Tutorial: Using MHDD to send ATA commands to a HDD

Scripts for MHDD 4.5.
fzabkar
Contributor
Contributor
Posts: 550
Joined: Tue Apr 16, 2013 9:28 am
Location: Australia

Tutorial: Using MHDD to send ATA commands to a HDD

Postby fzabkar » Tue Jul 22, 2014 11:10 am

Tutorial: Using MHDD to send ATA commands to a HDD

MHDD is a freeware tool for testing and working with HDDs at the ATA register level. It does not use BIOS functions.

MHDD is available here:
http://hddguru.com/software/2005.10.02-MHDD/

Version 4.5 (not 4.6) incorporates ATA/SCSI Terminal. This feature enables commands to be sent to the drive by directly manipulating the ATA registers. These commands can be processed as scripts. Script files should be placed in a SCRIPTS subdirectory immediately below the MHDD directory (MHDD_dirname\SCRIPTS\).

To invoke a script file, type a period followed by the script filename, eg ...

    .wdscript
All filenames should be in DOS 8.3 format, ie no long filenames, or filenames with spaces.

Any file referenced by the script will need to be placed in the MHDD directory (not the SCRIPTS subdirectory), unless its 8.3 pathname is specified.

For example, a reference to a filename of "ABC.BIN" will require that ABC.BIN be in the MHDD directory, a reference to DATA\ABC.BIN will look for the file in MHDD_dirname\DATA\, and a reference to \ABC.BIN will search the root. This is very important when writing to the drive, as there may be unpredictable results when a file is not found.

MHDD looks for drives on the IDE channels. If the drive under test is a SATA model, then the corresponding SATA controller must be configured in BIOS for IDE mode, sometimes referred to as "legacy" or "compatibility" mode. By default, MHDD does not touch any drive on the primary IDE channel. Therefore I would suggest that the test HDD be configured as the master on the secondary IDE port. The HDD can be selected from a list of drives discovered by the PORT command.

Code: Select all

MHDD>port

      Primary port 1F0h is disabled. To enable see MHDD.CFG

      PORT 170h (Secondary controller)
   3.  [ WDC WD2500BB-55RDA0  20.00K20  WD-WMANK3034983  488,397,168     ]

      PORT 100h (PC-3000 board)
   5.  [                                                                 ]
-------------------------------------------------------------------------------
 WARNING: PRIMARY CHANNEL DISABLED FOR YOUR SAFETY
 WARNING: SLAVE DEVICES NOT SUPPORTED
 Enter HDD number [3]:


The drive's identity can be confirmed using the ID or EID (ATA Identify Device) commands.

The following sample script retrieves a drive's 512-byte Identify Device information using the ATA ECh command.

Code: Select all

; ATA Identify Device (ECh)

reset
waitnbsy
;      FEA CNT LBL LBM LBH DEV CMD
regs = $00 $00 $00 $00 $00 $a0 $ec
waitnbsy
; checkdrq
sectorsto = DATA\identify.bin


A leading semicolon indicates that the line is a comment.

"Waitnbsy" waits for the drive to complete a command.

"Checkdrq" monitors the DMARQ (DMA Request) line to facilitate data transfer.

"Sectorsto" transfers data from the drive to a file on the host.

"Sectorsfrom" transfers data from a file on the host to the drive (not present in above example).

"Regs" loads the ATA registers.

The registers are specified in the following order, from left to right:

    Feature
    Count
    LBA 00-07
    LBA 08-15
    LBA 16-24
    Device
    Command


Here is the resulting output for a WD2500BB:

Code: Select all

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  7A 42 FF 3F 37 C8 10 00 00 00 00 00 3F 00 00 00  zBÿ?7È......?...
00000010  00 00 00 00 20 20 20 20 57 20 2D 44 4D 57 4E 41  ....    W -DMWNA
00000020  33 4B 33 30 39 34 33 38 00 00 00 10 32 00 30 32  3K309438....2.02
00000030  30 2E 4B 30 30 32 44 57 20 43 44 57 35 32 30 30  0.K002DW CDW5200
00000040  42 42 35 2D 52 35 41 44 20 30 20 20 20 20 20 20  BB5-R5AD 0     
00000050  20 20 20 20 20 20 20 20 20 20 20 20 20 20 10 80                .€
00000060  00 00 00 2F 01 40 00 00 00 00 07 00 DD 10 0F 00  .../.@......Ý...
00000070  FF 00 0D F6 FB 00 10 01 FF FF FF 0F 00 00 07 04  ÿ..öû...ÿÿÿ.....
00000080  03 00 78 00 78 00 78 00 78 00 00 00 00 00 00 00  ..x.x.x.x.......
00000090  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
000000A0  FE 00 00 00 6B 74 01 7F 33 46 69 74 01 3E 23 46  þ...kt..3Fit.>#F
000000B0  3F 00 00 00 00 00 00 00 FE FF 0D 60 80 80 08 00  ?.......þÿ.`€€..
000000C0  00 00 00 00 A0 86 01 00 70 59 1C 1D 00 00 00 00  .... †..pY......
000000D0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
000000E0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
000000F0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000100  01 00 00 00 00 00 00 00 00 00 76 12 00 00 00 00  ..........v.....
00000110  00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00  ................
00000120  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000130  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000140  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000150  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000160  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000170  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000180  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000190  00 00 00 00 00 00 00 00 00 00 00 00 3F 00 00 00  ............?...
000001A0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
000001B0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
000001C0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
000001D0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
000001E0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
000001F0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 A5 B2  ..............¥²


The following document defines the ATA command standard:

AT Attachment 8 - ATA/ATAPI Command Set (ATA8-ACS):
http://www.t13.org/documents/UploadedDo ... A8-ACS.pdf

