ST1500LM006 problem - strange capacity

[laptokowiec]

Hi
ST1500LM006 first detected as ST2000LM003 HN-M201RAD-2BC10006 (MRT, MHDD, Windows. Linux) with 41 lba capacity.
After a few attempts - reading firmware etc (MRT), starts to show properly (ST1500LM006 HN-M151RAD-2BC10006), but still with capacity 41. Mods, tracks and ROM were read without problems.
We've tried to change capacity in MRT. Procedure went smoothly but with no effect We tried the procedure with other samsung model (8e series) and it worked. So it looks that software (MRT) works ok.
SeDiv (demo) passport shows:
cylinders 16383
heads 16383
sectors 63
available capacity in chs mode: 16514064
available capacity in lba mode: 41
available capacity in lba48 mode: 6

Any ideas ?

[fzabkar]

Damaged PROFILE module???

Could you upload your resources?

[laptokowiec]

ST1500LM006 HN-M151RAD-2BC10006-S34QJ9AF911621.7z

(4.6 MiB) Downloaded 382 times

[fzabkar]

I've been comparing your HN-M151RAD resource dump against a HN-M201RAD dump and I've noticed that your MOVLY001 module is empty whereas the other has two code components. This could be a red herring, but it appears to be a significant point of difference.

Could we see your ROM? There is a section in the FLASHTBL which corresponds to each of the MOVLY001 components.

HN-M151RAD

Code:

Offset(h) 00       04       08       0C

00000000  00000000 00000000 00000000 00000000
00000010  00000000 00FFFFFF FFFFFFFF FFFFFFFF
00000020  00000000 01FFFFFF FFFFFFFF FFFFFFFF
00000030  00000000 02FFFFFF FFFFFFFF FFFFFFFF
00000040  00000000 03FFFFFF FFFFFFFF FFFFFFFF
00000050  00000000 04FFFFFF FFFFFFFF FFFFFFFF
00000060  00000000 05FFFFFF FFFFFFFF FFFFFFFF
00000070  00000000 06FFFFFF FFFFFFFF FFFFFFFF
00000080  00000000 07FFFFFF FFFFFFFF FFFFFFFF
00000090  00000000 08FFFFFF FFFFFFFF FFFFFFFF
000000A0  00000000 09FFFFFF FFFFFFFF FFFFFFFF
000000B0  00000000 0AFFFFFF FFFFFFFF FFFFFFFF
000000C0  00000000 0BFFFFFF FFFFFFFF FFFFFFFF
000000D0  00000000 0CFFFFFF FFFFFFFF FFFFFFFF
000000E0  00000000 0DFFFFFF FFFFFFFF FFFFFFFF
000000F0  00000000 0EFFFFFF FFFFFFFF FFFFFFFF
00000100  00000000 0FFFFFFF FFFFFFFF FFFFFFFF

HN-M201RAD

Code:

Offset(h) 00       04       08       0C

00000000  00000000 00000000 00000000 00000000
00000010  02000000 00018EFF 28010000 004D0100  <-
00000020  8C320000 018166FF BC330000 68390310  <-
00000030  F8BC0200 02FFFFFF FFFFFFFF FFFFFFFF  <-
00000040  00000000 03FFFFFF FFFFFFFF FFFFFFFF
00000050  00000000 04FFFFFF FFFFFFFF FFFFFFFF
00000060  00000000 05FFFFFF FFFFFFFF FFFFFFFF
00000070  00000000 06FFFFFF FFFFFFFF FFFFFFFF
00000080  00000000 07FFFFFF FFFFFFFF FFFFFFFF
00000090  00000000 08FFFFFF FFFFFFFF FFFFFFFF
000000A0  00000000 09FFFFFF FFFFFFFF FFFFFFFF
000000B0  00000000 0AFFFFFF FFFFFFFF FFFFFFFF
000000C0  00000000 0BFFFFFF FFFFFFFF FFFFFFFF
000000D0  00000000 0CFFFFFF FFFFFFFF FFFFFFFF
000000E0  00000000 0DFFFFFF FFFFFFFF FFFFFFFF
000000F0  00000000 0EFFFFFF FFFFFFFF FFFFFFFF
00000100  00000000 0FFFFFFF FFFFFFFF FFFFFFFF

