How to unlock ST3120026A when it's in maximum security and the master password is lost ( I tested generics ones “Seagate [ space padding to 32char ]” and others but it just failed”…
I dont care of the existing data on it , I just want to reset it if possible… Can this be done for free using software , or do I need a RS232 hardware ?
You have to adapt it for U9 (that is, find the correct sa track and sector, and modify the buffers).
~ Dependence of the second and third letters of the serial number and the number of heads (meaning taken from APP and ROM).
Heads 1 Heads 2 Heads 3 Heads 4 8 ALPINE JX, MQ, MW 20 JV, LH, MR, MX, NL 21 JT, MS, NR 22 JS, MT, LJ, NS 23 9 APLUS JX E0 JV, LH E1 JT E2 LJ, JS E3 10 APLUS JR F0 JQ F1 JP F2 JN F3 11 PUMA JX, MQ A8 JV, MR A9 JT, MS AA MT, JS AB
So for JT (as printed on HDD) :
~ Offset core system tracks HDD Seagate Barracuda with respect to the system area and the length of objects for subtraction, all values in HEX.
~ The structure of SA Seagate Barracuda drives. Saved is the beginning and length. All values are in HEX.
Hdd label report “FirmWare: 3.06” :
Model : Cert (sa/sect) : Ata Ovl (s/s) : Vendor (s/s) : App code (s/s/buffer) : Cert table (o/t/s) ALPINE (FW:3.xx) 0x29 240h 0x2A 5Dh 0x2C 12h 0x15 0x69 180h 80 0x29 240h 11h-12h ALPINE (FW:8.xx) 0x29 244h 0x2A 61h 0x2C 12h 0x15 0x69 180h 80 0x29 244h 11h-12h APLUS 0x47 2F8h 0x49 61h 0x4B 12h 0x15 0x16 0x2C 0x2D 180h 80 0x47 2F8h 13h PUMA 0x47 H0=280h H1=134h All=3B4h 0x49 71h 0x4B 12h 0x15 0x16 0x2C 0x2D 1A0h 60 0x48 134h 14h
T>ALPINE - 2_Disk 3.06 10-21-03 15:53 Built for ALPINE,GRAND2,Diamondback,TI1761 PreAmp,STL6 Andante PreAmp,InternalSpin,GC110,SVC123AC,OneToOne,2Disk,LowDelta,220 Servos,7200RPM,8Pole,NonModGray,100MHz,Code DRAM,Early Exit,Stall Converter,RwFeat=0000,SeaDex,HDW # ctrl+a : Eng Rev = .M67 # ctrl+a: 2>/8 8>C20 (SN: 5JT1GGXH)
ToDo :
0x2A, 50h sectors
Ctr+z: T>/2 2>x Zone 00: 00018 - 00BE8 1100 (044C) 683.439 ... Zone 0F: 155D7 - 16358 572 (023C) 363.922 Sys= 0F68E-0F70D 0280 SPTK on sys trks
~ SA starts from cylinder 0xF68E, this is your base cylinder, 0x280 sectors per track.
~ at the end of the log will be the coordinates of the system area
~ add the offset to the top and get the overlay start address where to write an overlay
Stuff Was Unreadable T>F SetStuff->ASCIFE Setting stuff to defaults
Ok We can assume that
"Sys= 0F68E-0F70D 0280 SPTK on sys trks" SA_start_cyl=0F68E
Model : ALPINE (FW:3.xx)
Cert :
~ // SA_start_cyl + 0x29 ~ R_SECTORS/F6B7/0/200/0/280/CERT_0_F6B7.trc/1/1
AtaOvl :
~ // SA_start_cyl + 0x2A ~ R_SECTORS/F6B8/0/200/0/280/OVL_0_F6B8.trc/1/1
App Code :
~ // SA_start_cyl + 0x15 and + 0x69 (copy) ~ R_SECTORS/F6A3/0/200/0/280/APP_0_F6A3.trc/1/1 ~ R_SECTORS/F6F7/0/200/0/280/APP_0_F6F7.trc/1/1
echo " 0x0F68E + 0x15 " | wcalc -h = 0xf6a3
echo " 0x0F68E + 0x69 " | wcalc -h = 0xf6f7
Vendor :
~ // SA_start_cyl + 0x2C ~ R_SECTORS/F6BA/0/200/0/280/VENDOR_0_F6BA.trc/1/1
# forum.hddguru.com/viewtopic.php?f=13&t=27119&start=40 7200.7 unlock zoc script ^Z T>/1 1>N5 1> . 1>Pgm=00 Trk=0F6BA(0F6BA).0(0).003(002) Zn=0 Err=00 ErCt=0000 Hlth=0008 CHlth=0000 Ready LBA=00000000 1>/2 2>s0F6BA,00,22 2>r,05,1 2>r,06,1 1>B0200,0200 2>B0200,0200 buffer 0200 comparing to 0200 RD:0200:10:00 WR:0210:10:00 Addr 0 1 2 3 4 5 6 7 8 9 A B C D E F 10 1 2 3 4 5 6 7 8 9 A B C D E F 040000 01015365 61676174 65202020 20202020 20202020 20202020 20202020 20202020 040020 2020CAA1 415DC0AD 856DC0AD 856DA687 42F58F5E B6538227 01890000 00000000 040040 00000220 28100000 00000000 00000000 00000000 00000000 00000000 00000000 040060 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 040080 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 