All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 13 posts ] 
Author Message
 Post subject: Samsung HM641JI
PostPosted: October 3rd, 2019, 10:47 
Offline

Joined: May 9th, 2017, 11:33
Posts: 140
At power on drive does not spin.

Terminal output is:

Apple Macpro RAID connect phy calibration PLL locked! ChipRev = 63B0

Nothing else. Any ideea what it could be?


Top
 Profile  
 
 Post subject: Re: Samsung HM641JI
PostPosted: October 3rd, 2019, 14:42 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
Power Up In Standby (PUIS)?

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Samsung HM641JI
PostPosted: October 3rd, 2019, 16:20 
Offline

Joined: May 9th, 2017, 11:33
Posts: 140
How can i tell if it's PUIS or not? If it's PUIS how do i overcome / disable?

I've tried with donor pcb and it goes like this:

Pacient drive - pacient pcb - pacient rom

No spin up, Terminal --> Apple Macpro RAID connect phy calibration PLL locked! ChipRev = 63B0

Pacient drive - donor pcb - pacient rom

No spin up, Terminal --> Apple Macpro RAID connect phy calibration PLL locked! ChipRev = 63B0

Pacient drive - pacient pcb - donor rom -->

Drive spins up, Terminal -->

ChipRev = 63B0
*PA VID=0007 PN=0000 Rev=0004
*PA VID=0007 PN=0000 Rev=0004
U
S_0Shock Sensor Circuit Enabled
SO_1
Shock Sensor Circuit Enabled
IS=1
CLA #36/72
Handoff RPM=619
SPOK
mS1 00000003
A1O=127 A1G=443
O=513 S=3
***** No Gray
SoUL!
PK_3 C: 21760 H:0
A1O=127 A1G=444
O=514 S=3
SK C: 10078 H:1
Platform Invalid MC Head
Loaded FIT ( 0: 0: 1)
CalibTable Loaded. Rev:0x17
ResoTable Loaded. Rev:0x01
Bump Limit Loaded. Rev:0x00
RRO1xTable Loaded. Rev:0x01
Ovly loaded to 0x0001CD00
Ovly loaded to 0x1005B800
[DEBUG HALT @\ðå\ðå<ðå<ðå<ðå<ðå<ðå():100349D7 L0 0000FFFF]
EPOK
Cur_SP=04007410
FIQ_SP=04007410
IRQ_SP=04007410
SVC_SP=04007410

*** HALT ***

I also read rom chip in external reader. After 2 reads and compare i noticed at certain offset there are some diffrences.

Well i made another 10 reads and it looks like it that area some bits are constantly changing at each read.

I'm not sure if problem is related or not but i'll compare tomorrow with similar rom version, and maybe use diffrent rom chip to test.


Top
 Profile  
 
 Post subject: Re: Samsung HM641JI
PostPosted: October 3rd, 2019, 16:27 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
You can enable/disable PUIS using HDAT2.

I have written a Samsung ROM analysis tool. I could check your ROM dumps for you.

Can you measure the voltage at the Tx/Rx pins? Are you using a 3.3V TTL adapter?

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Samsung HM641JI
PostPosted: October 4th, 2019, 9:08 
Offline

Joined: May 9th, 2017, 11:33
Posts: 140
Here are the rom chip dumps.

Voltage at the Tx/Rx pins is 2.47V. I use usb Terminal 3, i can jumper select 2.5v or 3.3v.


Attachments:
Samsung HM641JI.rar [174.55 KiB]
Downloaded 710 times
Top
 Profile  
 
 Post subject: Re: Samsung HM641JI
PostPosted: October 4th, 2019, 10:25 
Offline

Joined: May 30th, 2005, 17:07
Posts: 528
Hi,
FIPS was bad
Try this...

Mikippp


Attachments:
Read 01_FIPS.zip [177.25 KiB]
Downloaded 756 times
Top
 Profile  
 
 Post subject: Re: Samsung HM641JI
PostPosted: October 4th, 2019, 11:56 
Offline

Joined: May 9th, 2017, 11:33
Posts: 140
Thanks Mikippp, it works like a charm. I'd like to know how to do it myself next time it occurs.

fzabkar, can you share your Samsung ROM analysis tool?

Acelab was confident that it's not FIPS related ...

Case succesfully solved.


Top
 Profile  
 
 Post subject: Re: Samsung HM641JI
PostPosted: October 4th, 2019, 14:16 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
MasterT wrote:
fzabkar, can you share your Samsung ROM analysis tool?

http://www.users.on.net/~fzabkar/temp/samROMv3.exe
http://www.users.on.net/~fzabkar/temp/samROMv3.bas

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Samsung HM641JI
PostPosted: October 7th, 2019, 11:34 
Offline

Joined: September 30th, 2005, 7:33
Posts: 849
MasterT wrote:
Acelab was confident that it's not FIPS related ...

Case succesfully solved.

In the most cases it's not FIPS related - just a bad soldering of the FLASH chip.
A simple resoldering of it does the "miracle" ...
:D :D :D


Top
 Profile  
 
 Post subject: Re: Samsung HM641JI
PostPosted: October 8th, 2019, 10:39 
Offline

Joined: May 9th, 2017, 11:33
Posts: 140
BGman wrote:
In the most cases it's not FIPS related - just a bad soldering of the FLASH chip.
A simple resoldering of it does the "miracle" ...
:D :D :D


It happened to me before. So i know this trick.

Maybe FIPS problem is not so common after all.

