===== INDEX =====
* http://rzr.online.fr/q/alpine# How to reset #SeaGate #HdD #ST3120026A (#AlpinE) and #UnLock #MaxSecurity activation , #HdParm fails to rd
===== TODO =====
* http://yura.projektas.lt/files/seagate/720011_ES2.html LearN SaOffset 0x47?
* http://rzr.online.fr/x/pdf/http://www.rom.by/files/Offsets.xls
* http://forum.hddguru.com/viewtopic.php?f=13&t=27119
===== ST3120026A : SeaGate Barracuda 7200.7 =====
How to [[unlock]] [[ST3120026A]] when it's in maximum security and the master password is lost ( I tested generics ones "Seagate [ space padding to 32char ]" and others but it just failed"...
I dont care of the existing data on it , I just want to reset it if possible...
Can this be done for free using software , or do I need a RS232 hardware ?
http://forum.hddguru.com/search.php?keywords=seagate+lock&terms=all&author=&sc=1&sf=all&sk=t&sd=d&sr=posts&st=0&ch=300&t=0&submit=Search
http://hdd-911.com/index.php?option=com_docman&Itemid=31&task=view_category&catid=69&order=dmdate_published&ascdesc=DESC
==== ToDo : find "SA Offsets" ====
You have to adapt it for U9 (that is, find the correct sa track and sector, and modify the buffers).
* http://rzr.online.fr/x/pdf/http://www.rom.by/files/Offsets.xls
* http://yura.projektas.lt/files/seagate/
* http://yura.puslapiai.lt/files/seagate/Offsets.htm
~ Dependence of the second and third letters of the serial number and the number of heads (meaning taken from APP and ROM).
Heads 1 Heads 2 Heads 3 Heads 4
8 ALPINE JX, MQ, MW 20 JV, LH, MR, MX, NL 21 JT, MS, NR 22 JS, MT, LJ, NS 23
9 APLUS JX E0 JV, LH E1 JT E2 LJ, JS E3
10 APLUS JR F0 JQ F1 JP F2 JN F3
11 PUMA JX, MQ A8 JV, MR A9 JT, MS AA MT, JS AB
So for JT (as printed on HDD) :
* Alpine Type=22 Heads=3 (that's what UarT log reported : ALPINE - 1_Disk M.14 01-16-03 11:51 )
* Alpus Type=E2 Heads=3
* Puma Type=AA Heads=3
~ Offset core system tracks HDD Seagate Barracuda with respect to the system area and the length of objects for subtraction, all values in HEX.
~ The structure of SA Seagate Barracuda drives. Saved is the beginning and length. All values are in HEX.
Hdd label report "FirmWare: 3.06" :
Model : Cert (sa/sect) : Ata Ovl (s/s) : Vendor (s/s) : App code (s/s/buffer) : Cert table (o/t/s)
ALPINE (FW:3.xx) 0x29 240h 0x2A 5Dh 0x2C 12h 0x15 0x69 180h 80 0x29 240h 11h-12h
ALPINE (FW:8.xx) 0x29 244h 0x2A 61h 0x2C 12h 0x15 0x69 180h 80 0x29 244h 11h-12h
APLUS 0x47 2F8h 0x49 61h 0x4B 12h 0x15 0x16 0x2C 0x2D 180h 80 0x47 2F8h 13h
PUMA 0x47 H0=280h H1=134h All=3B4h 0x49 71h 0x4B 12h 0x15 0x16 0x2C 0x2D 1A0h 60 0x48 134h 14h
* Model : ALPINE (FW:3.xx)
** Cert: Offset_SA=0x29 ; Sectors=240h
** Ata Ovl : Offset_SA=0x2A ; Sectors=5Dh
** Vendor : Offset_SA=0x2C ; Sectors=12h
** App Code : Offsets_SA=0x15,0x69 ; Sectors=180h ; Buffer=80
** Cert Table : Offset_SA=0x29 ; Offset_Track=240h ; Sectors=11h-12h
==== ALPINE - 1_Disk M.14 01-16-03 11:51 ====
* http://www.hardw.net/forum/viewtopic.php?p=70936#70936
* http://www.pc-hospital.net/html/En/2008/0923/3675.html
Ctrl+L : RoM InfO
T>ALPINE - 2_Disk 3.06 10-21-03 15:53
Built for ALPINE,GRAND2,Diamondback,TI1761 PreAmp,STL6 Andante PreAmp,InternalSpin,GC110,SVC123AC,OneToOne,2Disk,LowDelta,220 Servos,7200RPM,8Pole,NonModGray,100MHz,Code DRAM,Early Exit,Stall Converter,RwFeat=0000,SeaDex,HDW
# ctrl+a :
Eng Rev = .M67
# ctrl+a:
2>/8
8>C20
(SN: 5JT1GGXH)
ToDo :
* http://forum.hddguru.com/viewtopic.php?f=1&t=26132&view=previous
* http://malthus.zapto.org/viewtopic.php?f=22&t=211&p=970#p970
* http://www.msfn.org/board/topic/158484-solution-seagate-barracuda-72007-pataide-diagnostic-serialuart-port/
* http://www.ihdd.ru/forum/seagate-st340014a-i-st380011a-gramotno-zapustit-selfskan-t6632-180.html
0x2A, 50h sectors
Ctr+z: T>/2
2>x
Zone 00: 00018 - 00BE8 1100 (044C) 683.439
...
