All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 14 posts ] 
Author Message
 Post subject: WDC WD5000LUCT-62MPJY0
PostPosted: July 13th, 2021, 9:52 
Offline

Banned User

Joined: March 16th, 2015, 3:37
Posts: 46
the drive isn't recognized by SAS expansion boards , only directly to sistem in AHCI/IDE mode...as i know on other Hubble LT2 models i change something in module 02 and that became detected, but in this one, nothing works...i will attach here the module 02 from this kind of drive, maybe someone can guide me...thanks !


Attachments:
02.rar [1.37 KiB]
Downloaded 554 times

_________________
https://t.me/pump_upp
Top
 Profile  
 
 Post subject: Re: WDC WD5000LUCT-62MPJY0
PostPosted: January 17th, 2022, 6:16 
Offline

Banned User

Joined: March 16th, 2015, 3:37
Posts: 46
Popica wrote:
the drive isn't recognized by SAS expansion boards , only directly to sistem in AHCI/IDE mode...as i know on other Hubble LT2 models i change something in module 02 and that became detected, but in this one, nothing works...i will attach here the module 02 from this kind of drive, maybe someone can guide me...thanks !


If someone able to take a look on mod02 of two drives ( one detected and one not detected, same model / fw / family ) and maybe we will find the issue,
Thank you for your time.


These drives came from dvr's, maybe i need to do one modification in plus than for unlock,


Attachments:
WD5000LUCT 02modules.zip [2.95 KiB]
Downloaded 249 times

_________________
https://t.me/pump_upp
Top
 Profile  
 
 Post subject: Re: WDC WD5000LUCT-62MPJY0
PostPosted: January 17th, 2022, 15:40 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15440
Location: Australia
Popica wrote:
If someone able to take a look on mod02 of two drives ( one detected and one not detected, same model / fw / family ) and maybe we will find the issue,

Neither of these two modules has a valid checksum. Did you edit them?

I extracted the sections from 02.bin (see attachment).


Attachments:
02_bin_dump.7z [2.67 KiB]
Downloaded 250 times

_________________
A backup a day keeps DR away.
Top
 Profile  
 
 Post subject: Re: WDC WD5000LUCT-62MPJY0
PostPosted: January 18th, 2022, 3:28 
Offline

Banned User

Joined: March 16th, 2015, 3:37
Posts: 46
was unlocked by PC3K,none of them was edited, in PC3K full module 02 show checksum ok, i extracted module 02 with pc3k and wdmarvel too, same , no difference...i dont know how to handle them now...

_________________
https://t.me/pump_upp


Top
 Profile  
 
 Post subject: Re: WDC WD5000LUCT-62MPJY0
PostPosted: January 18th, 2022, 15:58 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15440
Location: Australia
I have extracted the sections after "correcting" the checksum. It seems to me that most of them are corrupt, if you compare them against the dump from 02.bin.


Attachments:
WD5000LUCT-62MPJY0.7z [4 KiB]
Downloaded 238 times

_________________
A backup a day keeps DR away.
Top
 Profile  
 
 Post subject: Re: WDC WD5000LUCT-62MPJY0
PostPosted: January 18th, 2022, 16:15 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15440
Location: Australia
I see what is happening. The offsets of each section are being shifted by 0x6, 0xC, 0x12, 0x18, or 0x1E bytes (multiples of 6).

For example, here is section 43 from 02.bin (normal) and 027SX (shifted by 0x1E):

Code:
Section 43     Length 91 bytes

Addr  00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0000  00 01 00 C8 00 00 00 40 00 00 00 00 00 64 00 00  .......@.....d..
0010  00 00 08 08 08 08 00 00 00 08 10 0A 50 00 E8 03  ............P...
0020  00 00 1E 00 00 00 FF FF FF FF A0 0F A0 0F 00 00  ................
0030  1E 00 06 00 32 00 00 00 02 00 00 02 3C 00 00 00  ....2.......<...
0040  01 44 00 A0 00 00 00 00 40 00 00 00 10 00 00 00  .D......@.......
0050  00 3C 01 00 40 00 00 00 04 20 10                 .<..@.... .

