WDC WD5000LUCT-62MPJY0

[Popica]

the drive isn't recognized by SAS expansion boards , only directly to sistem in AHCI/IDE mode...as i know on other Hubble LT2 models i change something in module 02 and that became detected, but in this one, nothing works...i will attach here the module 02 from this kind of drive, maybe someone can guide me...thanks !

Attachments

02.rar

(1.37 KiB) Downloaded 567 times

[Popica]

the drive isn't recognized by SAS expansion boards , only directly to sistem in AHCI/IDE mode...as i know on other Hubble LT2 models i change something in module 02 and that became detected, but in this one, nothing works...i will attach here the module 02 from this kind of drive, maybe someone can guide me...thanks !

If someone able to take a look on mod02 of two drives ( one detected and one not detected, same model / fw / family ) and maybe we will find the issue,
Thank you for your time.


These drives came from dvr's, maybe i need to do one modification in plus than for unlock,

Attachments

WD5000LUCT 02modules.zip

(2.95 KiB) Downloaded 260 times

[fzabkar]

If someone able to take a look on mod02 of two drives ( one detected and one not detected, same model / fw / family ) and maybe we will find the issue,

Neither of these two modules has a valid checksum. Did you edit them?

I extracted the sections from 02.bin (see attachment).

Attachments

02_bin_dump.7z

(2.67 KiB) Downloaded 267 times

[Popica]

was unlocked by PC3K,none of them was edited, in PC3K full module 02 show checksum ok, i extracted module 02 with pc3k and wdmarvel too, same , no difference...i dont know how to handle them now...

[fzabkar]

I have extracted the sections after "correcting" the checksum. It seems to me that most of them are corrupt, if you compare them against the dump from 02.bin.

Attachments

WD5000LUCT-62MPJY0.7z

(4 KiB) Downloaded 251 times

[fzabkar]

I see what is happening. The offsets of each section are being shifted by 0x6, 0xC, 0x12, 0x18, or 0x1E bytes (multiples of 6).

For example, here is section 43 from 02.bin (normal) and 027SX (shifted by 0x1E):

Code:

Section 43     Length 91 bytes

Addr  00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0000  00 01 00 C8 00 00 00 40 00 00 00 00 00 64 00 00  .......@.....d..
0010  00 00 08 08 08 08 00 00 00 08 10 0A 50 00 E8 03  ............P...
0020  00 00 1E 00 00 00 FF FF FF FF A0 0F A0 0F 00 00  ................
0030  1E 00 06 00 32 00 00 00 02 00 00 02 3C 00 00 00  ....2.......<...
0040  01 44 00 A0 00 00 00 00 40 00 00 00 10 00 00 00  .D......@.......
0050  00 3C 01 00 40 00 00 00 04 20 10                 .<..@.... .

Code:

Section 43     Length 91 bytes

Addr  00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0000  00 78 00 00 00 32 00 00 00 40 1F 90 01 05 20 4E  .x...2...@.... N
0010  D0 07 B4 00 0F 00 50 00 F4 01 F4 01 E8 03 00 01  ......P.........
                                                ^^
0020  00 C8 00 00 00 40 00 00 00 00 00 64 00 00 00 00  .....@.....d....
0030  08 08 08 08 00 00 00 08 10 0A 50 00 E8 03 00 00  ..........P.....
0040  1E 00 00 00 FF FF FF FF A0 0F A0 0F 00 00 1E 00  ................
0050  06 00 32 00 00 00 02 00 00 02 3C                 ..2.......<

WD's warranty checker identifies these drives as "Sagem Orange".

[Popica]

I see what is happening. The offsets of each section are being shifted by 0x6, 0xC, 0x12, 0x18, or 0x1E bytes (multiples of 6).

For example, here is section 43 from 02.bin (normal) and 027SX (shifted by 0x1E):

Code:

Section 43     Length 91 bytes

Addr  00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0000  00 01 00 C8 00 00 00 40 00 00 00 00 00 64 00 00  .......@.....d..
0010  00 00 08 08 08 08 00 00 00 08 10 0A 50 00 E8 03  ............P...
0020  00 00 1E 00 00 00 FF FF FF FF A0 0F A0 0F 00 00  ................
0030  1E 00 06 00 32 00 00 00 02 00 00 02 3C 00 00 00  ....2.......<...
0040  01 44 00 A0 00 00 00 00 40 00 00 00 10 00 00 00  .D......@.......
0050  00 3C 01 00 40 00 00 00 04 20 10                 .<..@.... .

