WD1600BEVS-08VAT2 cannot read modules

[helpless]

Hi,
I have a 160gb 2,5" Denali that was locked and no free method could read the password. Upon inspecting it closer it turned out that no modules can be read. All my heads (2) have gone? Do I need a firmware to load? Anyone got one? I cannot read nor write mod 0A, it errors.

[helpless]

I studied a downloaded 0A.bin and I find that the info in the bin can be found in the last bytes of the ROM.bin.
I can save and read my ROM - which is damaged, and which contains mod 0A but cannot read head map, because it is damaged.
Why can I read a damaged ROM and why not a damaged head map?
I created mod 0A from my ROM. Can someone tell if my mod 0A is damaged or not? Or point me towards info on how to check it? Thanks.

Attachments

0A.zip

(170 Bytes) Downloaded 674 times

[fzabkar]

FWIW, at least it checksums OK.

Code:

C:\>chksum2 -32 0A.bin
0A.BIN: 512 bytes       checksum32 = 0x00000000


If you can upload the full ROM image, I can verify the various checksums and structures within the ROM.

See http://malthus.zapto.org/viewtopic.php?f=59&t=225

[helpless]

Spildit
Thanks for your suggestion. Wait for fzabkar to complete ROM check.

fzabkar
Would you do that? Great. Those instructions seem a bit complicated. But still don't know what next step will be if it turns out to be OK.

Attachments

08FA.zip

(164.96 KiB) Downloaded 721 times

[fzabkar]

I used NazYura's CHECK_FL.COM utility to check your ROM. There are errors in PMCBlocks 07 and 08, but these occur because CHECK_FL.COM is limited to 128KB ROMs.

Code:

------------------------------------------------------------------------------
Flash Code File Name --> 08FA.FLS

LDSC:00 CS  + -->[D1-D1] - PMCBlk:00 Size:[0C0D] Sign:[0000] CS  + -->[49-49]
LDSC:01 CS  + -->[E0-E0] - PMCBlk:01 Size:[706D] Sign:[588C] CS  + -->[6E-6E]
LDSC:02 CS  + -->[0C-0C] - PMCBlk:02 Size:[400D] Sign:[B45A] CS  + -->[97-97]
LDSC:03 CS  + -->[EA-EA] - PMCBlk:03 Size:[08D1] Sign:[0C0B] CS  + -->[F1-F1]
LDSC:04 CS  + -->[CB-CB] - PMCBlk:04 Size:[0221] Sign:[D002] CS  + -->[5F-5F]
LDSC:05 CS  + -->[96-96] - PMCBlk:05 Size:[0451] Sign:[6008] CS  + -->[FE-FE]
LDSC:06 CS  + -->[83-83] - PMCBlk:06 Size:[16D1] Sign:[A428] CS  + -->[8D-8D]
LDSC:07 CS  + -->[A6-A6] - PMCBlk:07 Size:[3DF5] Sign:[B097] CS BAD-->[20-71]
LDSC:08 CS  + -->[4B-4B] - !!! LDSC TABLE BAD !!! Skipping Check This File...

------------------------------------------------------------------------------

*** !!! Warning !!! Found Wrong Flash File !!! Warning !!!

History:
CS     - Control Sum
+      - GOOD Control Sum
BAD    - BAD Control Sum Found
LDSC   - PM Loader Config String
PMCBlk - Programm Memory Code Block
Sign   - Signature Block Code


I extracted PMCBlk:07 and PMCBlk:08 and ran the following checksum utility against them. In both cases the computed and expected checksums matched.

Code:

C:\Downloads\WD\WD1600BEVS-08VAT2>chksum2 -8 PMCBLK7.BIN
PMCBLK7.BIN:    81396 bytes     checksum8 = 0xCE


offset 0x221AF = 0xCE

Code:

C:\Downloads\WD\WD1600BEVS-08VAT2>chksum2 -8 PMCBLK8.BIN
PMCBLK8.BIN:    26884 bytes     checksum8 = 0xAE


offset 0x28AB4 = 0xAE

I then extracted the MODs using the information in the directory (MOD 0B). I had to pad some with zeros, but they all checksummed OK.

