All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 15 posts ] 
Author Message
 Post subject: MCB4E60G5MXP-0VBH3 shorting point for safe mode
PostPosted: September 21st, 2021, 11:37 
Offline
User avatar

Joined: September 16th, 2015, 9:06
Posts: 258
Location: Poland
Hello,
Got a Samsung MCB4E60G5MXP-0VBH3 with S3C29RBB01-YK40 controller.
It does get full ID but no sector access. As those controllers are supported via PC3000 wanted to try it. But this PCB is different than those in utility. ACELab has no expirience with such PCB's. So maybe here i'll find someone that had it. I've tested all the easily visible points.


Attachments:
DSCN4860.JPG
DSCN4860.JPG [ 7.28 MiB | Viewed 11483 times ]
DSCN4859.JPG
DSCN4859.JPG [ 7.21 MiB | Viewed 11483 times ]

_________________
odzyskiwanie danych
Top
 Profile  
 
 Post subject: Re: MCB4E60G5MXP-0VBH3 shorting point for safe mode
PostPosted: September 21st, 2021, 15:35 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15463
Location: Australia
What about shorting a NAND Ready/Busy pin to ground?

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: MCB4E60G5MXP-0VBH3 shorting point for safe mode
PostPosted: September 21st, 2021, 16:08 
Offline
User avatar

Joined: September 16th, 2015, 9:06
Posts: 258
Location: Poland
This one keeps the drive in BSY only.

_________________
odzyskiwanie danych


Top
 Profile  
 
 Post subject: Re: MCB4E60G5MXP-0VBH3 shorting point for safe mode
PostPosted: September 21st, 2021, 17:24 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15463
Location: Australia
Would it be safe to assume that entry into safe mode requires that a particular test point is shorted to ground? If so, then measure the voltages at all the likely candidates. They should be sitting near the Vio supply rail, most likely via an internal or external pullup resistor. Once you have identified the possible locations, measure their resistance to Vio -- it should not be 0 ohms.

You can identify the Vcore and Vio voltages by measuring the bypass capacitors under and around the controller.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: MCB4E60G5MXP-0VBH3 shorting point for safe mode
PostPosted: September 21st, 2021, 17:49 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15463
Location: Australia
Code:
                            VCore
                             +
                             |
               .-------------|--------------.
               |             |              |
        Vio    |             |              |
         +     |  I/O        |              |
         |     |             |              |
         +-----|        .----'-----.        |
         |     |        |          |        |
        .-.    |        |          |        |
        | |    |        |          |        |
      R | |    |        |          |        |
        '-'    |        |   core   |        |
  pullup |     |        |          |        |
         |     |        |          |        |
         |     |        |          |        |
         +-----| GPIO   '----------'        |
         |     |                            |
         o     |                            |
   Safe        |         controller         |
   Mode  o     |                            |
         |     '----------------------------'
        ===
        GND

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: MCB4E60G5MXP-0VBH3 shorting point for safe mode
PostPosted: September 22nd, 2021, 3:59 
Offline
User avatar

Joined: September 16th, 2015, 9:06
Posts: 258
Location: Poland
Found something that seem to give safe mode when shorted for 2 seconds. But it gives another problem with translator. Also there's info that drive is password locked.

Code:
Loader uploading
****************************************
   Code name............................... : PM800.ldr
   
   Power Off
   Power On
   Ready state waiting..................... : Ok
   Safe mode............................... : Ok
   Write HDD microcode
   Write Initialization Firmware........... : Ok
   
   Write HDD microcode
   Write Main Firmware..................... : Ok
   
   SSD status:
   SSD is in ready state................... : Yes
   SSD is locked........................... : No
   SSD is in Safe Mode..................... : No
   Loader uploaded......................... : Yes
   Logical access is possible.............. : No
   Physical access is possible............. : Possibly
****************************************

USER password........................... : Set
USER password........................... : [Encrypted (SEC_SHA1)]

Translator initialization
****************************************
   Microchips information uploading........ : Ok
   
   Creating translator
   ****************************************
      Reassingned block tables loading (channel: 0)
   ****************************************
   List index out of bounds (0)
****************************************
Test interrupted


Attachments:
DSCN4860.JPG
DSCN4860.JPG [ 4.09 MiB | Viewed 11307 times ]

_________________
odzyskiwanie danych
Top
 Profile  
 
 Post subject: Re: MCB4E60G5MXP-0VBH3 shorting point for safe mode
PostPosted: September 22nd, 2021, 4:12 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15463
Location: Australia
Those look like the pads for a capacitor. It seems to me that you shorted a power supply. Why would you just short things randomly?

