Need help repairing this corrupt ST2000LM007 ROM...

[$300 Data Recovery]

With the original PCB/ROM (https://slack-files.com/T041AF3B4-F047VGZH4L9-5be6f07c85), terminal repeatedly says:

Flash boot code Digital Signature Verification failure!
0x00000040
0x00001200
0x00000001
0x00000001
0x00000001
SEA5 Boot ROM 1.0 (06/01/2017)
Copyright Seagate 2017-VM000

I tried to fix using F3ROMExplorer, but it always ends up the same or with no terminal output at all. Same when trying to import donor CAP+ (tried several donor ROMs, all same model and same firmware). 

This is after a head swap (the heads were physically damaged, so it was never powered on before swapping). 

This drive also went to another data recovery company first, and unfortunately, it's the one that may have intentionally damaged the ROM (I think we can all guess who). 

Thank you!
Brian

[pbzcbf...@gmail.com]

What does PC3K's ROM analysis say?

Your ROM code (0 - 0x3FFFF) is backed up at 0x40000 - 0x7FFFF. There are slight differences, and there are 0x40 bytes which look like they could be a digital signature, but I don't really know.

You can force the ROM to boot from the alternate copy of the code by editing the header and CRC, but I don't know what effect this will have.

Does Ace's TS have any ideas?

[$300 Data Recovery]

PC3K says:

FLASH ROM Info
==============
Image size............... : 1048576
 
QNR Revisions:
Flash ROM image.......... : 3
GLOB_FLASH_DIR........... : 3
BOOTFW_CONT_0............ : 0
GLOB_FLASH_DIR........... : 4
BOOTFW_CONT_1............ : 0
 
 
CAP
###
Validation Key........... : 0x00000020
Fam ID................... : 0xAF (Rosewood_AF)
Fam Member............... : 0x1
Head count............... : 4
Date (ERROR!)............ : ?? - ?? - ????
SN....................... : ZDZMCQGG
PCB SN................... :     W239EASD
PCB PN................... :
WWN...................... : 5000C500E4EC486C
 
RAP
###
Format revision.......... : 0x0208
Contents revision........ : 0x840E0100
Number Sys Zones......... : 1
Number User Zones........ : 150
Heads count.............. : 4
FW Implementation Key.... : 0x1E
 
SAP
###
Addr 0................... : 0x00118B00
Addr 1................... : 0x80000000
 
Fam ID................... : 0xAF, (Rosewood_AF)
Fam Member............... : 0x1
SN....................... : ZDZMCQGG
Servo FW rev code........ : 0x79A1
Max head................. : 3
Seek mode................ : 2000
Flags.................... : 1A09
Head vendor.............. : default
RRO mode................. : 0005
Preamp type.............. : 0000
Heads polarity........... : 00 00 00 00
Logical head map......... : 00 01 02 03
Phys head maps........... : 00 00 00 00
 
IAP
###
ID, code................................ : 0xFFFF
PUIS.................................... : OFF
Active config........................... : FFFFFFFF
NAND ROM cache flag, Kahuna like........ : FFFFFFFF
NAND ROM cache flag, Rosewood like...... : FFFFFFFF
 
IAP 1
###
ID, code................................ : 0xFFFF
PUIS.................................... : OFF
Active config........................... : FFFFFFFF
NAND ROM cache flag, Kahuna like........ : FFFFFFFF
NAND ROM cache flag, Rosewood like...... : FFFFFFFF
 
CODE info
#########
Bank 0
ProdType................. : R1AEA09.SDM4
Controller FW Rev........ : 01022040
Customer Release......... : EB01
Changelist............... : 01836050
Build date / time........ : 1/2/2020 8:40:14 PM
Package Global ID........ : 00305567
Package Builder ID....... :
Build Rev................ :
Package Rev.............. : AA0097
Pkg P/N.................. : 100864158
Servo FW................. : 79A1 / ---- / ---- / ----
Package Version.......... : R1AEA09.SDM4.AA0097.EB01
Pkg CFW Ver.............. : R1AEA09.SDM4.01836050.00305567
 
Bank 1
ProdType................. : R1AEA09.SDM4
Controller FW Rev........ : 01022040
Customer Release......... : EB01
Changelist............... : 01836050
Build date / time........ : 1/2/2020 8:40:14 PM
Package Global ID........ : 00305567
Package Builder ID....... :
Build Rev................ :
Package Rev.............. : AA0097
Pkg P/N.................. : 100864158
Servo FW................. : 79A1 / ---- / ---- / ----
Package Version.......... : R1AEA09.SDM4.AA0097.EB01
Pkg CFW Ver.............. : R1AEA09.SDM4.01836050.00305567

Ace says, "Unfortunately can't fix it.. Try to transfer CAP+RAP+SAP+IAP adaptives from this ROM into the donor one (with the same full model name and f/w version). Then write such prepared donor ROM on the patient drive."

>You can force the ROM to boot from the alternate copy of the code by editing the header and CRC, but I don't know what effect this will have.

I've never heard of this, but I would love to try if you can provide a revised ROM copy or instructions. 

Thank you for your help!
Brian

[pbzcbf...@gmail.com]

FWIW ...

Serial number is ZDZxxxxx
Part number is 027JJ0DTX      

 ID  Flg  Cur  Wor  Raw             Description
------------------------------------------------------------------------
  1  0F    80   64  00000006163130  Raw Read Error Rate
  3  03   100  100  00000000000000  Spin Up Time
  4  32   100  100  0000000000000D  Start/Stop Count
  5  33   100  100  00000000000000  Reallocated Sector Count
  7  0F    64   60  000000002A2E07  Seek Error Rate
  9  32   100  100  0C9085000000CF  Power-On Hours Count
 10  13   100  100  00000000000000  Spin Retry Count
 12  32   100  100  00000000000005  Drive Power Cycle Count
184  32   100  100  00000000000000  End to End Error Det/Corr Count
187  32   100  100  00000000000000  Reported Uncorrectable Errors
188  32   100  100  00000000000000  Command Time Out
189  3A   100  100  00000000000000  High Fly Writes
190  22    60   50  000000311B0028  Airflow Temperature
191  32   100  100  00000000000000  Shock Sense
192  32   100  100  01000000000000  Emergency Retract Cycle Count
193  32   100  100  000000000003DF  Load/Unload Cycle Count
194  22    40   50  00001600000028  HDA Temperature
197  12   100  100  00000000000000  Current Pending Sector Count
198  10   100  100  00000000000000  Offline Uncorrectable Sector Count
199  3E   200  200  00000000000000  UltraDMA CRC Error Rate
240  00   100  253  2CE8BE0000001B  Head Flying Hours
241  00   100  253  0000004EFA3CA8  Total LBAs written
242  00   100  253  00000065BDA51D  Total LBAs read
254  32   100  100  00000000000000  Free Fall Sensor

[pbzcbf...@gmail.com]

See attached ROM.

[$300 Data Recovery]

Thanks! Unfortunately, no spin and terminal just says:

Flash boot code Digital Signature Verification failure!
0x00000040
0x00001200
0x00000001
0x00000001
0x00000001
SEA5 Boot ROM 1.0 (06/01/2017)
Copyright Seagate 2017-VM000

On Friday, October 21, 2022 at 5:23:21 PM UTC-7 pbzcbf...@gmail.com wrote:

See attached ROM.

[pbzcbf...@gmail.com]

What if you try a donor ROM, verify that it spins the drive, and then patch the patient's CAP, RAP and SAP segments into it?

[$300 Data Recovery]

Ya, this is what Ace suggested. I've tried this with several donor ROMs already, to no avail. Either nothing at all in terminal or the same "Flash boot code Digital Signature Verification failure" message. :(

[pbzcbf...@gmail.com]

Did Ace tell you where this "digital signature" is stored?

If you invalidate the ROM by shorting the Data Out pin to ground during power-on, does the same message appear in terminal, or do you get a "bad checksum" error? If the same message appears, then it must be coming from the kernel code.

[pbzcbf...@gmail.com]

Is it possible that you have a 3.3V ROM on a 1.8V board???

Could there be a problem with the RAM in the MCU or on the PCB? The ROM data needs to be unpacked into RAM ...

[$300 Data Recovery]

>Did Ace tell you where this "digital signature" is stored?

They did not.

>If you invalidate the ROM by shorting the Data Out pin to ground during power-on, does the same message appear in terminal, or do you get a "bad checksum" error? If the same message appears, then it must be coming from the kernel code.

I haven't tested this, but can try to confirm.

>Is it possible that you have a 3.3V ROM on a 1.8V board???

No. I'm using a donor PCB (same thing happens on original PCB too). The same donor model/FW (and using this drive's heads). They are an exact match. 

[pbzcbf...@gmail.com]

The fact that the date in the CAP is incoherent makes me wonder whether someone has fiddled with it. If so, I'm wondering whether the PCB and ROM are both native. I would check the date on the label against the YWW date codes on the ROM and other ICs.

IIUC, you took a working donor drive and transferred the patient's adaptives into it. The donor drive then produced the same "digital signature" error. If so, then this would suggest that there is something wrong with the adaptives, or perhaps there is a security key in the MCU??? However, I have never encountered a digital signature in a Seagate ROM, and I haven't heard of any Rosewood (?) model that has an MCU key.

[Philip Shaw]

Brian, which company are you referring to? 

