All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 12 posts ] 
Author Message
 Post subject: SAMSUNG HM641JI no spin
PostPosted: September 11th, 2022, 18:01 
Offline

Joined: August 18th, 2014, 18:42
Posts: 13
Location: zimbabwe
Hello
I have a SAMSUNG HM641JI that will not spin. But if i put a donor pcb it spins but not detected.
Can anyone please help me to fix if there is any error with the attached firmware.
Thank you.


Attachments:
origSAMSUNG HM641JI.rar [163.43 KiB]
Downloaded 191 times
Top
 Profile  
 
 Post subject: Re: SAMSUNG HM641JI no spin
PostPosted: September 12th, 2022, 0:33 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
There is a checksum error somewhere within this address range -- 0x4CC0 - 0x193AB.

Code:
Verifying Samsung SpinPoint ROM:  origSAMSUNG HM641JI.BIN

Checksum of Boot Block header = 0x26  - OK
Checksum of Boot Block (Actual/Expected) = 0x077A / 0x077A  - OK

Searching for FIPS block (expected checksum = 0x0000) ...

Found FIPS text string at 0x003000
Checksum for 0x0400 byte FIPS block = 0x8009  - BAD
Checksum for 0x0800 byte FIPS block = 0x0000  - OK
Checksum for 0x0C00 byte FIPS block = 0xFE00  - BAD
Checksum for 0x1000 byte FIPS block = 0xFC00  - BAD

Found FIPS text string at 0x014762
Checksum for 0x0400 byte FIPS block = 0x05D0  - BAD
Checksum for 0x0800 byte FIPS block = 0x35DE  - BAD
Checksum for 0x0C00 byte FIPS block = 0x5383  - BAD
Checksum for 0x1000 byte FIPS block = 0x4491  - BAD

Found FIPS text string at 0x01977C
Checksum for 0x0400 byte FIPS block = 0x3A78  - BAD
Checksum for 0x0800 byte FIPS block = 0xB9D1  - BAD
Checksum for 0x0C00 byte FIPS block = 0xCF20  - BAD
Checksum for 0x1000 byte FIPS block = 0x9E77  - BAD

Found FIPS text string at 0x01A0C8
Checksum for 0x0400 byte FIPS block = 0x6584  - BAD
Checksum for 0x0800 byte FIPS block = 0xE883  - BAD
Checksum for 0x0C00 byte FIPS block = 0x87D5  - BAD
Checksum for 0x1000 byte FIPS block = 0x67ED  - BAD

Possible 0x0800 byte FIPS block at address 0x003000

Searching for FLASHTBL ...

Found FLASHTBL text string at 0x004024
Parsing FLASHTBL at 0x004000 ...

ID Byt1 Byt3 Size     ROM address        RAMaddrs  Cksm (Exp/Act)
-----------------------------------------------------------------
00  00   FF  00000000 FFFFFFFF           00000000            N/A
01  02   FF  00000320 00004000-0000431F  FFF04000  ED AA   - BAD (Note 2)
02  08   FF  0000099C 00004320-00004CBB  FFF04320  BD BD   - OK
03  00   FF  000146EC 00004CC0-000193AB  00000000  CC 6C   - BAD (Note 3)  <--- There is a problem here
04  01   FF  00002C7C 000193B0-0001C02B  00014D00  00 06   - BAD (Note 1)
05  00   FF  00000D10 000193B4-0001A0C3  04000000  9E 9E   - OK
06  00   FF  0000022C 0001A0C8-0001A2F3  04005C00  F8 F8   - OK
07  00   FF  00018FE8 0001A2F8-000332DF  10000300  EF EF   - OK
08  01   FF  0001C464 000332E4-0004F747  1002E300  00 40   - BAD (Note 1)
09  00   FF  00002A64 000332E8-00035D4B  18052300  C1 C1   - OK
0A  00   FF  00000F98 00035D50-00036CE7  200164F0  5E 5E   - OK
0B  00   FF  000001D8 00036CEC-00036EC3  FFFE1000  92 92   - OK
0C  00   FF  00000DD0 00001800-000025CF  FFF01800  24 24   - OK
0D  02   FF  00000000 FFFFFFFF           FFF04000            N/A
0E  08   FF  00000000 FFFFFFFF           FFF04320            N/A
0F  20   FF  00000000 FFFFFFFF           FFF01800            N/A
10  00   FF  00000000 FFFFFFFF           FFFC0000            N/A
11  00   FF  00000000 FFFFFFFF           200164F0            N/A