Code:

C:\Downloads\WD\WD1600BEVS-08VAT2>chksum2 -32 ROM_??.bin
ROM_0D.BIN:     132 bytes       checksum32 = 0x00000000
ROM_47.BIN:     1024 bytes      checksum32 = 0x00000000
ROM_4F.BIN:     172 bytes       checksum32 = 0x00000000
ROM_30.BIN:     1024 bytes      checksum32 = 0x00000000
ROM_0B.BIN:     212 bytes       checksum32 = 0x00000000
ROM_0A.BIN:     64 bytes        checksum32 = 0x00000000


FWIW, here are the version numbers for your MODs:

Code:

MOD ID   version         details

0D       00010000        Firmware 14.01A14
47       FFg0000<space>  <-- does this version number look OK?
4F       000800FA
30       00160000
0B       00020000
0A       00X10002


ISTM that the version for MOD 47 looks strange, but I'm not a data recovery professional.

In short, everything checksums OK and everything looks OK, apart from the strange MOD 47 version.

[fzabkar]

In short, everything checksums OK and everything looks OK, apart from the strange MOD 47 version.

I had a look at the following resource set:

http://www.datadonor.net/HD%20Western%2 ... 26VAT0.zip

ISTM that your version number is probably OK.

Code:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  52 4F 59 4C 01 00 1E 00 47 00 01 00 56 D6 E9 BB  ROYL....G...VÖé»
00000010  45 48 61 30 34 30 30 20 07 07 07 00 30 00 20 01  EHa0400 ....0. .


[fzabkar]

ISTM that this drive may have custom OEM firmware for Lenovo. Perhaps this custom firmware is denying access to the SA???

Could the OP access the SA using a non-native PCB with different firmware??? Then maybe we could remove the password by hacking MOD 02 or wherever it is stored.

[fzabkar]

Aren't the model number and serial number retrieved from SA MOD 02? If so, then wouldn't this point to some kind of security lockout? Could it be that, when a password is set, normal ATA commands still work, but VSC commands that access the SA or ROM MODs may be disabled?

Otherwise, what kind of fault could cause the wrong head map to appear in ROM?

Can the OP still retrieve the drive's SMART data? AFAIK that would require access to SA MODs 20h, 21h, or 22h.

Does the drive still report its correct capacity to BIOS? Can we still retrieve its Identify Device information block?

[helpless]

Thank you guys! I have a same model with exactly the same behaviour, ROM is attached.
I used WDMarvel23 and it can (also) read the ROM - the file is identical with the one made with WDR -, but WDMarvel23 reports error reading modules 102, 103, 104, 105, 107 and 109. I will check SMART again soon, but AFAIR both drives were quite healthy and MHDD didn't come up with anything strange.

Attachments

0831.zip

(163.71 KiB) Downloaded 521 times

[fzabkar]

AISI, if MHDD can see the SMART data but WDMarvel23 cannot read SA MODs 20, 21, or 22, then that would suggest that VSCs have been disabled.

[helpless]

Here are some pictures. Due to password issue scan gives all sectors ABRT.
WDR when pressing Repair gives a warning if I am sure to flash and at the same time logs the following (last picture), so chose not to repair.

[helpless]

Now i would like to know if the drives were locked with ATA password or if they were working ok and develop that problem by themselfs.
I agree with Frank, i think that it's a ATA password on a costum firmware preventing some vsc.
Can you test to start in safe mode and load from loader or hot swap with a working drive ? If that allow access to SA we might be able to remove the pwd.

How the drive 'developed' the password I don't know. I bought it locked. All I know it might have been removed from a Lenovo. How do I start in safe mode and and load from loader? I don't have a working drive either. Try to get one.

[helpless]

I have same menu as here.
Load Overlay, is that what you mean?
Do you know safe mode settings for 2,5 WD drives? It has four pins. Where to put jumpers? Thanks.

