WD20NMVW-11AV3S2 ROM REGEN

[Amarbir[CDR-Labs]]

Spildit and Frank [Did i spell your name properly Mr Frank ] ,

I have told acelab to keep a eye on this thread so that if there could be some improvement in the tool if there is any issue .I stand behind what i said "Atleast with Acelab Ver 6.1X " . I have two MRT and 1 DFL Too But i Do Not Use Those For Day To Day Work ,As Far As experience with Shrek LT Drives are concerned i have done more then anyone here . SED Locked USB Board And Non SED Locked USB Boards Behave Differently .As Far As Theories Above Like If Its SED Locked The Drive Firmware Will Be This And That is Untrue With Acelab UDMA-e .UDMA-e Has One of the most fantastic ways of dealing with WDC Drives [ SED Locked Or Not ] .

[Amarbir[CDR-Labs]]

Well, assuming that was is stated in this thread is correct - viewtopic.php?f=1&t=33822 - it WILL NOT BE POSSIBLE to recover the data when the SED flag is set to "unlocked" because the reading method of the encrypted data will change.

If so I think we can apply the Slow Fix and lock the drive by turning the SED flag on again. This should provide the fix to get the data decrypted by the original USB PCB.

SED Locked with Slow Fix 02.rar

IT MIGHT BE NECESSARY TO RETURN THE SED FLAG BACK TO "01" TO RECOVER THE DATA !!!

Hello ,
You know something theories have to be clear in dealing with drives [ Are You Listing Mr Shahi ? ] ,When the SED flag is removed how the hell will usb pcb hooked back get the data [ The SED has to be set back again ] .I wonder how they challenge someones experience when they themself are not clear of WDC hdd Working Theories .Your note that It can not read firmware etc when SED enable should remain in your pocket .With PC3K i can do the following [ Do not ask me how ]

1 : Work on this kinda SED locked drive [ Without removing it even with SATA PCB ]
2 : Handle Slow Responding Problem Without [ Actually Doing a Damn Thing ]

PS : And All of this in kernel mode screen lol

So now keep guessing and keep doing your manual work ,Data recovery research and Doing Data recovery is Totally Different .We Do not dig soooooooooooooooooooooooo deppppppppppppppppp into stuff like you two guys do,We do the job and take our charges .Its simple you two are the gems of the data recovery industry [Who have released all researched information that the tools do into public domain ] .When Slow responding problem first came research was so simple ,You get a drive dump rom and modules ,you apply the tool then read rom and dumps then compare old and new rom + dumps and voila you understand how the hell its done ,Someones research into your pocket ,Then its all into public domain .Pure nonesense leave it i will not waste even a single minute more with you two on this into this thread ,I know how to solve this and i do the same everyday .And Shahi no words for your experience man bravooo ,even after explanation you never understood it .DFL works in a very different manner and MRT works a little closer to PC3K but not quite like it .Your Hitachi ROM Model Finding Theory Also Failed When We Two Were solving one case i had collectively remember that man. You three guys take a hike please .

PS2 : Shahi best of luck in understanding or not understand the WDC Drives Working ,You Need a Class i will do it For Rs :25000/- Online anytime

[shahij]

The image is complete, strange thing is that, it's producing garbage data.

It's Encrypted. used the traditional process to dercypt data, but not working

I'm trying to work on decryption

[shahij]

Well, assuming that was is stated in this thread is correct - viewtopic.php?f=1&t=33822 - it WILL NOT BE POSSIBLE to recover the data when the SED flag is set to "unlocked" because the reading method of the encrypted data will change.

You are right.

Hello ,
You know something theories have to be clear in dealing with drives [ Are You Listing Mr Shahi ? ] ,When the SED flag is removed how the hell will usb pcb hooked back get the data [ The SED has to be set back again ] .I wonder how they challenge someones experience when they themself are not clear of WDC hdd Working Theories .Your note that It can not read firmware etc when SED enable should remain in your pocket .With PC3K i can do the following [ Do not ask me how ]

No one challenged you regarding the SED Issue and Decrypted Data.

