Seagate ST500LM000

[egiomor]

Hello guys

it's the first time for me in this forum, I hope that you can help me to solve my issue.
Let's explain which is my issue:

Seagate ST500LM000 with Security ON HIGH Locked, the ATA password has been forgotten and the data within the SSHD are very important for me and I do not have any backup of it.
So it means that I'm desperate

I bought SeDiv tool but unfortunately this specific model is not supported yet.
I "built" a serial cable in order to connect via the diagnostic port and I found the diagnostic commands...but it is not enough to accomplish the mission.

Can someone help me in this hard mission?
Please let me know if my request is clear or if I have to explain better the situation.

Thanks a lot in advance for your cooperation and support
ciao
gio

[egiomor]

does the drive support the "r" command at level t ?



If so read sysfile 30a and post here.

http://www.hddoracle.com/viewtopic.php?f=83&t=1455

Can you use SeDiv to read sysfiles on you drive by ATA ? If so you have another way to retrieve the needed sysfile.

F3 T>r

Invalid Diag Cmd Parameter

F3 T>
As far as I know, SeDiv doesn't support this ST500LM000 model yet...

[egiomor]

does the drive support the "r" command at level t ?



If so read sysfile 30a and post here.

http://www.hddoracle.com/viewtopic.php?f=83&t=1455

Can you use SeDiv to read sysfiles on you drive by ATA ? If so you have another way to retrieve the needed sysfile.

F3 T>r

Invalid Diag Cmd Parameter

F3 T>
As far as I know, SeDiv doesn't support this ST500LM000 model yet...

ok my mistake sorry.
attached you can find r93 output and r30a as well

Attachments

FILE_3_093_0.txt

(4.5 KiB) Downloaded 794 times

FILE_3_30A_0.txt

(4 KiB) Downloaded 769 times

[egiomor]

What about the "generic F3 ARCH" tool on sediv ? Can you read sysfiles by ATA with it ?

thank you for your answer first all

sorry, my mistake...I didn't understand well the command...

attached you can find the r30A output.

Attachments

FILE_3_30A_0.7z

(321 Bytes) Downloaded 579 times

[egiomor]

What about the "generic F3 ARCH" tool on sediv ? Can you read sysfiles by ATA with it ?

Base folder not set! - Exit!
Main Menu -> Programm -> Settings -> View -> Select Folder -> Save!

Base folder not set! - Exit!
Main Menu -> Programm -> Settings -> View -> Select Folder -> Save!
Finished!


tried but no output file using the Sediv GUI

[egiomor]

does the drive support the "r" command at level t ?



If so read sysfile 30a and post here.

http://www.hddoracle.com/viewtopic.php?f=83&t=1455

Can you use SeDiv to read sysfiles on you drive by ATA ? If so you have another way to retrieve the needed sysfile.

F3 T>r

Invalid Diag Cmd Parameter

F3 T>
As far as I know, SeDiv doesn't support this ST500LM000 model yet...

Ok ... Did you try the posted ZOC script ?

yes, here you can find the output:

[SERIAL/DIRECT] CONNECTED TO PORT COM3 (38400-8N1)


Request spin / disc table recovery
ASCII Diag
TCC:0023
mode

F3 T>
Spinning Down

Spin Down Complete
Elapsed Time 3.913 secs
Delaying 5000 msec

Jumping to Power On Reset 
Rst 0x40M
Servo Processor Is Reset.
(P) SATA Reset












176 +++ TMP=delstr(TMP,1,k-1)
239 +++ TMP2=TOASCII(i)
212 +++ call RECEIVE
50 +++ NXTADDR=GET_DATA(ADDR,DUMPLEN)
Error 40 running "C:\Users\egiomor\Downloads\SUnlock\SUnlock.zrx", line 176: Incorrect call to routine
Error 40.13: DELSTR argument 3 must be zero or positive; found "-1"
00148600 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00148610 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00148620 50 86 14 40 20 85 14 40 00 00 00 00 00 00 00 00
00148630 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00148640 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00148650 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00148660 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00148670 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00148680 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00148690 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001486A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001486B0 00 00 00 00 00 00 00 00 E8 86 14 40 B8 85 14 40
001486C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001486D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001486E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001486F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00148700 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00148710 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00148720 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00148730 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00148740 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00148750 80 87 14 40 50 86 14 40 00 00 00 00 00 00 00 00
00148760 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00148770 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00148780 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00148790 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001487A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001487B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001487C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001487D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001487E0 00 00 00 00 00 00 00 00 18 88 14 40 E8 86 14 40
001487F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
F3 1>

ciao

[egiomor]

Master password - 19 05 1F 1F 11 0B 13 20

User password - 19 05 1F 1F 11 0B 13 20

Try to write the attached sysfile (patched). Power off/on the drive. Drive should be unlocked.

