WDC Module checksum calc and thoughts on mod 47

Research and Development. This is the place to report experimental stuff related to data recovery.
m4sterful
Registered User
Registered User
Posts: 26
Joined: Mon Aug 26, 2013 8:29 pm

WDC Module checksum calc and thoughts on mod 47

Postby m4sterful » Fri Aug 15, 2014 12:38 pm

here is a small app related to some stuff I'm playing with, it checks the module of a WD drive and confirms if the checksum is right. If it's wrong, it calculates the correct one. Comes with source.

Checksums on modules are calculated by adding the dword values (that is 4 byte values) to each other, and then calculating the number whose value will cause the dword to go to zero (0).

to calculate the values, you open file, add each dword value (little endian) and that's it. if it doesn't add to 0 the module will not be loaded by the drive on boot.

By basically doing NOT result + 1 you get the proper value it should be, then you byte swap it to get the visually proper value you can enter into the module you've just edited.

WDC Module check.rar
checks wd modules and calcs hash
(160.59 KiB) Downloaded 129 times

fzabkar
Contributor
Contributor
Posts: 550
Joined: Tue Apr 16, 2013 9:28 am
Location: Australia

Re: WDC Module checksum calc and thoughts on mod 47

Postby fzabkar » Fri Aug 15, 2014 9:45 pm

Thanks.

m4sterful
Registered User
Registered User
Posts: 26
Joined: Mon Aug 26, 2013 8:29 pm

Re: WDC Module checksum calc and thoughts on mod 47

Postby m4sterful » Sat Aug 16, 2014 10:16 pm

Forgot to put down my data on module 47, thinking of making an app for that today though, so I'll put that up too when its done..

fzabkar
Contributor
Contributor
Posts: 550
Joined: Tue Apr 16, 2013 9:28 am
Location: Australia

Re: WDC Module checksum calc and thoughts on mod 47

Postby fzabkar » Sun Aug 17, 2014 1:20 am

m4sterful wrote:Forgot to put down my data on module 47, thinking of making an app for that today though, so I'll put that up too when its done..

I'm looking forward to it.

I've looked at the structure of MOD 47, but the only observations I can make are in regard to the table and to various patterns in the data. I have no idea what each data set means, though.

WD30EZRX-00DC0B0

Code: Select all

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  52 4F 59 4C 01 00 1E 00 47 00 03 00 99 51 35 7A  ROYL....G....Q5z
00000010  48 53 6F 30 30 30 30 36 07 07 07 00 30 00 C0 01  HSo00006....0.À.
00000020  E0 01 00 00 00 00 00 00 00 00 00 00 00 00 43 57  à.............CW

WD2002FAEX-00MJRA0

Code: Select all

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  52 4F 59 4C 01 00 1E 00 47 00 03 00 E9 D2 35 ED  ROYL....G...éÒ5í
00000010  43 54 2E 37 37 37 37 00 01 01 04 00 30 00 24 02  CT.7777.....0.$.
00000020  4C 02 00 00 00 00 00 00 00 00 00 00 00 00 45 59  L.............EY

It appears that offsets 1Ch - 1Dh, 1Eh - 1Fh, and 20h - 21h point to 3 data sections within the module.

The WD30EZRX-00DC0B0 appears to consist of the following sections:

    0x030 - 0x1BF
    0x1C0 - 0x1DF
    0x1E0 - 0x5FF

... and the WD2002FAEX-00MJRA0 ...

    0x030 - 0x223
    0x224 - 0x24B
    0x24C - 0x5FF

I don't know if the last section extends to the end of the module.

Here is section 1 of MOD 47 for the WD30EZRX-00DC0B0:

Code: Select all

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F 20 21 22 23 24 25 26 27 28 29 2A 2B 2C 2D 2E 2F 30 31

