ST16000NM001G-2KK103 - romboot code reading timeout

[wayne horner]

Hi

Have a new model seagate

   Model : ST16000NM001G-2KK103
  Serial : ZL2B8K43
Firmware : SN03
Capacity : 16 TB (31 251 759 104)

cant read rom through terminal

There are 2 roms....

IS25WP016

Smaller than the soic8

Guess I need another adapter for these.

Terminal works.
Trying to read with bootcode mode seems to go through the steps

The serial lights blink as expected

Seems to be 2 uploads then timeout

then gets terminal timeout

Here is whats on boot code screen

=================================
Switching HDD power supply OFF

Switching HDD power supply ON
Flash type inx... 0x0000000C
Flash size....... 0x00200000
Flash prm dmp.... 0xEF 0x60 0x10 0x0B 0x05 0xFF 0x01 0x03 0x3C 0x20 0x40 0x04 0x00 0x01 0x00 0x00


Receiving file  flash.bin, length = 2097152
Terminal: No response from sender!

Switching HDD power supply OFF

Switching HDD power supply ON
Flash type inx... 0x0000000C
Flash size....... 0x00200000
Flash prm dmp.... 0xEF 0x60 0x10 0x0B 0x05 0xFF 0x01 0x03 0x3C 0x20 0x40 0x04 0x00 0x01 0x00 0x00


Receiving file  flash.bin, length = 2097152
Terminal: No response from sender!
======================
Terminal on power shows
Boot0x0100MAA0053SN03
Trans
Rst0x0100MAA0053SN03
(P)SATAReset

NVCScramSavedHBSize:020A
LD:MD_Alloc:00000090HB_Alloc:0000FlashRestorePowerDevReg7E:0001   PowerDevReg7D:0000MD_Saved:00000090HB_Saved:00000000MD_CRC:1E55
PP:MD_Alloc:0000F000HB_Alloc:0000FlashRestore
PVTSize:00106A54   CompSize:00002108   DeCompSize:00106A54MD_Saved:00002108HB_Saved:00000000MD_CRC:CADA
TW:MD_Alloc:00000400HB_Alloc:002EFlashRestoreMD_Saved:00000160HB_Saved:00000000MD_CRC:2493
WCD:MD_Alloc:00040000HB_Alloc:1293FlashRestoreMD_Saved:00000040HB_Saved:00000000MD_CRC:80C3
GC:MD_Alloc:00005000HB_Alloc:0000FlashRestoreMD_Saved:00004368HB_Saved:00000000MD_CRC:D8AA
DSP0003
2Sync:0 4
===============================================

===================
TERMINAL RESPONSES
ASCII Diag mode

LPower=
HPower
TCC:001B Humidity:0.0% Pressure:704 mBars PartialPressure:689.92 mBars SmoothedPartialPressure:688.29 mBars EMCDataErr:00000000 Req=0038 Status=0001ACTIVE
F3 T>
ASCII Online mode

LPower=IDLE1
LPower=IDLE2
Diagnostic Port Locked

ASCII Diag mode

LPower=
HPower
TCC:001B Humidity:0.0% Pressure:704 mBars PartialPressure:689.92 mBars SmoothedPartialPressure:688.29 mBars EMCDataErr:00000000 Req=0038 Status=0001ACTIVE
F3 T>

Alandata Data Recovery -  (949)287-3282  
"Cleanroom Data Recovery of RAID, VMware, Network Attached Storage, Linux, Tape, Disk, Forensics"

www.AlanData.com   www.AlanDataRecovery.com

[pbzcbf...@gmail.com]

https://forum.hddguru.com/viewtopic.php?p=297114#p297114

[wayne horner]

Thanks

Mrt was able to read the ROM with terminal

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/273f535c-c87e-4c18-b989-515ed0289279n%40googlegroups.com.

[wayne horner]

when I tried to read another with mrt it failed.

There must be a set of bootcode commands that do the reading

Heres is what appears when pc3000 tries to read

It seems like it puts it in bootcode mode

then uploads 2? modules to ram to do the reading

that handshake happens ok

then it gets hung on the modem block receive phase.

=================

I found some  bootcode commands but something isnt right

Receiving "0 of 0" seems like a problem.

Heres is what appears when pc3000 tries to read
image.png
It seems like it puts it in bootcode mode
then uploads 2? modules to ram to do the reading
that handshake happens ok
then it gets hung on the modem block receive phase.
the green upload bar goes across twice then it hangs...

