View topic - corrupted ROM

Main » Forums home » Conventional hard drives

All times are UTC - 5 hours [ DST ]

corrupted ROM

Page 1 of 1

[ 10 posts ]

Previous topic | Next topic

Author

Message

HeavyDrinkDrive

Post subject: corrupted ROM

Posted: November 2nd, 2022, 5:20

Joined: November 1st, 2022, 12:59
Posts: 12
Location: France

Hi Everyone,

I have a WD drive (WD10SPSZ-24Z10T1) to recover after what seems to be an overvoltage or shortcircuit on the motherboard...

I've found the HDD not spinning. replacing the PCB with another one made the drive turn and windows recognized it uninitialiazed.

I've tied to dump the ROM from the orginal PCB into the new PCB but then the HDD didn't want to spin anymore...

As far as I went through i realized that the F/W version was different on the 2 drives but i also think that their is a chance for the datas in the original ROM was corrupted because i was able to read it only once and after it doesn't worked anymore...

I have looked in both BIN files and realized that their was a "missing part" in the original ROM (perhaps a reading issue...)...

I am quite new in this kind of troubleshooting and I can't really find a clue on my case, i am a bit afraid of going further without any advices.

Do you guys think i can recover my datas with a ROM coming from a drive with another F/W version ? Or maybe i is posssible to fix the original ROM file by filling the "missing part" ?

Attachments:

File comment: the two bin files extracted from the ROMs

ROMs.rar [1.24 MiB]
Downloaded 122 times

Top

fzabkar

Post subject: Re: corrupted ROM

Posted: November 2nd, 2022, 16:01

Joined: September 8th, 2009, 18:21
Posts: 15525
Location: Australia

This is my WD ROM analysis tool:

http://users.on.net/~fzabkar/FreeBasic_W32/WD/wdROMv17.bas
http://users.on.net/~fzabkar/FreeBasic_W32/WD/wdROMv17.exe

Code:

Analysing damaged drive FW version 05,01A05.bin ...

Searching for LDSCs and verifying PCMBlocks ...

LDSC   LDSC    Att   PCMBlock          RAM         size      PCMBlk CS
Start  ID CS        Start -  End     address     RAM / ROM    Exp/Act
-----  -- --   --   -----   -----   --------   ------ -----  ---------
    0  5A ED   04      20 -  1B47       1000     1B24  1B24  467D8B41 000B23BD BAD (not digitally signed)
                                                             000AA428 000AA693 BAD (digitally signed)
 2000  01 49   04    2180 -  4AA0      49688     2820  2820    EC   3C   BAD
 2020  02 58   11    4AA1 -  8B6D   30080000 c   5600  40CC    E4   57   BAD
 2040  03 CE   0C    8B6E -  8F62   24000000      3F4   3F4    D8   D8   OK
 2060  04 29   40    8F63 -  E33F   FFE00200     53DC  53DC    12   80   BAD
 2080  05 1C   01    E340 -  EE4C   38265E00 c    D48   B0C    46   AA   BAD
 20A0  06 0D   04    EE4D -  F2ED   38266E00      4A0   4A0    FF   59   BAD
 20C0  07 CB   01    F2EE - 15236          0 c   7968  5F48    66   A2   BAD
 20E0  08 EA   01   15237 - 15657       DF8C c    4EC   420    47   47   OK
 2100  09 13   03   15658 - 17CFC      40340 c   3198  26A4    B9   55   BAD
 2120  0A C2   03   17CFD - 180D9   60267E00 c    9BC   3DC    30   30   OK
 2140  0B 19   01   180DA - 30582   3834EE00 c  20840 184A8    F2   06   BAD
 2160  0C 1D   01   30583 - 561CB   38008230 c  33460 25C48    99   0C   BAD
82040  03 66   0C   88B06 - 88EFA   24000000      3F4   3F4    D8   51   BAD
82060  04 4A   40   88EFB - 8E31B   FFE00200     5420  5420    B0   3E   BAD
820C0  07 3F   01   8F2CA - 95242          0 c   79A0  5F78    46   00   BAD
820E0  08 BA   01   95243 - 95663       DF50 c    4EC   420    BF   29   BAD
82140  0B 83   01   980E2 - B05FA   3834EE00 c  208C0 18518    92   6F   BAD
82160  0C 99   01   B05FB - D6263   38008230 c  33424 25C68    7F   43   BAD

LDSC   = PM Loader Config String (32 bytes)
ID     = ID byte of LDSC (byte #0)
CS     = Checksum byte or word
Att    = Attributes
PCMBlk = Program Code Memory Block
Exp    = Expected checksum for PCMBLock
Act    = Actual checksum for PCMBLock
c      = compressed PCMBlock
size   = size of decompressed (in RAM) and compressed (in ROM) PCMBlock in bytes

No ROYL directory modules (0x0B or 0x20B) found in ROM

Code:

Analysing donor drive FW version 04,01A04.BIN ...