Zone 0F: 155D7 - 16358 572 (023C) 363.922
Sys= 0F68E-0F70D 0280 SPTK on sys trks
~ SA starts from cylinder 0xF68E, this is your base cylinder, 0x280 sectors per track.
~ at the end of the log will be the coordinates of the system area
~ add the offset to the top and get the overlay start address where to write an overlay
Stuff Was Unreadable
T>F
SetStuff->ASCIFE
Setting stuff to defaults
Ok We can assume that
"Sys= 0F68E-0F70D 0280 SPTK on sys trks"
SA_start_cyl=0F68E
Model : ALPINE (FW:3.xx)
* Cert: Offset_SA=0x29 ; Sectors=240h
* Ata Ovl : Offset_SA=0x2A ; Sectors=5Dh
* Vendor : Offset_SA=0x2C ; Sectors=12h
* App Code : Offsets_SA=0x15,0x69 ; Sectors=180h ; Buffer=80
* Cert Table : Offset_SA=0x29 ; Offset_Track=240h ; Sectors=11h-12h
Cert :
~ // SA_start_cyl + 0x29
~ R_SECTORS/F6B7/0/200/0/280/CERT_0_F6B7.trc/1/1
AtaOvl :
~ // SA_start_cyl + 0x2A
~ R_SECTORS/F6B8/0/200/0/280/OVL_0_F6B8.trc/1/1
App Code :
~ // SA_start_cyl + 0x15 and + 0x69 (copy)
~ R_SECTORS/F6A3/0/200/0/280/APP_0_F6A3.trc/1/1
~ R_SECTORS/F6F7/0/200/0/280/APP_0_F6F7.trc/1/1
echo " 0x0F68E + 0x15 " | wcalc -h
= 0xf6a3
echo " 0x0F68E + 0x69 " | wcalc -h
= 0xf6f7
Vendor :
~ // SA_start_cyl + 0x2C
~ R_SECTORS/F6BA/0/200/0/280/VENDOR_0_F6BA.trc/1/1
# forum.hddguru.com/viewtopic.php?f=13&t=27119&start=40 7200.7 unlock zoc script
^Z
T>/1
1>N5
1> .
1>Pgm=00 Trk=0F6BA(0F6BA).0(0).003(002) Zn=0 Err=00 ErCt=0000 Hlth=0008 CHlth=0000 Ready LBA=00000000
1>/2
2>s0F6BA,00,22
2>r,05,1
2>r,06,1
1>B0200,0200
2>B0200,0200
buffer 0200 comparing to 0200 RD:0200:10:00 WR:0210:10:00
Addr 0 1 2 3 4 5 6 7 8 9 A B C D E F 10 1 2 3 4 5 6 7 8 9 A B C D E F
040000 01015365 61676174 65202020 20202020 20202020 20202020 20202020 20202020
040020 2020CAA1 415DC0AD 856DC0AD 856DA687 42F58F5E B6538227 01890000 00000000
040040 00000220 28100000 00000000 00000000 00000000 00000000 00000000 00000000
040060 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
040080 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0400A0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0400C0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0400E0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
040100 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
040120 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
040140 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
040160 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
040180 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0401A0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0401C0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0401E0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
040200 FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFBFFFF FFFFFFFF FFFFFFFF FFFFFFFF
2>.
2>Pgm=00 Trk=0F6BA(0F6BA).0(0).007(006) Zn=0 Err=00 ErCt=0000 Hlth=0008 CHlth=0000 Ready LBA=00000000
Master PassWord :
0x5365616761746520202020202020202020202020202020202020202020202020
"Seagate " # 01234567890ABCD = 0x53656167617465 = "Seagate" + ' '*25 = 32c
* "0x0101" designates that User PWD is installed, type of protection - Maximum.
