"Are you talking about drive 2, right ?"

YES. that's the drive I'm working now. let's don't talk about flash. the flash operation was just fine and after that the donor worked fine. till I did some pcb swapping between donor-patient..to test some stuff.

more. just did a pcb swap..put the old pcb to the donor..and again dead (I said..give it one last chance). putting back it's pcb it started. so it's something with the screwing...cables f...I don't know..but its getting worse.

now the donor works. of-course with the H1 buggie but I'm afraid these are the final day for it


I want to start it in "safe mode" to test it...then load perm ovl..because I have its mods. then try to read SA, to see if it works.

to enter "safe mode" I inserted the4 jumpers at the back..and after that..it started to click as dead.

You will need another drive ...
At any rate, now that the donor is working again, place the 4 jumpres and load the perm_ovl and test again if it allow access to SA or not !

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

now it works but I'm not sure how..because I think I must delete some mods in order to test the perm_ovl thing. now..it starts as WDC ROM..and although I call load_perm_ovl..and then I try to read the SA...it works. but it works also without loading perm ovl... so I believe that the kernel tries to read its mods as soon as I call the Read_module. that's why I say that I must erase the SA and do the test

There are 2 things ....
Either you load perm_ovl from the drive or you load it from a file
Are you using just your tool to test it ? Or are you using another tool to send the perm_ovl to the drive ? In other words, what tool are you using to send perm_ovl to drive while testing ?

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

I'm developing my tool

I load it from locally saved mod_11. (mod 11 ...of-course it's a backup of the donor's SA)

now..

I deleted mod_01 from H1 so the donor can't load any mod. I'm in safe mode now. to test the deletion, when I try to read mod_01 (with a vsc command)...I get 0x5181 -->> DISK_DAM_ERROR which it's good since the kernel tries to load the file from H0..where it's deleted...then tries the H1 which it's defect (errors posted early).

for any other mod I get 0x3701 -->> FM_ERR_DIR...which meand..the dir module (01) missing/error

I can read the SA without any mods loaded...I'm in kernel mode!! I didn't load any perm overlayer at this moment! so this brings light into my mind
there are vsc functions which throws 0x3042 -->> VSCE_PERM_OVL_NOT_LOADED...so requires mod 11 to be loaded...but THE SA ACCESS DOESN'T DEPEND ON ANY MODULE. THE SA can be empty...and the kernel still can read it.

Are you sure about that ?
Can you delete module 11 from head0 and check ? Maybe drive is loading perm_ovl from the copy on the platter ?
Well, if not you can format SA and then even if you power down the drive you can copy the modules back and it will be ok
If you can read and write to SA without perm_ovl then you don't need the loader file at all ....

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

100% sure

there are 2 copies of each mod: ..H1 and H2. the kernel loads H1 and if H1 mod is bogus..then it tries H2 copy. there's no need to del mod 11 since the kernel wont know where it is..if I delete the mod 1. mod 1 has the locations inside SA of all the mods! so..what i did it's the same as del entire SA!

who knows where perm_ovl it's required. perhaps when writing? more test needs to be done. I'll try to fix back the mod 1 to check if I can without perm ovl.

Cool !
So, the code in ROM is all that is needed to access SA
Even on "safe mode" .....
If you can write back without perm_ovl ..... i can't see any use for loading using perm_ovl ... unless you need some commands or start self scan .... strange ....

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

I did the write mod_1...without any perm_ovl, directly from "safe mode".

don't know what will happen when you try to read the sa as you go to its limit...since the size it's given in mod 11. perhaps a safe cylinder border it's hard-coded in kernel. as you change zone...you'll need the adaptives...which are in other mods...so you won't be able to do self scan or complicated stuff while all important mods are missing from SA. you may safely limit to SA operations only.

perhaps the perm ovl it's required by those tools to get the SA SPT (sect per track). when the tools want to write mods on SA they want to know the SA size...to know how much can go writing mods. the size it's given by a vsc command but only after perm ovl it's loaded.



if you can't read the SA the preamp it's dead

Did it really write to SA ? nd can you read it back and compare the files to see if was corretcly written ?

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

By the way, SD WD doctor have a function to read SA at a lower speed, to gain access to SA. Any clue about what it might be and any use for it ?
Starts to look like obscured lies ...

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

Maybe the slow speed SA reading would apply to when adaptives are gone ?
And maybe the loading perm. overlay can be used when you have some defects on ROM ?
Just trying to guess as i think there must be some use for those functions on the comercial tools...

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

Now that i think about it, i've read somewhere (pc3k or salvation manual) that when flashing WD ROM one should allways do that from safe mode.
Maybe what happened with you the other day was related to the code on the drive using RAM or buffers the same time it was flashing ?
At any rate i like the fact that your tool checks for what was written.

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

yes. in fact I erased only one sector..the first sector in SA for H1. it's equivalent, if you like..to erasing bootloader for windows...it won't be able to find any file..although the files are 100% there.



don't know about it. it is for all wd models or something specific? let's don't blame for what we don't know.



"Safe mode" can be achieved by dismounting PCB from hdd (if you don't know the jumpers). the kernel doesn't load the SA. it is safer because the kernel doesn't do any other data transfers and leaves the MCU handle only the rom write. on the other hand, it could be a software bug. if the software continues writing I/O port although the device say... stop..I'm busy..the data it's missed.

Removing the pcb is the same as setting the jumpers ?
Even the totality of the ROM code is loaded when you set the jumpers ?
Is there any advantage of setting the jumpers over removing the pcb ?
Can you test to set the jumpers and try to read ROM ?
The only advantage that i can see is if spindle controller is damaged you can set jumpers and prevent it to lock the pcb so you can read ROM ?
Maybe some other modules of ROM are not loaded with the jumpers ?

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

1. it has the same effect. the kernel doesn't read the SA. the result is: "kernel mode" aka safe mode
2. I think so.
3. You dont use the screwdriver
4. the rom reading it's not influenced by any jumpers. yes it reads fine with or w/o jmprs.
5. I noticed that when the PCB is removed..or the safe mode is on via jumpers..the pcb identifies with 0 heads. I have to spin it up to update its head number. when it's 0 heads..if I send it some commands which involves heads..I get an error..invalid-head. mod 0xa which it's inside rom..holds the the H number. so you can see that it's loaded only when needed. we can link the heads number module loading...by the spinup action. I believe that the first call made internally by the kernel to the function which spin the motor..initialize the head number..by reading mod 0xa.

Cool !
I guess that i will do some experimental work on WD too !

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

case of a dead head. which in fact wasn't dead.

so the mod 47 (sa adaptives) located in rom...can be regenerated from SA's mod 41 (which contains also the mod47 data). if you have the same rom version.

And ????

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

and..if a head doesn't work as it should be this could be a cause..and should be checked. compare mod47 against mod 41 to see if somehow mod 47 wasn't corrupted.