Rosewood ROM with Bad CRC

[shahij]

The ROM has issue (RAP, CAP)

Bad CRC Seg:0x06
LED:0x000000BB FAddr:0x00004A18

We did CRC recalc, Cap issue gone, still RAP error.

Original ROM and CRC Calculated ROM in attachment

What do you see?

Attachments

ROM.zip

(943.78 KiB) Downloaded 19 times

[pepe]

didn't it occur to you that CAP is completely erased when recalculating the crc?
also, the end of RAP is missing. So recalcing the crc is not enough in this case.

[fzabkar]

It seems to me that the RAP segment may be complete except for the CRC word at the end.

Code:

End of RAP data in RAP segment

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0002B140  00 F2 00 F6 00 DC 00 F1 00 E6 00 00 89 06 C4 23
0002B150  08 06 81 06 00 00 80 06 08 E2 13 09 09 00 1E 00
0002B160  8B 33 FF FF FF FF FF FF FF FF FF FF FF FF FF FF
0002B170  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

End of RAP data in Extra Space

Code:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00027910  00 F2 00 F6 00 DC 00 F1 00 E6 00 00 89 06 C4 23
00027920  08 06 81 06 00 00 80 06 08 E2 13 09 09 00 1E 00
00027930  8B 33 FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00027940  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

I found these SMART data in Extra Space:

Code:

Serial number is WDZH0MPF
Part number is 027JJ0DTX       

ID  Flg  Cur  Wor  Raw             Description
------------------------------------------------------------------------
  1  0F    78   64  000000039D524C  Raw Read Error Rate
  3  03    99   99  00000000000000  Spin Up Time
  4  32    90   90  000000000028A3  Start/Stop Count
  5  33   100  100  00000000000000  Reallocated Sector Count
  7  0F    74   60  00000001AD0AD2  Seek Error Rate
  9  32    96   96  01CC6A00000FAB  Power-On Hours Count
10  13   100  100  00000000000000  Spin Retry Count
12  32    97   97  00000000000EFA  Drive Power Cycle Count
184  32   100  100  00000000000000  End to End Error Det/Corr Count
187  32   100  100  00000000000000  Reported Uncorrectable Errors
188  32   100   99  00000000000003  Command Time Out
189  3A   100  100  00000000000000  High Fly Writes
190  22    66   41  00000022210022  Airflow Temperature
191  32   100  100  00000000000012  Shock Sense
192  32   100  100  0100000000001F  Emergency Retract Cycle Count
193  32    66   66  000000000110E9  Load/Unload Cycle Count
194  22    34   59  00000D00000022  HDA Temperature
197  12   100  100  00000000000000  Current Pending Sector Count
198  10   100  100  00000000000000  Offline Uncorrectable Sector Count
199  3E   200  200  00000000000000  UltraDMA CRC Error Rate
240  00   100  253  15FEBA000004ED  Head Flying Hours
241  00   100  253  000001C43B6E1E  Total LBAs written
242  00   100  253  000002E8EAE242  Total LBAs read
254  32   100  100  00000000000000  Free Fall Sensor

Attachments

SMART.7z

(1.26 KiB) Downloaded 14 times

[pepe]

i need to disagree, there should be data at around B4000, but there's only FF...

[fzabkar]

i need to disagree, there should be data at around B4000, but there's only FF...

Has someone manipulated the ROM??

[fzabkar]

I examined a working RAP. The missing stuff at the end was copied at offset 0x2E700 in the Extra Space. In the OP's case this backup location is overwritten with SMART data.

[fzabkar]

Is this a similar case?

https://groups.google.com/g/datarecoverycertification/c/1w8qC5TbcBM/m/Tph2dMGcAAAJ

In that case the DL_UDSBFW segment overwrote the SAP and RAP. In the current case the DL_UDSBFW segment is empty(0xFF).

[shahij]

i need to disagree, there should be data at around B4000, but there's only FF...

Has someone manipulated the ROM??

not sure, will ask user tomorrow

[fzabkar]

In that other thread the ROM was damaged as a result of a firmware bug. I suspect that a similar bug has damaged your ROM. In other Rosewood versions the SMART data are written to ROM segment 0x2B, whereas in yours they are written to the extra space at the end. Unfortunately this has destroyed the backup copy of the RAP.