The game was If it's ROM ISSUE or Not.
And yes, in this case, The ROM WAS issue. I lost the drive ID again, and I was able to restore this one by writing backed up ROM, 47 mod and Editing the 0A mod in ROM.

In perspective of SED issue, yes, you are right. You know this one 6 months earlier then I do. There are several things you had to ask others who is experienced specifically, and I still remember the Hitachi HSA info I shared with you from my experience that worked for you

Your Hitachi ROM Model Finding Theory Also Failed When We Two Were solving one case i had collectively remember that man. You three guys take a hike please .

[/quote]

I didn't tell you the Hitachi issue exactly, it was a GUESS Statement I told you. Guess statement sometime can be incorrect. So, as you said that you did the research and found my info incorrect, then we can send Hitachi ARM series with Missing ROM, and you can solve the case from now on? If so, then it's really going to be great for all of us.

Do you know, we post for assistance 1-2% of cases only to the forum we deal everyday? The problem is - we ask it straight, not passively.

The word you use - work and charge - it's simple. Yes, same here. It's simple for all of us.

At the end - I've full respect in your experience.

Good Luck to all the guys involved in the case. Best wishes. Thanks a lot

[shahij]

Yes, I did use the Patched 02 already... Worked on Relo list also

Can see data straight with SATA PCB, re-imaging is going on now

[Amarbir[CDR-Labs]]

(...)
You three guys take a hike please .

Spildit ,
Merry Christmas To You And Family Also

[Amarbir[CDR-Labs]]

Please disregard @Amarbir[CDR-Labs]

If you have PC-3000 you connect the PCB by TTL and aply the "slow fix" by TTL and that's it. It will patch module 02 without removing the SED flag. Then either use the original PCB and you will gain directly access to data or you can use SATA PCB and decrypt by PC-3000.

If you don't have PC-3000 just turn on that SED flag (apply my copy of 02 mentioned on my last post) and place USB PCB with original ROM back to the drive.

If you have to image again use the SED flag turned on and Slow Issue fix turned on.

Well,
No i do not apply Slow fix at all ,You kindly try and read my statements i DO NOT TELL THE TOOL TO APPLY SLOW FIX AT ALL .I can solve this slow fix with PC3000 using my own method [ Its a sequence i use to initialise the drive ] and it takes care of this .In My 1 year plus usage of the tool i might have applied slow fix in pc 3000 2 to 5 times only ,Do explain shahi how Drives with SED and NON SED Works ,Once he understands the theory its gonna be easy for him ,And remember MRT does all of this in a different manner then PC3K

[fzabkar]

Here are the directory modules from the rebuilt ROM (ROM_WDC ROM MODEL-SHREKLT-.bin):

Module 20B

Code:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  52 4F 59 4C 04 00 1E 00 0B 02 01 00 33 A2 7C B4  ROYL........3¢|´
00000010  30 30 30 33 30 30 30 30 00 00 00 01 00 00 0A 1A  00030000........
                                           ^^
                                           active flag ?

Module 0B

Code:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  52 4F 59 4C 04 00 1E 00 0B 00 01 00 05 B6 23 AF  ROYL.........¶#¯
00000010  30 30 30 33 30 30 30 30 00 00 00 00 00 00 0A 1A  00030000........
                                           ^^
                                           inactive flag ?

In this case the flag bytes are 01/00 whereas in the patient ROM they are 02/01.

[fzabkar]

This is the "head map" section from the "real" 0A module:

Code:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  20 06 00 08 08 FF 00 00 7C 51 7C 48 4A 4E 54 33   ....ÿ..|Q|HJNT3
00000010  53 42 00 00 00 00 00 00 00 00 00 00 00 00 86     SB............†

The 8-bit checksum for these bytes is 0x00.