Actually it's the first time i had such a case.


Top
 Profile  
 
 Post subject: Re: Samsung HM641JI
PostPosted: April 17th, 2021, 4:45 
Offline
User avatar

Joined: April 15th, 2020, 8:32
Posts: 17
Location: Poland
Could You guys please verify my ROM? I can't run this rom tools


Attachments:
20210417_102729_FLASH_25040.zip [173 KiB]
Downloaded 433 times

_________________
https://jkrecovery.pl/
Top
 Profile  
 
 Post subject: Re: Samsung HM641JI
PostPosted: April 17th, 2021, 5:40 
Offline

Joined: May 30th, 2005, 17:07
Posts: 528
Hi,
Try this

Mikippp


Attachments:
20210417_102729_FLASH_25040_FIPS.zip [176.75 KiB]
Downloaded 420 times
Top
 Profile  
 
 Post subject: Re: Samsung HM641JI
PostPosted: April 17th, 2021, 14:30 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
http://www.users.on.net/~fzabkar/FreeBasic_W32/Samsung/samROMv4.bas
http://www.users.on.net/~fzabkar/FreeBasic_W32/Samsung/samROMv4.exe

Code:
Verifying Samsung SpinPoint ROM:  C:\Samsung\Firmware\HM641JI\20210417_102729_FLASH_25040.bin

Checksum of Boot Block header = 0x0B  - OK
Checksum of Boot Block (Actual/Expected) = 0x2B / 0x2B  - OK

Searching for FIPS block (expected checksum = 0x0000) ...

Found FIPS text string at 0x0116E6
Checksum for 0x0400 byte FIPS block = 0xC53D  - BAD
Checksum for 0x0800 byte FIPS block = 0x0860  - BAD
Checksum for 0x0C00 byte FIPS block = 0x6E57  - BAD
Checksum for 0x1000 byte FIPS block = 0x3E49  - BAD

Found FIPS text string at 0x01E5B0
Checksum for 0x0400 byte FIPS block = 0x26FA  - BAD
Checksum for 0x0800 byte FIPS block = 0xE2EA  - BAD
Checksum for 0x0C00 byte FIPS block = 0xF040  - BAD
Checksum for 0x1000 byte FIPS block = 0xF3A8  - BAD

Found FIPS text string at 0x01F8B8
Checksum for 0x0400 byte FIPS block = 0xA5BD  - BAD
Checksum for 0x0800 byte FIPS block = 0x65DB  - BAD
Checksum for 0x0C00 byte FIPS block = 0x961C  - BAD
Checksum for 0x1000 byte FIPS block = 0xFA03  - BAD

Could not find a FIPS block with valid checksum

Searching for FLASHTBL ...

Found FLASHTBL text string at 0x000534
Parsing FLASHTBL at 0x000510 ...

ID Attr Byt3    Size   ROM address range   RAMaddrs  Cksm (Exp/Act)
-----------------------------------------------------------------
00  00   FF         0                             0            N/A
01  02   FF       320      510 - 82F       FFF00510  FA 7A   - BAD (Note 2)
02  08   FF      1650      830 - 1E7F      FFF00830  FF FF   - OK
03  00   FF     1C9A8     1E88 - 1E82F            0  AC AC   - OK
04  01   FF      3254    1E838 - 21A8B        1CD00  00 08   - BAD (Note 1)
05  00   FF      1060    1E840 - 1F89F      4000000  E4 E4   - OK
06  00   FF         0                       4005960            N/A
07  00   FF       22C    1F8B0 - 1FADB      4005A00  72 72   - OK
08  00   FF         0                       4006000            N/A
09  00   FF     1C840    1FAEC - 3C32B     1002D800  73 73   - OK
0A  01   FF     16998    3C334 - 52CCB     1005B800  00 A4   - BAD (Note 1)
0B  00   FF       610    3C33C - 3C94B     14000000  FF FF   - OK
0C  00   FF      1E94    3C954 - 3E7E7     1407C800  64 64   - OK
0D  00   FF         0                      1C000000            N/A
0E  00   FF         0                      1FFE0000            N/A
0F  00   FF      1740    3E800 - 3FF3F     FFF3E800  3C 3D   - BAD (Note 3)

Found FLASHTBL text string at 0x031B03
Inconsistent ID

Found FLASHTBL text string at 0x031B4F
Inconsistent ID


Searching for SERVOTBL ...

SERVOTBL text string not found

Size            - size of module in ROM expressed in bytes
ROM address     - absolute address range of module in ROM
RAMaddrs        - load point of module in RAM
Cksm (Exp/Act)  - Expected Checksum / Actual Checksum


Note 1:  The address range of affected module may conflict with another module,
          in which case this is probably a false negative.

Note 2:  If this module is the FLASHTBL or SERVOTBL, then this is most likely
          a false negative.

Note 3:  This may or may not be a genuinely BAD module. Examine the checksum
          of the first half of the ROM. If 0x0000, then module is probably OK,
          otherwise it may or may not be bad. Also examine the "adjusted"
          checksum, if applicable.

Note 4:  The address range of the module is outside the limits of the ROM.


FLASHTBL header contains no extents information


Calculating ROM checksums ...
Checksum for 0x000000 - 0x03FFFF = 0x0000
Checksum for 0x040000 - 0x07FFFF = 0x0802
Checksum for entire ROM = 0x0802

_________________
A backup a day keeps DR away.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 13 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: ccc and 55 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group