00000000  F0 6B 2A 80 72 00 0F 0D 0F 0D 55 56 8C 04 78 01 00 DA 48 80 02 04 09 2D 56 08 08 01 02 01 02 03 D0 09 00 00 00 84 20 00 80 08 40 00 00 00 00 00 00 00
00000032  F0 6B 26 80 72 00 0F 08 0D 08 55 56 8C 04 78 01 00 DA 42 80 01 03 06 28 56 07 08 03 01 01 72 03 D0 09 00 00 00 84 21 00 80 08 40 00 00 00 00 00 00 00
00000064  E0 6B 22 80 72 00 0F 0E 10 0E 55 56 8C 04 78 01 00 DA 4B 80 02 04 06 28 56 01 07 01 01 01 72 03 D0 09 00 00 00 84 26 00 80 08 40 00 00 00 00 00 00 00
00000096  F0 6B 22 80 72 01 0F 0B 10 0B 55 56 8C 04 78 01 00 DA 2E 80 02 04 05 28 56 09 09 03 01 01 02 04 D0 09 00 00 00 84 21 00 80 08 40 00 00 00 00 00 00 00
000000C8  E0 6B 26 80 72 00 0F 0F 0E 0D 55 56 8C 04 78 01 00 DA 40 80 02 05 09 2D 56 07 07 01 01 01 72 03 D0 09 00 00 00 84 22 00 80 08 40 00 00 00 00 00 00 00
000000FA  F0 6B 1E 80 72 01 0F 0D 0F 0C 55 56 8C 04 78 01 00 DA 44 80 00 02 02 23 56 05 09 02 02 01 02 04 D0 09 00 00 00 84 24 00 80 08 40 00 00 00 00 00 00 00
0000012C  C0 6B 20 80 72 00 0F 05 0F 05 55 56 8C 04 78 01 00 DA 80 80 03 04 08 2D 56 0A 05 03 01 01 02 00 D0 09 00 00 00 84 20 00 80 08 40 00 00 00 00 00 00 00
0000015E  C0 6B 20 80 72 00 0F 05 0F 05 55 56 8C 04 78 01 00 DA 80 80 03 04 08 2D 56 0A 05 03 01 01 02 00 D0 09 00 00 00 84 20 00 80 08 40 00 00 00 00 00 00 00

It appears to consist of 50-byte records for each of the 8 (?) heads.

Here is the same section for the WD2002FAEX-00MJRA0 (6 heads ?):

Code: Select all

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F 20 21 22 23 24 25 26 27 28 29 2A 2B 2C 2D 2E 2F 30 31

00000000  E0 2B 22 80 74 01 0F 0E 0F 0D 04 18 0C 00 57 00 00 DA 65 80 02 04 05 23 56 02 0C FE 02 01 02 04 D0 09 00 00 00 84 26 00 80 08 40 00 00 00 00 00 00 00
00000032  B0 2B 26 80 74 05 0F 0A 0D 09 04 18 0C 00 57 00 00 DA 4B 80 02 06 08 28 56 09 15 00 05 00 02 05 D0 09 00 00 00 84 3E 00 80 08 40 00 00 00 00 00 00 00
00000064  B0 2B 1C 80 74 02 0F 08 0D 09 04 18 0C 00 57 00 00 DA 4C 80 02 05 05 1E 56 06 0D 00 03 01 12 03 D0 09 00 00 00 84 20 00 80 08 40 00 00 00 00 00 00 00
00000096  E0 2B 26 80 74 04 0F 09 0D 08 04 18 0C 00 57 00 00 DA 5A 80 01 03 04 23 56 09 10 02 03 01 02 04 D0 09 00 00 00 84 23 00 80 08 40 00 00 00 00 00 00 00
000000C8  B0 2B 28 80 74 03 0F 09 0D 09 04 18 0C 00 57 00 00 DA 37 80 02 05 08 23 56 01 12 FF 03 FF 02 04 D0 09 00 00 00 84 3E 00 80 08 40 00 00 00 00 00 00 00
000000FA  B0 2B 22 80 74 04 0F 0D 0D 0C 04 18 0C 00 57 00 00 DA 52 80 02 04 05 23 56 07 11 FF 03 00 12 03 D0 09 00 00 00 84 3F 00 80 08 40 00 00 00 00 00 00 00
0000012C  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0000015E  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000190  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001C2  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00


The second section appears to have a single double-word entry for each head:

Code: Select all

Offset(h) 00       04       08       0C

00000000  1F723204 18842C06 1E722804 1A943207
00000010  20723002 1D743201 00042002 00042002

Code: Select all

Offset(h) 00       04       08       0C

00000000  16622E06 14543005 16542C07 17633007
00000010  30552C05 17522E04 00000000 00000000
00000020  00000000 00000000

I don't have any insight into the third section.
Attachments
MOD47.7z
(1.21 KiB) Downloaded 70 times

m4sterful
Registered User
Registered User
Posts: 26
Joined: Mon Aug 26, 2013 8:29 pm

Re: WDC Module checksum calc and thoughts on mod 47

Postby m4sterful » Sun Aug 17, 2014 3:26 am

I think you'll like this.. 0047 contains the surface adaptives of the drive -- that is the pre-amp and microjog values of the head stack.