0400A0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 0400C0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 0400E0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 040100 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 040120 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 040140 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 040160 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 040180 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 0401A0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 0401C0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 0401E0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 040200 FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFBFFFF FFFFFFFF FFFFFFFF FFFFFFFF 2>. 2>Pgm=00 Trk=0F6BA(0F6BA).0(0).007(006) Zn=0 Err=00 ErCt=0000 Hlth=0008 CHlth=0000 Ready LBA=00000000 Master PassWord : 0x5365616761746520202020202020202020202020202020202020202020202020 "Seagate " # 01234567890ABCD = 0x53656167617465 = "Seagate" + ' '*25 = 32c * "0x0101" designates that User PWD is installed, type of protection - Maximum. * http://www.progtown.com/topic364189-removal-of-the-atapassword-with-hdd-p65.html 22H is usser password offset : 040020 2020CAA1 415DC0AD 856DC0AD 856DA687 42F58F5E B6538227 01890000 00000000 040040 00000220 28100000 00000000 00000000 00000000 00000000 00000000 00000000 User PassWord : 0xCAA1415DC0AD856DC0AD856DA68742F58F5EB653822701890000000000000000 /1 U 040022 Adr 40022 = CA --> 20 U040022 Adr 40022 = 20 --> 31 U040023 Adr 40022 = 20 --> 31 # Ctrl-z
* http://forum.hddguru.com/viewtopic.php?f=13&t=27119&start=40 7200.7 unlock zoc script * http://www.progtown.com/topic364189-removal-of-the-atapassword-with-hdd-p65.html# Read
Someone else has same model :
* http://forum.hddguru.com/viewtopic.php?f=1&t=15626&p=103322&hilit=ST3120026A#p103322
Drive is ST3120026A / Alpine (U9). On the one attempt the drive got to SA I have modules 1 through 10 except number 7 (APP). I wasn't sure if the (P)PATA Reset suggested that the heads were OK? Log output: Interface task reset 4096k x 16 buffer detected ALPINE - 1_Disk M.14 01-16-03 11:51 Buzz - <?>( F>Head Mask 0000 - Switch to full int. Spin Ready <?>( F>j,,1 8.01 04-05-04 15:38 <?>( T>Y20 T><?>(Interface task reset 4096k x 16 buffer detected ALPINE - 1_Disk M.14 01-16-03 11:51 Head Mask 0000 - Switch to full int. Spin Ready 8.01 04-05-04 15:38 (P)PATA Reset Stuff Was Unreadable<?> T>
On U9 you will have to erase pwd by editing vendor track sector 6 edit first two bytes to 00 .
Barracuda 7200.7 (120GB) :
Model: ST3120026A SN: 5JT1GGXH PN: 9W2083-311 HDA PN: 100264019 Config: D48-02 Firmware: 3.06 Date Code: 04207 Site Code: WU
password :
"0123456789ABCDEF0123456789ABCDEF" "WDCWDCWDCWDCWDCWDCWDCWDCWDCWDCWD" "Seagate " # 25char "xty3fgds2h32j4kd02k9rfgep36435" "idrive" "XBOXSCENE" "TEAMASSEMBLY"
http://forums.xbox-scene.com/lofiversion/index.php/t521161.html
ToDo :
Feedback :
https://bugs.launchpad.net/ubuntu/+source/hdparm/+bug/487168
Sense Key : Aborted Command :
# dmesg sd 1:0:0:0: [sdb] Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE sd 1:0:0:0: [sdb] Sense Key : Aborted Command [current] [descriptor] Descriptor sense data with sense descriptors (in hex): 72 0b 00 00 00 00 00 0c 00 0a 80 00 00 00 00 00 00 00 00 00 sd 1:0:0:0: [sdb] Add. Sense: No additional sense information end_request: I/O error, dev sdb, sector 0 Buffer I/O error on device sdb, logical block 0 ata2: EH complete
http://lkml.indiana.edu/hypermail/linux/kernel/0903.3/01400.html
ToDo: FT232R Data Cable : DKU-5 or CA-42 Nokia
http://ireckon.net/2009/05/unbricking-a-seagate-barracuda/
http://sites.google.com/site/seagatefix/
MisC: “command F3” ???