* http://www.progtown.com/topic364189-removal-of-the-atapassword-with-hdd-p65.html
22H is usser password offset :
040020 2020CAA1 415DC0AD 856DC0AD 856DA687 42F58F5E B6538227 01890000 00000000
040040 00000220 28100000 00000000 00000000 00000000 00000000 00000000 00000000
User PassWord :
0xCAA1415DC0AD856DC0AD856DA68742F58F5EB653822701890000000000000000
/1 U 040022
Adr 40022 = CA --> 20
U040022
Adr 40022 = 20 --> 31
U040023
Adr 40022 = 20 --> 31 # Ctrl-z
* http://forum.hddguru.com/viewtopic.php?f=13&t=27119&start=40 7200.7 unlock zoc script
* http://www.progtown.com/topic364189-removal-of-the-atapassword-with-hdd-p65.html# Read
==== TODO : Find Cylinder FOR U9 ====
* http://www.slideshare.net/er0080/pc-seag-bara p57
Someone else has same model :
* http://forum.hddguru.com/viewtopic.php?f=1&t=15626&p=103322&hilit=ST3120026A#p103322
Drive is ST3120026A / Alpine (U9).
On the one attempt the drive got to SA I have modules 1 through 10 except number 7 (APP).
I wasn't sure if the (P)PATA Reset suggested that the heads were OK?
Log output:
Interface task reset
4096k x 16 buffer detected
ALPINE - 1_Disk M.14 01-16-03 11:51
Buzz - (
F>Head Mask 0000 - Switch to full int.
Spin Ready
(
F>j,,1
8.01 04-05-04 15:38
(
T>Y20
T>(Interface task reset
4096k x 16 buffer detected
ALPINE - 1_Disk M.14 01-16-03 11:51
Head Mask 0000 - Switch to full int.
Spin Ready
8.01 04-05-04 15:38
(P)PATA Reset
Stuff Was Unreadable
T>
On U9 you will have to erase pwd by editing vendor track sector 6 edit first two bytes to 00 .
* http://forum.hddguru.com/viewtopic.php?f=1&t=12000&p=77722&hilit=U9#p77722
==== MISC ====
Barracuda 7200.7 (120GB) :
Model: ST3120026A
SN: 5JT1GGXH
PN: 9W2083-311
HDA PN: 100264019
Config: D48-02
Firmware: 3.06
Date Code: 04207
Site Code: WU
* http://rzr.online.fr/x/pdf/http://www.seagate.com/support/disc/manuals/ata/cuda7200pm.pdf
* http://www.seagate.com/ww/v/index.jsp?name=Barracuda_7200.7&vgnextoid=a0283b0c2aeef010VgnVCM100000f5ee0a0aRCRD&locale=en-US&reqPage=Legacy
[[password]] :
"0123456789ABCDEF0123456789ABCDEF"
"WDCWDCWDCWDCWDCWDCWDCWDCWDCWDCWD"
"Seagate " # 25char
"xty3fgds2h32j4kd02k9rfgep36435"
"idrive"
"XBOXSCENE"
"TEAMASSEMBLY"
http://forums.xbox-scene.com/lofiversion/index.php/t521161.html
[[ToDo]] :
* http://www.seagateunlock.com/seagate-barracuda-firmware-update-sm310.exe
[[Feedback]] :
* https://shop.maxim-ic.com/storefront/searchsample.do?event=Sample&menuitem=Sample&Partnumber=MAX232CWE%2B
* http://forum.hddguru.com/seagate-120gb-detected-but-unreadable-st3120026a-t12834.html#p94725
* http://forum.hddguru.com/how-unlock-seagate-st3120026a-max-security-mode-nopw-t14545.html
https://bugs.launchpad.net/ubuntu/+source/hdparm/+bug/487168
[[Sense]] Key : Aborted Command :
# dmesg
sd 1:0:0:0: [sdb] Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE
sd 1:0:0:0: [sdb] Sense Key : Aborted Command [current] [descriptor]
Descriptor sense data with sense descriptors (in hex):
72 0b 00 00 00 00 00 0c 00 0a 80 00 00 00 00 00
00 00 00 00
sd 1:0:0:0: [sdb] Add. Sense: No additional sense information
end_request: I/O error, dev sdb, sector 0
Buffer I/O error on device sdb, logical block 0
ata2: EH complete
http://lkml.indiana.edu/hypermail/linux/kernel/0903.3/01400.html
ToDo: FT232R Data Cable : DKU-5 or CA-42 Nokia
http://ireckon.net/2009/05/unbricking-a-seagate-barracuda/
http://sites.google.com/site/seagatefix/
* http://yura.projektas.lt/files/seagate/720011_ES2.html :
* m0 user area and a 2.2-quick format the remaining parameters can be left by default, saving only the dash, or by typing 0 in the end we put'ValidKey' [22]
* http://www.mapleleafmountain.com/seagatebrick.html
* http://forum.hddguru.com/how-unlock-seagate-st380012ace-t14488.html
* http://www.mitsubishiforum.com/forum/showthread.php?t=22994
* http://www.linuxquestions.org/questions/linux-general-1/need-to-unlock-30-hard-drives-792958/page2.html
* http://cmrr.ucsd.edu/people/Hughes/HDDEraseReadMe.txt
* http://www.rockbox.org/lock.html
MisC: "command F3" ???