Presenting my new ROYL adaptives tool. Takes as input any royl series module 47 or rom file, validates it as being one or the other based on the module having a header with a proper hash, and then spits out the microjogs and surface adaptive values! You can use this to match your western digital drives for head swaps.

Companies such as http://www.donordrives.com/ list these values - you want to look at microjogs when matching WD drives and modify the preamp values on your target drive for better copy results. The first of course is related to the space between the read and write heads on that particular head, the second is the measured value input from the preamplifier should be amplified to standardize input across all heads.

Note!! Only royl series, made this in.. well I've been working since this afternoon so ~4 hours, your milage may vary.

Why I made it: The PC3000 spits out these values very nicely, but sometimes it's busy recovering data. So we can use the DFL-WD... Except it lists the entries backwards from PC3000 (in little endian), and does not figure out the head count, so you can see in the picture below it has loaded the microjog values (which come after the preamp values) in as head 6 and 7!

There's one really, really big reason I made this though - these units require the drive to be on, and read the module from the drive only! We can't use a file we have on our hard drives. I have had in the past drives that will not boot properly, and getting 0047 is hard. So I have the file on my hard drive.. but ohhh I can't get the values! And most recently, working on a particular drive series (tornado 3), I found both systems couldn't read that module from the unit.. but they could read the full ROM, which HAS 0047 in it!

So this solves all that, reads the file off your hard drive and gives you the values. If you're cool dumping the rom and/or the module, here it is.

How I made it: Well I knew the adaptives were in 0047, from reading forums, instruction manuals, etc etc. I had noticed that the adaptives seemed to be in the same place on many but not all drives when comparing my commercial program outputs to the file. Then I was analyzing the header (for my previous program) and I realized that directly after the header was the offsets to the adaptive! Checked on 4 different series (zephyr, tornado, tornado3, shasta3d) and it seemed to line up. So then it was just a matter of going through carefully, making the app, and finally checking it against values provided by DFL and PC3000. I did it partially as a coding exercise and blind - compared to the commercial app output after creation. Happy to say it appears to line up, but please, test it, don't rely on it for $$$ hard drive swaps! This is part of a series of utilities I'm planning on creating so changing it to work with the old pre-marvell stuff is not in the plan, but if you find a rom it doesn't work with send it by and I could take a look...

So as for your comments - do I know everything that file does? no. For instance there is a *clear* data structure from 2eh to the data section marking the amplifier values, I don't know what that does, I may put more time into that. There's two copies of 0047 in most rom modules I see - a backup? a raw file? not sure.

BTW the modules you sent me has 6 heads with the following info:

HEAD NO | MICROJOGS | PREAMP VAL
0 - 10C5 - 62E6216
1 - 11D4 - 5305414
2 - 1032 - 72C5416
3 - 10F1 - 7306317
4 - 10B4 - 52C5530
5 - 10A9 - 42E5217
6 - A0A - 0000
7 - A0A - 0000

HEAD NO | MICROJOGS | PREAMP VAL
0 - 11F4 - 432721F
1 - 134B - 62C8418
2 - 122D - 428721E
3 - 1337 - 732941A
4 - 11F9 - 2307220
5 - 1311 - 132741D
6 - A0A - 2200400
7 - A0A - 2200400

We can see they both probably have 6 heads - when it starts showing "a0a" or "0000" the head doesn't exist. I try and guess how many heads based on the difference between the If I processed 0A, I could get that info too... but maybe next time.

0047.png
comparison

MOD47 tool.rar
module 47 analysis tool
(182.78 KiB) Downloaded 123 times

m4sterful
Registered User
Registered User
Posts: 26
Joined: Mon Aug 26, 2013 8:29 pm

Re: WDC Module checksum calc and thoughts on mod 47

Postby m4sterful » Sun Aug 17, 2014 3:36 am

Oh and I might not have been clear - but those values you found are entry points only, they don't indicate the actual size of the data in them.. the first value I see is before what you identified, at 1ah, that's the size of the file (0001, which is 1 sector, or 512 bytes). I actually use that to verify the file is the right size.

0030h is the one I'm interested in right now - I don't know exactly what it is.. I'm going to copy it out and stare at it a little.

0224h and 024Ch we know...

fzabkar
Contributor
Contributor
Posts: 550
Joined: Tue Apr 16, 2013 9:28 am
Location: Australia

Re: WDC Module checksum calc and thoughts on mod 47

Postby fzabkar » Sun Aug 17, 2014 6:18 am

Thanks very much. I confess that it's going to take some time to absorb your work, but in the meantime I thought I'd add a few more observations of my own.