Also I found an instruction on the internet that said bootcode command to read is
r32a,9,0 in hyper terminal
But that doesnt work - I must not be doing it right - each keypress gives bad cmd
here is terminal output
========================
Bad cmd: 0x552E
>

Bad cmd: 0x552E
> R3
Bad cmd: 0x5233
> 2A
Bad cmd: 0x3241
> ,9
Bad cmd: 0x2C39
> ,0
Bad cmd: 0x2C30
>
Bad cmd: 0x5208
>
Bad cmd: 0x5208
> R3
Bad cmd: 0x5233
> ?
Boot Cmds:
 DS
 AP <addr>
 WT <data>
 RD
 GO
 TE
 BR <divisor>
 BT
 WW
 RW
 WM
 RM
 DL
?
 RET
>
==================

Alandata Data Recovery -  (949)287-3282  
"Cleanroom Data Recovery of RAID, VMware, Network Attached Storage, Linux, Tape, Disk, Forensics"

www.AlanData.com   www.AlanDataRecovery.com

[pbzcbf...@gmail.com]

"r32a,9,0" is a Seagate terminal command. It reads a sys file corresponding to the flash memory. In boot code mode, the terminal code isn't running. Only the MCU's kernel code would be running at this time.

[Alandata Recovery]

..." "r32a,9,0" is a Seagate terminal command"....

Yes that makes sense....

On Tue, May 3, 2022 at 11:51 AM pbzcbf...@gmail.com <pbzcbf...@gmail.com> wrote:

"r32a,9,0" is a Seagate terminal command. It reads a sys file corresponding to the flash memory. In boot code mode, the terminal code isn't running. Only the MCU's kernel code would be running at this time.

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/0e5452a1-8e42-457d-b016-1abae0579e49n%40googlegroups.com.

--

Alandata Data Recovery -  (949)287-3282  

"Cleanroom Data Recovery of RAID, VMware, NAS, Linux, Tape, Disk, Forensics"

www.alandata.com   www.alandataRecovery.com

[wayne horner]

hi

For those rom collectors out there

I read the dual roms from the 2 st16000nm

Alandata Data Recovery -  (949)287-3282  

"Cleanroom Data Recovery of RAID, VMware, Network Attached Storage, Linux, Tape, Disk, Forensics"

www.AlanData.com   www.AlanDataRecovery.com

On Tue, Jul 19, 2022 at 9:04 PM wayne horner <waynea...@gmail.com> wrote:

hi

For those rom collectors out there

I read the dual roms from the 2 st16000nm

Alandata Data Recovery -  (949)287-3282  

"Cleanroom Data Recovery of RAID, VMware, Network Attached Storage, Linux, Tape, Disk, Forensics"

www.AlanData.com   www.AlanDataRecovery.com

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/CAH-%2BjWT%3DCB5MK7ANOef%2BgQfWQEUX-Jqo2GdA_%3Dyy%2Bo3L54ia6w%40mail.gmail.com.

[pbzcbf...@gmail.com]

This is the RAP segment. It consists of 5 sections which are mostly empty. Each section begins with a " DaT" signature. This is completely different from other F3 architectures.

RAP header (at offset 0xA0000 in first ROM):

Offset(h) 00   02   04   06   08   0A   0C   0E

00000000  584E 7643 106F 6413 0100 0300 0000 0000  XNvC.od.........
00000010  0000 0000 4D00 C591 0000 0000 0000 0000
00000020  0000 0000 1100 0000 0A02 0305 5800 0002
                                        ^^^^^^^^^ section #1
00000030  7800 0403 9804 0404 B8F4 0405 D844 0501
          --------- ********* ######### +++++++++ sections #2 to #5
00000040  8000 0104 0000 0000 0000 0000 0000 0000
00000050  0000 0000 0000 0000

1st section:

Offset(h) 00   02   04   06   08   0A   0C   0E

                              2044 6154 0209 5FDD  ........ DaT....
00000060  0000 1800 C380 0300 4000 0000 0000 0000
00000070  0000 0000 0000 0000 646A 9F3C 0300 0100
00000080  4000 0000 0000 0000 0000 0000 0000 FFFF
00000090  1000 0000 0000 0000 EEEE EEEE 0000 0000
000000A0  1000 0000 1000 0100 3153 434D 0000 0000  ........1SCM....
000000B0  0000 0000 0000 0000 FFFF FFFF FFFF FFFF

2nd section:

Offset(h) 00   02   04   06   08   0A   0C   0E

00020070                      2044 6154 0301 8440  ........ DaT....
00020080  0000 0000 9324 0500 6001 0000 0000 0000
00020090  0000 0000 0000 0000 0000 0000 0000 0000
000200A0  0000 0000 0000 0000 FFFF FFFF FFFF FFFF
000200B0  0000 0000 0000 0000 0000 0000 0000 0000
000200C0  0000 0000 0000 0000 0000 0000 0000 0000
000200D0  0000 0000 0000 0000 0000 0000 0000 0000
000200E0  0000 0000 0000 0000 0000 0000 0000 0000
000200F0  0000 0000 0000 0000 0000 0000 0000 0000