Found FLASHTBL text string at 0x02A363
Inconsistent ID

Found FLASHTBL text string at 0x02B523
Inconsistent ID


Searching for SERVOTBL ...

Found SERVOTBL text string at 0x037024
Parsing SERVOTBL at 0x037000 ...

ID Byt1 Byt3 Size     ROM address        RAMaddrs  Cksm (Exp/Act)
-----------------------------------------------------------------
00  02   FF  00000100 00037000-000370FF  FFF37000  51 C7   - BAD (Note 2)
01  00   FF  00008DF0 00037104-0003FEF3  00000000  99 99   - OK
02  00   FF  00000814 0003FEF8-0004070B  04000100  12 12   - OK
03  00   FF  000002A0 00040710-000409AF  FFFE1000  6F 6F   - OK
04  02   FF  00000000 00036FFF           FFF37000            N/A


Size            - size of module in ROM expressed in bytes
ROM address     - absolute address range of module in ROM
RAMaddrs        - load point of module in RAM
Cksm (Exp/Act)  - Expected Checksum / Actual Checksum


Note 1:  The address range of affected module may conflict with another module,
          in which case this is probably a false negative.

Note 2:  If this module is the FLASHTBL or SERVOTBL, then this is most likely
          a false negative.

Note 3:  This may or may not be a genuinely BAD module. Examine the checksum
          of the first half of the ROM. If 0x0000, then module is probably OK,
          otherwise it may or may not be bad. Also examine the "adjusted"
          checksum, if applicable.

Note 4:  The address range of the module is outside the limits of the ROM.



Calculating ROM checksums ...
Checksum for 0x000000 - 0x03FFFF = 0xD9CA
Checksum for 0x040000 - 0x07FFFF = 0x3BD8
Checksum for entire ROM = 0x15A2

Extents reported by FLASHTBL header = 0x000000 - 0x036FFF
Extents reported by SERVOTBL header = 0x037000 - 0x041FFF

Checksum from 0 to end of SERVOTBL = 0x05A2

Checksum (adjusted) from 0 to end of SERVOTBL = 0x00A0
Checksum (adjusted) from 0 to 0x41FFF = 0x00A0

(adjusted for FIPS and penultimate words in SERVOTBL)

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: SAMSUNG HM641JI no spin
PostPosted: September 12th, 2022, 5:25 
Offline

Joined: August 18th, 2014, 18:42
Posts: 13
Location: zimbabwe
Thank you for the help. Unfortunately I don't have any knowledge on checksum correction. Is there a software tool to do checksum correction?.


Top
 Profile  
 
 Post subject: Re: SAMSUNG HM641JI no spin
PostPosted: September 12th, 2022, 13:49 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
stfungayi wrote:
Is there a software tool to do checksum correction?.

No, it's impossible. You need to find the same ROM code in a donor resource.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: SAMSUNG HM641JI no spin
PostPosted: September 13th, 2022, 1:59 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
I've repaired your ROM using parts of the 2AJBBWNM.143 file in the burn resources.

http://files.hddguru.com/download/Software/SHTR/Burn/MAIN.7z

Excerpt from patient ROM:

Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00004000  48 53 FF FF 00 30 F0 FF 32 41 4A 42 62 77 6E 5F  HSÿÿ.0ðÿ2AJBbwn_        <-- 2AJBbwn_
00004010  32 41 4A 30 61 6B 37 5F 00 00 00 00 00 70 03 00  2AJ0ak7_.....p..
00004020  02 2B 01 02 46 4C 41 53 48 54 42 4C 03 00 00 01  .+..FLASHTBL....


