• http://rzr.online.fr/q/alpine# How to reset #SeaGate #HdD #ST3120026A (#AlpinE) and #UnLock #MaxSecurity activation , #HdParm fails to rd

• http://yura.projektas.lt/files/seagate/720011_ES2.html LearN SaOffset 0x47?
• http://rzr.online.fr/x/pdf/http://www.rom.by/files/Offsets.xls
• http://forum.hddguru.com/viewtopic.php?f=13&t=27119

How to unlock ST3120026A when it's in maximum security and the master password is lost ( I tested generics ones “Seagate [ space padding to 32char ]” and others but it just failed”…

I dont care of the existing data on it , I just want to reset it if possible… Can this be done for free using software , or do I need a RS232 hardware ?

http://forum.hddguru.com/search.php?keywords=seagate+lock&terms=all&author=&sc=1&sf=all&sk=t&sd=d&sr=posts&st=0&ch=300&t=0&submit=Search

http://hdd-911.com/index.php?option=com_docman&Itemid=31&task=view_category&catid=69&order=dmdate_published&ascdesc=DESC

You have to adapt it for U9 (that is, find the correct sa track and sector, and modify the buffers).

• http://rzr.online.fr/x/pdf/http://www.rom.by/files/Offsets.xls
• http://yura.projektas.lt/files/seagate/
• http://yura.puslapiai.lt/files/seagate/Offsets.htm

~ Dependence of the second and third letters of the serial number and the number of heads (meaning taken from APP and ROM).

	 Heads 1	 Heads 2	 Heads 3	 Heads 4
8 	 ALPINE	 JX, MQ, MW	 20	 JV, LH, MR, MX, NL	 21	 JT, MS, NR	 22	 JS, MT, LJ, NS	 23						
9 	 APLUS	 JX	 E0	 JV, LH	 E1	 JT	 E2	 LJ, JS	 E3						
10 	 APLUS	 JR	 F0	 JQ	 F1	 JP	 F2	 JN	 F3						
11 	 PUMA	 JX, MQ	 A8	 JV, MR	 A9	 JT, MS	 AA	 MT, JS	 AB

So for JT (as printed on HDD) :

• Alpine Type=22 Heads=3 (that's what UarT log reported : ALPINE - 1_Disk M.14 01-16-03 11:51 )
• Alpus Type=E2 Heads=3
• Puma Type=AA Heads=3

~ Offset core system tracks HDD Seagate Barracuda with respect to the system area and the length of objects for subtraction, all values ​​in HEX.

~ The structure of SA Seagate Barracuda drives. Saved is the beginning and length. All values ​​are in HEX.

Hdd label report “FirmWare: 3.06” :

Model                 : Cert (sa/sect) : Ata Ovl (s/s) : Vendor (s/s) : App code (s/s/buffer) : Cert table (o/t/s)
ALPINE (FW:3.xx)	0x29	240h	0x2A	5Dh	0x2C	12h	0x15 0x69	180h	80	0x29	240h	11h-12h

ALPINE (FW:8.xx)	0x29	244h	0x2A	61h	0x2C	12h	0x15 0x69	180h	80	0x29	244h	11h-12h
APLUS	0x47	2F8h	0x49	61h	0x4B	12h	0x15 0x16 0x2C 0x2D	180h	80	0x47	2F8h	13h
PUMA	0x47	H0=280h H1=134h All=3B4h	0x49	71h	0x4B	12h	0x15 0x16 0x2C 0x2D	1A0h	60	0x48	134h	14h

• Model : ALPINE (FW:3.xx)
• * Cert: Offset_SA=0x29 ; Sectors=240h
• * Ata Ovl : Offset_SA=0x2A ; Sectors=5Dh
• * Vendor : Offset_SA=0x2C ; Sectors=12h
• * App Code : Offsets_SA=0x15,0x69 ; Sectors=180h ; Buffer=80
• * Cert Table : Offset_SA=0x29 ; Offset_Track=240h ; Sectors=11h-12h

• http://www.hardw.net/forum/viewtopic.php?p=70936#70936
• http://www.pc-hospital.net/html/En/2008/0923/3675.html

Ctrl+L : RoM InfO

T>ALPINE - 2_Disk    3.06  10-21-03 15:53
Built for ALPINE,GRAND2,Diamondback,TI1761 PreAmp,STL6 Andante PreAmp,InternalSpin,GC110,SVC123AC,OneToOne,2Disk,LowDelta,220 Servos,7200RPM,8Pole,NonModGray,100MHz,Code DRAM,Early Exit,Stall Converter,RwFeat=0000,SeaDex,HDW

# ctrl+a :
Eng Rev = .M67

# ctrl+a: 
2>/8
8>C20
(SN: 5JT1GGXH)

ToDo :

