MCB4E60G5MXP-0VBH3 shorting point for safe mode

[melvin]

Hello,
Got a Samsung MCB4E60G5MXP-0VBH3 with S3C29RBB01-YK40 controller.
It does get full ID but no sector access. As those controllers are supported via PC3000 wanted to try it. But this PCB is different than those in utility. ACELab has no expirience with such PCB's. So maybe here i'll find someone that had it. I've tested all the easily visible points.

Attachments

[fzabkar]

What about shorting a NAND Ready/Busy pin to ground?

[melvin]

This one keeps the drive in BSY only.

[fzabkar]

Would it be safe to assume that entry into safe mode requires that a particular test point is shorted to ground? If so, then measure the voltages at all the likely candidates. They should be sitting near the Vio supply rail, most likely via an internal or external pullup resistor. Once you have identified the possible locations, measure their resistance to Vio -- it should not be 0 ohms.

You can identify the Vcore and Vio voltages by measuring the bypass capacitors under and around the controller.

[fzabkar]

Code:

                            VCore
                             +
                             |
               .-------------|--------------.
               |             |              |
        Vio    |             |              |
         +     |  I/O        |              |
         |     |             |              |
         +-----|        .----'-----.        |
         |     |        |          |        |
        .-.    |        |          |        |
        | |    |        |          |        |
      R | |    |        |          |        |
        '-'    |        |   core   |        |
  pullup |     |        |          |        |
         |     |        |          |        |
         |     |        |          |        |
         +-----| GPIO   '----------'        |
         |     |                            |
         o     |                            |
   Safe        |         controller         |
   Mode  o     |                            |
         |     '----------------------------'
        ===
        GND

[melvin]

Found something that seem to give safe mode when shorted for 2 seconds. But it gives another problem with translator. Also there's info that drive is password locked.

Code:

Loader uploading
****************************************
   Code name............................... : PM800.ldr
   
   Power Off
   Power On
   Ready state waiting..................... : Ok
   Safe mode............................... : Ok
   Write HDD microcode
   Write Initialization Firmware........... : Ok
   
   Write HDD microcode
   Write Main Firmware..................... : Ok
   
   SSD status:
   SSD is in ready state................... : Yes
   SSD is locked........................... : No
   SSD is in Safe Mode..................... : No
   Loader uploaded......................... : Yes
   Logical access is possible.............. : No
   Physical access is possible............. : Possibly
****************************************

USER password........................... : Set
USER password........................... : [Encrypted (SEC_SHA1)]

Translator initialization
****************************************
   Microchips information uploading........ : Ok
   
   Creating translator
   ****************************************
      Reassingned block tables loading (channel: 0)
   ****************************************
   List index out of bounds (0)
****************************************
Test interrupted

Attachments

[fzabkar]

Those look like the pads for a capacitor. It seems to me that you shorted a power supply. Why would you just short things randomly?

[melvin]

I'm probably wrong but this should also give safe mode. And it's on a donor.

[fzabkar]

Do you measure 3.3V between those pads? If so, they could be the NAND power supply, in which case the controller may go into safe mode because it doesn't find any NAND chips. In any case there should be a proper way to do this, eg by disabling the appropriate DC-DC converter.

[melvin]

Yes, those are from NAND power supply. Strange that PC3000 didn't show this but i found that:
SD SECURITY SUBSYSTEM
-----------------------------------------------------------------------------
MASTER password......................... : [Encrypted (SEC_SHA1)]
USER password........................... : [Encrypted (SEC_SHA1)]
Master Code............................. : FFFF
USER password is set.................... : Yes
Security level.......................... : Maximum
-----------------------------------------------------------------------------
And if it's security level is set to max i will not get any sector access.

Waiting for an answer from the owner as he wrote that there was no password.


Didn't find a proper way yet. Your scheme is understood but hard to find on the PCB.

[fzabkar]

After starting the drive in the usual way, can you access the SMART data? If so, then that would suggest that the drive is simply password protected, not stuck in some damaged state.

Measure the voltages at the JTAG pads. That should tell you the Vio voltage. Then find all the possible safe mode candidates by looking for this same voltage.

[melvin]

No, SMART cannot be read.

[fzabkar]

I just discovered that CAP-XX, the manufacturer of the supercapacitors, is an Australian company. I didn't think we manufactured anything in this country anymore.

https://www.cap-xx.com/products/prismatic-overview/cap-xx-prismatic-product-guide/
https://www.cap-xx.com/wp-content/uploads/datasheets/CAP-XX-HS108-HS208-Datasheet.pdf

[fzabkar]

I've written up my proposed method for locating safe mode test points. It appears to work for a Samsung 840 Evo SSD.

How to locate the "safe mode" or "ROM mode" shorting points on an SSD:
http://www.hddoracle.com/viewtopic.php?f=106&t=3088

Can you measure the voltages at the round pads? Can you also determine which of these is connected to ground?

[melvin]

Great one. Sadly client took the drives.