I think so.

Please keep us updated !

Any progress with your tool ?

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

I had some plans developing the tool on the new received donor...(especially working on SA modules) but because it has that filter broken..I don't have a testing hardware of course, I have around about 2 sata hdds but don't want to play on them an older one..on which I could play has ide con...not supported by working pc's mobo which has only sata connectors.

I'm waiting for a rom programmer ...because I plan to implement a "write flash" option..and I want a way to fix the rom chip...if I accidentally brick it during software tests.

some basic functions in my application

LOOKSSSS COOLLL !
Spildit Likes it

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

some words about WD mod_01.

mod_01 it's the first module accessed by the rom firmware. it's in fact a table holding information about all mods that are present on SA.

the mod_01 starts with a header. if the ROYL mark it's found at the beginning, this means that the firmware it's somehow newer..and the first 48 bytes forms a header. if not..the first 24 bytes...are the header of the old format.

the ROYL format it's somehow an enhancement to the old one. the mod's IDs are stored on 2 bytes..instead 1 byte....so more than 256 mods can be stored on SA on ROYL firmwares.

after the directory header...follows a series of headers describing each module.it is normal because the firmware must know where on the platters in SA is stored each mod. the number of headers (mods) is indicated in the main header...in case of old format..and for the new format in some bytes after the header;

the table entry describing each mod.. has a size of 8bytes...and holds the mod ID, the cylinder and start sector..+ size in sectors..so the mod can be read. on ROYL firmware there is another way of accessing mods..called LBA...so if this is stated in the main header (Bytes 16:19 "0002")...then the tables looks a little different having 18bytes size, in fact the first byte (usually = 0x12) tell the length; what it's interesting is that there is a member on this header showing the number of module copies on SA and a file attribute member, which doesn't exist on CHS way.

so to handle the mod1 parsing...one must read the header. if it's the old format...get the number of mods form this header (Bytes 10:11)..and then scroll down for each mode's table entry and get the mod. if the ROYL mark it's found...the version int field (starting at 16 byte) in header must be checked..to see if we have a LBA or CHS table for mods. then read the "number of mods" which it's found after the main header...size 2 bytes. the mods table it's located immediately after the "number of mods" for LBA..and 4 bytes after that..for CHS mode.

to examine this use a hex-editor and open a 0x0001.mod downloaded from here

Thanks for sharing !
Also you might want to check this one out !
WDMarvel23 http://rghost.net/43013692

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

^^ useless...for non-russian speakers

today some words about PUIS (Power Up In Standby) nice to have for hot-swapping pcb

while playing with my evolving app I came across a strange situation while implementing wd PUIS. there's a wd-vsc which controls this option, which means that the HDD will start without spinning the platters.

a flag with 4 options controls the PUIS type.


PM2 it's the PCB' jumper..

in my case, I wasn't able to set the drive in PUIS state with the PM2 jumper because the flag was set in firmware for "Disable PUIS, PM2 jumper ignored", which doesn't care of the PM2 jumper and spins always. I had the problem while setting the flag to "Enable PUIS, PM2 jumper ignored". on reboot the drive was silent...but it doesn't wanted to respond to my VSC commands (returning HOST_UNSUPPORTED_ATA_OPCODE), in order to set it back. more...for the ATA identify command (which it's the standard method to detect present hdds)...returned an empty structure. so what to do? (flash firmware? I don't have the tools.)



If you enter in this state..you won't be able to sent VSC commands to restore back the flag; on the other hand, windows seems not to know how to start the device. perhaps the bios should handle this. I didn't made researches on how to start the hdd with external methods so I coded another ATA command to sent to device in order to exit from PUIS state.after that, the firmware accepts again VSCs so I was able to reset the PUIS flag to jumper controlled.

Here I've implemented a check to see if the device it's somehow stacked in PUIS mode. This is the respons for ATA_IDENTIFY (0xEC)

Cool ! I guess you are doing great !

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

Louis, can you guive us a helping hand on this thread ?
Let's team up !
You have more knowledge then i about the inner workings of the WD Rom/Firmware.
Can you spare a moment to give your oppinion on this one ?
Thanks.

wd800jd-pcb-swapped-times-with-the-same-error-t25583.html

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

yeah, I tried to find some useful software tests for the inside components ...servo..preamp.