You're correct about the WD30EZRX drive having 6 heads.

Here are several MOD 0A examples:

WD2002FAEX-00MJRA0

Code: Select all

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  52 4F 59 4C 04 00 1E 00 0A 00 01 00 39 5E 2B 69  ROYL........9^+i
00000010  30 30 30 32 30 30 30 30 07 03 0D 00 00 00 30 0D  00020000......0.
00000020  04 06 06 00 00 00 7C 4E 7C 5A 59 45 55 43 5A 46  ......|N|ZYEUCZF
00000030  55 55 00 00 FF FF FF FF FF FF 00 00 99 F5 3F 00  UU..ÿÿÿÿÿÿ...õ?.
00000040  3F 00 00 00 00 00 48 00 00 00 00 00 00 00 00 00  ?.....H.........

WD30EZRX-00DC0B0

Code: Select all

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  52 4F 59 4C 04 00 1E 00 0A 00 01 00 24 60 37 6D  ROYL........$`7m
00000010  30 30 30 32 30 30 30 30 0B 04 0C 00 00 00 30 0D  00020000......0.
00000020  04 06 06 00 00 00 7C 4E 7C 52 57 43 55 48 52 44  ......|N|RWCUHRD
00000030  55 55 00 00 FF FF FF FF FF FF 00 00 AA F5 3F 00  UU..ÿÿÿÿÿÿ..ªõ?.
00000040  3F 00 00 00 00 00 47 00 00 00 00 00 00 00 00 00  ?.....G.........

WD20NMVW-11AV3S0

Code: Select all

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  52 4F 59 4C 04 00 1E 00 0A 00 01 00 02 C5 D7 58  ROYL.........Å×X
00000010  30 30 30 31 30 30 30 30 05 01 0D 00 00 00 20 06  00010000...... .
00000020  00 08 08 FF 00 00 7C 51 7C 53 4A 4E 43 33 53 54  ...ÿ..|Q|SJNC3ST
00000030  00 00 00 00 00 00 00 00 00 00 00 00 7A FB 00 00  ............zû..

WD7500BPKT-00PK4T0

Code: Select all

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  52 4F 59 4C 04 00 1E 00 0A 00 01 00 E7 A6 E2 75  ROYL........ç¦âu
00000010  30 30 30 31 30 30 30 30 07 11 0B 00 00 00 20 06  00010000...... .
00000020  00 04 04 0F 00 00 7C 4B 7C 44 54 46 38 53 44 35  ......|K|DTF8SD5
00000030  00 00 00 00 00 00 00 00 00 00 00 00 9E FC 00 00  .............ü..

Offsets 16h - 1Fh appear to comprise a DCM string. There is a similar DCM string in MOD 02. In the case of the WD7500BPKT-00PK4T0, the correspondence between the two strings appears to be as follows:

Code: Select all

 | K | D T F 8 S D 5       MOD 0A
S|BKL|PDMTHFC8RSVDKYUF     MOD 02


After examing the output of SeDiv, it would appear that the Media type is "T" and the Head type is "F".

|K|DTF8SD5

If we examine MOD 47, we see "FT" at offsets 2Eh and 2Fh. These appear to be the DCM codes for the Head and Media types.

Code: Select all

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  52 4F 59 4C 01 00 1E 00 47 00 02 00 AA 01 2D 5E  ROYL....G...ª.-^
00000010  47 4A 2E 34 30 31 34 38 07 07 07 00 30 00 44 01  GJ.40148....0.D.
00000020  5C 01 00 00 00 00 00 00 00 00 00 00 00 00 46 54  \.............FT

Similarly, we find "CW" and "EY" in the other examples.

Offsets 21h and 22h in MOD 0A appear to reflect the number of heads. Offset 23h looks like a head map in the earlier models, but this appears to change to 3Eh and/or 40h in later models.

fzabkar
Contributor
Contributor
Posts: 550
Joined: Tue Apr 16, 2013 9:28 am
Location: Australia

Re: WDC Module checksum calc and thoughts on mod 47

Postby fzabkar » Sun Aug 17, 2014 6:40 am

m4sterful wrote:Oh and I might not have been clear - but those values you found are entry points only, they don't indicate the actual size of the data in them.. the first value I see is before what you identified, at 1ah, that's the size of the file (0001, which is 1 sector, or 512 bytes). I actually use that to verify the file is the right size.