This is the same section from the "uninitialised" 0A module:

Code:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  20 06 01 00 00 00 00 00 00 00 00 00 00 00 00 00   ...............
00000010  00 00 55 55 00 00 00 00 00 00 00 00 00 00 2B     ..UU..........+

The 8-bit checksum is 0xFC.

Sorry, I believe this is the correct way to calculate the checksum.

Code:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000010                                            20 06                 .
00000020  00 08 08 FF 00 00 7C 51 7C 48 4A 4E 54 33 53 42  ...ÿ..|Q|HJNT3SB
00000030  00 00 00 00 00 00 00 00 00 00 00 00 86 FB        ............†û
                                checksum word ^^^^^

Sum of bytes from 0x1E to 0x3D is 0x047A.

0x047A + 0xFB86 = 0x10000

Code:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000010                                            20 06                 .
00000020  01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  55 55 00 00 00 00 00 00 00 00 00 00 2B FF        UU..........+ÿ
                                checksum word ^^^^^

Sum of bytes from 0x1E to 0x3D is 0x00D1.

0x00D1 + 0xFF2B = 0xFFFC

[shahij]

1. I read this one proeprly http://forum.acelaboratory.com/viewtopi ... 155&t=8909
You have reported the things happen by USB interface only, but nothing is cleared what happens in SATA. And it's appreciated that you have been observing things on SHREK LT drives.

No, in my case in Kernel mode also, the Head Map was reporting WRONG, and 47 was producing error.

I've reported things here, all with SATA, in kernel model without HDA attached - it was reporting wrong and error as posted in the first post

Please disregard @Amarbir[CDR-Labs]

If you have PC-3000 you connect the PCB by TTL and aply the "slow fix" by TTL and that's it. It will patch module 02 without removing the SED flag. Then either use the original PCB and you will gain directly access to data or you can use SATA PCB and decrypt by PC-3000.

If you don't have PC-3000 just turn on that SED flag (apply my copy of 02 mentioned on my last post) and place USB PCB with original ROM back to the drive.

If you have to image again use the SED flag turned on and Slow Issue fix turned on.

Well,
No i do not apply Slow fix at all ,You kindly try and read my statements i DO NOT TELL THE TOOL TO APPLY SLOW FIX AT ALL .I can solve this slow fix with PC3000 using my own method [ Its a sequence i use to initialise the drive ] and it takes care of this .In My 1 year plus usage of the tool i might have applied slow fix in pc 3000 2 to 5 times only ,Do explain shahi how Drives with SED and NON SED Works ,Once he understands the theory its gonna be easy for him ,And remember MRT does all of this in a different manner then PC3K

2. The game was If in this case the ROM is ISSUE or Not as reported.

No, I can't explain the difference between SED and NON-SED WD Drive how it works theoretically till date. It's just matter of time to understand clearly. Why don't you explain this one that gets helpful for us if you really care?

3. I've written the Patched ROM and It IDs properly


I hope this one answers all the things.

[shahij]

Yes, ROM was definitely issue as I reported in my OP, without working on ROM, I had no way to get ID on this HDD. At the middle Amarbir stated and gave a reference link that it's the issue of this SHREK LT drive itself!!!

I also feel very happy for the case that in my limited knowledge but with SUPER CONFIDENCE that I was able to suspect it's ROM as first state!

Thanks Spildit, drHDD and fzabkar. Special thanks to Amarbir for giving a reference link which looks like similar to that case [may be this one confused him], but actually his reported case and this case is different and really is a ROM issue. I personally see positively that it's just the similarity of symptoms got by Mr. Amarbir in his experience and at a glance things confused him.

Thanks all the guys for all the good work

Chrismas to all

[maximus]

I would just like to say that this has been a very informative thread, and also inspiring. Some of the information pointed me in a direction where I have now managed to do a successful test of dumping ROM in kernel mode, and patching and writing ROM in a way that allows raw access to SA. And this test was successful via USB, with no hardware tools, only a computer and my HDDSuperTool program. So I now think I can perform the slow fix on locked drives, although that will take some work yet to work with the raw SA.

Merry Christmas!

[maximus]

Can you hint on how you patch ROM to gain access to raw SA on locked drives ? What module did you edit/patch ?

You posted this link in the thread:
http://forum.acelaboratory.com/viewtopic.php?t=8555
The picture that shows "Block SA access" was the clue for me.

[maximus]

Patch ROM to block normal SA access so it can't load, so it comes up in what seems like total kernel mode with nothing loaded. But then it is allowed to have raw SA access.

[maximus]

After looking at the links, yes, I am modifying SA regions in a way to do this, but not same exact method (I only modified one byte in my test). Maybe it has been known for a long time, but it is new to me. And the other difference is that I am doing it myself without 3rd party tools. The fact that I had a successful test via USB was actually surprising even to me.

[Amarbir[CDR-Labs]]

After looking at the links, yes, I am modifying SA regions in a way to do this, but not same exact method (I only modified one byte in my test). Maybe it has been known for a long time, but it is new to me. And the other difference is that I am doing it myself without 3rd party tools. The fact that I had a successful test via USB was actually surprising even to me.

Not a surprise at all. If HDDSuperTool can bypass the USB bridge and send VSC to the drive and get a valid response out of it, like if you can apply the slow fix then you can do all the other operations as well. Meaning you can do to the drive all the stuff that PC-3000 and all the other firmware tools do (with exception of the hardware controll/handle of power) and you can do that by USB.

If you block SA regions you should be able to read entire tracks, get the modules out of it and patch them or use it as loader/dir/whatever...

True ,
Spildit its a known fact the PC3K can work with USB Drives Also Via USB For Firmware/ROM Work .But It Does Not Work In All Drives i Have Tested

[Amarbir[CDR-Labs]]

After looking at the links, yes, I am modifying SA regions in a way to do this, but not same exact method (I only modified one byte in my test). Maybe it has been known for a long time, but it is new to me. And the other difference is that I am doing it myself without 3rd party tools. The fact that I had a successful test via USB was actually surprising even to me.

Not a surprise at all. If HDDSuperTool can bypass the USB bridge and send VSC to the drive and get a valid response out of it, like if you can apply the slow fix then you can do all the other operations as well. Meaning you can do to the drive all the stuff that PC-3000 and all the other firmware tools do (with exception of the hardware controll/handle of power) and you can do that by USB.

If you block SA regions you should be able to read entire tracks, get the modules out of it and patch them or use it as loader/dir/whatever...

True ,
Spildit its a known fact the PC3K can work with USB Drives Also Via USB For Firmware/ROM Work .But It Does Not Work In All Drives i Have Tested

I do have access to PC-3000 Express, latest version and i find it way better to use WDMarvel for WD rather then PC3K.

Only advantage of PC3K is the terminal connection to PCB that allows to work on USB only pcb without special adaptor/converting to sata or use HDDSuperTool.

Awesome ,
Give us a list of few special things you do with WDmarvel that you miss in UDMa/Express .

[Amarbir[CDR-Labs]]

Awesome ,
Give us a list of few special things you do with WDmarvel that you miss in UDMa/Express .

Try it out for free and see for yourself

https://wdmarvel.com/en/

Well,
I did go there and downloaded the Demo ,But still i am interested to know from your viewpoint

[Amarbir[CDR-Labs]]

Great ,
So gimme some time to respond .I am a busy man with WORK.Try one atlantis family pcb wd6400aaks without Connection to hdd .Thats not SED but still has same issue as described by shahi here .Kindly connect to my Facebook profile ,I sometimes do live broadcasts to discuss and show what i have learned or how my viewpoint differs from others .