ROM FLASHTBL

Code:

Offset(h) 00       04       08       0C

00002020  021F0102 464C4153 4854424C 030000FF  ....FLASHTBL....
00002030  0000FFFF FFFFFFFF 00000000 00000000
00002040  0101FFFF FFFFFFFF 004D0100 00000000
00002050  020200FF 00200000 0020F0FF 00030000
00002060  03086EFF 00230000 0023F0FF 941E0000
00002070  0400DFFF 9C410000 00000000 D04C0100
00002080  050100FF 748E0100 004D0100 8C320000
00002090  0600C6FF 7C8E0100 00000800 B00B0000
000020A0  0700FDFF 349A0100 005C0800 4C030000
000020B0  0800B7FF 889D0100 00800800 C4010000
000020C0  0980F7FF 549F0100 00800110 68B90100
000020D0  0A8100FF C4580300 68390310 F8BC0200
000020E0  0B00A2FF CC580300 C0030090 705C0000
000020F0  0CFFFFFF FFFFFFFF FFFFFFFF 00000000
00002100  0DFFFFFF FFFFFFFF FFFFFFFF 00000000
00002110  0EFFFFFF FFFFFFFF FFFFFFFF 00000000
00002120  0FFFFFFF FFFFFFFF FFFFFFFF 00000000
00002130  10FFFFFF FFFFFFFF FFFFFFFF 00000000
00002140  11FFFFFF FFFFFFFF FFFFFFFF 00000000
00002150  12FFFFFF FFFFFFFF FFFFFFFF 00000000
00002160  13FFFFFF FFFFFFFF FFFFFFFF 00000000
00002170  14FFFFFF FFFFFFFF FFFFFFFF 00000000
00002180  15FFFFFF FFFFFFFF FFFFFFFF 00000000
00002190  16FFFFFF FFFFFFFF FFFFFFFF 00000000
000021A0  17FFFFFF FFFFFFFF FFFFFFFF 00000000
000021B0  00FFFFFF FFFFFFFF 004D0100 8C320000  <-
000021C0  01FFFFFF FFFFFFFF 68390310 F8BC0200  <-

[laptokowiec]

I wrote that ROM was read, but there's something wrong with it
MRT reads it all but in the end it says checksum is wrong (and theres no file)
I've forgotten about problems withe the rom - I checked the procedure (reading rom) with several 8e series disks and there was no problem at all.

[fzabkar]

Do you have a terminal log?

Is it possible that the PCB is not original? Do the date codes on the ICs and PCB (sticker on underside) match the label?

Can you read the FIPS? There are two copies in the SA (12D RESTFLSH.rpm and 73 MOVLY001.rpm) which would allow us to compare firmware versions and serial numbers with those in the ROM.

[laptokowiec]

I have FIPS

Attachments

FIPS_2BC72A1M.d31.bin.7z

(1.42 KiB) Downloaded 385 times

[laptokowiec]

'fresh' terminal from SHT demo:

Identify from HDD {22:00:19}
------------------------------------------
Mode utility ........................... : Normal
MC Access mode ......................... : DISC I/O
Device port ............................ : F0F0,F0E2,S
Model ID ............................... : M9T 2.5(SATA)
Mode adressing ......................... : 48 bit

Model .................................. : HN-M151RAD
F/W Version ............................ : 2BC10006
Serial Number .......................... : S34QJ9AF911621
Logical: CHS ........................... : 16383/16/63
Cache Size ............................. : 32767 Kb
Sectors available with LBA cmd ......... : 41 (0,0GB)
Sectors available with LBA48 cmd ....... : 6 (0,0GB)
Real MAX LBA ........................... : 403 019 726 (192,2GB)

Technological passport
Flash Version .......................... : 2BC72A1M.d31
Head Number ............................ : 6
Zone Number ............................ : 48
SA Cyl ................................. : 128
SA SPT ................................. : 1536

Table modules is loaded ................ : from SA

Zones distribution table ............... : loaded

[fzabkar]

I wrote that ROM was read, but there's something wrong with it :?
MRT reads it all but in the end it says checksum is wrong (and theres no file)

Could it be that you are using a 3.3V TTL adapter? Your drive appears to have a 1.8V serial interface.

