SAP damage

[shahij]

Hello

I have the ROM with damage SAP, can anyone figure out where is the problem?

Thank you in advance

Attachments

ROM_ZN155V07_547DCC76.7z

(306.97 KiB) Downloaded 16 times

[fzabkar]

Someone filled the SAP with 0xFF. Fortunately, there is a full copy of the SAP in the extra space at the end of the ROM. You just need to carve it out and paste it.

[SWM]

"You just need to carve it out and paste it."

Attachments

New_ROM_ZN155V07_547DCC76.zip

(344.31 KiB) Downloaded 12 times

[SWM]

A smart person told me in a private message that it's not just the SAP that's stuck there. So, it's easier to transfer the adaptive settings to the ROM from the same FW. Or try restoring from a second copy.

[fzabkar]

The first copy of the BOOTFW has a bad CRC. The fault appears to be in the compressed CPRS section. If it's a single-bit error, I should be able to find it. If it's a man-made problem, then who knows.

Edit: "File has multiple bit errors."

Edit #2: I just confirmed that the corruption is another man-made problem.

[fzabkar]

This is the point where 00000758_DL_BOOTFW is corrupted:

Code:

Offset(h) 00       04       08       0C

0000F870  8600018E ED107D3C 28F80EC3 C8E2EFFA  †..Ží.}<(ø.ÃÈâïú
0000F880  78A4872D DBC7234E AD557ED7 C7233BF3  x¤‡-ÛÇ#N.U~×Ç#;ó
0000F890  E6E9C823 6743DA09 0125D197 57F4DA16  æéÈ#gCÚ..%Ñ—WôÚ.
0000F8A0  BC3EE9CD 32AB60CE 10554453 FC5FFB09  ¼>éÍ2«`Î.UDSü_û.
0000F8B0  EA512BEE FFFFFFDF 0C524C45 D8550100  êQ+îÿÿÿß.RLEØU..
0000F8C0  E47F0100 0A005354 58A9D855 0500AB02  ä.....STX©ØU..«.
0000F8D0  00030F00 0200007F 2C298C42 17DD0E40  ........,)ŒB.Ý.@
0000F8E0  08007E00 00050300 01000200 00040100  ..~.............
0000F8F0  08000003 01000900 00030800 EA512BEE  ............êQ+î
0000F900  00040002 00040100 E8000005 05009406  ........è.....”.
0000F910  53543100 30030500 444D3031 30002005  ST1.0...DM010. .
0000F920  2F003132 30333131 32304343 34334234  /.12031120CC43B4
0000F930  32333230 31355A4E 31352556 30375000  232015ZN15%V07P.
0000F940  C500B587 3023892C 298C4217 DD0E0100  Å.µ‡0#‰,)ŒB.Ý...
0000F950  04000005 0F055700 22120012 03201512  ......W.".... ..

It looks like the UDSBFW segment has overwritten the tail end of 00000758_DL_BOOTFW. I'm not sure that this is man-made.

[SWM]

ROM_Z9AGE_withAdapt_ZN155V07_CC43:

Attachments

ROM_Z9AGE_withAdapt_ZN155V07_CC43.zip

(414.09 KiB) Downloaded 13 times

[fzabkar]

Here is very similar case of ROM corruption (0x72, Kahuna_5400):

https://groups.google.com/g/datarecoverycertification/c/1w8qC5TbcBM/m/Tph2dMGcAAAJ

As in the present case, the UDSBFW data have overwritten the SAP and RAP segments. It appears that the firmware has written nonvolatile cached data (NvC) to the wrong place in the ROM during a power loss event. That looks like a serious firmware bug. In that other case you can see NTFS metadata ("FILE0") in the adaptive segments.

[shahij]

ROM_Z9AGE_withAdapt_ZN155V07_CC43:

Thank you,

This is the point where 00000758_DL_BOOTFW is corrupted:

Code:

Offset(h) 00       04       08       0C

0000F870  8600018E ED107D3C 28F80EC3 C8E2EFFA  †..Ží.}<(ø.ÃÈâïú
0000F880  78A4872D DBC7234E AD557ED7 C7233BF3  x¤‡-ÛÇ#N.U~×Ç#;ó
0000F890  E6E9C823 6743DA09 0125D197 57F4DA16  æéÈ#gCÚ..%Ñ—WôÚ.
0000F8A0  BC3EE9CD 32AB60CE 10554453 FC5FFB09  ¼>éÍ2«`Î.UDSü_û.
0000F8B0  EA512BEE FFFFFFDF 0C524C45 D8550100  êQ+îÿÿÿß.RLEØU..
0000F8C0  E47F0100 0A005354 58A9D855 0500AB02  ä.....STX©ØU..«.
0000F8D0  00030F00 0200007F 2C298C42 17DD0E40  ........,)ŒB.Ý.@
0000F8E0  08007E00 00050300 01000200 00040100  ..~.............
0000F8F0  08000003 01000900 00030800 EA512BEE  ............êQ+î
0000F900  00040002 00040100 E8000005 05009406  ........è.....”.
0000F910  53543100 30030500 444D3031 30002005  ST1.0...DM010. .
0000F920  2F003132 30333131 32304343 34334234  /.12031120CC43B4
0000F930  32333230 31355A4E 31352556 30375000  232015ZN15%V07P.
0000F940  C500B587 3023892C 298C4217 DD0E0100  Å.µ‡0#‰,)ŒB.Ý...
0000F950  04000005 0F055700 22120012 03201512  ......W.".... ..

It looks like the UDSBFW segment has overwritten the tail end of 00000758_DL_BOOTFW. I'm not sure that this is man-made.

it worked

It is not man made. The drive is of my one friend and confirmed the drive stopped working suddenly

could be power stability issue?

[fzabkar]

To me, it looks like a firmware bug, so technically speaking it is man made. I think the drive suffered a power loss and then attempted to save the SDRAM data to the NvCache in the ROM. However, the data was written to the wrong offset, thereby corrupting the ROM. Your drive is a 3.5" SMR Barracuda whereas that other one was a 2.5" hybrid model. This suggests that there is some bug in Seagate's power loss data protection code that potentially affects a large number of families/models.