Seagate DVR lock drive

[fzabkar]

Just send home $10 to buy a refurb 500GB...

https://www.ebay.co.uk/p/Seagate-Pipeli ... 9&thm=2000

what If I said I have 200 Plus hdds that are locked.

I suspect that "guru" is in the same business.

[fzabkar]

Guys .... This is a ST-10 drive .... PUIS "flag" will not be in ROM as ROM code on ST-10 is just that ... CODE without configuration modules. PUIS flag will be on VENDOR.

If PUIS is enabled, then the drive will not spin up until it is commanded to do so. This means that the PUIS flag MUST be on the PCB.

[rogfanther]

If the guy would follow your earlier advice, and make dumps of the ROM from an unlocked drive, both with and without PUIS, it would be maybe possible to determine the section in which something changes, right ?

Then the guy could make a dump of the ROM from his locked drive, and try to find and change the corresponding values . Sounds reasonable ?

[fzabkar]

If the guy would follow your earlier advice, and make dumps of the ROM from an unlocked drive, both with and without PUIS, it would be maybe possible to determine the section in which something changes, right ?

Then the guy could make a dump of the ROM from his locked drive, and try to find and change the corresponding values . Sounds reasonable ?

The OP's problem is that he cannot find an unlocked drive that supports PUIS (he told me this via PM). Spildit has also been unable to acquire a supported drive, from any Seagate family.

[rogfanther]

Oh, ok, I misread it as if he had enabled successfully PUIS.

Would Hdat be enough to enable PUIS and test ?

Any suggestion of models/families that we could test ? I have some Seagates in the "project box" that I could test.

[fzabkar]

Would Hdat be enough to enable PUIS and test ?

Any suggestion of models/families that we could test ? I have some Seagates in the "project box" that I could test.

Normally, HDAT2 should be able to enable/disable PUIS. I don't know what is so special about the OP's drive that prevents HDAT2 from working. :?

Thanks for your offer of help. I would test drives prior to F3, ie 7200.10 and earlier. The Identify Device output should indicate support for PUIS in bit #5 of word #83.

[saroya44]

If the drive were mine i would attempt to gain terminal access first and then read VENDOR. To gain terminal access get rid of seacos security sector with Z0 ... It should work ....

How to break the seacos security with ZO command if we can't access to terminal.

[fzabkar]

I extracted the following Identify Device block from the locked ROM. Word #83 has a value of 0x7D61, which indicates that the PUIS feature set is supported. Word #86 indicates that the PUIS feature set is enabled.

Code:

Offset(d) 00   02   04   06   08   10   12   14   16   18

00000000  5A0C FF3F 37C8 1000 0000 0000 3F00 0000 0000 0000  Z.ÿ?7È......?.......
00000020  2020 2020 2020 2020 2020 2020 5139 4147 4A39 4451              Q9AGJ9DQ
00000040  0000 0040 0400 2E33 5641 204A 2020 5453 3533 3030  ...@...3VA J  TS5300
00000060  3338 5330 4543 2020 2020 2020 2020 2020 2020 2020  38S0EC             
00000080  2020 2020 2020 2020 2020 2020 2020 1080 0000 002F                .€.../
00000100  0040 0002 0002 0700 FF3F 1000 3F00 10FC FB00 1000  .@......ÿ?..?..üû...
00000120  FFFF FF0F 0000 0704 0300 7800 7800 7800 7800 0000  ÿÿÿ.......x.x.x.x...
00000140  0000 0000 0000 0000 0000 1F00 0605 0000 4800 0000  ................H...
00000160  FE00 0000 6B34 617D 2340 0000 6000 0000 7F00 0000  þ...k4a}#@..`.......
00000180  0000 FEFE 0000 0000 00A0 0000 0000 0000 0000 0000  ..þþ..... ..........
00000200  3060 383A 0000 0000 0000 0000 0040 0000 0000 0000  0`8:.........@......
00000220  0000 0000 0000 0000 0000 0000 0000 0001 0000 0000  ....................
00000240  0000 0000 0000 0000 0000 0000 0000 0000 0000 3060  ..................0`
00000260  383A 3060 383A 2020 0200 B682 0200 8A00 FF01 FF3C  8:0`8:  ..¶‚..Š.ÿ.ÿ<
00000280  0000 C607 0001 0008 1413 0012 0200 8000 0000 0000  ..Æ...........€.....
00000300  9010 0202 0000 0404 0000 0000 0300 0000 0012 0B00  ....................
00000320  0000 0000 0000 0000 0000 0000 0000 0000 0000 0000  ....................
00000340  0000 0000 0000 0000 0000 0000 0000 0000 0000 0000  ....................
00000360  0000 0000 0000 0000 0000 0000 0000 0000 0000 0000  ....................
00000380  0000 0000 0000 0000 0000 0000 0000 0000 0000 0000  ....................
00000400  0000 0000 0000 0000 0000 0000 0000 0000 0000 0000  ....................
00000420  0000 0000 0000 0000 0000 0000 0000 0000 0000 0000  ....................
00000440  0000 0000 0000 0000 0000 0000 0000 0000 0000 0000  ....................
00000460  0000 0000 0000 0000 0000 0000 0000 0000 0000 0000  ....................
00000480  0000 0000 0000 0000 0000 0000 0000 0000 0000 0000  ....................
00000500  0000 0000 0000 0000 0000 A5A1                      ..........¥¡

This block of data would normally be found on the Vendor Track. It is not present in the unlocked ROM.

