HDD GURU FORUMS
http://forum.hddguru.com/

MCB4E60G5MXP-0VBH3 shorting point for safe mode
http://forum.hddguru.com/viewtopic.php?f=10&t=41720
Page 1 of 1

Author:  melvin [ September 21st, 2021, 11:37 ]
Post subject:  MCB4E60G5MXP-0VBH3 shorting point for safe mode

Hello,
Got a Samsung MCB4E60G5MXP-0VBH3 with S3C29RBB01-YK40 controller.
It does get full ID but no sector access. As those controllers are supported via PC3000 wanted to try it. But this PCB is different than those in utility. ACELab has no expirience with such PCB's. So maybe here i'll find someone that had it. I've tested all the easily visible points.

Attachments:
DSCN4860.JPG
DSCN4860.JPG [ 7.28 MiB | Viewed 11485 times ]
DSCN4859.JPG
DSCN4859.JPG [ 7.21 MiB | Viewed 11485 times ]

Author:  fzabkar [ September 21st, 2021, 15:35 ]
Post subject:  Re: MCB4E60G5MXP-0VBH3 shorting point for safe mode

What about shorting a NAND Ready/Busy pin to ground?

Author:  melvin [ September 21st, 2021, 16:08 ]
Post subject:  Re: MCB4E60G5MXP-0VBH3 shorting point for safe mode

This one keeps the drive in BSY only.

Author:  fzabkar [ September 21st, 2021, 17:24 ]
Post subject:  Re: MCB4E60G5MXP-0VBH3 shorting point for safe mode

Would it be safe to assume that entry into safe mode requires that a particular test point is shorted to ground? If so, then measure the voltages at all the likely candidates. They should be sitting near the Vio supply rail, most likely via an internal or external pullup resistor. Once you have identified the possible locations, measure their resistance to Vio -- it should not be 0 ohms.

You can identify the Vcore and Vio voltages by measuring the bypass capacitors under and around the controller.

Author:  fzabkar [ September 21st, 2021, 17:49 ]
Post subject:  Re: MCB4E60G5MXP-0VBH3 shorting point for safe mode

Code:
                            VCore
                             +
                             |
               .-------------|--------------.
               |             |              |
        Vio    |             |              |
         +     |  I/O        |              |
         |     |             |              |
         +-----|        .----'-----.        |
         |     |        |          |        |
        .-.    |        |          |        |
        | |    |        |          |        |
      R | |    |        |          |        |
        '-'    |        |   core   |        |
  pullup |     |        |          |        |
         |     |        |          |        |
         |     |        |          |        |
         +-----| GPIO   '----------'        |
         |     |                            |
         o     |                            |
   Safe        |         controller         |
   Mode  o     |                            |
         |     '----------------------------'
        ===
        GND

Author:  melvin [ September 22nd, 2021, 3:59 ]
Post subject:  Re: MCB4E60G5MXP-0VBH3 shorting point for safe mode

Found something that seem to give safe mode when shorted for 2 seconds. But it gives another problem with translator. Also there's info that drive is password locked.

Code:
Loader uploading
****************************************
   Code name............................... : PM800.ldr
   
   Power Off
   Power On
   Ready state waiting..................... : Ok
   Safe mode............................... : Ok
   Write HDD microcode
   Write Initialization Firmware........... : Ok
   
   Write HDD microcode
   Write Main Firmware..................... : Ok
   
   SSD status:
   SSD is in ready state................... : Yes
   SSD is locked........................... : No
   SSD is in Safe Mode..................... : No
   Loader uploaded......................... : Yes
   Logical access is possible.............. : No
   Physical access is possible............. : Possibly
****************************************

USER password........................... : Set
USER password........................... : [Encrypted (SEC_SHA1)]

Translator initialization
****************************************
   Microchips information uploading........ : Ok
   
   Creating translator
   ****************************************
      Reassingned block tables loading (channel: 0)
   ****************************************
   List index out of bounds (0)
****************************************
Test interrupted


Attachments:
DSCN4860.JPG
DSCN4860.JPG [ 4.09 MiB | Viewed 11309 times ]

Author:  fzabkar [ September 22nd, 2021, 4:12 ]
Post subject:  Re: MCB4E60G5MXP-0VBH3 shorting point for safe mode

Those look like the pads for a capacitor. It seems to me that you shorted a power supply. Why would you just short things randomly?

Author:  melvin [ September 22nd, 2021, 4:54 ]
Post subject:  Re: MCB4E60G5MXP-0VBH3 shorting point for safe mode

I'm probably wrong but this should also give safe mode. And it's on a donor.

Author:  fzabkar [ September 22nd, 2021, 14:55 ]
Post subject:  Re: MCB4E60G5MXP-0VBH3 shorting point for safe mode

Do you measure 3.3V between those pads? If so, they could be the NAND power supply, in which case the controller may go into safe mode because it doesn't find any NAND chips. In any case there should be a proper way to do this, eg by disabling the appropriate DC-DC converter.

Author:  melvin [ September 22nd, 2021, 15:19 ]
Post subject:  Re: MCB4E60G5MXP-0VBH3 shorting point for safe mode

Yes, those are from NAND power supply. Strange that PC3000 didn't show this but i found that:
SD SECURITY SUBSYSTEM
-----------------------------------------------------------------------------
MASTER password......................... : [Encrypted (SEC_SHA1)]
USER password........................... : [Encrypted (SEC_SHA1)]
Master Code............................. : FFFF
USER password is set.................... : Yes
Security level.......................... : Maximum
-----------------------------------------------------------------------------
And if it's security level is set to max i will not get any sector access.

Waiting for an answer from the owner as he wrote that there was no password.


Didn't find a proper way yet. Your scheme is understood but hard to find on the PCB.

Author:  fzabkar [ September 22nd, 2021, 15:48 ]
Post subject:  Re: MCB4E60G5MXP-0VBH3 shorting point for safe mode

After starting the drive in the usual way, can you access the SMART data? If so, then that would suggest that the drive is simply password protected, not stuck in some damaged state.

Measure the voltages at the JTAG pads. That should tell you the Vio voltage. Then find all the possible safe mode candidates by looking for this same voltage.

Author:  melvin [ September 22nd, 2021, 16:13 ]
Post subject:  Re: MCB4E60G5MXP-0VBH3 shorting point for safe mode

No, SMART cannot be read.

Author:  fzabkar [ September 22nd, 2021, 16:32 ]
Post subject:  Re: MCB4E60G5MXP-0VBH3 shorting point for safe mode

I just discovered that CAP-XX, the manufacturer of the supercapacitors, is an Australian company. I didn't think we manufactured anything in this country anymore.

https://www.cap-xx.com/products/prismatic-overview/cap-xx-prismatic-product-guide/
https://www.cap-xx.com/wp-content/uploads/datasheets/CAP-XX-HS108-HS208-Datasheet.pdf

Author:  fzabkar [ September 25th, 2021, 3:45 ]
Post subject:  Re: MCB4E60G5MXP-0VBH3 shorting point for safe mode

I've written up my proposed method for locating safe mode test points. It appears to work for a Samsung 840 Evo SSD.

How to locate the "safe mode" or "ROM mode" shorting points on an SSD:
http://www.hddoracle.com/viewtopic.php?f=106&t=3088

Can you measure the voltages at the round pads? Can you also determine which of these is connected to ground?

Author:  melvin [ September 25th, 2021, 6:03 ]
Post subject:  Re: MCB4E60G5MXP-0VBH3 shorting point for safe mode

Great one. Sadly client took the drives.

Page 1 of 1 All times are UTC - 5 hours [ DST ]
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
http://www.phpbb.com/