3rd section:

Offset(h) 00   02   04   06   08   0A   0C   0E

00020290                      2044 6154 0401 7A7A           DaT....
000202A0  0000 FFFF DACA 2000 0821 0000 0000 0000
000202B0  0000 0000 0000 0000 0C52 4C45 546A 1000  .........RLETj..
000202C0  FC20 0000 FFFF FFFF FFFF FFFF FFFF FFFF

4th section:

Offset(h) 00   02   04   06   08   0A   0C   0E

00027AB0                      2044 6154 0501 C4EC           DaT....
00027AC0  0000 FFFF 2A36 2500 6843 0000 0000 0000
00027AD0  0000 0000 0000 0000 02FF FFFF 1800 0000

........  <several blocks of data follow>

5th section:

Offset(h) 00   02   04   06   08   0A   0C   0E

0002A2D0                      2044 6154 0101 9CEF  ........ DaT....
0002A2E0  0000 FFFF C175 9200 9000 0000 0000 0000
0002A2F0  0000 0000 0000 0000 904E 764C 0200 2F00
0002A300  200B 520B 840B B60B E80B 1A0C 4C0C 7E0C
0002A310  B00C E20C 140D 460D 780D AA0D DC0D 0E0E
0002A320  400E 720E A40E D60E 080F 3A0F 6C0F 9E0F
0002A330  D00F 0210 3410 6610 9810 CA10 FC10 2E11
0002A340  6011 9211 C411 F611 2812 5A12 8C12 BE12
0002A350  F012 2213 5413 8613 B813 EA13 1C14 4E14
0002A360  8014 B214 E414 1615 4815 7A15 AC15 DE15
0002A370  1016 4216 7416 A616 D816 0A17 3C17 6E17
0002A380  A017 D217 0418 3618 6818 9A18 CC18 FE18
0002A390  3019 6219 9419 C619 F819 2A1A 5C1A 8E1A
0002A3A0  C01A F21A 241B 561B 881B BA1B EC1B 1E1C
0002A3B0  501C 821C B41C E61C 181D 4A1D 7C1D AE1D
0002A3C0  E01D 121E 441E 761E A81E DA1E 0C1F 3E1F
0002A3D0  701F A21F D41F 0620 3820 6A20 9C20 CE20
0002A3E0  0021 3221 6421 9621 C821 FA21 2C22 5E22
0002A3F0  9022 C222 F422 2623 5823 8A23 BC23 EE23

[Alandata Recovery]

Nice!

It's this in the first ROM... The one with the normal disc signature?

What's in the second ROM?

--

Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/e8ce66cd-3e18-44e4-b411-b296dd02eec2n%40googlegroups.com.

[pbzcbf...@gmail.com]

Yes, that's the "normal" ROM.

This is the start of the second ROM. It consists of a large LZMA compressed data segment. I have attached the decompressed version.

There are several large blocks of data which could be the RAP stuff from the earlier architecture. but I haven't analysed it. Some data blocks have a size of 250 bytes.

Offset(h) 00       04       08       0C

00000000  01C0FF27 00000000 4C5A4D41 D4A60600  ........LZMA....
                                     ^^^^^^^^    <-- compressed size = 0x6A6D4
00000010  F09F1700 5D000001 00F09F17 00000000
          --------                               <-- decompressed size = 0x179FF0
00000020  000001FF FDF1871F 45F1335A 95273C84
........
0006A6C0  23A0B1FF 7FA4F7F9 B80E4C65 363EC1CE
0006A6D0  4D834EC9 4F03ADFF FCD79851 00000000

[pbzcbf...@gmail.com]

I should add that an area of 0xA0000 appears to be reserved for this LZMA segment, with a 16-bit CRC at the end..

0009FFF0  00000000 00000000 989C0000 00000000    <-- 16-bit CRC = 0x9C98

[pbzcbf...@gmail.com]

Here are two sections which contain SMART attribute data:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B