Attachments:
origSAMSUNG_HM641JI_repaired.7z [150.71 KiB]
Downloaded 172 times

_________________
A backup a day keeps DR away.
Top
 Profile  
 
 Post subject: Re: SAMSUNG HM641JI no spin
PostPosted: September 13th, 2022, 12:40 
Offline

Joined: August 18th, 2014, 18:42
Posts: 13
Location: zimbabwe
Thank you for the repaired .The hdd is now spinning for a short time with few clicks then stops spinning.
Terminal output is below ending with LED110c

Code:
ActiveFW : 00FWVer : 0001SATA PLL cal doneDDR size detected = 8MB*PA VID=0007 PN=0000 Rev=0004*PA VID
=0007 PN=0000 Rev=0004U
S_0SSC EN
SO_1
SSC EN
IS=4
CLA #36/72
Handoff RPM=669
SPOK
SR:58 SS:00000280
mS1 00000003
A1O=116 A1G=449
O=510 S=-1
SoUL!
PK_3   C:     0 H:0
A1O=116 A1G=449
O=510 S=0
SoUL!
PK_3   C:     0 H:1
A1O=116 A1G=450
O=510 S=-1
SoUL!
PK_3   C:     0 H:2
A1O=116 A1G=450
O=510 S=0
SoUL!
PK_3   C:     0 H:3
A1O=116 A1G=451
O=510 S=-1
SoUL!
PK_3   C:     0 H:0
A1O=116 A1G=451
O=510 S=0
SoUL!
PK_3   C:     0 H:1
A1O=116 A1G=451
O=510 S=0
SoUL!
PK_3   C:     0 H:2
A1O=116 A1G=451
O=510 S=1
SoUL!
PK_3   C:     0 H:3
A1O=116 A1G=452
O=510 S=-1
SoUL!
PK_3   C:     0 H:0
A1O=116 A1G=452
O=510 S=0
SoUL!
PK_3   C:     0 H:1
A1O=116 A1G=452
O=510 S=1
SoUL!
PK_3   C:     0 H:2
A1O=116 A1G=452
O=510 S=1
SoUL!
PK_3   C:     0 H:3
A1O=116 A1G=453
O=510 S=-1
SoUL!
PK_3   C:     0 H:0
A1O=116 A1G=453
O=510 S=-1
SoUL!
PK_3   C:     0 H:1
A1O=116 A1G=453
O=510 S=0
SoUL!
PK_3   C:     0 H:2
A1O=116 A1G=454
O=510 S=-2
SoUL!
PK_3   C:     0 H:3
Unlatch Fail
EPOK
Software unloading!
PK_4   C:     0 H:0
Software unloading!
PK_4   C:     0 H:0
LED 110C
LED 110C
LED 110C
LED 110C
LED 110C


Top
 Profile  
 
 Post subject: Re: SAMSUNG HM641JI no spin
PostPosted: September 13th, 2022, 17:20 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
LED 110x appear to be latch or ramp errors.

http://files.hddguru.com/download/Software/SHTR/MANUAL_EN.pdf (page 57)

However, clicking would suggest that the heads have moved off the ramp ???

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: SAMSUNG HM641JI no spin
PostPosted: September 14th, 2022, 2:45 
Offline

Joined: August 18th, 2014, 18:42
Posts: 13
Location: zimbabwe
Thank you for your help, as it turns out, I have now been informed that someone had previously opened the hdd platter enclosure .So maybe the heads are disturbed.


Top
 Profile  
 
 Post subject: Re: SAMSUNG HM641JI no spin
PostPosted: September 14th, 2022, 3:21 
Offline
User avatar

Joined: January 28th, 2009, 10:54
Posts: 3452
Location: Greece
fzabkar wrote:
However, clicking would suggest that the heads have moved off the ramp ???


Not necessarily, clicking would occur also when mashed/deformed heads can not leave the ramp and would smash hard against the platter edges.

