All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 40 posts ]  Go to page 1, 2  Next
Author Message
 Post subject: Question about Vendor Specific Commands
PostPosted: March 29th, 2020, 16:59 
Offline

Joined: July 6th, 2013, 15:13
Posts: 310
Location: ISLAMABAD
Hi

How companies Get Vendor Specific Command for Read and Write module WD Module?
Answer =


How companies Get Vendor Specific Command for Read and Write module WD Tracks?
Answer =


How companies Get Vendor Specific Command for Other Functions related to WD?
Answer =



How companies Get Vendor Specific Command for Read and Write module On SeaGate Drive?
Answer =




How companies Get The Names of Seagate ROM Modules, that its RAP, CAP SAP?
Answer =



How companies Get Vendor Specific Command for Read and Write of Hitachi ROM and NVRAM and its Super ON Commands ?
Answer =




Does any one have the Answer ?


ATA Command can be found in T13 Documents. and others

But from where the Companies found the VSC commands ?


I hope a Good Reply from Guru of that Forum.


Kind Regards
Waqas Ali


Top
 Profile  
 
 Post subject: Re: Question about Vendor Specific Commands
PostPosted: March 29th, 2020, 17:41 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
I'm no guru, but ISTM that the vast majority of inside information is leaked by insiders, primary in jurisdictions that care little about IP. The bigger data recovery tool manufacturers have bigger war chests, so they would be in the best position to buy such information, if indeed that is what they do. The smaller players could just spy on the SATA interface and ascertain the VSCs that way.

There are some important documents (Seagate and WD) which have made it into the "public domain", and some are hosted in the Files section of this web site.

In the early days there was a core group of mainly Russian hackers who captured VSCs by spying on the ATA traffic during firmware downloads, and the HDD manufacturers provided various utilities which would also have used their VSCs. Quantum accidently released a lot of inside tech info, and this became the basis for a lot of data recovery tools of that time. There is a long thread by @eaxi at hddoracle.com which goes into great detail on this subject.

My own suspicion is that the proportion of genuine reverse engineering is relatively small.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Question about Vendor Specific Commands
PostPosted: March 29th, 2020, 17:58 
Offline

Joined: July 6th, 2013, 15:13
Posts: 310
Location: ISLAMABAD
Yes

The accurate answer.

No one can Get VSC Commands with Info From the Factory.
OR in Other words
Without any Factory Software or Documents.



That's My Point.


Almost Every WD software is a copy of Trex.

No one is added the VSC of WD by there Own in his Software including me.

Detecting VSC by ATA Analyzer is a lengthy process ,if you not have any factory software.


Because only a Factory software can issue VSC, which you can Captured by ATA Analyzer.

Other Wise cannot Capcture VSC command with ATA Analyzer.


Firmware Update Software also comes from the Factory.

So there is no way to built your own software without info from the Factory.



you can only Make Sector Read, Write Verify , Read DMA, Write DMA utility with VSC. because its a Standard ATA Command mention on T13 Documents.




Making Firmware Level repair software need Info and Documents about the hdd from the Factory.







Kind Regards
Waqas Ali


Top
 Profile  
 
 Post subject: Re: Question about Vendor Specific Commands
PostPosted: March 30th, 2020, 3:18 
Offline

Joined: October 3rd, 2005, 0:40
Posts: 4311
Location: Hungary
There are ways to find out vsc without any hints from the manufacturer or spying on the interface. In fact, most of the fw updates do not issue any vscs, they usually use std ata commands during the process.
There is no point to do research in vscs already known like for wd, however, there are a lot more than what's included in trex, which is to be reversed.
And i think you are wrong by stating noone does reversing because of it being a lengthy process. It is, but hey, what is all this DR thing about?
Surely not pressing buttons...


pepe

_________________
Adatmentés - Data recovery


Top
 Profile  
 
 Post subject: Re: Question about Vendor Specific Commands
PostPosted: April 3rd, 2020, 10:58 
Offline

Joined: October 3rd, 2005, 0:40
Posts: 4311
Location: Hungary
in what aspect?