000C79F8                          0A 00 01 0F
000C7A04  00 64 64 00 00 00 00 00 00 00 03 03
000C7A10  00 62 62 00 00 00 00 00 00 00 04 32
000C7A1C  00 64 64 02 00 00 00 00 00 00 05 33
000C7A28  00 64 64 00 00 00 00 00 00 00 07 0F
000C7A34  00 64 FD F2 02 00 00 00 00 00 09 32
000C7A40  00 64 64 00 00 00 00 00 00 00 0A 13
000C7A4C  00 64 64 00 00 00 00 00 00 00 0C 32
000C7A58  00 64 64 02 00 00 00 00 00 00 12 0B
000C7A64  00 64 64 00 00 00 00 00 00 00 B8 32
000C7A70  00 64 64 00 00 00 00 00 00 00 BB 32
000C7A7C  00 64 64 00 00 00 00 00 00 00 BC 32
000C7A88  00 64 FD 00 00 00 00 00 00 00 BD 3A
000C7A94  00 64 64 00 00 00 00 00 00 00 BE 22
000C7AA0  00 4A 42 1A 00 1A 1A 00 00 00 BF 32
000C7AAC  00 64 64 00 00 00 00 00 00 00 C0 32
000C7AB8  00 64 64 01 00 00 00 00 00 00 C1 32
000C7AC4  00 64 64 06 00 00 00 00 00 00 C2 22
000C7AD0  00 1A 28 1A 00 00 00 19 00 00 C5 12
000C7ADC  00 64 64 00 00 00 00 00 00 00 C6 10
000C7AE8  00 64 64 00 00 00 00 00 00 00 C7 3E
000C7AF4  00 C8 FD 00 00 00 00 00 00 00

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B

000C8340  30 32 37 4A 4A 30 4E 4C 58 20 20 20  027JJ0NLX  
000C834C  20 20 20 20 01 0F 00 64 64 00 00 00
000C8358  00 00 00 00 03 03 00 62 62 06 00 00
000C8364  00 00 00 00 04 32 00 64 64 02 00 00
000C8370  00 00 00 00 05 33 00 64 64 00 00 00
000C837C  00 00 00 00 07 0F 00 64 FD D5 02 00
000C8388  00 00 00 00 09 32 00 64 64 00 00 00
000C8394  00 00 00 00 0A 13 00 64 64 00 00 00
000C83A0  00 00 00 00 0C 32 00 64 64 02 00 00
000C83AC  00 00 00 00 12 0B 00 64 64 00 00 00
000C83B8  00 00 00 00 B8 32 00 64 64 00 00 00
000C83C4  00 00 00 00 BB 32 00 64 64 00 00 00
000C83D0  00 00 00 00 BC 32 00 64 FD 00 00 00
000C83DC  00 00 00 00 BD 3A 00 64 64 00 00 00
000C83E8  00 00 00 00 BE 22 00 4A 42 1A 00 1A
000C83F4  1A 00 00 00 BF 32 00 64 64 00 00 00
000C8400  00 00 00 00

These are the data:

ID Flags Cu Wo  Raw
-- ----- -- --  --------------------
01 0F 00 64 64  00 00 00 00 00 00 00  Raw Read Error Rate
03 03 00 62 62  00 00 00 00 00 00 00  Spin Up Time
04 32 00 64 64  02 00 00 00 00 00 00  Start/Stop Count
05 33 00 64 64  00 00 00 00 00 00 00  Reallocated Sector Count
07 0F 00 64 FD  F2 02 00 00 00 00 00  Seek Error Rate
09 32 00 64 64  00 00 00 00 00 00 00  Power-On Hours Count
0A 13 00 64 64  00 00 00 00 00 00 00  Spin Retry Count
0C 32 00 64 64  02 00 00 00 00 00 00  Drive Power Cycle Count
12 0B 00 64 64  00 00 00 00 00 00 00   ?? Helium ??
B8 32 00 64 64  00 00 00 00 00 00 00  End to End Error Det/Corr Count
BB 32 00 64 64  00 00 00 00 00 00 00  Reported Uncorrectable Errors
BC 32 00 64 FD  00 00 00 00 00 00 00  Command Time Out
BD 3A 00 64 64  00 00 00 00 00 00 00  High Fly Writes
BE 22 00 4A 42  1A 00 1A 1A 00 00 00  Airflow Temperature
BF 32 00 64 64  00 00 00 00 00 00 00  Shock Sense
C0 32 00 64 64  01 00 00 00 00 00 00  Emergency Retract Cycle Count
C1 32 00 64 64  06 00 00 00 00 00 00  Load/Unload Cycle Count
C2 22 00 1A 28  1A 00 00 00 19 00 00  HDA Temperature
C5 12 00 64 64  00 00 00 00 00 00 00  Current Pending Sector Count
C6 10 00 64 64  00 00 00 00 00 00 00  Offline Uncorrectable Sector Count
C7 3E 00 C8 FD  00 00 00 00 00 00 00  UltraDMA CRC Error Rate

It looks like this particular drive is relatively new.

[pbzcbf...@gmail.com]

There is no mention of Two Dimensional Magnetic Recording (TDMR) in the product manual, but I can see 4 differential pairs running between the HDA and MCU.

Seagate Exos X16 SATA Product Manual, Rev. F:
https://www.seagate.com/www-content/product-content/enterprise-hdd-fam/exos-x-16/en-us/docs/100845789f.pdf

[pbzcbf...@gmail.com]

The drive has 18 heads, so could there be two preamps, with one read and write channel pair for each?