IMHO it is a good idea to keep copies of the earlier and later standards, as new features are added while others are made obsolete.

http://www.t10.org/ftp/t13/project/d0791r4c-ATA-1.pdf
http://www.t10.org/ftp/t13/project/d0948r4c-ATA-2.pdf
http://www.t10.org/ftp/t13/project/d2008r7b-ATA-3.pdf
http://www.t10.org/ftp/t13/project/d115 ... TAPI-4.pdf
http://www.t10.org/ftp/t13/project/d132 ... TAPI-5.pdf
http://www.t13.org/Documents/UploadedDo ... TAPI-6.pdf
http://www.t10.org/ftp/t13/docs2004/d15 ... TAPI-7.pdf (Vol 1)
http://www.t10.org/ftp/t13/docs2004/d15 ... TAPI-7.pdf (Vol 2)
http://www.t10.org/ftp/t13/docs2004/d15 ... TAPI-7.pdf (Vol 3)
http://web.archive.org/web/201306100751 ... ata10a.zip

fzabkar
Contributor
Contributor
Posts: 550
Joined: Tue Apr 16, 2013 9:28 am
Location: Australia

Using MHDD to send Vendor Specific Commands (VSC) to a WD dr

Postby fzabkar » Tue Jul 22, 2014 11:16 am

Using MHDD to send Vendor Specific Commands (VSC) to a WD drive

Western Digital uses the ATA SMART Command Transport to send Vendor Specific Commands (VSC) to its drives.

VSCs are encapsulated as data and transmitted to the drive via a "key sector" using a standard ATA SMART Write Log command (B0h / D6h). A subsequent SMART Write Log or SMART Read Log command (B0h / D5h) transfers data (eg SA modules) to or from the drive. Vendor specific log 0xBE is used for the key sector, while data are transferred via log 0xBF.

Prior to sending the Read/Write Log commands, the VSC Enable command (80h / 45h) must be sent to the drive. The LBAH and LBAM registers are loaded with 57h / 44h, ie the ASCII values for "WD".

There is also a corresponding VSC Disable command (80h / 44h).

The following script example reads 1 byte at offset 0x16 of section 0x0D of MOD 02.

The key sector (rd_0D_16.bin) contains the VSC ...

    2A 00 01 00 02 00 0D 00 16 00 01 00
The data are returned in 0D_16.bin. Each sector is padded with zeros.

Code: Select all

; VSC enable

reset
waitnbsy
regs = $45 $0b $00 $44 $57 $a0 $80
waitnbsy

; read idle3 timer byte at offset 0x16 in section 0x0D of module 02

regs = $d6 $01 $be $4f $c2 $a0 $b0
waitnbsy
checkdrq
sectorsfrom = rd_0D_16.bin
waitnbsy
regs = $d5 $01 $bf $4f $c2 $a0 $b0
waitnbsy
checkdrq
sectorsto = 0D_16.bin

; end of script


rd_0D_16.bin

Code: Select all

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  2a 00 01 00 02 00 0D 00 16 00 01 00 00 00 00 00
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
........
000001F0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

BadBlock
Contributor
Contributor
Posts: 73
Joined: Sat Jan 11, 2014 12:37 am

Re: Tutorial: Using MHDD to send ATA commands to a HDD

Postby BadBlock » Tue Jul 22, 2014 2:42 pm

Very informative. Thanks!

fzabkar
Contributor
Contributor
Posts: 550
Joined: Tue Apr 16, 2013 9:28 am
Location: Australia

MHDD script for retrieving Fujitsu HDD modules

Postby fzabkar » Wed Jul 23, 2014 11:25 am

MHDD script for retrieving Fujitsu HDD modules (MPE3064AT)

Attached is an MHDD script consisting of VSCs to retrieve HDD firmware modules from a Fujitsu MPE3064AT HDD. It is based on the information provided in the following thread:

viewtopic.php?f=92&t=57

The thread talks about MPG models, but the script appears to work for the MPE also. Some modules are not present in my MPE drive, so I had to edit the script to avoid errors from these missing modules.

BTW, here are freeware tools that can retrieve Fujitsu resources and others:

http://aplex86.narod.ru/firmprog.html
Attachments
MPE3064AT_ED-03-08_05469927.7z
(6.13 KiB) Downloaded 169 times
RDHD_MPG.7z
(556 Bytes) Downloaded 153 times

fzabkar
Contributor
Contributor
Posts: 550
Joined: Tue Apr 16, 2013 9:28 am
Location: Australia

Re: MHDD script for retrieving Fujitsu HDD modules

Postby fzabkar » Wed Jul 30, 2014 11:14 am

The following MHDD script retrieves all available SA modules numbered from 1 to 255 (decimal). It now incorporates error processing and no longer exits if a module does not exist. The script has been tested on a Fujitsu MPE3064AT.

Code: Select all

; read all HDD modules from Fujitsu MPG / MPE SA

reset
waitnbsy

; enable Fujitsu VSCs

regs = $fa $43 $42 $41 $40 $a0 $c1

; get modules

%modid = 0

@loop:
%modid = %modid + 1
if %modid = 256 @end
waitnbsy
regs = %modid $01 $00 $00 $00 $00 $c2
waitnbsy
%error = iserror
if %error = 1 @loop
checkdrq
sectorsto = fuj_mods\%modid.bin
goto @loop

@end:

User avatar
Spildit
Posts: 1554
Joined: Sat Apr 06, 2013 4:59 pm
Location: Portugal
Contact:

Re: Tutorial: Using MHDD to send ATA commands to a HDD

Postby Spildit » Wed Dec 31, 2014 3:26 pm

Thankkkksssss !!!!
Fantastic Tutorial !
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)


Return to “MHDD”

Who is online

Users browsing this forum: No registered users and 1 guest