Code:
Section 43     Length 91 bytes

Addr  00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0000  00 78 00 00 00 32 00 00 00 40 1F 90 01 05 20 4E  .x...2...@.... N
0010  D0 07 B4 00 0F 00 50 00 F4 01 F4 01 E8 03 00 01  ......P.........
                                                ^^
0020  00 C8 00 00 00 40 00 00 00 00 00 64 00 00 00 00  .....@.....d....
0030  08 08 08 08 00 00 00 08 10 0A 50 00 E8 03 00 00  ..........P.....
0040  1E 00 00 00 FF FF FF FF A0 0F A0 0F 00 00 1E 00  ................
0050  06 00 32 00 00 00 02 00 00 02 3C                 ..2.......<

WD's warranty checker identifies these drives as "Sagem Orange".

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: WDC WD5000LUCT-62MPJY0
PostPosted: January 19th, 2022, 2:57 
Offline

Banned User

Joined: March 16th, 2015, 3:37
Posts: 46
fzabkar wrote:
I see what is happening. The offsets of each section are being shifted by 0x6, 0xC, 0x12, 0x18, or 0x1E bytes (multiples of 6).

For example, here is section 43 from 02.bin (normal) and 027SX (shifted by 0x1E):

Code:
Section 43     Length 91 bytes

Addr  00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0000  00 01 00 C8 00 00 00 40 00 00 00 00 00 64 00 00  .......@.....d..
0010  00 00 08 08 08 08 00 00 00 08 10 0A 50 00 E8 03  ............P...
0020  00 00 1E 00 00 00 FF FF FF FF A0 0F A0 0F 00 00  ................
0030  1E 00 06 00 32 00 00 00 02 00 00 02 3C 00 00 00  ....2.......<...
0040  01 44 00 A0 00 00 00 00 40 00 00 00 10 00 00 00  .D......@.......
0050  00 3C 01 00 40 00 00 00 04 20 10                 .<..@.... .

Code:
Section 43     Length 91 bytes

Addr  00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0000  00 78 00 00 00 32 00 00 00 40 1F 90 01 05 20 4E  .x...2...@.... N
0010  D0 07 B4 00 0F 00 50 00 F4 01 F4 01 E8 03 00 01  ......P.........
                                                ^^
0020  00 C8 00 00 00 40 00 00 00 00 00 64 00 00 00 00  .....@.....d....
0030  08 08 08 08 00 00 00 08 10 0A 50 00 E8 03 00 00  ..........P.....
0040  1E 00 00 00 FF FF FF FF A0 0F A0 0F 00 00 1E 00  ................
0050  06 00 32 00 00 00 02 00 00 02 3C                 ..2.......<

WD's warranty checker identifies these drives as "Sagem Orange".



that means if i will replace this Section with one without those identifications, recalc checksum and write back, its posible to be resolved the problem ? i will check it today

_________________
https://t.me/pump_upp


Top
 Profile  
 
 Post subject: Re: WDC WD5000LUCT-62MPJY0
PostPosted: January 19th, 2022, 12:57 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15440
Location: Australia
These PVR HDDs appear to be firmware locked in some way.

Module 02 consists of several sections containing model number, serial number, firmware version, capacity, password, etc. At the beginning of the module is a table which identifies the location and size of each section. This particular PVR firmware obfuscates the table so that it points to the wrong locations. I would think that this "doctored" firmware would know how to decode these sections correctly. If we now "fix" module 02 when the drive expects it to be obfuscated, I don't know how the firmware will behave.

How are you accessing the SA now? Are you using a loader? Are you using a different PCB and ROM?

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: WDC WD5000LUCT-62MPJY0
PostPosted: January 19th, 2022, 15:41 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15440
Location: Australia
To "repair" module 02, go to offset 0x200 and delete 6 bytes. Then go to offset 0x400 and delete another 6 bytes, followed by offset 0x600 and delete 6, and so on until the end. Then pad the last sector with zeros. After doing this, the checksum is correct.