• http://forum.hddguru.com/viewtopic.php?f=1&t=26132&view=previous
• http://malthus.zapto.org/viewtopic.php?f=22&t=211&p=970#p970
• http://www.msfn.org/board/topic/158484-solution-seagate-barracuda-72007-pataide-diagnostic-serialuart-port/
• http://www.ihdd.ru/forum/seagate-st340014a-i-st380011a-gramotno-zapustit-selfskan-t6632-180.html

0x2A, 50h sectors 

Ctr+z: T>/2
2>x
Zone 00:  00018 - 00BE8  1100 (044C) 683.439
...
Zone 0F:  155D7 - 16358   572 (023C) 363.922
Sys= 0F68E-0F70D   0280 SPTK on sys trks

~ SA starts from cylinder 0xF68E, this is your base cylinder, 0x280 sectors per track.

~ at the end of the log will be the coordinates of the system area

~ add the offset to the top and get the overlay start address where to write an overlay

Stuff Was Unreadable
T>F

SetStuff->ASCIFE 
Setting stuff to defaults

Ok We can assume that

"Sys= 0F68E-0F70D   0280 SPTK on sys trks" 
SA_start_cyl=0F68E

Model : ALPINE (FW:3.xx)

• Cert: Offset_SA=0x29 ; Sectors=240h
• Ata Ovl : Offset_SA=0x2A ; Sectors=5Dh
• Vendor : Offset_SA=0x2C ; Sectors=12h
• App Code : Offsets_SA=0x15,0x69 ; Sectors=180h ; Buffer=80
• Cert Table : Offset_SA=0x29 ; Offset_Track=240h ; Sectors=11h-12h

Cert :

~ // SA_start_cyl + 0x29
~ R_SECTORS/F6B7/0/200/0/280/CERT_0_F6B7.trc/1/1

AtaOvl :

~ // SA_start_cyl + 0x2A
~ R_SECTORS/F6B8/0/200/0/280/OVL_0_F6B8.trc/1/1

App Code :

~ // SA_start_cyl + 0x15 and + 0x69 (copy)
~ R_SECTORS/F6A3/0/200/0/280/APP_0_F6A3.trc/1/1
~ R_SECTORS/F6F7/0/200/0/280/APP_0_F6F7.trc/1/1

echo " 0x0F68E + 0x15  " | wcalc -h
= 0xf6a3

echo " 0x0F68E + 0x69  " | wcalc -h
= 0xf6f7

Vendor :

~ // SA_start_cyl + 0x2C
~ R_SECTORS/F6BA/0/200/0/280/VENDOR_0_F6BA.trc/1/1

# forum.hddguru.com/viewtopic.php?f=13&t=27119&start=40  7200.7 unlock zoc script
^Z
T>/1
1>N5
1> .
1>Pgm=00 Trk=0F6BA(0F6BA).0(0).003(002) Zn=0 Err=00 ErCt=0000 Hlth=0008 CHlth=0000 Ready LBA=00000000

1>/2
2>s0F6BA,00,22
2>r,05,1
2>r,06,1
1>B0200,0200
2>B0200,0200
buffer 0200   comparing to 0200  RD:0200:10:00  WR:0210:10:00
 Addr  0 1 2 3  4 5 6 7  8 9 A B  C D E F 10 1 2 3  4 5 6 7  8 9 A B  C D E F
040000 01015365 61676174 65202020 20202020 20202020 20202020 20202020 20202020
040020 2020CAA1 415DC0AD 856DC0AD 856DA687 42F58F5E B6538227 01890000 00000000
040040 00000220 28100000 00000000 00000000 00000000 00000000 00000000 00000000
040060 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
040080 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0400A0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0400C0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0400E0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
040100 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
040120 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
040140 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
040160 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
040180 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0401A0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0401C0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0401E0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
040200 FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFBFFFF FFFFFFFF FFFFFFFF FFFFFFFF
2>.
2>Pgm=00 Trk=0F6BA(0F6BA).0(0).007(006) Zn=0 Err=00 ErCt=0000 Hlth=0008 CHlth=0000 Ready LBA=00000000

Master PassWord :

0x5365616761746520202020202020202020202020202020202020202020202020
"Seagate        " # 01234567890ABCD = 0x53656167617465 = "Seagate" + ' '*25 = 32c

* "0x0101" designates that User PWD is installed, type of protection - Maximum.