I understand your comment regarding the entry points, and I did make my own comment to that effect in relation to the third section. However, maybe I'm having a senior's moment, but I can't see a value of 0001 at offset 1Ah in MOD 47.

fzabkar
Contributor
Contributor
Posts: 550
Joined: Tue Apr 16, 2013 9:28 am
Location: Australia

Re: WDC Module checksum calc and thoughts on mod 47

Postby fzabkar » Sun Aug 17, 2014 10:34 am

Here is an example with the same microjog and preamp val offsets as the drive in your screenshot:

WD3200BEVT-22A23T0 (MOD 47, offset 0x30, 46 bytes per row)

Code: Select all

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F 20 21 22 23 24 25 26 27 28 29 2A 2B 2C 2D

00000000  E0 C5 18 80 71 00 0F 12 12 12 6E FC BC 04 38 01 40 DA 50 C0 02 05 0B 32 56 0B 09 05 02 02 12 02 C0 09 00 00 00 84 24 00 00 FF 20 00 80 40
0000002E  E0 C5 1A 80 71 00 0F 10 10 11 6E FC BC 04 38 01 40 DA 40 C0 03 05 0B 32 56 0B 07 03 02 01 02 02 C0 09 00 00 00 84 24 00 00 FF 20 00 80 40
0000005C  C0 C5 20 80 71 00 0F 05 0F 05 6E FC BC 04 38 01 40 DA 80 C0 02 03 0B 10 56 0A EB F0 00 FB 02 00 C0 09 00 00 00 84 20 00 00 FF 20 00 80 40
0000008A  C0 C5 20 80 71 00 0F 05 0F 05 6E FC BC 04 38 01 40 DA 80 C0 02 03 0B 10 56 0A EB F0 00 FB 02 00 C0 09 00 00 00 84 20 00 00 FF 20 00 80 40
000000B8  C0 C5 20 80 71 00 0F 05 0F 05 6E FC BC 04 38 01 40 DA 80 C0 02 03 0B 10 56 0A EB F0 00 FB 02 00 C0 09 00 00 00 84 20 00 00 FF 20 00 80 40
000000E6  C0 C5 20 80 71 00 0F 05 0F 05 6E FC BC 04 38 01 40 DA 80 C0 02 03 0B 10 56 0A EB F0 00 FB 02 00 C0 09 00 00 00 84 20 00 00 FF 20 00 80 40


It appears to have two heads, and this is confirmed by an examination of MOD 0A.

Code: Select all

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  52 4F 59 4C 04 00 1E 00 0A 00 01 00 FE A8 AF 74  ROYL........þ¨¯t
00000010  30 30 58 31 30 30 30 32 04 05 0B 00 00 00 20 06  00X10002...... .
00000020  00 02 02 03 00 00 7C 42 7C 57 4C 4B 54 4C 59 44  ......|B|WLKTLYD
00000030  00 00 00 00 00 00 00 00 00 00 00 00 6E FC 00 00  ............nü..


BTW, it does appear to me that the entry points do in fact define the beginning an end of the first and second data sections, but the length of the last section is unclear.

BadBlock
Contributor
Contributor
Posts: 73
Joined: Sat Jan 11, 2014 12:37 am

Re: WDC Module checksum calc and thoughts on mod 47

Postby BadBlock » Sun Aug 17, 2014 2:05 pm

Very interesting information; thank you both. Will take quite a while to truely understand everything though.

m4sterful
Registered User
Registered User
Posts: 26
Joined: Mon Aug 26, 2013 8:29 pm

Re: WDC Module checksum calc and thoughts on mod 47

Postby m4sterful » Mon Aug 18, 2014 10:21 am

Ah, that's great. I knew head count was in 0A somewhere, but you've snagged it. Re 21h and 22h - looks like one is the amount of physical heads, and the other is the amount of virtual heads - as below, where I've cut one head.

Code: Select all

00000000h: 52 4F 59 4C 04 00 1E 00 0A 00 01 00 F6 B6 EC 58 ; ROYL........ö¶ìX
00000010h: 30 30 30 31 30 30 30 30 08 04 0B 00 00 00 20 06 ; 00010000...... .
00000020h: 02 03 02 06 00 00 7C 50 7C 47 4B 4D 4D 4E 45 4F ; ......|P|GKMMNEO


.. time for a new little app.