_________________
Adatmentés - Data recovery


Top
 Profile  
 
 Post subject: Re: Question about Vendor Specific Commands
PostPosted: April 3rd, 2020, 18:57 
Offline

Joined: March 25th, 2018, 16:39
Posts: 26
Location: Europe
I dig in Seagates only, so I can get you easy answer on one of your question:
"How companies Get The Names of Seagate ROM Modules, that its RAP, CAP SAP?"
I present small portion of factory log extracted from Seagate HDD SA, you can find similar logs on many Seagates. You can see the well-known names of ROM components used both by commercial and free soft - they are not invented by third-party DR software makers, they are original Seagates' ones:

Jan 13 2013-07:19:51 Sending Block: 800 of 1025: Size=512
Jan 13 2013-07:20:03 Sending Block: 1000 of 1025: Size=512
Jan 13 2013-07:20:12 Return Data:
PROGRAMMING COMPLETE! ---------------------------------------------------------- VERIFYING FLASH IMAGE... Header: 530B00004800000000000000E2B50400 Header plus boot code checksum verified! Offset Length Type ------ ------ ---- 0x00040 0x598E0 DL_CFW 0x598E0 0x00410 IAP 0x59CF0 0x16000 DL_SFW 0x6FCF0 0x01100 DL_SHELL 0x70DF0 0x00210 DL_CAPM 0x71000 0x0A000 DL_RAPM 0x7B000 0x05000 DL_SAPM Flash Byte size : 0x00080000 Entire flash image checksum: 0x44F0 PASS Done
Jan 13 2013-07:20:12 Flash Load time: 175.861538
..
So to get Seagates' original names and location of ROM components is real simple, but most people are to lazy to do it themselves. You just have to dump WHOLE SA, not only files selected by PC3K, find factory log and compare it with ROM of this disk...
..
As for general discussion:
1) I agree with fzabkar, that many valuable sources come from leaks/"illegal sales" by (ex-)Seagate/WD/... employees. The best example can be full WinFOF leak a few years ago - this was a VERY valuable source, at least for me :) I realized, how they prepare their disks for sale.
2) I agree with pepe, that there are still MANY valuable sources for reversing. If someone is concerned with Seagate - I can recommend STECON cracking - this is VERY educational. The first and usually the last :) barrier for average user is extracting SeaScripts from these distributions. They are encrypted by proprietary algorithm.
3) Reversing at all, not only concerning HDD firmware, had dramatically collapsed in free world in last 10 years. I will not attach any valuable stuff here, I will not send anything to people who I dont' know in real life. "Pirate-hunters" enjoy their success, because people stopped sharing their knowledge and soft. You can find valuable info mainly on chinese, russian etc sites... Big shame :(
Of course there is a second reason of reversing fall: knowledge is money :)


Top
 Profile  
 
 Post subject: Re: Question about Vendor Specific Commands
PostPosted: April 3rd, 2020, 19:29 
Offline

Joined: July 6th, 2013, 15:13
Posts: 310
Location: ISLAMABAD
eaxi wrote:
I dig in Seagates only, so I can get you easy answer on one of your question:
"How companies Get The Names of Seagate ROM Modules, that its RAP, CAP SAP?"
I present small portion of factory log extracted from Seagate HDD SA, you can find similar logs on many Seagates. You can see the well-known names of ROM components used both by commercial and free soft - they are not invented by third-party DR software makers, they are original Seagates' ones:

Jan 13 2013-07:19:51 Sending Block: 800 of 1025: Size=512
Jan 13 2013-07:20:03 Sending Block: 1000 of 1025: Size=512
Jan 13 2013-07:20:12 Return Data:
PROGRAMMING COMPLETE! ---------------------------------------------------------- VERIFYING FLASH IMAGE... Header: 530B00004800000000000000E2B50400 Header plus boot code checksum verified! Offset Length Type ------ ------ ---- 0x00040 0x598E0 DL_CFW 0x598E0 0x00410 IAP 0x59CF0 0x16000 DL_SFW 0x6FCF0 0x01100 DL_SHELL 0x70DF0 0x00210 DL_CAPM 0x71000 0x0A000 DL_RAPM 0x7B000 0x05000 DL_SAPM Flash Byte size : 0x00080000 Entire flash image checksum: 0x44F0 PASS Done
Jan 13 2013-07:20:12 Flash Load time: 175.861538
..
So to get Seagates' original names and location of ROM components is real simple, but most people are to lazy to do it themselves. You just have to dump WHOLE SA, not only files selected by PC3K, find factory log and compare it with ROM of this disk...
..
As for general discussion:
1) I agree with fzabkar, that many valuable sources come from leaks/"illegal sales" by (ex-)Seagate/WD/... employees. The best example can be full WinFOF leak a few years ago - this was a VERY valuable source, at least for me :) I realized, how they prepare their disks for sale.
2) I agree with pepe, that there are still MANY valuable sources for reversing. If someone is concerned with Seagate - I can recommend STECON cracking - this is VERY educational. The first and usually the last :) barrier for average user is extracting SeaScripts from these distributions. They are encrypted by proprietary algorithm.
3) Reversing at all, not only concerning HDD firmware, had dramatically collapsed in free world in last 10 years. I will not attach any valuable stuff here, I will not send anything to people who I dont' know in real life. "Pirate-hunters" enjoy their success, because people stopped sharing their knowledge and soft. You can find valuable info mainly on chinese, russian etc sites... Big shame :(
Of course there is a second reason of reversing fall: knowledge is money :)






Hi Sir

The Main Question is still remain,

Without Factory software, no one is able to get the Names of Firmware.

without Names and info, its a difficult Job to open each in Hex and find what is happening.


I am a developer, i know how to get commands and how to split the Hex Data in to valuable form.

But without info from the factory software , its not possible.

How WD software are made ? do you think that those 100 of ATA commands can automatically found by just hex editing ? Off course no, it was found from the factory software, used sniffer and get the command. check this original software , what is giving to buffer.

How people know that its SPT, and its Sector, off course its from checking the info from the factory and comparing.


Like if you want to find the WD, how people know that this offset is a password offset.

In module 02, at the start there are the location address and its size of every section of a 02 module

But how people get to know the sections ?




You can make a Simple ATA Program by using T13, only

For Vendor command you need info from the Factory. or reverse Factory software


Last edited by waqas_ali766 on April 3rd, 2020, 19:34, edited 1 time in total.

Top
 Profile  
 
 Post subject: Re: Question about Vendor Specific Commands
PostPosted: April 3rd, 2020, 19:31 
Offline

Joined: July 6th, 2013, 15:13
Posts: 310
Location: ISLAMABAD
eaxi wrote:
I dig in Seagates only, so I can get you easy answer on one of your question:
"How companies Get The Names of Seagate ROM Modules, that its RAP, CAP SAP?"
I present small portion of factory log extracted from Seagate HDD SA, you can find similar logs on many Seagates. You can see the well-known names of ROM components used both by commercial and free soft - they are not invented by third-party DR software makers, they are original Seagates' ones:

Jan 13 2013-07:19:51 Sending Block: 800 of 1025: Size=512
Jan 13 2013-07:20:03 Sending Block: 1000 of 1025: Size=512
Jan 13 2013-07:20:12 Return Data:
PROGRAMMING COMPLETE! ---------------------------------------------------------- VERIFYING FLASH IMAGE... Header: 530B00004800000000000000E2B50400 Header plus boot code checksum verified! Offset Length Type ------ ------ ---- 0x00040 0x598E0 DL_CFW 0x598E0 0x00410 IAP 0x59CF0 0x16000 DL_SFW 0x6FCF0 0x01100 DL_SHELL 0x70DF0 0x00210 DL_CAPM 0x71000 0x0A000 DL_RAPM 0x7B000 0x05000 DL_SAPM Flash Byte size : 0x00080000 Entire flash image checksum: 0x44F0 PASS Done
Jan 13 2013-07:20:12 Flash Load time: 175.861538
..
So to get Seagates' original names and location of ROM components is real simple, but most people are to lazy to do it themselves. You just have to dump WHOLE SA, not only files selected by PC3K, find factory log and compare it with ROM of this disk...
..
As for general discussion:
1) I agree with fzabkar, that many valuable sources come from leaks/"illegal sales" by (ex-)Seagate/WD/... employees. The best example can be full WinFOF leak a few years ago - this was a VERY valuable source, at least for me :) I realized, how they prepare their disks for sale.
2) I agree with pepe, that there are still MANY valuable sources for reversing. If someone is concerned with Seagate - I can recommend STECON cracking - this is VERY educational. The first and usually the last :) barrier for average user is extracting SeaScripts from these distributions. They are encrypted by proprietary algorithm.
3) Reversing at all, not only concerning HDD firmware, had dramatically collapsed in free world in last 10 years. I will not attach any valuable stuff here, I will not send anything to people who I dont' know in real life. "Pirate-hunters" enjoy their success, because people stopped sharing their knowledge and soft. You can find valuable info mainly on chinese, russian etc sites... Big shame :(
Of course there is a second reason of reversing fall: knowledge is money :)




Jan 13 2013-07:19:51 Sending Block: 800 of 1025: Size=512
Jan 13 2013-07:20:03 Sending Block: 1000 of 1025: Size=512
Jan 13 2013-07:20:12 Return Data:
PROGRAMMING COMPLETE! ---------------------------------------------------------- VERIFYING FLASH IMAGE... Header: 530B00004800000000000000E2B50400 Header plus boot code checksum verified! Offset Length Type ------ ------ ---- 0x00040 0x598E0 DL_CFW 0x598E0 0x00410 IAP 0x59CF0 0x16000 DL_SFW 0x6FCF0 0x01100 DL_SHELL 0x70DF0 0x00210 DL_CAPM 0x71000 0x0A000 DL_RAPM 0x7B000 0x05000 DL_SAPM Flash Byte size : 0x00080000 Entire flash image checksum: 0x44F0 PASS Done
Jan 13 2013-07:20:12 Flash Load time: 175.861538

Programming Complete = its from the TMP file, if you open in Note Pad.
In the End of that you will find the names, like CFW Boot, RAP CAP SAP, IAP, Shell.

But if you not have that winfof and TPM files, are you able to get that names ???

here in your text, i see that you loading a ROM by winfof, using A TPM file.

So you also get the Info from the Factory software. hehehehe


That the point i am telling, always need factory info or software for Vendor commands and original names.


Top
 Profile  
 
 Post subject: Re: Question about Vendor Specific Commands
PostPosted: April 3rd, 2020, 20:05 
Offline

Joined: March 25th, 2018, 16:39
Posts: 26
Location: Europe
Sorry, Ali, but you didnt' understand
I didnt' download anything to this disk
Presented fragment is a dump from original SA on this disk.
It can be read as normal SA - you get files by FAT, you read free SA sectors by normal LBA access.
This is original factory log, produced by Seagate during preparing disk for use and for sale. This log was of course produced by WinFOF, but WinFOF of Seagate, not mine one.
So WinFOF has nothing to all this - you dont' need working WinFOF to read or doing something else with it.
You just have factory log with simple text variables and all you have to do is to apply it to ROM image from this disk. Then you will have DL_CAPM, DL_SAPM... etc names mapped to the ROM. And this is an answer to your question "how they get names of ROM components" - they have deduced them from logs like that


Top
 Profile  
 
 Post subject: Re: Question about Vendor Specific Commands
PostPosted: April 3rd, 2020, 20:36 
Offline

Joined: July 6th, 2013, 15:13
Posts: 310
Location: ISLAMABAD
eaxi wrote:
Sorry, Ali, but you didnt' understand
I didnt' download anything to this disk
Presented fragment is a dump from original SA on this disk.
It can be read as normal SA - you get files by FAT, you read free SA sectors by normal LBA access.
This is original factory log, produced by Seagate during preparing disk for use and for sale. This log was of course produced by WinFOF, but WinFOF of Seagate, not mine one.
So WinFOF has nothing to all this - you dont' need working WinFOF to read or doing something else with it.
You just have factory log with simple text variables and all you have to do is to apply it to ROM image from this disk. Then you will have DL_CAPM, DL_SAPM... etc names mapped to the ROM. And this is an answer to your question "how they get names of ROM components" - they have deduced them from logs like that





Hi

I think we both get miss understand.