* http://www.progtown.com/topic364189-removal-of-the-atapassword-with-hdd-p65.html

22H is usser password offset :

040020 2020CAA1 415DC0AD 856DC0AD 856DA687 42F58F5E B6538227 01890000 00000000
040040 00000220 28100000 00000000 00000000 00000000 00000000 00000000 00000000

User PassWord :

0xCAA1415DC0AD856DC0AD856DA68742F58F5EB653822701890000000000000000

/1 U 040022
Adr 40022 = CA --> 20

U040022
Adr 40022 = 20 --> 31

U040023
Adr 40022 = 20 --> 31 # Ctrl-z

* http://forum.hddguru.com/viewtopic.php?f=13&t=27119&start=40 7200.7 unlock zoc script * http://www.progtown.com/topic364189-removal-of-the-atapassword-with-hdd-p65.html# Read

• http://www.slideshare.net/er0080/pc-seag-bara p57

Someone else has same model :

* http://forum.hddguru.com/viewtopic.php?f=1&t=15626&p=103322&hilit=ST3120026A#p103322

Drive is ST3120026A / Alpine (U9).
On the one attempt the drive got to SA I have modules 1 through 10 except number 7 (APP).
I wasn't sure if the (P)PATA Reset suggested that the heads were OK?

Log output:

Interface task reset
4096k x 16 buffer detected
ALPINE - 1_Disk M.14 01-16-03 11:51

Buzz - <?>(
F>Head Mask 0000 - Switch to full int.
Spin Ready
<?>(
F>j,,1
8.01 04-05-04 15:38
<?>(
T>Y20
T><?>(Interface task reset
4096k x 16 buffer detected
ALPINE - 1_Disk M.14 01-16-03 11:51
Head Mask 0000 - Switch to full int.
Spin Ready
8.01 04-05-04 15:38
(P)PATA Reset

Stuff Was Unreadable<?>
T>

On U9 you will have to erase pwd by editing vendor track sector 6 edit first two bytes to 00 .

• http://forum.hddguru.com/viewtopic.php?f=1&t=12000&p=77722&hilit=U9#p77722

Barracuda 7200.7 (120GB) :

Model: ST3120026A
SN: 5JT1GGXH
PN: 9W2083-311
HDA PN: 100264019
Config: D48-02
Firmware: 3.06
Date Code: 04207
Site Code: WU

• http://rzr.online.fr/x/pdf/http://www.seagate.com/support/disc/manuals/ata/cuda7200pm.pdf
• http://www.seagate.com/ww/v/index.jsp?name=Barracuda_7200.7&vgnextoid=a0283b0c2aeef010VgnVCM100000f5ee0a0aRCRD&locale=en-US&reqPage=Legacy

password :

"0123456789ABCDEF0123456789ABCDEF"
"WDCWDCWDCWDCWDCWDCWDCWDCWDCWDCWD" 
"Seagate                         " # 25char
"xty3fgds2h32j4kd02k9rfgep36435"
"idrive"
"XBOXSCENE"
"TEAMASSEMBLY"

http://forums.xbox-scene.com/lofiversion/index.php/t521161.html

ToDo :

• http://www.seagateunlock.com/seagate-barracuda-firmware-update-sm310.exe

Feedback :

• https://shop.maxim-ic.com/storefront/searchsample.do?event=Sample&menuitem=Sample&Partnumber=MAX232CWE%2B
• http://forum.hddguru.com/seagate-120gb-detected-but-unreadable-st3120026a-t12834.html#p94725
• http://forum.hddguru.com/how-unlock-seagate-st3120026a-max-security-mode-nopw-t14545.html

https://bugs.launchpad.net/ubuntu/+source/hdparm/+bug/487168

Sense Key : Aborted Command :

 # dmesg
 sd 1:0:0:0: [sdb] Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE
 sd 1:0:0:0: [sdb] Sense Key : Aborted Command [current] [descriptor]
 Descriptor sense data with sense descriptors (in hex):
         72 0b 00 00 00 00 00 0c 00 0a 80 00 00 00 00 00 
         00 00 00 00 
 sd 1:0:0:0: [sdb] Add. Sense: No additional sense information
 end_request: I/O error, dev sdb, sector 0
 Buffer I/O error on device sdb, logical block 0
 ata2: EH complete

http://lkml.indiana.edu/hypermail/linux/kernel/0903.3/01400.html

ToDo: FT232R Data Cable : DKU-5 or CA-42 Nokia

http://ireckon.net/2009/05/unbricking-a-seagate-barracuda/

http://sites.google.com/site/seagatefix/

• http://yura.projektas.lt/files/seagate/720011_ES2.html :
• m0 user area and a 2.2-quick format the remaining parameters can be left by default, saving only the dash, or by typing 0 in the end we put'ValidKey' [22]

• http://www.mapleleafmountain.com/seagatebrick.html
• http://forum.hddguru.com/how-unlock-seagate-st380012ace-t14488.html
• http://www.mitsubishiforum.com/forum/showthread.php?t=22994
• http://www.linuxquestions.org/questions/linux-general-1/need-to-unlock-30-hard-drives-792958/page2.html
• http://cmrr.ucsd.edu/people/Hughes/HDDEraseReadMe.txt
• http://www.rockbox.org/lock.html

MisC: “command F3” ???