Then set a new password and remove it using for example Victoria, MHDD, etc .... This will write a proper sysfile to all copies.

FILE_3_30A_0.rar

Thank you so much for your support Spildit,

just to understand and to learn something else
do you want to share with the forum what you did?
The Master and User password you set it is not possible to see, simply translating from HEX to ASCII I think...

In order to "upload" or write back the sysfile, I think it is enough to w30A, isn't it?

Thank you again
ciao
gio

[egiomor]

Master password - 19 05 1F 1F 11 0B 13 20

User password - 19 05 1F 1F 11 0B 13 20

Try to write the attached sysfile (patched). Power off/on the drive. Drive should be unlocked.

Then set a new password and remove it using for example Victoria, MHDD, etc .... This will write a proper sysfile to all copies.

FILE_3_30A_0.rar

Thank you so much for your support Spildit,

just to understand and to learn something else
do you want to share with the forum what you did?
The Master and User password you set it is not possible to see, simply translating from HEX to ASCII I think...

In order to "upload" or write back the sysfile, I think it is enough to w30A, isn't it?

Thank you again
ciao
gio

Ok Spildit,

I compared what I downloaded from the hard drive with what you modified and:

on the address 00000048 you modified 00 00 00 00 12 02 00 00 0C 54 01 -> 00 00 00 00 12 02 00 00 0C 54 00

the "famous" field involved to enable or disable the password, is it correct?

ciao
gio

[unknown]

Master password - 19 05 1F 1F 11 0B 13 20

User password - 19 05 1F 1F 11 0B 13 20

Try to write the attached sysfile (patched). Power off/on the drive. Drive should be unlocked.

Then set a new password and remove it using for example Victoria, MHDD, etc .... This will write a proper sysfile to all copies.

FILE_3_30A_0.rar

Thank you so much for your support Spildit,

just to understand and to learn something else
do you want to share with the forum what you did?
The Master and User password you set it is not possible to see, simply translating from HEX to ASCII I think...

In order to "upload" or write back the sysfile, I think it is enough to w30A, isn't it?

Thank you again
ciao
gio

That's it. The same way you read it.
Good luck

[egiomor]

Thank you so much for your support Spildit,

just to understand and to learn something else
do you want to share with the forum what you did?
The Master and User password you set it is not possible to see, simply translating from HEX to ASCII I think...

In order to "upload" or write back the sysfile, I think it is enough to w30A, isn't it?

Thank you again
ciao
gio

I did patch the file. Located the "T" then count 4 bytes. There was a flag of "01" that i did change to "00" compare binary files. Most of times the drive will be locked with MAX security so you will most likely have 01 01 that you need to patch to 00 00.

Then you have the passwords. On your case user password is the same as master password.

Then section ends with FE FF

You can write the same way you read but with w command instead, lacking that you can send the HEX values to unlock the drive or even make a file and send them using Victoria.

Here :

Password.rar

Extract that file and use it with VICTORIA FOR WINDOWS to unlock the drive like this :

http://www.hddoracle.com/viewtopic.php?f=117&t=1072

FULL EXPLANATION OF UNLOCKING :

http://www.hddoracle.com/viewtopic.php?f=2&t=2394

Issue fixed! Thanks a lot Spildit for your essential help

I understood what you did, just a recap:

1 - download, from the sshd firmware, of the 30A memory address (r30A from T level)
2 - editing of the field involved to enable/disable the "Security option" (using a binary files editor)
3 - write back the code to the same memory address (w30A from T level).

And until now for me is clear, what I don't know is the following:

1 - How did you know that the memory address involved in this particular issue was 30A ?
2 - How did you know the specific field and HEX address to be edited ?

Could you please help me in order to understand?

Thanks a lot again
ciao
gio