Please Take a look at the picture, here is the Original TPM file from the Factory, in which the names of the ROM modules are mention, but not all names.

Attachment:
TPM Picture.jpg
TPM Picture.jpg [ 385.62 KiB | Viewed 11563 times ]



How you collect the Names from the ROM.bin file, without the Factory names , which get from the Factory Data.
Can you please show me how to get names from ROM.bin

Because as i know, because i am a programer.

We Open rom.bin , parse the address, and then read the Module ID and set the name and then we show in A ListView

ID = 06 in Hex in Rom.bin = RAP a simple Example

So the Question is, This RAP is not mention in the Rom.bin file

We have a ready made compare function in our program, which read the 06 ID and assign the name , which we have in our Data Base.

Lets see the following picture

Attachment:
ROM Module Name.jpg
ROM Module Name.jpg [ 418.32 KiB | Viewed 11563 times ]



I hope you can now understand.

Second you cannot Dump ROM without a Original Factory info.
1. if you want to Read ROM by ATA. then you must have Vendor command for that
2. if you want to read rom by BOOTMode, then you must have TPM file

3. Other wise use a external programmer to read Chip


From the Above Picture, i show you the way how to get the names and then add in your own software.


If you want me to understand your words fully, Can you please Upload with some reference and pictures.


Kind Regards
Waqas Ali


Top
 Profile  
 
 Post subject: Re: Question about Vendor Specific Commands
PostPosted: April 3rd, 2020, 20:46 
Offline

Joined: July 6th, 2013, 15:13
Posts: 310
Location: ISLAMABAD
Hi

Few more example for you with my Own SRS software

Here you can see, its showing Few ROM Modules name.

Attachment:
ROM Module Name SRS.jpg
ROM Module Name SRS.jpg [ 411.67 KiB | Viewed 11561 times ]



And here you can see names of the modules in my Database which i am assigning by Coding

Attachment:
ROM Module Name ARRAY in SRS.jpg
ROM Module Name ARRAY in SRS.jpg [ 165.89 KiB | Viewed 11561 times ]



Kind Regards
Waqas Ali


Top
 Profile  
 
 Post subject: Re: Question about Vendor Specific Commands
PostPosted: April 3rd, 2020, 23:40 
Offline

Joined: March 25th, 2018, 16:39
Posts: 26
Location: Europe
Ali, I really dont' understand what you try to do
You just want to give names to DL_CFW sub-components??
They have no specific names given by Seagate
But if you are programmer, you should know what are they
"ID=3" of your DL_CFW is typical ARM start code: interrupt table, ISR and so on
I've attached similar code from disk I work on:
Attachment:
1.jpg
1.jpg [ 332.96 KiB | Viewed 11543 times ]

And same parts of code marked on your module:
Attachment:
2.jpg
2.jpg [ 175.79 KiB | Viewed 11543 times ]

Other parts of this DL_CFW are "ID=2": code and "ID=1": data, as I see
The list of ROM modules, which you copied from F3ROMExplorer, doesnt' name sub-components, because there is no reason to give names to sub-components which cant' be used apart. You can add new CAP to flash-ROM, but you cant' change only "ID=3" in DL_CFW, leaving the rest unchanged - this would be total incompatible


Top
 Profile  
 
 Post subject: Re: Question about Vendor Specific Commands
PostPosted: April 4th, 2020, 6:03 
Offline

