These two sections have a checksum of 0x00000000.
- Code:
Offset(h) 00 04 08 0C
000FF010 4D504348 00000008 00000000 B3AFBCAF MPCH............
======== ^^^^^^^^
size including checksum dword checksum dword
- Code:
Offset(h) 00 04 08 0C
000FF020 4D532020 00000608 4D532020 08000000 MS ....MS ....
========
size including checksum dword
000FF030 00000000 000002D8 00000075 05000000 .......Ø...u....
........
000FF620 00000000 00000000 43010000 70ABD9D7
^^^^^^^^
checksum dword
May 4th, 2026, 0:15
May 4th, 2026, 1:30
fzabkar wrote:I haven't started analysing the patient. I've only looked at the known good donor to establish the structure and the checksums. I still need to do more work. Alternatively, you can check those same areas with a hex editor. I use HxD.
This new firmware architecture is nothing like the old one. I can't just modify my current Toshiba ROM checking tool. I need to write a completely new tool.
May 4th, 2026, 10:07
Offset(h) 00 04 08 0C
001D2600 50572020 11000000 01000000 90360000 PW ............
001D2610 FCFFFFFF 4FACEA02 0900200E FFFFFFFF
........
001D5C90 FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
001D5CA0 FFFFFFFFOffset(h) 00 04 08 0C
001E4800 500C4C02 500C4316 01070000 00000000 P.L.P.C.........
001E4810 00000000 00000000 00000000 00000000 ................
001E4820 FF1DFF1D FF1DFF1D FF1DFF1D FF1DFF1D ÿ.ÿ.ÿ.ÿ.ÿ.ÿ.ÿ.ÿ.
001E4830 FF1DFF1D FF1DFF1D FF1DFF1D FF1DFF1D ÿ.ÿ.ÿ.ÿ.ÿ.ÿ.ÿ.ÿ.
001E4840 00005401 C7070D1F 401A640E C7070D1F ..T.Ç...@.d.Ç...
001E4850 00005401 C7076D1C 401A640E C7076D1C ..T.Ç.m.@.d.Ç.m.
001E4860 00005401 C7076D1C 01070D1F 00000000 ..T.Ç.m.........
001E4870 D0101D09 00000000 00000000 00000000 Ð...............
001E4880 020B0000 00000000 00000000 00000000 ................
001E4890 FF1D0000 00000000 00000000 00000000 ÿ...............
001E48A0 D0101D09 00000000 00000000 00000000 Ð...............
001E48B0 00000000 00000000 00000000 00000000 ................
001E48C0 00000000 00000000 020B0107 630F0000 ............c...
001E48D0 401A1016 00000000 040D0000 00000000 @...............
001E48E0 401AD711 01070000 151C0000 00000000 @.×.............
001E48F0 D0101D09 00000000 00000000 00000000 Ð...............Offset(h) 00 04 08 0C
001E7600 4D430000 00000000 00C30000 01000400 MC..............
001E7610 2A000000 00002A00 84010000 0000FFFF
........
001E7E70 10000000 00000000 10000000 00000000
001E7E80 10000000 00000000 10000000 00000000
001E7E90 0000FFFF FFFFFFFF FFFFFFFF FFFFFFFF
001E7EA0 FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFFOffset(h) 00 04 08 0C
001F7600 A0186150 1819FE05 02000000 E4210200
001F7610 1819FE05 08000000 30A50300 22000000
001F7620 B8AAF968 E05998C4 05000000 00010000
........
001FB5E0 0E19FE05 03000000 9CD40100 60506550
001FB5F0 0E19FE05 06000000 9C970300 002517C7
001FB600 FFFFFFFF 00000000 00000000 00000000
........
001FD5F0 00000000 00000000 00000000 00000000
001FD600 61000000 20040000 00080000 00000000
001FD610 07000000 28150C50 801E0000 00090000
........
001FE5B0 07000000 08150C50 501E0000 08000000
001FE5C0 61000000 20040000 00080000 00000000
001FE5D0 07000000 28150C50 501E0000 00090000
001FE5E0 571E0000 00000000 37000000 40480E00
001FE5F0 07000000 08150C50 781E0000 08000000
001FE600 FFFFFFFF 00000000 00000000 00000000
001FE610 00000000 00000000 00000000 00000000
001FE620 00000000 00000000 00000000 00000000
........
001FEDE0 00000000 00000000 00000000 00000000
001FEDF0 00000000 00000000 00000000 00000000
001FEE00 03000000 FCB70950 5B1A0B50 73F70100
001FEE10 03000000 FCB70950 5B1A0B50 F9CA6F01
001FEE20 03000000 FCB70950 5B1A0B50 FACA6F01
001FEE30 03000000 FCB70950 5B1A0B50 3017F001
001FEE40 03000000 FCB70950 5B1A0B50 3217F001
001FEE50 03000000 FCB70950 5B1A0B50 433B0303
001FEE60 03000000 FCB70950 5B1A0B50 443B0303
001FEE70 03000000 FCB70950 5B1A0B50 4548BD03
001FEE80 03000000 FCB70950 5B1A0B50 CE35BF03
001FEE90 03000000 FCB70950 5B1A0B50 A152EA03
001FEEA0 03000000 FCB70950 5B1A0B50 A252EA03
001FEEB0 00000000 00000000 00000000 00000000
001FEEC0 00000000 00000000 00000000 00000000
........
001FF600 00589661 54300000 5A300000 00000100
001FF610 00589761 00000000 00000000 00800000
001FF620 00189861 00000000 00000000 00200000
001FF630 00389861 2C000000 00000000 00200000
001FF640 00D89761 AC060000 B4060000 00400000
001FF650 FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
001FF660 FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFFMay 4th, 2026, 12:51
Powered by phpBB © phpBB Group.