Code:

Section 43     Length 91 bytes

Addr  00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0000  00 78 00 00 00 32 00 00 00 40 1F 90 01 05 20 4E  .x...2...@.... N
0010  D0 07 B4 00 0F 00 50 00 F4 01 F4 01 E8 03 00 01  ......P.........
                                                ^^
0020  00 C8 00 00 00 40 00 00 00 00 00 64 00 00 00 00  .....@.....d....
0030  08 08 08 08 00 00 00 08 10 0A 50 00 E8 03 00 00  ..........P.....
0040  1E 00 00 00 FF FF FF FF A0 0F A0 0F 00 00 1E 00  ................
0050  06 00 32 00 00 00 02 00 00 02 3C                 ..2.......<

WD's warranty checker identifies these drives as "Sagem Orange".

that means if i will replace this Section with one without those identifications, recalc checksum and write back, its posible to be resolved the problem ? i will check it today

[fzabkar]

These PVR HDDs appear to be firmware locked in some way.

Module 02 consists of several sections containing model number, serial number, firmware version, capacity, password, etc. At the beginning of the module is a table which identifies the location and size of each section. This particular PVR firmware obfuscates the table so that it points to the wrong locations. I would think that this "doctored" firmware would know how to decode these sections correctly. If we now "fix" module 02 when the drive expects it to be obfuscated, I don't know how the firmware will behave.

How are you accessing the SA now? Are you using a loader? Are you using a different PCB and ROM?

[fzabkar]

To "repair" module 02, go to offset 0x200 and delete 6 bytes. Then go to offset 0x400 and delete another 6 bytes, followed by offset 0x600 and delete 6, and so on until the end. Then pad the last sector with zeros. After doing this, the checksum is correct.

Attachments

027SX not detected LSI_edited.7z

(1.46 KiB) Downloaded 250 times

[Popica]

These PVR HDDs appear to be firmware locked in some way.

Module 02 consists of several sections containing model number, serial number, firmware version, capacity, password, etc. At the beginning of the module is a table which identifies the location and size of each section. This particular PVR firmware obfuscates the table so that it points to the wrong locations. I would think that this "doctored" firmware would know how to decode these sections correctly. If we now "fix" module 02 when the drive expects it to be obfuscated, I don't know how the firmware will behave.

How are you accessing the SA now? Are you using a loader? Are you using a different PCB and ROM?

The drive works perfectly fine after unlock techno mode access, no need any ldr, ROM or PCB,
only issue its that detection on other system than IDE Mode from Bios or USB 2.0 interface adapter

[fzabkar]

Maybe you could write the "repaired" 02 module (027SX) to the SA?

Could you upload the ROM and SA resource dumps? Did you test the checksums of the other SA modules?

Does this model have backups of module 02 in module 0x802E or 0x802F or somewhere else?

[fzabkar]

I have also "repaired" the 02N31 module. This time the algorithm is slightly different.

Go to offset 0x200 and delete 4 bytes.

Go to offset 0x400 and delete 6 bytes.

Go to offset 0x600 and delete 6 bytes.

Go to offset 0x800 and delete 6 bytes.

Go to offset 0xA00 and delete 6 bytes.

Pad the last sector with 0x00.

The checksum is then correct (0x00000000).

Attachments

02N31 detected LSI_edited.7z

(1.44 KiB) Downloaded 237 times

[Popica]

Maybe you could write the "repaired" 02 module (027SX) to the SA?

Could you upload the ROM and SA resource dumps? Did you test the checksums of the other SA modules?

Does this model have backups of module 02 in module 0x802E or 0x802F or somewhere else?

Sorry for late reply, you have attached one full backup from one WD5000LUCT , same kind of the issue explained before

about backup of 02, i dont find it in 0x802E or F

Attachments

Copy 1.rar

(14.03 MiB) Downloaded 234 times

Copy 0.rar

(14.02 MiB) Downloaded 235 times

WDC ROM - WD5000LUCT-62MPJY0-03-01A03-WD-WX41A770ER FR.rar

(247.74 KiB) Downloaded 237 times

[fzabkar]

Module 02 in your latest resource dump is normal, ie no obfuscation. :-?

From WD's warranty page ...

WD5000LUCT-62MPJY0
HUBLT2
5400
16M
SATA II
3.0GB/S
500.0 GB
2HD
SAGEM Orange

Attachments

02_bin_dump.7z

(2.67 KiB) Downloaded 236 times