WD WD10PURZ-85U8XY0 - No BIOS chip

[grevan]

Story is WD WD10PURZ came with no BIOS chip, so trying to reconstruct from donor.
PCB 2060-800006-001
Using MRT
- Found donor, same PCB, same main controller, 2 weeks apart
- Backup donor ROM and resources
- Transfered donor ROM to patient
- Patient gets ready, recognizes right family, obviously no SA access
- Tried to load donor loaders to RAM (gives me 1B, 411, 5C, 10, 11 choices when i choose folder)
- Loading each loader with "Persistent cover" method works (allways loading 11 last)
- Loading with "write to RAM" method gives error "Err(Write Data Fail)"
- Head test says heads are OK
- Can´t get module list and cant find module 0x129 by trying to search for it
- Sometimes i can get loader 0x1B to "write to RAM", but only 0x1B
Any tips i could try?
I don´t think this PCB model is locked, right?

[fzabkar]

- Transfered donor ROM to patient

Why not just use the donor PCB?

I don´t think this PCB model is locked, right?

If it is locked, then should you start and work with the donor PCB?

[grevan]

After reading some articles I think there's a bug with MRT 2.1.10.4 version, which cannot unlock rom, saying "wrong size". I'll try later another unlock option alternative.
I forgot to mention that.

[Hardcore Games]

I am wondering if the disk model has more than one iteration of logic board. I am aware that many disks have used commodity parts to keep costs down.

More of interest is why the BIOS chip was absent in the first place. At least if present it could be copied with a ROM reader to analyse.

[grevan]

About the pcb, I was thinking the same.

Amazing story, its a cctv case from a computer shop. Apparently employee was stealing things and camera stopped recording. Analyzing the rom it was detected as from a GPU mobile card. So he swapped the rom without leaving any traces.
MRT has a reconstruct rom option, but it needs to access SA. As I was not able to unlock the rom, giving me an error of wrong size, i thought maybe the rom was not locked. But now I found out that bug for that family, TrailXLB. Rom is 256kb and MRT expects to be larger. Apparently I need to select another family that accepts smaller rom.
Do you think the fail of loading loaders to ram could be from the chip being locked?

[fzabkar]

I have a ROM dump from your model. It doesn't appear to be signed.

Code:

Analysing WD10PURZ-2060-800039-001(DONOR)_0x40000.bin ...

Searching for LDSCs and verifying PCMBlocks ...

LDSC   LDSC    Att   PCMBlock          RAM         size      PCMBlk CS
Start  ID CS        Start -  End     address     RAM / ROM    Exp/Act
-----  -- --   --   -----   -----   --------   ------ -----  ---------
    0  5A 52   04     120 -  19EF       A800     18CC  18CC  0009BD53 0009BD53 OK (not digitally signed)
   20  01 B1   0C    19F0 -  1DE0    1000000      3F0   3F0    80   80   OK
   40  02 99   01    1DE1 -  6691          0 c   5C98  48B0    D6   D6   OK
   60  03 30   01    6692 -  6CFE       9D10 c    7E8   66C    AC   AC   OK
   80  04 C6   03    6CFF -  9B63      402E0 c   3A5C  2E64    35   35   OK
   A0  05 B0   03    9B64 -  9DD4    8180E00 c    3E0   270    AD   AD   OK
   C0  06 34   01    9DD5 - 1ACF1   88210A00 c  16794 10F1C    A7   A7   OK
   E0  07 45   11   1ACF2 - 1E87A   80800000 c   5004  3B88    1F   1F   OK
  100  08 68   01   1E87B - 32967   88000230 c  1BA74 140EC    2C   2C   OK

LDSC   = PM Loader Config String (32 bytes)
ID     = ID byte of LDSC (byte #0)
CS     = Checksum byte or word
Att    = Attributes
PCMBlk = Program Code Memory Block
Exp    = Expected checksum for PCMBLock
Act    = Actual checksum for PCMBLock
c      = compressed PCMBlock
size   = size of decompressed (in RAM) and compressed (in ROM) PCMBlock in bytes

Verifying ROYL modules ...

ID          Size (bytes)         Address    Checksum
dir   hdr        dir       hdr
----  ----   --------  --------   --------   --------
0001  N/A    00004000  N/A        0001B5FA             N/A
000A  OK     0000004E  00000200   0003E000   00000000  OK
000B  OK     00000119  00000200   0003FB56   00000000  OK
020B  OK     00000119  00000200   0003EB56   00000000  OK
0030  OK     00000400  OK         0003D000   00000000  OK
0047  OK     00000600  OK         0003E556   00000000  OK
000D  OK     00000108  00000200   0003E04E   00000000  OK
004F  OK     00000400  OK         0003E156   00000000  OK

[fzabkar]

Do you think the fail of loading loaders to ram could be from the chip being locked?

"Hardcore Games" is a troll. S/he has no knowledge of data recovery.

[grevan]

The pcb is different, patient is 2060-800006-001.
I dumped that rom from 2060-800039-001, but size is the same 256kb.
I believe it might be the same from 800006.

[grevan]

I think this PCB model is not locked.
Entered kernel mode.
Created a LDR from donor
It fails to loads into RAM