I'm doing some tests on the good drive. I get fine results..no error if I call functions in a logic order.


but if I stop the spinning the platters and call actuator init I get an error. the drive doesn't start spinning:

I assume that servo_actuator_init needs to access the SA to read its data, but since the drive it's not spinning it throws an error.

so the error code it's around my bad hdd error 0x4341; usually the numbers starting from 0xXXyy belongs to a specific part ie servo all wix 0x40xx etc

ok..more...

again about PUIS. now I have the donor PCB which Powers Up in Stand By based on the jumper I set on PM2 or not! (so a jumper which does the specs) since it doesn't start the motor, it means that that flag it's written somehow inside the rom firmware. I have translated the PCB to the patient and it it proved true. the patient with the PM2 set doesn't start (until I send it the right ata command). so, I've done a rom dump and compared to the factory default. the dirty flag it's written inside 0xD mod at the end of the rom. the factory byte it's set to 0x02...and after I did the VSC modification...to 1...the flash reflected it as 0x00 (so if I set a flag with the VSC command to 3...it will be set in firmware as 3-1 = 2)

attached the roms. use HxD to compare the diff. the "Orig" in file's name, marks the default factory firmware. the crc byte it's changes..the flag byte..and 4 letters

what's funny is that on the patient hdd on witch the rom firmware can't access the SA..the VSC doesn't let me change the PUIS...it throws VSCE_PERM_OVL_NOT_LOADED. basically it needs to edit itself, but complains about SA

bad news.

my donor seems to be badly damaged. it came unformatted so what I did till today..I did with it how it was. only tests with rom and SA. today booted under xp to test some stuff and did a format. played with wdr and did a sort of surface scan..and at a moment it started to make some really ugly noise. it was with the old pcb on it. now look how it looks. however the external shape...about I've told proved that didn't left untouched the internals.

I'm not interested in that...but I'm afraid the HSA not to be affected. the heads reads fine the SA.

not. now that I'm looking better I get some DISK ECU UNSAFE ERROR on head 1 in SA. and in the rest of the. m...damn. that pattern it's for a dead head. and since i didn't tested the donor from the beginning I don't know if the old PCB did that..when playing around with it mounted on donor.

this is what the owner left behind on head 0..cyl n sector z


tsted again backup all function and it downloads well the rom and SA modules. all modules are located on head 0...and therefore I could play fine with it till today, not knowing what lies inside

Can you do me a favour ? On WDR Demo - Test - Heads Write Test.
And post log.

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

it sucks.

well, since I have formatted the hdd, now it's seen by wingoz. this is a big deal because it tries to access it and f. it. the device must be disabled from device manager, otherwise it will screw your operations!

as I said, the wdr demo or not reports ok on heads tests read...write etc. look in the image at the dos window...my app reporting head 1 down + the error. I'm 100% that the head is dead. I see it during debugging... the error and nothing came up in the read buffer.

more..wdr back-ups the files to a drive and unfortunately it was exactly the one I was working on, the donor. suddenly windows started throwing errors that cannot access that dir created by wdr. to play around..I did a head depop for head 1 and did a reset. then the entire modules list (except mod1) went red..with the error FM...bla bla...like on the other thread. while windows continuing popping messages with "cannot access ...blabla". I did a pc reboot this time, popped back the head and now the SA modules are fine. only that the hdd identifies as something else while it was WDC WD2000JD now it became WDC WD1200LB . at inspection the rom firmware is heavy changed in mod 47 (SA adaptives), so really I don't understand from where such large modifications and what was touched inside that mod.

From this i can conclude that the errors that are shown on WDR might not be the real error, at least for version 3 of the full program.
At any rate regarding your drive i would do as following.

- Would get a new donnor drive,

Would check heads with your program and if heads are good i would try to do the head swap to the drive that you have with one bad head (not your important drive of course)

- If it works you can use r-studio to check the data of the guy who sold you the drive (NOT)....

- I think thayt i would try to get my money back (the guy sold you a broken drive) or if not i would use it to test the head stack swap ....

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

wdr3 demo and full too. look at the window's title.

I'll wait for another donor to appear at a decent price on ebay. this one It was sold only to us..that's why I purchased it through a guy which can buy in us ans ship to me. so no doubts that I can do anything at this moment. one with only a letter in DCM slipped through after already placed the order for this one..

Bad Luck ...

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.

there's a tool around to check the royl module's checksum.

fzabkar someday said:



What he didn't knew, it was that the module sum correctly...but the tool is the problem, it misses something

I've worked today on a function which does a rom firmware file check. I mean...for an existing file...if someone want's to check the integrity. I've implemented a reverse scan at the end of the firmware file..searching for the ROYL mark..then for FLASH_MODULE_DIRECTORY..and from there...scan all internal mods for crc. for the ROYL frm it's possible, but for the old model firmware...I don't see an easy way. However, I need this function, if I plan to develop firmware write. some checks must be made on the firmware we want to flash.

Hello louis, i noticed that you have WDR3.0 inside HBCD? you customized your HBCD i guess?
Also about your tool, just for information, do you plan to release it or not?