After reading your thread at the wdmarvel.com forum, ISTM that WD's protections are locking out VSC commands. Nevertheless it appears that Vlad has managed to retrieve a complete resource dump:
http://zalil.ru/34989728/59873b50.5312d ... 085398.rarIIUC, MOD 0D in the ROM is at least partly responsible for the lockout. The suggestion was that you could gain access to the SA by hotswapping the PCB. Vlad and Tomset appear to know of a way to rewrite the ROM in situ but they have declined to tell you how. However, ISTR that you were able to read your ROM using a programmer. If so, then I propose to patch your ROM with an unprotected copy of MOD 0D and you could then write this patched ROM to your PCB. Assuming we then gain access to the SA via the regular VSCs, we could then rewrite MOD 02 with an unprotected backup.
MOD 02 can be extracted from MOD 802F in your resource dump.
Here are the differences between your "blocked" MOD 02 (MOD_02_locarno_blocked.bin) and the backup copy that I carved out of MOD 802F (MOD_02_from_802F.bin):
Serial Number
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
000000C0 00 01 57 44 2D 57 58 32 31 41 43 30 38 35 ..WD-WX21AC085
000000D0 33 39 38 00 00 00 00 00 00 398......
000000C0 00 01 57 44 2D 57 58 32 31 41 43 30 38 35 ..WD-WX21AC085
000000D0 33 39 38 20 20 20 20 20 20 398
Max LBAs
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
000000D0 00 01 10 3F 00 00 00
000000E0 00 AF EA 42 25 AF EA 42 25 AF EA 42 25 00 00 00
000000F0 00
000000D0 00 01 10 3F 00 00 00
000000E0 00 FF FF FF FF FF FF FF FF FF FF FF FF 00 00 00
000000F0 00
Model Number
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
000003B0 00 01 57 44 43 20 57 44 33 32 30 30 42 55 44 ..WDC WD3200BUD
000003C0 54 2D 36 32 44 50 5A 59 30 20 20 20 20 20 20 20 T-62DPZY0
000003D0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
000003E0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
000003F0 20 20 20 00 00
000003B0 00 01 20 20 20 20 20 20 20 20 20 20 20 20 20
000003C0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
000003D0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
000003E0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
000003F0 20 20 20 20 20
DCM (?) and manufacture (?) date
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
000003F0 00 01 53 7C 42 42 4C 7C 50 4E 4D ..S|BBL|PNM
00000400 4C 48 49 43 53 52 4C 56 59 4B 47 55 4A 00 20 20 LHICSRLVYKGUJ.
00000410 20 20 20 20 20 20 20 20 20 20 20 31 32 2D 30 38 12-08
00000420 2D 32 30 31 30 00 00 00 00 00 00 00 00 00 00 00 -2010
00000430 00 00 00 00 00 00 00 00 00 00 00
000003F0 00 01 53 7C 42 42 4C 7C 50 4E 4D ..S|BBL|PNM
00000400 4C 48 49 43 53 52 4C 56 59 4B 47 55 4A 00 20 20 LHICSRLVYKGUJ.
00000410 20 20 20 20 20 20 20 20 20 20 20 31 32 2D 30 39 12-09
00000420 2D 32 30 31 30 00 00 00 00 00 00 00 00 00 00 00 -2010
00000430 00 00 00 00 00 00 00 00 00 00 00
User and master password
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000430 00 01 00 00 00
00000440 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000450 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 57 ...............W
00000460 44 43 57 44 43 57 44 43 57 44 43 57 44 43 57 44 DCWDCWDCWDCWDCWD
00000470 43 57 44 43 57 44 43 57 44 43 57 44 43 57 00 62 CWDCWDCWDCWDCW.b
00000480 09 FE FF 65 00 .þÿe.
00000430 00 01 00 00 00
00000440 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000450 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 57 ...............W
00000460 44 43 57 44 43 57 44 43 57 44 43 57 44 43 57 44 DCWDCWDCWDCWDCWD
00000470 43 57 44 43 57 44 43 57 44 43 57 44 43 57 00 62 CWDCWDCWDCWDCW.b
00000480 09 FE FF 25 00 .þÿ%.
Apart from the obvious differences in the capacity and model number records, there also appears to be a significant difference in byte 0x483, ie 0x65 versus 0x25. Perhaps this is a flag byte of some kind?
Here are your "blocked" MOD 0D (MOD_0D_locarno_blocked_ROM.bin) and the backup copy that I carved out of MOD 109 (MOD_0D_from_109.bin):
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000 52 4F 59 4C 04 00 1E 00 0D 00 01 00 BC 68 9D F3 ROYL........¼h.ó
00000010 30 30 30 31 30 30 30 30 00 00 00 00 00 00 00 01 00010000........
00000020 30 31 2E 30 31 41 30 31 00 00 03 02 00 00 50 01 01.01A01......P.
00000030 4E E2 05 54 2C 18 00 01 FE FF 00 00 00 00 02 00 Nâ.T,...þÿ......
00000040 01 01 00 01 00 00 57 44 43 20 57 44 33 32 30 30 ......WDC WD3200
00000050 42 55 44 54 2D 36 32 44 50 5A 59 30 20 20 20 20 BUDT-62DPZY0
00000060 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
00000070 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
00000080 20 20 00 00 00 00 00 00 32 00 00 00 00 00 00 00 ......2.......
00000000 52 4F 59 4C 04 00 1E 00 0D 00 01 00 CC 0B C3 09 ROYL........Ì.Ã.
00000010 30 30 30 31 30 30 30 30 00 00 00 00 00 00 00 00 00010000........
00000020 30 30 2E 30 30 30 30 30 00 01 03 02 00 00 00 00 00.00000........
00000030 00 00 00 00 00 00 00 01 FE FF 00 00 00 00 20 00 ........þÿ.... .
00000040 01 01 00 01 00 00 20 20 20 20 20 20 20 20 20 20 ......
00000050 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
00000060 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
00000070 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
00000080 20 20 00 02 00 00 00 00 32 00 00 00 00 00 00 00 ......2.......
I suspect that offsets 0x2E - 0x35 may contain a 32-bit key that is somehow locking you out of the drive.
I propose to patch your ROM code as follows (ROM_152G_locarno_patched.bin):
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000 52 4F 59 4C 04 00 1E 00 0D 00 01 00 36 62 D5 49 ROYL........6bÕI
00000010 30 30 30 31 30 30 30 30 00 00 00 00 00 00 00 00 00010000........
00000020 30 31 2E 30 31 41 30 31 00 01 03 02 00 00 00 00 01.01A01........
00000030 00 00 00 00 00 00 00 01 FE FF 00 00 00 00 20 00 ........þÿ.... .
00000040 01 01 00 01 00 00 57 44 43 20 57 44 33 32 30 30 ......WDC WD3200
00000050 42 55 44 54 2D 36 32 44 50 5A 59 30 20 20 20 20 BUDT-62DPZY0
00000060 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
00000070 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
00000080 20 20 00 00 00 00 00 00 32 00 00 00 00 00 00 00 ......2.......
Note that the 32-bit checksum in bytes 0x0C - 0x0F has been recomputed.
Can you write the patched ROM to your PCB, or preferably to a donor PCB?