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners


Top
 Profile  
 
 Post subject: Re: SAMSUNG HM641JI no spin
PostPosted: October 5th, 2022, 6:43 
Offline

Joined: June 26th, 2019, 8:55
Posts: 32
Location: Indore, India
fzabkar wrote:
I've repaired your ROM using parts of the 2AJBBWNM.143 file in the burn resources.

http://files.hddguru.com/download/Software/SHTR/Burn/MAIN.7z

Excerpt from patient ROM:

Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00004000  48 53 FF FF 00 30 F0 FF 32 41 4A 42 62 77 6E 5F  HSÿÿ.0ðÿ2AJBbwn_        <-- 2AJBbwn_
00004010  32 41 4A 30 61 6B 37 5F 00 00 00 00 00 70 03 00  2AJ0ak7_.....p..
00004020  02 2B 01 02 46 4C 41 53 48 54 42 4C 03 00 00 01  .+..FLASHTBL....



I am also having same issue. ROM seems Culprit to me .

https://forum.hddguru.com/viewtopic.php?f=1&t=42700

Attachment:
ROM_DEFECT.7z [467.84 KiB]
Downloaded 167 times


Top
 Profile  
 
 Post subject: Re: SAMSUNG HM641JI no spin
PostPosted: October 5th, 2022, 14:25 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
The actual ROM size is 0x80000. Your ROM is twice as big as it needs to be.

There should be a checksum word at 0x7FFFE. It appears that your ROM code is probably OK, but the checksum has been changed to 0xFFFF.

Could this be sabotage?

Edit these two bytes:

Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0007FFF0  FF FF FF FF FF FF FF FF FF FF FF 00 01 00 45 C7
                                                    ^^^^^


Code:
Verifying Samsung SpinPoint ROM:  ROM_DEFECT_trunc.bin

Calculating ROM checksums ...
Checksum for 0x000000 - 0x03FFFF = 0xCC07
Checksum for 0x040000 - 0x07FFFF = 0x6CB3
Checksum for entire ROM = 0x38BA

Checksum of Boot Block header = 0x63  - OK
Checksum of Boot Block (Actual/Expected) = 0x7173 / 0x7173  - OK

Searching for FIPS block (expected checksum = 0x0000) ...

Found FIPS text string at 0x001000
Checksum for 0x0400 byte FIPS block = 0xD542  - BAD
Checksum for 0x0800 byte FIPS block = 0xCDFA  - BAD
Checksum for 0x0C00 byte FIPS block = 0x4ABD  - BAD
Checksum for 0x1000 byte FIPS block = 0x0000  - OK

Found FIPS text string at 0x00A456
Checksum for 0x0400 byte FIPS block = 0xD265  - BAD
Checksum for 0x0800 byte FIPS block = 0x294B  - BAD
Checksum for 0x0C00 byte FIPS block = 0xFE83  - BAD
Checksum for 0x1000 byte FIPS block = 0x9C6F  - BAD

Found FIPS text string at 0x01C948
Checksum for 0x0400 byte FIPS block = 0xE1AE  - BAD
Checksum for 0x0800 byte FIPS block = 0x8670  - BAD
Checksum for 0x0C00 byte FIPS block = 0x7D6C  - BAD
Checksum for 0x1000 byte FIPS block = 0xB5E3  - BAD

Found FIPS text string at 0x032EDD
Checksum for 0x0400 byte FIPS block = 0xBBAE  - BAD
Checksum for 0x0800 byte FIPS block = 0xB77D  - BAD
Checksum for 0x0C00 byte FIPS block = 0xE02D  - BAD
Checksum for 0x1000 byte FIPS block = 0x832F  - BAD

Possible 0x1000 byte FIPS block at address 0x001000

Searching for FLASHTBL ...

Found FLASHTBL text string at 0x002024
Parsing FLASHTBL at 0x002000 ...