On Fri, Oct 21, 2022 at 10:33 PM pbzcbf...@gmail.com <pbzcbf...@gmail.com> wrote:

The fact that the date in the CAP is incoherent makes me wonder whether someone has fiddled with it. If so, I'm wondering whether the PCB and ROM are both native. I would check the date on the label against the YWW date codes on the ROM and other ICs.

IIUC, you took a working donor drive and transferred the patient's adaptives into it. The donor drive then produced the same "digital signature" error. If so, then this would suggest that there is something wrong with the adaptives, or perhaps there is a security key in the MCU??? However, I have never encountered a digital signature in a Seagate ROM, and I haven't heard of any Rosewood (?) model that has an MCU key.

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/c55189dc-bc37-4d5e-9818-897d5ebd675cn%40googlegroups.com.

[pbzcbf...@gmail.com]

Here are two other similar problems:

https://forum.hddguru.com/viewtopic.php?f=1&t=41599&mobile=desktop

https://www.rflashdata.com/st1000lm035-hdd-firmware-problem-recovery-pcb100809471reva/2020/04/20/12/23/

[$300 Data Recovery]

>The fact that the date in the CAP is incoherent makes me wonder whether someone has fiddled with it.

I do believe it was fiddled with. But, SN in ROM matches label. 

>Brian, which company are you referring to? 

I'd rather not mention their name. 

[pbzcbf...@gmail.com]

To me, this problem can't be too hard to narrow down. The ROM is divided into code and data segments. You would just transfer various segments from the patient ROM into a donor ROM and donor PCB until the donor produces the same error. Then you have found the problem segment. You wouldn't even need a donor HDA.

[Fraser Corrance]

Brian, 

I haven't had very many drives from this family come through for recovery so I only have a few ROMs to compare with yours. There are a couple things that I noticed when comparing the ROMs that I have to yours. 

2 out of the 3 ROMs that I have backed up also have date errors. 

CAP
###
Validation Key........... : 0x00000020
Fam ID................... : 0xAF (Rosewood_AF)
Fam Member............... : 0x1
Head count............... : 4
Date (ERROR!)............ : ?? - ?? - ????

SN....................... : ZDZAB8M3
PCB SN................... :     K033545W
PCB PN................... :
WWN...................... : 5000C500C54710E7

These were drives that I was able to recover successfully so perhaps the date thing is not a big deal. 

Another thing that stands out is this:

GLOB_FLASH_DIR........... : 2

Your glob flash dir is 4. I am not sure if this could be related the cause of the symptom you are experiencing but it may be worth a try although I am not sure about how to change that value. 

[pbzcbf...@gmail.com]

Maybe this thread could shed some light?

https://forum.hddguru.com/viewtopic.php?f=1&t=42905

[pbzcbf...@gmail.com]

Digital signature in inactive segment

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00007A80  33 22 11 00 00 00 00 00 00 00 00 00 00 00 00 00  3"..............
00007A90  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00007AA0  00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22  ....""""""""""""
00007AB0  22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22  """"""""""""""""
00007AC0  22 22 22 22 11 11 11 11 11 11 11 11 11 11 11 11  """"............
00007AD0  11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11  ................
00007AE0  11 11 11 11                                      ....

Digital signature in active segment

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00047A80  01 00 00 00 70 76 2B F7 9C 3D 41 7A D5 89 12 C4  ....pv+÷œ=AzÕ‰.Ä
00047A90  BE 9A 31 96 7E 28 F3 CA 5E F8 0C 88 8E 35 C9 D5  ¾š1–~(óÊ^ø.ˆŽ5ÉÕ
00047AA0  02 A6 D2 2D E5 13 B6 6F FB D3 04 78 F7 77 40 15  .¦Ò-å.¶oûÓ.x÷w@.
00047AB0  2C C7 FF 09 42 DA 5B D3 69 AD BB 0F AC 7B 01 DE  ,Çÿ.BÚ[Ói.».¬{.Þ
00047AC0  B2 BB 62 E5 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A  ²»bå............
00047AD0  0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A  ................
00047AE0  0A 0A 0A 0A                                      ....

[pbzcbf...@gmail.com]

Here are comments by @Doomer:

https://forum.hddguru.com/viewtopic.php?p=300878#p300878

"First I would make sure that PCB (not the ROM) is original, its SN is W239EASD (requires scanning of the QR code)
If it is then I would guess the ROM code is not original.

This code if from a newer version of the Rosewood drive that can't be unlocked by PC3K, it requires a newer CPU as well (can't be told apart just by looking on its markings).
Using older type of the CPU would result in signature validation failure (just as the OP is having problems with).

One more thing, in addition to what I said.
ROM could have been somewhat incorrectly modified by one of many DR tools that do ROM unlocks and this could have resulted in signature failure."

[$300 Data Recovery]

Great info for next time! Thank you Fraser and Frank!