[fzabkar]

A search with Google Images turns up Lenovo every time.

http://www.donordrives.com/media/catalo ... 1-0005.jpg
http://www.donordrives.com/media/catalo ... 0-0024.jpg
http://i.ebayimg.com/00/s/NDg4WDY1MA==/ ... ~~60_3.JPG
http://www.computerrecyclingllc.com/eBa ... 6-6399.JPG
http://www.computerrecyclingllc.com/eBa ... 26-663.JPG
http://www.computerrecyclingllc.com/eBa ... 6-9786.JPG

Would it be possible to access the SA with the "techno key" if the OP were to swap boards with the second drive? If the second board has dissimilar adaptives that prevent access to the SA even in unlocked mode, then perhaps the code that checks for the password won't be loaded and VSCs will remain enabled. I'm assuming that any such code doesn't exist in ROM and resides completely in the SA.

[helpless]

A search with Google Images turns up Lenovo every time.

http://www.donordrives.com/media/catalo ... 1-0005.jpg
http://www.donordrives.com/media/catalo ... 0-0024.jpg
http://i.ebayimg.com/00/s/NDg4WDY1MA==/ ... ~~60_3.JPG
http://www.computerrecyclingllc.com/eBa ... 6-6399.JPG
http://www.computerrecyclingllc.com/eBa ... 26-663.JPG
http://www.computerrecyclingllc.com/eBa ... 6-9786.JPG

Would it be possible to access the SA with the "techno key" if the OP were to swap boards with the second drive? If the second board has dissimilar adaptives that prevent access to the SA even in unlocked mode, then perhaps the code that checks for the password won't be loaded and VSCs will remain enabled. I'm assuming that any such code doesn't exist in ROM and resides completely in the SA.

I failed to notice, that these drives have indeed Lenovo p/n printed on them.
So I have 2 exactly same drives, both locked. You suggest that swapping board would enable access to SA? Or I got it wrong?
You mean just swap (NOT HOT SWAP) and power on and see?
Techno key? Pls Explain!

Would be nice if someone with a Lenovo could lock his drive and check it on another comp if SA can be accessed.

[helpless]

Safe mode, try to place jumpers on all pins.
On my WDR I have a "Load Permanent Overlay" and a "Load overlay" option. You will need a loader from an unlocked drive.
On Hot Swap, donor should be unlocked, and booted. Then pcb swaped to locked drive. That will preserve the unlock state, and allow to read modules on the locked drive, hopefully...
SA can be read even without correct adaptives, as long as pcb/rom is compatible. Otherwise you wouldnt be able to read SA to regen Rom.

Where can this "Load Permanent Overlay" menu be found?
And how do I stop the spindle motor for a hot swap?

[fzabkar]

Spildit, AIUI the OP has two similar drives. If he swaps the boards between the drives, and if their adaptives are different enough to prevent either drive from accessing the SA, then this would mean that the "password MODs" would not be loaded. Could he not then use "techno" mode to access the SA MODs on both drives? AISI, he wouldn't need to hotswap or use a loader. Am I making sense?

[helpless]

I mean hot swap using an unlocked drive ! If you hot swap with a locked drive the lock on the vsc will be there too. You need an unlocked drive that is equal to the one you want to unlock.

From what I learned, I can agree.

Regarding the option is on WDR Actions menu. Check pictures on my site.

Checked them, I have same Actions menu, and regarding ovelays there are 3 options:

Load Overlay
Load Transient Overlay
Reinit Permanent Overlay

or maybe I just can't see. Can you tell me what these commands do?

Also, do you have a loader for this drive ?

No, I dont have it.

[helpless]

Board swap doesn't work, hdd is identified in BIOS as "hard drive" 0 capacity, and POST reports hard disk error. MHDD doesn't detect the drive, so I didn't go into Windows.
Earlier I tried unlocking with older mobo i848 chipset, I always got hard drive error (with own PCB).
It seems I am left with no other option but hot swap or loader.

[helpless]

Frank, you are brilliant, your idea worked perfectly!

I had to attach power only after Windows has loaded, because it gave me BSOD.
Then I could read all mods and find psw. Funny what these Lenovos do to prevent hacking.
Many thanks to Spildit, too, for his neverending support.