Attachments:
027SX not detected LSI_edited.7z [1.46 KiB]
Downloaded 241 times

_________________
A backup a day keeps DR away.
Top
 Profile  
 
 Post subject: Re: WDC WD5000LUCT-62MPJY0
PostPosted: January 20th, 2022, 2:42 
Offline

Banned User

Joined: March 16th, 2015, 3:37
Posts: 46
fzabkar wrote:
These PVR HDDs appear to be firmware locked in some way.

Module 02 consists of several sections containing model number, serial number, firmware version, capacity, password, etc. At the beginning of the module is a table which identifies the location and size of each section. This particular PVR firmware obfuscates the table so that it points to the wrong locations. I would think that this "doctored" firmware would know how to decode these sections correctly. If we now "fix" module 02 when the drive expects it to be obfuscated, I don't know how the firmware will behave.

How are you accessing the SA now? Are you using a loader? Are you using a different PCB and ROM?


The drive works perfectly fine after unlock techno mode access, no need any ldr, ROM or PCB,
only issue its that detection on other system than IDE Mode from Bios or USB 2.0 interface adapter

_________________
https://t.me/pump_upp


Top
 Profile  
 
 Post subject: Re: WDC WD5000LUCT-62MPJY0
PostPosted: January 20th, 2022, 13:47 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15440
Location: Australia
Maybe you could write the "repaired" 02 module (027SX) to the SA?

Could you upload the ROM and SA resource dumps? Did you test the checksums of the other SA modules?

Does this model have backups of module 02 in module 0x802E or 0x802F or somewhere else?

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: WDC WD5000LUCT-62MPJY0
PostPosted: January 20th, 2022, 15:17 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15440
Location: Australia
I have also "repaired" the 02N31 module. This time the algorithm is slightly different.

Go to offset 0x200 and delete 4 bytes.

Go to offset 0x400 and delete 6 bytes.

Go to offset 0x600 and delete 6 bytes.

Go to offset 0x800 and delete 6 bytes.

Go to offset 0xA00 and delete 6 bytes.

Pad the last sector with 0x00.

The checksum is then correct (0x00000000).


Attachments:
02N31 detected LSI_edited.7z [1.44 KiB]
Downloaded 229 times

_________________
A backup a day keeps DR away.
Top
 Profile  
 
 Post subject: Re: WDC WD5000LUCT-62MPJY0
PostPosted: January 25th, 2022, 2:56 
Offline

Banned User

Joined: March 16th, 2015, 3:37
Posts: 46
fzabkar wrote:
Maybe you could write the "repaired" 02 module (027SX) to the SA?

Could you upload the ROM and SA resource dumps? Did you test the checksums of the other SA modules?

Does this model have backups of module 02 in module 0x802E or 0x802F or somewhere else?




Sorry for late reply, you have attached one full backup from one WD5000LUCT , same kind of the issue explained before

about backup of 02, i dont find it in 0x802E or F


Attachments:
Copy 1.rar [14.03 MiB]
Downloaded 220 times
Copy 0.rar [14.02 MiB]
Downloaded 224 times
WDC ROM - WD5000LUCT-62MPJY0-03-01A03-WD-WX41A770ER FR.rar [247.74 KiB]
Downloaded 229 times

_________________
https://t.me/pump_upp
Top
 Profile  
 
 Post subject: Re: WDC WD5000LUCT-62MPJY0
PostPosted: January 25th, 2022, 17:12 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15440
Location: Australia
Module 02 in your latest resource dump is normal, ie no obfuscation. :-?

From WD's warranty page ...

    WD5000LUCT-62MPJY0
    HUBLT2
    5400
    16M
    SATA II
    3.0GB/S
    500.0 GB
    2HD
    SAGEM Orange


Attachments:
02_bin_dump.7z [2.67 KiB]
Downloaded 224 times

_________________
A backup a day keeps DR away.
Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 14 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 20 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group