Searching for LDSCs and verifying PCMBlocks ...

LDSC   LDSC    Att   PCMBlock          RAM         size      PCMBlk CS
Start  ID CS        Start -  End     address     RAM / ROM    Exp/Act
-----  -- --   --   -----   -----   --------   ------ -----  ---------
    0  5A ED   04      20 -  1B47       1000     1B24  1B24  000AA37C 000AA37C OK (digitally signed)
 2000  01 49   04    2180 -  4AA0      49688     2820  2820    3A   3A   OK
 2020  02 9B   11    4AA1 -  8B31   30080000 c   55BC  4090    4F   4F   OK
 2040  03 92   0C    8B32 -  8F26   24000000      3F4   3F4    D8   D8   OK
 2060  04 ED   40    8F27 -  E303   FFE00200     53DC  53DC    12   12   OK
 2080  05 E0   01    E304 -  EE10   38265E00 c    D48   B0C    B7   B7   OK
 20A0  06 D1   04    EE11 -  F2B1   38266E00      4A0   4A0    79   79   OK
 20C0  07 4F   01    F2B2 - 15232          0 c   79B8  5F80    2C   2C   OK
 20E0  08 BA   01   15233 - 15653       DF60 c    4EC   420    C5   C5   OK
 2100  09 DB   03   15654 - 17CE8      40340 c   3184  2694    F4   F4   OK
 2120  0A AE   03   17CE9 - 180C5   60267E00 c    9BC   3DC    2A   2A   OK
 2140  0B 0E   01   180C6 - 3035A   3834EE00 c  20578 18294    B6   B6   OK
 2160  0C B0   01   3035B - 55F4B   38008230 c  333D0 25BF0    88   88   OK
82000  01 49   04   82180 - 84AA0      49688     2820  2820    EC   EC   OK
82020  02 58   11   84AA1 - 88B6D   30080000 c   5600  40CC    E4   E4   OK
82040  03 CE   0C   88B6E - 88F62   24000000      3F4   3F4    D8   D8   OK
82060  04 29   40   88F63 - 8E33F   FFE00200     53DC  53DC    12   12   OK
82080  05 1C   01   8E340 - 8EE4C   38265E00 c    D48   B0C    46   46   OK
820A0  06 0D   04   8EE4D - 8F2ED   38266E00      4A0   4A0    79   79   OK
820C0  07 CB   01   8F2EE - 95236          0 c   7968  5F48    66   66   OK
820E0  08 EA   01   95237 - 95657       DF8C c    4EC   420    47   47   OK
82100  09 13   03   95658 - 97CFC      40340 c   3198  26A4    B9   B9   OK
82120  0A C2   03   97CFD - 980D9   60267E00 c    9BC   3DC    30   30   OK
82140  0B 19   01   980DA - B0582   3834EE00 c  20840 184A8    F2   F2   OK
82160  0C 1D   01   B0583 - D61CB   38008230 c  33460 25C48    99   99   OK

LDSC   = PM Loader Config String (32 bytes)
ID     = ID byte of LDSC (byte #0)
CS     = Checksum byte or word
Att    = Attributes
PCMBlk = Program Code Memory Block
Exp    = Expected checksum for PCMBLock
Act    = Actual checksum for PCMBLock
c      = compressed PCMBlock
size   = size of decompressed (in RAM) and compressed (in ROM) PCMBlock in bytes


ROYL directory module 0x000B found at 0x7F39A

Active directory flag = 0x03

Identifying SA regions ...

Reg#    Reg size     Reg loc
----  ----------  ----------
0x00  0x000E95F0  0x00000000
0x01  0x000E95F0  0x000EEBA8

Verifying ROYL modules ...