ID Byt1 Byt3 Size     ROM address        RAMaddrs  Cksm (Exp/Act)
-----------------------------------------------------------------
00  00   FF  00000000 FFFFFFFF           00000000            N/A
01  40   FF  00000000 FFFFFFFF           00014D00            N/A
02  02   FF  00000300 00002000-000022FF  FFF02000  00 49   - BAD (Note 2)
03  08   FF  00001ED8 00002300-000041D7  FFF02300  AB AB   - OK
04  00   FF  00014C40 000041E0-00018E1F  00000000  18 18   - OK
05  40   FF  00002FB0 00018E28-0001BDD7  00014D00  09 09   - OK
06  00   FF  00000B60 0001BDE0-0001C93F  00080000  35 35   - OK
07  00   FF  00000384 0001C948-0001CCCB  00085C00  D7 D7   - OK
08  00   FF  00000234 0001CCD4-0001CF07  00088000  F9 F9   - OK
09  80   FF  0004C870 0001CF10-0006977F  10018000  94 94   - OK
0A  81   FF  000054B4 00069788-0006EC3B  10064870  00 DD   - BAD (Note 1)
0B  00   FF  00006820 00069790-0006FFAF  900003C0  49 49   - OK

Found FLASHTBL text string at 0x0530DB
Inconsistent ID

Found FLASHTBL text string at 0x05AF93
Inconsistent ID


Searching for SERVOTBL ...

Found SERVOTBL text string at 0x071024
Parsing SERVOTBL at 0x071000 ...

ID Byt1 Byt3 Size     ROM address        RAMaddrs  Cksm (Exp/Act)
-----------------------------------------------------------------
00  02   FF  000000C0 00071000-000710BF  FFF71000  00 70   - BAD (Note 2)
01  00   FF  0000CECC 000710C4-0007DF8F  00000000  C6 C6   - OK
02  00   FF  00000F68 0007DF98-0007EEFF  00080000  80 80   - OK


Size            - size of module in ROM expressed in bytes
ROM address     - absolute address range of module in ROM
RAMaddrs        - load point of module in RAM
Cksm (Exp/Act)  - Expected Checksum / Actual Checksum


Note 1:  The address range of affected module may conflict with another module,
          in which case this is probably a false negative.

Note 2:  If this module is the FLASHTBL or SERVOTBL, then this is most likely
          a false negative.

Note 3:  This may or may not be a genuinely BAD module. Examine the checksum
          of the first half of the ROM. If 0x0000, then module is probably OK,
          otherwise it may or may not be bad. Also examine the "adjusted"
          checksum, if applicable.

Note 4:  The address range of the module is outside the limits of the ROM.


Extents reported by FLASHTBL header = 0x000000 - 0x070FFF
Extents reported by SERVOTBL header = 0x071000 - 0x07FFFF

Checksum from 0 to end of SERVOTBL = 0x38BA

Checksum (adjusted for FIPS and penultimate words in SERVOTBL)
  Expected / Actual = 0x0000 / 0x2FB8

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: SAMSUNG HM641JI no spin
PostPosted: October 5th, 2022, 16:02 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
I'm not sure about the checksum now. The PUIS (Power Up In Standby) flag in the FIPS module appears to be set:

http://www.hddoracle.com/viewtopic.php?f=59&t=1247#p8192

Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00001000  46 49 50 53 01 01 00 00 32 2E 30 30 30 20 20 20  FIPS....2.000   
00001010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00001020  FF AA 50 55 37 4D 48 36 53 31 42 41 30 45 42 48  ÿªPU7MH6S1BA0EBH
             ^^
             0xAA = PUIS enabled

HDAT2 should be able to disable PUIS, or you can change 0xAA to 0xFF and recalculate the FIPS checksum.

Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00001FF0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 92 8C
                                                    ^^^^^ edited FIPS checksum (PUIS disabled)

Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00001FF0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 92 E1
                                                    ^^^^^ original FIPS checksum (PUIS enabled)

_________________
A backup a day keeps DR away.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 12 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Google [Bot], Google Adsense [Bot] and 70 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group