[fzabkar]

The FIPS matches the copy in MOVLY001, except for some minor differences, so it would appear that the PCB is native.

[laptokowiec]

... the client says pcb is original, but the hdd also was in other company. The dates match.

[fzabkar]

The problem seems like a HPA issue, but the SETMAX module is clear. ??

I checked the source code for SHTR. It obtains the "Real MAX LBA" via an ATA command rather than by examining a particular SA module, so that doesn't help.

Maybe you could search your SA dump for 0x180597CE or 0xCE970518 ?

That might tell us where this number is coming from.

Real MAX LBA = 403 019 726 = 0x180597CE

[fzabkar]

Maybe you could search your SA dump for 0x180597CE or 0xCE970518 ?

I searched your modules and found nothing. :?

[laptokowiec]

Do you have access to any 1.5TB Samsung hdd or resources for it?

[laptokowiec]

...
We've got only 1TB, 640GB, 500GB and 320GB.
There's a pattern in MOD 9D PARAM_DM (18:1B).
It's B0 6D 70 74 for 1TB,
B0 88 E0 E8 for 2TB (from hddguru resources)
and for 500GB its 30 60 38 3A.
For the problematic one (1.5TB) it's 6F BE 2C C0. Whats intersting, it was 30 00 00 00 when it was recognized as ST2000LM003 HN-M201RAD-2BC10006.

[fzabkar]

...
We've got only 1TB, 640GB, 500GB and 320GB.
There's a pattern in MOD 9D PARAM_DM (18:1B).

The source code for SHTR refers to that dword as "MAX LBA PARAM_DM". It is equivalent to the "REAL MAX LBA" reported by SHTR multiplied by 8. That is, SHTR is reporting the total number of physical sectors, not LBAs (another bug).

This then begs the question, why is the PARAM_DM module reporting a capacity of 1.65TB (= 0xC02CBE6F x 512 bytes), and why is the number not a multiple of 8?

Why does this number sometimes appear as 0x30? Could it be that there is a difference in the second copy of this module, and that the drive sometimes uses the second copy when it has trouble reading the first?

Some models use the CONFIG module to store the max LBA, but yours is empty.

[fzabkar]

You might like to contact the OP in the following thread for a copy of the ST1500LM006 resources:

https://forum.hddguru.com/viewtopic.php?f=1&t=39198

BTW, the ROM in that thread has no references to MOVLY001 components. Instead this SA overlay appears to be resident in section 09 of the ROM. That would explain why MOVLY001 is empty in your firmware version.

Code:

Offset(h) 00   02   04   06   08   0A   0C   0E

00002020  011F 0102 464C 4153 4854 424C 0300 00FF
00002030  0000 FFFF FFFF FFFF 0000 0000 0000 0000
00002040  0140 FFFF FFFF FFFF 004D 0100 0000 0000
00002050  0202 00FF 0020 0000 0020 F0FF 0003 0000
00002060  0308 31FF 0023 0000 0023 F0FF C81E 0000
00002070  0400 33FF D041 0000 0000 0000 D84C 0100
00002080  0540 C2FF B08E 0100 004D 0100 AC2F 0000
00002090  0600 0FFF 64BE 0100 0000 0800 740B 0000
000020A0  0700 E2FF E0C9 0100 005C 0800 7C03 0000
000020B0  0800 C5FF 64CD 0100 0080 0800 3002 0000
000020C0  0980 13FF 9CCF 0100 0080 0110 F8D6 0400  <-- incorporates MOVLY001 ???
000020D0  0A00 E3FF 9CA6 0600 C003 0090 1067 0000
000020E0  0B08 FFFF FFFF FFFF 0023 F0FF 0000 0000
000020F0  0CFF FFFF FFFF FFFF FFFF FFFF 0000 0000
00002100  0DFF FFFF FFFF FFFF FFFF FFFF 0000 0000
00002110  0EFF FFFF FFFF FFFF FFFF FFFF 0000 0000
00002120  0FFF FFFF FFFF FFFF FFFF FFFF 0000 0000
00002130  10FF FFFF FFFF FFFF FFFF FFFF 0000 0000
00002140  11FF FFFF FFFF FFFF FFFF FFFF 0000 0000
00002150  12FF FFFF FFFF FFFF FFFF FFFF 0000 0000
00002160  13FF FFFF FFFF FFFF FFFF FFFF 0000 0000
00002170  14FF FFFF FFFF FFFF FFFF FFFF 0000 0000
00002180  15FF FFFF FFFF FFFF FFFF FFFF 0000 0000
00002190  16FF FFFF FFFF FFFF FFFF FFFF 0000 0000
000021A0  17FF FFFF FFFF FFFF FFFF FFFF 0000 0000
000021B0  00FF FFFF FFFF FFFF FFFF FFFF 0000 0000
000021C0  01FF FFFF FFFF FFFF FFFF FFFF 0000 0000
000021D0  02FF FFFF FFFF FFFF FFFF FFFF 0000 0000
000021E0  03FF FFFF FFFF FFFF FFFF FFFF 0000 0000
000021F0  04FF FFFF FFFF FFFF FFFF FFFF 0000 0000
00002200  05FF FFFF FFFF FFFF FFFF FFFF 0000 0000
00002210  06FF FFFF FFFF FFFF FFFF FFFF 0000 0000
00002220  07FF FFFF FFFF FFFF FFFF FFFF 0000 0000
00002230  08FF FFFF FFFF FFFF FFFF FFFF 0000 0000
00002240  09FF FFFF FFFF FFFF FFFF FFFF 0000 0000
00002250  0AFF FFFF FFFF FFFF FFFF FFFF 0000 0000
00002260  0BFF FFFF FFFF FFFF FFFF FFFF 0000 0000
00002270  0CFF FFFF FFFF FFFF FFFF FFFF 0000 0000
00002280  0DFF FFFF FFFF FFFF FFFF FFFF 0000 0000
00002290  0EFF FFFF FFFF FFFF FFFF FFFF 0000 0000
000022A0  0FFF FFFF FFFF FFFF FFFF FFFF 0000 0000

[laptokowiec]

Thanks
I'll try to contact OP.
I'll also try to read the rom again. Maybe in other software.

[HddDonorMarket]

Link for same drive for future resarch in forum.
https://forum.hddguru.com/viewtopic.php ... &p=277770#

[fzabkar]

There appear to be two capacity parameters in the PARAM_DM and PROFILE modules.

Code:

Offset(h) 00       04       08       0C

00000000  50415241 4D5F444D 9D000000 00000000  PARAM_DM........
00000010  11000900 00001F01 307BA8AE 00000000
                            ^^^^^^^^  0xAEA87B30 x 512 bytes = 1.500TB

Code:

Offset(h) 00       04       08       0C

00000000  50524F46 494C4520 B2000000 00000000  PROFILE ........
........
000004D0  61220000 08000000 2F7BA8AE 00000000
                            ^^^^^^^^  max LBA = 0xAEA87B2F = 1.5TB
000004E0  11220000 04000000 07000000 00000000
000004F0  10220000 04000000 7F000000 00000000
00000500  63220000 04000000 1F110000 00000000
00000510  64220000 04000000 00200000 00000000
00000520  66220000 04000000 15000000 00000000
00000530  68220000 04000000 01000000 00000000

Code:

Offset(h) 00       04       08       0C

00000000  50524F46 494C4520 B2000000 00000000  PROFILE ........
........
000004A0  71220000 04000000 30000000 00000000
000004B0  62220000 08000000 28000000 00000000