Joined: October 3rd, 2005, 0:40
Posts: 4311
Location: Hungary
you can get some of those names from commands in drive fw, some you can get from factory fw update (PUBLIC!!!).
And yeah, it gives a huge help if you know something from factory sw, but it is not a must. Hex editing -as you called it - will not get you much in understanding how things work, like how the drive's multitasking OS works, how the multiple processor cores work together, how you can block some unneccessary and harmful process from being executed, etc.
So there is life beyond info from factory, although it can be quite handy if you know how to use it.

pepe

_________________
Adatmentés - Data recovery


Top
 Profile  
 
 Post subject: Re: Question about Vendor Specific Commands
PostPosted: April 4th, 2020, 8:25 
Offline

Joined: July 6th, 2013, 15:13
Posts: 310
Location: ISLAMABAD
eaxi wrote:
Ali, I really dont' understand what you try to do
You just want to give names to DL_CFW sub-components??
They have no specific names given by Seagate
But if you are programmer, you should know what are they
"ID=3" of your DL_CFW is typical ARM start code: interrupt table, ISR and so on
I've attached similar code from disk I work on:
Attachment:
1.jpg

And same parts of code marked on your module:
Attachment:
2.jpg

Other parts of this DL_CFW are "ID=2": code and "ID=1": data, as I see
The list of ROM modules, which you copied from F3ROMExplorer, doesnt' name sub-components, because there is no reason to give names to sub-components which cant' be used apart. You can add new CAP to flash-ROM, but you cant' change only "ID=3" in DL_CFW, leaving the rest unchanged - this would be total incompatible




Are you saying that all names , like rap cap sap. Are in side the rom.bin file ?

Can you show us us where in the ROM.
By the way i not copy from fw rom explorer.
Canot you see by eyes that i uploaded factory tpm file picture.
From there i copy names.

How could you say that i copy from f3rom exlorer.

I think its easy to just say that some one copy from them.

I copy from factory tmp file. Not from f3 explorer

F3explorer person also copy from factory tmp.

I am sure that name like rap cap sap, not available in rom.bin file
Like name CPRS, open rom.bin and search CPRS test you will find it.

Can you show rap cap sap IAP ? Any of these 4 ?

Also i can swap any thing from 1 rom to another without any problem.
Rap cap sap sfw. This is added in my software to swap from patient to donor rom.


In the above post. Where is mention ID
ID = 06 in Hex in Rom.bin = RAP a simple Example

This is just example. Not an accurate value.

I am requested you to please please show rap cap sap names in rom.bin


After that i will show you a video how a develper find the names of rap cap and sap from rom.bin


Kind regards
Waqas ali


Top
 Profile  
 
 Post subject: Re: Question about Vendor Specific Commands
PostPosted: April 4th, 2020, 8:53 
Offline

Joined: July 6th, 2013, 15:13
Posts: 310
Location: ISLAMABAD
Hi

People here talk too much . And gives less info.


Here is a quick answer to this main post which i submit.

You can get ATA coommand from a factory software.
Or
from an update file which factory release.
By using any analyzer software, for example bus hound.

Or you can buy those vendor command from a person , who already capture those command using analyzer.

This is the only way to get the VSC commands.


Windows will never tell you about the VCS command.

Windows will only tell you about the T13 .

I hope people will understand how VSC command found.

Kind regards


Top
 Profile  
 
 Post subject: Re: Question about Vendor Specific Commands
PostPosted: April 4th, 2020, 12:04 
Offline

Joined: September 30th, 2005, 7:33
Posts: 849
One can find VSC commands by "sniffing" some demo versions of programs like WDR, SeDiv, SHT, etc....
And the best "sniffing" instrument for this purpose is the HDD itself.
Some commands can be found by "trials and errors". From t13 we know what to put in CR and just remains to figure out what to put in FR...


Top
 Profile  
 
 Post subject: Re: Question about Vendor Specific Commands
PostPosted: April 4th, 2020, 12:18 
Offline

Joined: October 3rd, 2005, 0:40
Posts: 4311
Location: Hungary
this conversation is getting annoying.
you cannot find RAP, CAP etc strings in rom for two reasons: most of the rom code (bootfw) is compressed, and it does not contain such strings even after decompression. But please, do you really think it is the bootfw that runs the drive??
Quote:
This is the only way to get the VSC commands.