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: MCB4E60G5MXP-0VBH3 shorting point for safe mode
PostPosted: September 22nd, 2021, 4:54 
Offline
User avatar

Joined: September 16th, 2015, 9:06
Posts: 258
Location: Poland
I'm probably wrong but this should also give safe mode. And it's on a donor.

_________________
odzyskiwanie danych


Top
 Profile  
 
 Post subject: Re: MCB4E60G5MXP-0VBH3 shorting point for safe mode
PostPosted: September 22nd, 2021, 14:55 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15463
Location: Australia
Do you measure 3.3V between those pads? If so, they could be the NAND power supply, in which case the controller may go into safe mode because it doesn't find any NAND chips. In any case there should be a proper way to do this, eg by disabling the appropriate DC-DC converter.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: MCB4E60G5MXP-0VBH3 shorting point for safe mode
PostPosted: September 22nd, 2021, 15:19 
Offline
User avatar

Joined: September 16th, 2015, 9:06
Posts: 258
Location: Poland
Yes, those are from NAND power supply. Strange that PC3000 didn't show this but i found that:
SD SECURITY SUBSYSTEM
-----------------------------------------------------------------------------
MASTER password......................... : [Encrypted (SEC_SHA1)]
USER password........................... : [Encrypted (SEC_SHA1)]
Master Code............................. : FFFF
USER password is set.................... : Yes
Security level.......................... : Maximum
-----------------------------------------------------------------------------
And if it's security level is set to max i will not get any sector access.

Waiting for an answer from the owner as he wrote that there was no password.


Didn't find a proper way yet. Your scheme is understood but hard to find on the PCB.

_________________
odzyskiwanie danych


Top
 Profile  
 
 Post subject: Re: MCB4E60G5MXP-0VBH3 shorting point for safe mode
PostPosted: September 22nd, 2021, 15:48 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15463
Location: Australia
After starting the drive in the usual way, can you access the SMART data? If so, then that would suggest that the drive is simply password protected, not stuck in some damaged state.

Measure the voltages at the JTAG pads. That should tell you the Vio voltage. Then find all the possible safe mode candidates by looking for this same voltage.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: MCB4E60G5MXP-0VBH3 shorting point for safe mode
PostPosted: September 22nd, 2021, 16:13 
Offline
User avatar

Joined: September 16th, 2015, 9:06
Posts: 258
Location: Poland
No, SMART cannot be read.

_________________
odzyskiwanie danych


Top
 Profile  
 
 Post subject: Re: MCB4E60G5MXP-0VBH3 shorting point for safe mode
PostPosted: September 22nd, 2021, 16:32 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15463
Location: Australia
I just discovered that CAP-XX, the manufacturer of the supercapacitors, is an Australian company. I didn't think we manufactured anything in this country anymore.

https://www.cap-xx.com/products/prismatic-overview/cap-xx-prismatic-product-guide/
https://www.cap-xx.com/wp-content/uploads/datasheets/CAP-XX-HS108-HS208-Datasheet.pdf

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: MCB4E60G5MXP-0VBH3 shorting point for safe mode
PostPosted: September 25th, 2021, 3:45 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15463
Location: Australia
I've written up my proposed method for locating safe mode test points. It appears to work for a Samsung 840 Evo SSD.

How to locate the "safe mode" or "ROM mode" shorting points on an SSD:
http://www.hddoracle.com/viewtopic.php?f=106&t=3088

Can you measure the voltages at the round pads? Can you also determine which of these is connected to ground?

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: MCB4E60G5MXP-0VBH3 shorting point for safe mode
PostPosted: September 25th, 2021, 6:03 
Offline
User avatar

Joined: September 16th, 2015, 9:06
Posts: 258
Location: Poland
Great one. Sadly client took the drives.

_________________
odzyskiwanie danych


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 15 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 44 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group