[saroya44]

Oh, ok, I misread it as if he had enabled successfully PUIS.

Would Hdat be enough to enable PUIS and test ?
.

Brother, I tried through HDAT and MRT.but the PUIS feature was not enable.

[fzabkar]

Oh, ok, I misread it as if he had enabled successfully PUIS.

Would Hdat be enough to enable PUIS and test ?
.

Brother, I tried through HDAT and MRT.but the PUIS feature was not enable.

I think @rogfanther was asking whether HDAT2 should work for his "project" HDDs.

[rogfanther]

Oh, ok, I misread it as if he had enabled successfully PUIS.

Would Hdat be enough to enable PUIS and test ?
.

Brother, I tried through HDAT and MRT.but the PUIS feature was not enable.

Sorry, I had read your post a little too fast and thought you had been able to enable it. After I read it again I saw that it didn´t work.

[fzabkar]

@saroya44, can you edit the ROM dump with MRT? If so, can you change one byte (eg change 0xFF to 0xFE) and show us how MRT recalculates the checksum?

[fzabkar]

ROM code on ST-10 is just that ... CODE without configuration modules.

As you say, the 3.AAD and 3.AVJ ROMs don't appear to have any separate data sections, apart from the Identify Device block in the locked ROM. I'm wondering if we just need to edit this block and then recompute the ROM checksum. There appears to be a 16-bit ROM checksum word at offset 0xFFFE. Strangely, the checksum byte for the Identify Device block is 0x85 whereas the ATA standard stipulates that it should be zero. I expect that this anomaly is just a red herring, though.

Throughout both ROMs there are code sections which are terminated with 0xDB 0x00, followed by empty space padded with 0xFFFF. Opcode DB 00 is a RETS instruction (return from subroutine). The unlocked ROM has 7 such sections, whereas the locked ROM has 6.

In short, I haven't managed to find any location outside these code blocks that is reserved for the PUIS flag. That is not to say that such a location does not exist. If I were approaching this problem, I would edit words #83 and #86 in the Identify Device block and then recalculate the appropriate checksum(s).

[saroya44]

@saroya44, can you edit the ROM dump with MRT? If so, can you change one byte (eg change 0xFF to 0xFE) and show us how MRT recalculates the checksum?

Please find attached ROM after editing.

Attachments

LOCKED ROM EDIT.rar

(36.62 KiB) Downloaded 496 times

Last edited by saroya44 on July 21st, 2018, 19:50, edited 1 time in total.

[fzabkar]

Please find attached ROM after editing.

I can't see any attachments. :?

[fzabkar]

It appears that MRT doesn't recalculate any checksums.

Anyway, the following changes should disable PUIS support in the Identify Device data block.

change from ...

Code:

Offset(h) 00   02   04   06   08   0A   0C   0E

00001A90  0000 6B34 617D 2340 0000 6000 0000 7F00
                    ^^^^           ^^^^
                    wd #83         wd #86

... to:

Code:

Offset(h) 00   02   04   06   08   0A   0C   0E

00001A90  0000 6B34 417D 2340 0000 4000 0000 7F00
                    ^^^^           ^^^^
                    wd #83         wd #86

[saroya44]

It appears that MRT doesn't recalculate any checksums.

Anyway, the following changes should disable PUIS support in the Identify Device data block.

change from ...

Code:

Offset(h) 00   02   04   06   08   0A   0C   0E

00001A90  0000 6B34 617D 2340 0000 6000 0000 7F00
                    ^^^^           ^^^^
                    wd #83         wd #86

... to:

Code:

Offset(h) 00   02   04   06   08   0A   0C   0E

00001A90  0000 6B34 417D 2340 0000 4000 0000 7F00
                    ^^^^           ^^^^
                    wd #83         wd #86

ok lets try. will get back to you.

[fzabkar]

It would be interesting to see the Identify Device data that are reported by the drive in the standby state. AFAIK, most drives do not report much info at all when PUIS is on (word #0 reports "incomplete"). Most of the ID data needs to be retrieved from the SA, as you say. However, the OP's drive appears to be an exception.

One other thing ... The OP has told me that he has a drive which was successfully converted (by another party) from 3.AVF firmware to 3.AAD. I suggested that he boot the "locked" patient with a 3.AAD donor PCB plus a 3.AAD loader in the hope that he would then have SA access. However, he says that the drive remains BSY after doing this.

[saroya44]

It appears that MRT doesn't recalculate any checksums.

Anyway, the following changes should disable PUIS support in the Identify Device data block.

change from ...

Code:

Offset(h) 00   02   04   06   08   0A   0C   0E

00001A90  0000 6B34 617D 2340 0000 6000 0000 7F00
                    ^^^^           ^^^^
                    wd #83         wd #86

... to:

Code:

Offset(h) 00   02   04   06   08   0A   0C   0E

00001A90  0000 6B34 417D 2340 0000 4000 0000 7F00
                    ^^^^           ^^^^
                    wd #83         wd #86

Not worked. Drive goes to same condition as it was before writing edited ROM.

[Moltke]

Use a compatible PCB (100XXXXXX) by getting F>, read all tracks (with resources
оn the 0-th head) (App, OVL, Vend). To find the coordinates, use F > y

Download compatible for used PCB APP
F > J,, 1
T > R
T > ^ R
T > y
and change Vend from a resource that does not use puis