I won't argue with this. :facepalm:

I already helped a lot, you just fail to understand.
pepe

_________________
Adatmentés - Data recovery


Top
 Profile  
 
 Post subject: Re: Question about Vendor Specific Commands
PostPosted: April 4th, 2020, 14:28 
Offline

Joined: July 6th, 2013, 15:13
Posts: 310
Location: ISLAMABAD
BGman wrote:
One can find VSC commands by "sniffing" some demo versions of programs like WDR, SeDiv, SHT, etc....
And the best "sniffing" instrument for this purpose is the HDD itself.
Some commands can be found by "trials and errors". From t13 we know what to put in CR and just remains to figure out what to put in FR...



100% perfect answer regerding that post.

Kind regards
Waqas Ali


Top
 Profile  
 
 Post subject: Re: Question about Vendor Specific Commands
PostPosted: April 4th, 2020, 18:41 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
waqas_ali766 wrote:
eaxi wrote:
I present small portion of factory log extracted from Seagate HDD SA ...

PROGRAMMING COMPLETE! ---------------------------------------------------------- VERIFYING FLASH IMAGE... Header: 530B00004800000000000000E2B50400 Header plus boot code checksum verified! Offset Length Type ------ ------ ---- 0x00040 0x598E0 DL_CFW 0x598E0 0x00410 IAP 0x59CF0 0x16000 DL_SFW 0x6FCF0 0x01100 DL_SHELL 0x70DF0 0x00210 DL_CAPM 0x71000 0x0A000 DL_RAPM 0x7B000 0x05000 DL_SAPM Flash Byte size : 0x00080000 Entire flash image checksum: 0x44F0 PASS Done

Are you saying that all names , like rap cap sap. Are in side the rom.bin file ?

AIUI, @eaxi is telling you that these names can be found in the factory logs in the SA. The names of these ROM modules are not present in the ROM, only their IDs.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Question about Vendor Specific Commands
PostPosted: April 4th, 2020, 18:52 
Offline

Joined: July 6th, 2013, 15:13
Posts: 310
Location: ISLAMABAD
fzabkar wrote:
waqas_ali766 wrote:
eaxi wrote:
I present small portion of factory log extracted from Seagate HDD SA ...

PROGRAMMING COMPLETE! ---------------------------------------------------------- VERIFYING FLASH IMAGE... Header: 530B00004800000000000000E2B50400 Header plus boot code checksum verified! Offset Length Type ------ ------ ---- 0x00040 0x598E0 DL_CFW 0x598E0 0x00410 IAP 0x59CF0 0x16000 DL_SFW 0x6FCF0 0x01100 DL_SHELL 0x70DF0 0x00210 DL_CAPM 0x71000 0x0A000 DL_RAPM 0x7B000 0x05000 DL_SAPM Flash Byte size : 0x00080000 Entire flash image checksum: 0x44F0 PASS Done

Are you saying that all names , like rap cap sap. Are in side the rom.bin file ?


AIUI, @eaxi is telling you that these names can be found in the factory logs in the SA. The names of these ROM modules are not present in the ROM, only their IDs.




Hi

Friend me to saying the same, that it can be found in Factory log.

Not Available in the ROM.bin file

But some people try to show me in the IDA Pro , that names are in the ROM.bin
because CPRS is available in the ROM.bin file


that's why i said, show RAP CAP SAP names.

then he reply, that its compressed.

i try to say him, that in ROM Image, only the ID is available

like 01, 02, 03, 04

And from that ID we assign the Names By programming.

Same method is done in WD Drives.


in WD hdd, all modules and there address is available in 01 module, but only the ID number and There Location and there Size.

Not the Names of Modules.

Names of Modules we get from Factory logs. and put in the Software ListView Programatically , so a User can understand.

fzabkar, i am wrong kindly tell me, i know you are expert in this.

Kind Regards


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 40 posts ]  Go to page 1, 2  Next

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Google [Bot] and 52 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group