532 sudo hdparm --security-disable "$passwd" "$dev" 533 history
http://ubuntuforums.org/showthread.php?t=2054553
sudo hdparm -I /dev/sdb
/dev/sdb: SG_IO: bad/missing sense data, sb[]: 70 00 05 00 00 00 00 0a 00 00 00 00 24 00 00 c0 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ATA device, with non-removable media
Serial Number: ����:���U����
Standards:
Likely used: 1
Configuration:
Logical max current cylinders 0 0 heads 0 0 sectors/track 510 0 -- Logical/Physical Sector size: 512 bytes device size with M = 1024*1024: 0 MBytes device size with M = 1000*1000: 0 MBytes cache/buffer size = unknown
Capabilities:
IORDY not likely Cannot perform double-word IO R/W multiple sector transfer: not supported DMA: not supported PIO: pio0
St310014A(S)
Interface task reset 1024k x 16 buffer Ref 023B - Hd Msk 0A00 - Switch to full int. Ready C1 - ST310014A(S) ROM.01.04 ATRst PSlv Interfacenterface task reHd Msk 0A00 - Pgm=60 Trk64(000664).0.000 Zn Ready =7 Err=00 ErCt=0000 Hlth=0000 CHlth=0000 Ntrdy C1 - ST310014A(S) ROM.01.04 ATRst PSlv Interface task reset 1024k x 16 buffer C1 - ST310014A(S) ROM.01.04 ATRst Interface task reset 1024k x 16 buffer C1 - ST310014A(S) ROM.01.04 ATRst PSlv 2>/x Invalid Entry 2>/2 2>x VBPIConfig: 00 FF RamHeadMap: 00 F1 Total Capacity= 01503790 SCyl ECyl H0 H1 H2 H3 ---- ---- -- -- -- -- Zone 0: 00000064-00000095 576 NIL Zone 1: 0000009C-000002BC 756 NIL Zone 2: 000002BD-000009C4 748 NIL Zone 3: 000009C5-00001130 736 NIL Zone 4: 00001131-00001E78 720 NIL Zone 5: 00001E79-00002580 699 NIL Zone 6: 00002581-00002F44 672 NIL Zone 7: 00002F45-00003C8C 658 NIL Zone 8: 00003C8D-00004970 633 NIL Zone 9: 00004971-000059D8 604 NIL Zone A: 000059D9-00007210 576 NIL Zone B: 00007211-00007EF4 534 NIL Zone C: 00007EF5-000088B8 518 NIL Zone D: 000088B9-0000DB87 518 NIL
16,388 CYL - 16 HDS - 63 SECT - LBA 20,005,650
T>/2 (Enter) 2>S006b (Enter) 2>R21,01 (Enter) 2>C0,570 (Enter) 2>W20,01 (Enter) T>/2 (Enter) : # Enter Level2 : "work with drive using physical parameters" 2>S006b (Enter) # sx,y Positioning to cylinder "x" , head "y" 2>R21,01 (Enter) # ry,z Read sector from current service area track , y initial sector number , z number of sector 2>C0,570 (Enter) # cx,y,z Compares buffer blocks : # "x" beginning of the first block # "y" beginning of the second block # "z" block lenght 2>W20,01 (Enter) # Wx,y,z Save System Sector from RAM to service area on disk surface # (System sector includes adaptive data among other components) # x, y not used, z=must be equal to 22
Sxxxx is a command seek to cylinder
3.3V LVTTL
T>/2 (Enter) Enter Level2 : "work with drive using physical parameters" 2>S006b (Enter) sx,y Positioning to cylinder "x" , head "y" 2>R21,01 (Enter) ry,z Read sector from current service area track , y initial sector number , z number of sector 2>C0,570 (Enter) cx,y,z Compares buffer blocks : "x" beginning of the first block : "y" beginning of the second block , "z" block lenght 2>W20,01 (Enter) Wx,y,z Save System Sector from RAM to service area on disk surface (System sector includes adaptive data among other components) x, y noy used, z=must be equal to 22
If S/R 2d and 3d digit are : JR (from S/N: 5JRETEX5)
printf "0x%x\n" 21 = 0x15 is this AppCode ?
S006b could be number of cyl (see U Series X)
Series X ACE LabU Series X Длина Key ID Номера цилиндров сектор (секторов) Key ; ID ; Стартовый (секторо) ; Длина (секторов) ; Номера цилиндров ; ; starting (sector) ; lenght (sectors) ; Number cylinder 0x0A ; SYS1 ; 0x00A ; 0x005 ; 0x6B 0x7F 0x93 key=43130131
Size_in_Bytes = Cylinders*heads*sectors*512
Seagate ST380811AS [80 GB SATA] data sheet: Bytes per sector 512 Default sectors per track 63 Default read/write heads 16 Default cylinders 16,383
cat alpine_rd.cmd // ST380011A FW:3.06 // Barracuda 7200.7 Alpine M.14 // SA start cyl. F68E, SPT: 0x280
cat alpine_rd.txt // ST380011A FW:3.06 // Barracuda 7200.7 Alpine M.14 // SA start cyl. E99B, SPT: 0x280