 ID          Size (bytes)         Address    Checksum
 dir   hdr        dir       hdr
----  ----   --------  --------   --------   --------
0001  N/A    00004000  N/A        00000000             N/A
000A  OK     0000004E  00000200   0007E000   00000000  OK
000B  OK     0000013D  00000200   0007F39A   00000000  OK
020B  OK     0000013D  00000200   0007D39A   00000000  OK
0030  OK     00000400  OK         000FE000   00000000  OK
0047  OK     00000600  OK         0007E556   00000000  OK
000D  OK     00000108  00000200   0007E04E   00000000  OK
004F  OK     00000400  OK         0007E156   00000000  OK
0181  OK     00000C00  OK         000FE400   00000000  OK
01A2  OK     0000007E  00000200   0007EB56   00000000  OK
01B6  OK     0000069E  00000800   0007EBD4   00000000  OK
01B0  OK     00000128  00000200   0007F272   00000000  OK

ROYL directory module 0x020B found at 0x7D39A

Active directory flag = 0x02

Identifying SA regions ...

Reg#    Reg size     Reg loc
----  ----------  ----------
0x00  0x000E95F0  0x00000000
0x01  0x000E95F0  0x000EEBA8

Verifying ROYL modules ...

 ID          Size (bytes)         Address    Checksum
 dir   hdr        dir       hdr
----  ----   --------  --------   --------   --------
0001  N/A    00004000  N/A        000E82CD             N/A
000A  OK     0000004E  00000200   0007C000   00000000  OK
000B  OK     0000013D  00000200   0007F39A   00000000  OK
020B  OK     0000013D  00000200   0007D39A   00000000  OK
0181  OK     00000C00  OK         000FE400   00000000  OK
0030  OK     00000400  OK         000FE000   00000000  OK
0047  OK     00000600  OK         0007C556   00000000  OK
000D  OK     00000108  00000200   0007C04E   00000000  OK
004F  OK     00000400  OK         0007C156   00000000  OK
01A2  OK     0000007E  00000200   0007CB56   00000000  OK
01B6  OK     0000069E  00000800   0007CBD4   00000000  OK
01B0  OK     00000128  00000200   0007D272   00000000  OK

dir  -  Module ID/Size as reported in directory module (0x20B or 0x0B)
hdr  -  Module ID/Size as reported in module's header
N/A  -  Not Applicable
BAD  -  Module has invalid checksum. This may be due to non-existent module.

ROM modules saved to Flash_01\000Bmods and Flash_01\020Bmods

Active directory is 0x0B

Analysing active 0x0A module ...

Head map checksum (Expected / Actual) = 0x0000 / 0x0000 - OK
Number of heads (physical / in use) = 2/2
Head map #1 = 0x0003 / 0b0000000000000011
Head map #2 = 0x0003 / 0b0000000000000011

DCM = | R | G Z P B K G S 
      : : : : : : : : : :
      : : : : : : : : : unknown
      : : : : : : : : top VCM
      : : : : : : : ACA
      : : : : : : bottom VCM
      : : : : : HSA
      : : : : media
      : : : preamp
      : : latch
      : base
      spindle motor

Analysing active 0x0D module ...

Firmware Version = 04.01A04
World Wide Name = 50014EE2BB876E5B
Model Number = WDC WD10SPZX-24Z10                      
Serial Number =                     


Analysing active 0x4F module ...

ROM version = 00050066

Analysing active 0x47 module ...

Preamp values
-----------
0  01320573
1  012A037E

Microjogs
-------
0  0000
1  0000

Head/Media DCM = PZ

_________________
A backup a day keeps DR away.

Top

fzabkar

Post subject: Re: corrupted ROM

Posted: November 2nd, 2022, 16:04

Joined: September 8th, 2009, 18:21
Posts: 15525
Location: Australia

Are you trying to read your ROM with a 3.3V programmer?

_________________
A backup a day keeps DR away.

Top

HeavyDrinkDrive

Post subject: Re: corrupted ROM

Posted: November 2nd, 2022, 16:54

Joined: November 1st, 2022, 12:59
Posts: 12
Location: France

Hello fzabkar,

As far as i can see (and understand) the original ROM file is bad.

I've tried both with 1.8V and 3.3V on two different readers I can't remember on wich case i achieved to read it... i also tried to solder it on a pcb instead of using a clamp to avoid bad contacts...

to answer your question in my other thread wich was a false issue, my PCB is 2060-800066 which is "MCU locked".

As I understand i need to be able to recover the datas frome the original ROM in order to get my HDD back to life, right ? In this case i don't believe it will be a success I wll try one more time to read this chip with the slowest baudrate i can do.

Is their anyway to "clone" the raw datas on the drive and trying to rebuild files from this ?