Also as the code is 'simply' ARM/RISC assembler I'm thinking of trying to tie in dissassembly here somewhere. Have you made, or do you know anyone to have made any progress that way, such as in this post? http://forum.hddguru.com/viewtopic.php?f=13&t=20324

m4sterful
Registered User
Registered User
Posts: 26
Joined: Mon Aug 26, 2013 8:29 pm

Re: WDC Module checksum calc and thoughts on mod 47

Postby m4sterful » Mon Aug 18, 2014 1:12 pm

I understand your comment regarding the entry points, and I did make my own comment to that effect in relation to the third section. However, maybe I'm having a senior's moment, but I can't see a value of 0001 at offset 1Ah in MOD 47.


As for that, that one was my bad, I was completely off base there.

m4sterful
Registered User
Registered User
Posts: 26
Joined: Mon Aug 26, 2013 8:29 pm

Re: WDC Module checksum calc and thoughts on mod 47

Postby m4sterful » Mon Aug 18, 2014 1:55 pm

New info on 0A: offset 23h is the head map, in binary

Happened I was comparing two drives with same family, heads, head count, etc., but one with 400GB config'd 1,3,4,5 and another 500 config'd as 1,2,3,4,5, and I noticed that address 23h directly after head count shows 3A on one and 3E on the other. Well if we assume in binary we have 00000000 = 8 possible heads, 3A = 00111010 and 3E is 00111110.

Used one of my tools to verify, and this is the case. I see that another address must also be related, as this is changed when a commercial tool does it 'officially' (don't want to say at this point as this is not my work, but theirs - may be a checksum or another important value but not sure), but for just getting an idea of the head map, 23h is all you need it appears.

fzabkar
Contributor
Contributor
Posts: 550
Joined: Tue Apr 16, 2013 9:28 am
Location: Australia

Re: WDC Module checksum calc and thoughts on mod 47

Postby fzabkar » Mon Aug 18, 2014 5:49 pm

Offset 23h is the head map in earlier models, but in later models (eg WD2002FAEX-00MJRA0 and WD30EZRX-00DC0B0) it has a value of 0. That's why I suggested that offsets 3Eh or 40h (= 3F) might be suitable candidates in the newer firmware.

m4sterful
Registered User
Registered User
Posts: 26
Joined: Mon Aug 26, 2013 8:29 pm

Re: WDC Module checksum calc and thoughts on mod 47

Postby m4sterful » Mon Aug 18, 2014 8:44 pm

Didn't notice your comment on that. Had a look at 3Ch in 0A?

fzabkar
Contributor
Contributor
Posts: 550
Joined: Tue Apr 16, 2013 9:28 am
Location: Australia

Re: WDC Module checksum calc and thoughts on mod 47

Postby fzabkar » Mon Aug 18, 2014 10:00 pm

I noticed the two bytes at 3Ch, but I don't know what to make of them.

m4sterful
Registered User
Registered User
Posts: 26
Joined: Mon Aug 26, 2013 8:29 pm

Re: WDC Module checksum calc and thoughts on mod 47

Postby m4sterful » Tue Aug 19, 2014 4:27 am

related to head map.. can't see how. Change head count or position it is changed as well.. maybe 16 bit checksum? Tried checksumming a few ranges but it didn't quite add up..

m4sterful
Registered User
Registered User
Posts: 26
Joined: Mon Aug 26, 2013 8:29 pm

Re: WDC Module checksum calc and thoughts on mod 47

Postby m4sterful » Tue Aug 19, 2014 4:44 am

It's a single word checksum of the addresses 1e to 3d, such that it should equal zero; much like header 0c to 0f, but just not a dword.

This fit's nicely with the header being 30 bytes (I was pretty sure of my definition as in my source code for the latter app but.. nice to see that confirmed), and the next section being 30 bytes also, with a 2 byte checksum footer. I expect many other entries could be similarly defined..

fzabkar
Contributor
Contributor
Posts: 550
Joined: Tue Apr 16, 2013 9:28 am
Location: Australia

Re: WDC Module checksum calc and thoughts on mod 47

Postby fzabkar » Tue Aug 19, 2014 9:22 am

Nice find. Ironically I had first thought that those two Head/Media ASCII characters in MOD 47 may have constituted a checksum word, but I didn't think to explore that same possibility in MOD 0A.

User avatar
Spildit
Posts: 1554
Joined: Sat Apr 06, 2013 4:59 pm
Location: Portugal
Contact:

Re: WDC Module checksum calc and thoughts on mod 47

Postby Spildit » Mon Dec 29, 2014 11:15 pm

Thanks ! Very nice !!!
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)


Return to “R&D - Experiments”

Who is online

Users browsing this forum: Google [Bot] and 1 guest