ST9500325AS dead PCB with shorted ROM

[Markus Bauer]

Hello,

from my last ST9500325AS I had still a donor PCB laying around and I got today another ST9500325AS with a dead rom.

So I tryed to find the closest firmware on hddsurgery and reprogrammed the ROM hoping that I can read that way maybe the SA and then try to reconstruct the ROM.

I get the head a few times knocking and then it comes ready. The terminal shows that:

Rst 0x08M
RW cmd 002F req = 18 F0 9F E5 18 F0 9F E5 18 F0 9F E5 18 F0 9F E5 18 F0 9F E5 00 00 A0 E1
            opts = 00000000

RW Err = 84150180

ASCII Diag mode

F3 T>
Wyatt TetonST4 Mule 01 Teton4.2 DDR160M 240M 248SS ZG
Product FamilyId: 3C, MemberId: 01
HDA SN: S2WBFHKB, RPM: 5449, Wedges: F8, Heads: 4, Lbas: 3A386030, PreampType: 78 07
PCBA SN: 0000N2264DKF, Controller: TETONST_4(63A2)(3-0E-4-2), Channel: AGERE_COPPERHEAD_LITE, PowerAsic: MCKINLEY MOBILE PLUS Rev 15, BufferBytes: 800000
Package Version: WY05A7.BSM1.DA99LO., Package P/N: ---------, Package Builder ID: 84,
Package Build Date: 09/21/2011, Package Build Time: 15:26:16, Package CFW Version: WY05.BSM1.00391541.8400,
Package SFW1 Version: 7AEE, Package SFW2 Version: ----, Package SFW3 Version: ----, Package SFW4 Version: ----
Controller FW Rev: 00990001, CustomerRel: 0003, Changelist: 00391541, ProdType: WY05.BSM1, Date: 09/21/2011, Time: 152616, UserId: 00080603
Servo FW Rev: 7DED
RAP FW Implementation Key: 0E, Format Rev: 3D03, Contents Rev: 26 1E 04 05
Features:
- Quadradic Equation AFH enabled
- VBAR with adjustable zone boundaries enabled
- Volume Based Sparing enabled
- IOEDC enabled
- IOECC enabled
- DERP Read Retries enabled
- LTTC-UDR2 enabled 

I guess the PreAmp-Type is from the HSA itself because without the HDD attached it shows 00 00 for the Preamp.

But I am not really sure if the heads are OK and I just can't read or if the heads are gone as well.

When I try to read the heads resistance I get:

F3 T>/7

F3 7>X

LED:000000CC FAddr:0025B437
LED:000000CC FAddr:0025B437

I googled both and many had some issue like that but no info on how they finally solve it. As the majority of people assume the head is gone I would maybe try to swap the head but can I even trust the PreAmp type?

And I had another idea - as I have 3 working ones but none with fitting PreAmp wouldn't it possible to get the platters inside of a working drive? I know the G- and P-List will not fit but would that matter if I anyway have to try to reconstruct the ROM somehow?

[Markus Bauer]

I also tryed Frasers method but the Wyatt family drives just quit T> r1 and T> r3F with "Invalid Diag Cmd". I tested it with 2 of my stock donors.

In C> Q I didn't found anything like "read file" as in the output of one of my Paraoh donors. So there is no r-command in T> and probably also not in some other mode unless I have overlooked something...

Fraser checked that there are some copies of that method but I am stuck because the command don't exist...

The drive becomes even ready after a few times clicking and gives the me serial-number and model of the ROM-dump I used but 0.00 GB capacity. 

Rest of the data don't read: 

Getting detailed firmware version...
Failed to get firmware version!

Physical sector size : .............................Failed to get

physical sector size of service area : .............Failed to get

Number of physical heads : .........................Failed to get
Get System module information ...
     ID      length      Description
 =========================

Failed to get system module information!

Getting service area size.......
Service area size: : ................................Fail

Getting list  of sys files.......
Serial port error!
DT List is empty, please get DT List first!

Getting list  of sys files.......

I tryed also the Sys files viewer in MRT but no matter what values I use for Volume, FD and Copy I get just the error "Operation not supported on 7200.11 HDDs" so I guess that also depend on the r-command...

[Markus Bauer]

So basically I have just again replicated what Fraser tested on the last case!

Frank's idea to try a Loader sounds good but I am still not sure if I should rather go down that rabbit hole or first try to swap the heads for working ones. 

If I open up the Module-List I have at least some in there but I am not able to read module 6 not over ATA and not over Serial. Funny is that I can't even with a stethoscope hear that the head does something and so I ask:

• Where does that module-list come from?
• Does the module-list mean that the head work or not?

[pbzcbf...@gmail.com]

If you replace the PCB and heads from the same donor, then at least the head adaptives will match.

 

[Markus Bauer]

Thanks Frank.

Oh man - yesterday I was really bind! Maybe you know that days when you fiddle so long arround that your thinking becomes totally corrupted and you can't see the obvious!

I tested all on a fully working drive so SA and UA where fully accessable and FW is fully booted and the r1 command was not working so I am not sure a loader could change that or did you mean a loader created from a drive supporting that command? As a fully working drive don't support the download of Sys-files with r1 command and MRT say in the dialog which use that command that this operation is not supported on that model there is no way r1 will work except you did inject is somehow with a loader from another drive but I am not sure that will be possible.

Very good point Frank!

When I replace the head and the PCB together as a matching pair then I just need a donor with the right firmware. What could then be the caviot of that way? If I backup CAP, RAP and SAP from the working ROM I guess I could patch then any ROM with the right firmware and then restore CAP, SAP and RAP to the previous values and still maintain a working pair... 

Donors I have a few but no matching firmware ones - I will try to frankensein my very own one together and give it a shot unless someone tell me that this will not work.

Thanks!

[pbzcbf...@gmail.com]

As far as I can tell, if the ROM and SA firmware versions don't match, then you will see a compatibility error in terminal. The build codes will then tell you what to look for. 

A Seagate F3 loader typically consists of 4 SA overlays, one of which contains the code which supports the "r" terminal command.

[pbzcbf...@gmail.com]

I found a complete track dump for this model at HDD Guru. We could search the tracks and sys files for CAP, RAP and SAP. Then we would know whether there are copies of these adaptives in the SA. Otherwise, there may be manufacturing logs from which these adaptives could be rebuilt.

https://files.hddguru.com/download/MRT/Seagate/ST9500325AS-0003SDM1-6VE8NCXS.rar

The above resource also contains an MRT loader.

[pbzcbf...@gmail.com]

The CAP (~0007.rpm), RAP (~0006.rpm) and SAP (~0004.rpm)  are backed up in the SABackup\ModDir  directory. These are located on SA track 2.

The contents of these files differ very slightly from their corresponding ROM adaptives. The sys files have no header or footer or CRC, but these components are easy enough to add.

If you can retrieve these files from the SA, or retrieve track #2, then I should be able to build a ROM for you. Or you could try building your own with F3RomExplorer.

[pbzcbf...@gmail.com]

By the way, MRT's loaders are encrypted. I have written a Python script to decrypt them, if you need it.

[Markus Bauer]

I come back to that for sure - thank you very much so far.