* http://forum.ixbt.com/print/0011/037875.html
{{http://www.arkadasbilgisayar.com/images//products/harddisk_kart/seagate_35/ST3120026A/ST3120026A.jpg}}
==== HDPARM ====
532 sudo hdparm --security-disable "$passwd" "$dev"
533 history
http://ubuntuforums.org/showthread.php?t=2054553
sudo hdparm -I /dev/sdb
/dev/sdb:
SG_IO: bad/missing sense data, sb[]: 70 00 05 00 00 00 00 0a 00 00 00 00 24 00 00 c0 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ATA device, with non-removable media
Serial Number: ����:���U����
Standards:
Likely used: 1
Configuration:
Logical max current
cylinders 0 0
heads 0 0
sectors/track 510 0
--
Logical/Physical Sector size: 512 bytes
device size with M = 1024*1024: 0 MBytes
device size with M = 1000*1000: 0 MBytes
cache/buffer size = unknown
Capabilities:
IORDY not likely
Cannot perform double-word IO
R/W multiple sector transfer: not supported
DMA: not supported
PIO: pio0
===== REFERENCE : St310014A(S) ======
St310014A(S)
Interface task reset 1024k x 16 buffer
Ref 023B - Hd Msk 0A00 - Switch to full int.
Ready
C1 - ST310014A(S)
ROM.01.04
ATRst
PSlv
Interfacenterface task reHd Msk 0A00 - Pgm=60 Trk64(000664).0.000 Zn Ready
=7 Err=00 ErCt=0000 Hlth=0000 CHlth=0000 Ntrdy
C1 - ST310014A(S)
ROM.01.04
ATRst
PSlv
Interface task reset 1024k x 16 buffer
C1 - ST310014A(S)
ROM.01.04
ATRst
Interface task reset 1024k x 16 buffer
C1 - ST310014A(S)
ROM.01.04
ATRst
PSlv
2>/x
Invalid Entry
2>/2
2>x
VBPIConfig: 00 FF
RamHeadMap: 00 F1
Total Capacity= 01503790
SCyl ECyl H0 H1 H2 H3
---- ---- -- -- -- --
Zone 0: 00000064-00000095 576 NIL
Zone 1: 0000009C-000002BC 756 NIL
Zone 2: 000002BD-000009C4 748 NIL
Zone 3: 000009C5-00001130 736 NIL
Zone 4: 00001131-00001E78 720 NIL
Zone 5: 00001E79-00002580 699 NIL
Zone 6: 00002581-00002F44 672 NIL
Zone 7: 00002F45-00003C8C 658 NIL
Zone 8: 00003C8D-00004970 633 NIL
Zone 9: 00004971-000059D8 604 NIL
Zone A: 000059D9-00007210 576 NIL
Zone B: 00007211-00007EF4 534 NIL
Zone C: 00007EF5-000088B8 518 NIL
Zone D: 000088B9-0000DB87 518 NIL
16,388 CYL - 16 HDS - 63 SECT - LBA 20,005,650
{{http://www.lovinglotus.com/images/ta/july/sapcb3.jpg}}
==== ST310014ACE : ? Seagate U Series X 10 (Hard Drives: IDE/EIDE) ====
T>/2 (Enter)
2>S006b (Enter)
2>R21,01 (Enter)
2>C0,570 (Enter)
2>W20,01 (Enter)
T>/2 (Enter) :
# Enter Level2 : "work with drive using physical parameters"
2>S006b (Enter)
# sx,y Positioning to cylinder "x" , head "y"
2>R21,01 (Enter)
# ry,z Read sector from current service area track , y initial sector number , z number of sector
2>C0,570 (Enter)
# cx,y,z Compares buffer blocks :
# "x" beginning of the first block
# "y" beginning of the second block
# "z" block lenght
2>W20,01 (Enter)
# Wx,y,z Save System Sector from RAM to service area on disk surface
# (System sector includes adaptive data among other components)
# x, y not used, z=must be equal to 22
Sxxxx is a command seek to cylinder