Top

fzabkar

Post subject: Re: corrupted ROM

Posted: November 2nd, 2022, 17:59

Joined: September 8th, 2009, 18:21
Posts: 15525
Location: Australia

If you use a hex editor (eg HxD freeware) to compare offsets 0x2000+ against offsets 0x82000+, you will find that, whenever the second half of the ROM differs from the first half, the bits in the second half have gone high. This means that your reader is performing worse the longer it runs. Unfortunately all the adaptive sections (ROYL header) are in the second half of the ROM, and they all appear to be bad.

Please refrain from trying to read a 1.8V ROM with a 3.3V reader, if that is indeed what is happening.

I suggest you obtain a multimeter (~US$5). Also, show us a photo of the PCB.

TVS Diode FAQ:
http://www.hddoracle.com/viewtopic.php?f=100&t=86

_________________
A backup a day keeps DR away.

Top

HeavyDrinkDrive

Post subject: Re: corrupted ROM

Posted: November 3rd, 2022, 4:40

Joined: November 1st, 2022, 12:59
Posts: 12
Location: France

Hi,

I've already performed the basic electrical tests on the PCB and it appears to be good.

I am not testing the original board as the drive failed after what seems to be a power failure on the PCB motherboard (the computer was off and i discover the audio codec hot as hell and as i opened the case it started to burn...) and also while desoldering the ROM chip my hot air flow was a bit to strong and the tiniest IC on the board decided to fly out, it must be a decoupling capacitor but as i dont't have the schematic i prefer to use a new PCB

I do use 3.3V sometimes instead of 1.8V in a "last chance" try for chips that might need a "little punch" to start working. I know this is not a good practice but in some cases i was able to get what i need.

Attached, a picture of the new PCB with it's original ROM.

Attachments:

314380725_660885239105504_8517262555633257133_n.jpg [ 350.29 KiB | Viewed 3723 times ]

Top

TakeTwo

Post subject: Re: corrupted ROM

Posted: November 3rd, 2022, 6:02

Joined: September 27th, 2022, 7:09
Posts: 10
Location: Europe

Quote:

I do use 3.3V sometimes instead of 1.8V in a "last chance" try for chips that might need a "little punch" to start working. I know this is not a good practice but in some cases i was able to get what i need.

This is not only not good practice but can easily fry the chip (Been there, done that). If you are doing this more often consider buying a programmer with adjustable voltage. So you can increase it in small steps beyond what is allowed officially. This can still fry the chip but the chance is lower than using 3.3V for a 1.8V chip.
Also try to first read the chip without desoldering, iirc this also works better with a better programmer.

Top

HeavyDrinkDrive

Post subject: Re: corrupted ROM

Posted: November 4th, 2022, 6:28

Joined: November 1st, 2022, 12:59
Posts: 12
Location: France

Hi,

I only tied with 3.3V as i wasn't able to get any good extract from the chip...

After some trials I realized that the issue was in fact the programmer itself, I've flashed another ROM on a second programmer then try to read it with my first programmer but it didn't worked, worst of all when i tried to read the datas with my second programmer they were bad...

So I guess that I've messed up my ROM at the very first time I tried to read it with my crappy programmer...

Top

fzabkar

Post subject: Re: corrupted ROM

Posted: November 4th, 2022, 15:47

Joined: September 8th, 2009, 18:21
Posts: 15525
Location: Australia

Try to read the unique "adaptive" components of the ROM instead of the entire ROM.

These are the ROYL modules:

Code:

Address    Size (bytes)
--------   ------------
0007C000   0000004E
0007C556   00000600  
0007C04E   00000108  
0007C156   00000400  
0007CB56   0000007E  
0007CBD4   0000069E  
0007D272   00000128  
0007D39A   0000013D  
0007E000   0000004E  
0007E04E   00000108  
0007E156   00000400  
0007E556   00000600  
0007EB56   0000007E  
0007EBD4   0000069E  
0007F39A   0000013D  
000FE000   00000400  
000FE400   00000C00  

Also carve out the range from 0 to 0x1FFF.

These are the critical areas. The rest can be recovered from resource dumps.

Don't discard the original PCB. You will need it.

_________________
A backup a day keeps DR away.

Top

HeavyDrinkDrive

Post subject: Re: corrupted ROM

Posted: November 5th, 2022, 5:34

Joined: November 1st, 2022, 12:59
Posts: 12
Location: France

Hi,

Well... the chip is not giving any sign of life even with slow baudrate and withour any data validation...
I think it is totally burnt...

Top

Page 1 of 1

[ 10 posts ]

Main » Forums home » Conventional hard drives

All times are UTC - 5 hours [ DST ]

Who is online

Users browsing this forum: Google [Bot] and 67 guests

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum