Switch to full style
In-depth technology research: finding new ways to recover data, accessing firmware, writing programs, reading bits off the platter, recovering data from dust.

Forum rules

Please do not post questions about data recovery cases here (use this forum instead). This forum is for topics on finding new ways to recover data. Accessing firmware, writing programs, reading bits off the platter, recovering data from dust...
Post a reply

Seagate boot ROM dump

June 2nd, 2019, 10:15

A few years back I used some python code to dump the bootloader ROM from a seagate F3 drive using the AP and RD commands within the bootloader

It was referenced in a slide presentation by Jonas Zaddach (starting on slide 18) and written by Travis Goodspeed
http://s3.eurecom.fr/~zaddach/docs/Recon14_HDD.pdf

I can't find this script.
Can anyone help ?

Re: Seagate boot ROM dump

June 2nd, 2019, 22:39

If you can't find the Python code, it shouldn't be too difficult to write a ZOC script to do this. You could modify the ZOC script I wrote for dumping WD's bootloader.

AIUI, the command sequence is …

    AP 0<CR>
    RD<CR>
    RD<CR>
    RD<CR>
    etc

Re: Seagate boot ROM dump

June 3rd, 2019, 7:02

fzabkar,
AP 0<CR>
-bootloader here. BootROM sits at 0x100000.)))
skeeter, What version BootROM you need? I've some dumps.

Re: Seagate boot ROM dump

June 3rd, 2019, 7:37

E123 wrote:fzabkar,
AP 0<CR>
-bootloader here. BootROM sits at 0x100000.)))

I found this after I posted:

http://s3.eurecom.fr/~zaddach/docs/POC13_zaddach.pdf

Code:
Memory Range             Type

0x00000000 – 0x00008000  Code SRAM
0x00100000 – 0x00120000  ROM
0x00200000 – 0x00400000  Code DRAM
0x04000000 – 0x04004000  Data SRAM
0x40000000 – 0x50000000  IO
0x60000000 – 0x70000000  Data DRAM

Re: Seagate boot ROM dump

June 3rd, 2019, 18:47

If you would like to play with WD instead, here is the boot loader from a WD20EADS (uploaded via a ZOC script):

FFFF0000-FFFF2AFF.rar
(7.89 KiB) Downloaded 170 times


@Severence and I have been able to decompress WD's ROM code (@Severence has compiled a Windows version of LZHUF for this purpose). My ROM parsing tool extracts the various code segments.

Seagate's ROM segments are compressed with a different algorithm ("CPRS").

Re: Seagate boot ROM dump

June 6th, 2019, 13:59

Thanks for all the ideas, but I want to stick with seagate because it will make it much easier later when I get to the actual firmware code (having messages and diagnostics in text throughout....)

The version I have is:

SEA-3 Yeti Boot ROM 2.0 (12/06/2007)
Copyright Seagate 2007

Re: Seagate boot ROM dump

June 6th, 2019, 14:25

skeeter, https://yadi.sk/d/qMVdXFEuy4zUtg
Post a reply