3.3V LVTTL
@TaG: SeaGate
* http://rzr.online.fr/x/pdf/http://www.tdubel.com/artikkelit/tiedostot/ST310014ACE_unlocking_tutorial_english.pdf
* http://rzr.online.fr/x/pdf/http://www.evo-x.de/tutorials/dateianhaenge/ST310014A__Unlock_Tutorial_by_cyd0g_.pdf
* http://rzr.online.fr/x/pdf/http://www.tdubel.com/artikkelit/tiedostot/ST310014ACE_unlocking_tutorial_english.pdf
T>/2 (Enter) Enter Level2 : "work with drive using physical parameters"
2>S006b (Enter) sx,y Positioning to cylinder "x" , head "y"
2>R21,01 (Enter) ry,z Read sector from current service area track , y initial sector number , z number of sector
2>C0,570 (Enter) cx,y,z Compares buffer blocks : "x" beginning of the first block : "y" beginning of the second block , "z" block lenght
2>W20,01 (Enter) Wx,y,z Save System Sector from RAM to service area on disk surface (System sector includes adaptive data among other components) x, y noy used, z=must be equal to 22
==== SA ====
If S/R 2d and 3d digit are : JR (from S/N: 5JRETEX5)
* APLUS SN=JR TYPE=F0 HEADS=1
** Certs : Offset_SA=0x47 Sectors=2F8h
** ATA_Ovl Offset_SA=0x49 Sectors=61h
** Vendor Offset_SA=0x4B Sectors=12h
** AppCode Offsets_SA=0x15,0x16,0x2C,0x2D Sectors=180h Buffer=80
** Cert_table Offset_SA=0x47 Offset_track=2F8h Sectors=13h
printf "0x%x\n" 21 = 0x15 is this AppCode ?
* http://xdr5tgy7ujmcft67uhgbvvgy75thn.files.wordpress.com/2008/08/st310014ace-label.jpg#
* 16,383 CYL - 16 HDS - 63 SECT - LBA 20,005,650
* http://www.donordrives.com/media/catalog/product/cache/1/image/9df78eab33525d08d6e5fb8d27136e95/d/o/donor_1165.jpg# 5JREZ1L2
==== CYL ====
S006b could be number of cyl (see U Series X)
* http://www.slideshare.net/er0080/pc-seag-bara# page30
Series X
ACE LabU Series X Длина Key ID Номера цилиндров сектор (секторов)
Key ; ID ; Стартовый (секторо) ; Длина (секторов) ; Номера цилиндров
; ; starting (sector) ; lenght (sectors) ; Number cylinder
0x0A ; SYS1 ; 0x00A ; 0x005 ; 0x6B 0x7F 0x93
key=43130131
* https://en.wikipedia.org/wiki/Cylinder-head-sector
Size_in_Bytes = Cylinders*heads*sectors*512
Seagate ST380811AS [80 GB SATA] data sheet:
Bytes per sector 512
Default sectors per track 63
Default read/write heads 16
Default cylinders 16,383
===== OTHERS SEAGATES =====
cat alpine_rd.cmd
// ST380011A FW:3.06
// Barracuda 7200.7 Alpine M.14
// SA start cyl. F68E, SPT: 0x280
cat alpine_rd.txt
// ST380011A FW:3.06
// Barracuda 7200.7 Alpine M.14
// SA start cyl. E99B, SPT: 0x280
* http://forum.hddguru.com/viewtopic.php?f=13&t=27119&start=40 7200.7 unlock zoc script
===== MISC =====
* http://hackaday.com/2013/08/02/sprite_tm-ohm2013-talk-hacking-hard-drive-controller-chips/
* http://files.hddguru.com/index.php?action=downloadfile&filename=ST_MEM_FREE_28_12_06.ZIP&directory=Software/Seagate&# SeaGate
===== MORE =====
@TaG: AtA RpI SeriaL HdD IdE
{{http://elinux.org/images/2/2a/GPIOs.png}}