• http://forum.ixbt.com/print/0011/037875.html

532  sudo hdparm --security-disable "$passwd" "$dev" 
533  history 

http://ubuntuforums.org/showthread.php?t=2054553

sudo hdparm -I /dev/sdb

/dev/sdb: SG_IO: bad/missing sense data, sb[]: 70 00 05 00 00 00 00 0a 00 00 00 00 24 00 00 c0 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00

ATA device, with non-removable media

      Serial Number:      ����:���U����

Standards:

      Likely used: 1

Configuration:

      Logical         max     current
      cylinders       0       0
      heads           0       0
      sectors/track   510     0
      --
      Logical/Physical Sector size:           512 bytes
      device size with M = 1024*1024:           0 MBytes
      device size with M = 1000*1000:           0 MBytes 
      cache/buffer size  = unknown

Capabilities:

      IORDY not likely
      Cannot perform double-word IO
      R/W multiple sector transfer: not supported
      DMA: not supported
      PIO: pio0 

St310014A(S)

Interface task reset 1024k x 16 buffer

Ref 023B - Hd Msk 0A00 - Switch to full int.
                   Ready
C1 - ST310014A(S)
ROM.01.04
ATRst
PSlv

Interfacenterface task reHd Msk 0A00 - Pgm=60 Trk64(000664).0.000 Zn                   Ready
=7 Err=00 ErCt=0000 Hlth=0000 CHlth=0000 Ntrdy
C1 - ST310014A(S)
ROM.01.04
ATRst
PSlv

Interface task reset 1024k x 16 buffer
C1 - ST310014A(S)
ROM.01.04
ATRst



Interface task reset 1024k x 16 buffer
C1 - ST310014A(S)
ROM.01.04
ATRst
PSlv
2>/x
Invalid Entry 
2>/2
2>x
VBPIConfig: 00 FF 
RamHeadMap: 00 F1 
Total Capacity= 01503790

           SCyl    ECyl    H0  H1  H2  H3 
           ----    ----    --  --  --  -- 
 Zone 0: 00000064-00000095 576 NIL
 Zone 1: 0000009C-000002BC 756 NIL
 Zone 2: 000002BD-000009C4 748 NIL
 Zone 3: 000009C5-00001130 736 NIL
 Zone 4: 00001131-00001E78 720 NIL
 Zone 5: 00001E79-00002580 699 NIL
 Zone 6: 00002581-00002F44 672 NIL
 Zone 7: 00002F45-00003C8C 658 NIL
 Zone 8: 00003C8D-00004970 633 NIL
 Zone 9: 00004971-000059D8 604 NIL
 Zone A: 000059D9-00007210 576 NIL
 Zone B: 00007211-00007EF4 534 NIL
 Zone C: 00007EF5-000088B8 518 NIL
 Zone D: 000088B9-0000DB87 518 NIL

16,388 CYL - 16 HDS - 63 SECT - LBA 20,005,650

T>/2 (Enter)
2>S006b (Enter)
2>R21,01 (Enter)
2>C0,570 (Enter)
2>W20,01 (Enter)


T>/2 (Enter) :
# Enter Level2 : "work with drive using physical parameters"

2>S006b (Enter) 
# sx,y Positioning to cylinder "x" , head "y"

2>R21,01 (Enter) 
# ry,z Read sector from current service area track , y initial sector number , z number of sector

2>C0,570 (Enter) 
# cx,y,z Compares buffer blocks : 
# "x" beginning of the first block 
# "y" beginning of the second block 
# "z"  block lenght

2>W20,01 (Enter)
# Wx,y,z Save System Sector from RAM to service area on disk surface 
# (System sector includes adaptive data among other components) 
# x, y not used, z=must be equal to 22

Sxxxx is a command seek to cylinder

3.3V LVTTL

@TaG: SeaGate

• http://rzr.online.fr/x/pdf/http://www.tdubel.com/artikkelit/tiedostot/ST310014ACE_unlocking_tutorial_english.pdf
• http://rzr.online.fr/x/pdf/http://www.evo-x.de/tutorials/dateianhaenge/ST310014A__Unlock_Tutorial_by_cyd0g_.pdf
• http://rzr.online.fr/x/pdf/http://www.tdubel.com/artikkelit/tiedostot/ST310014ACE_unlocking_tutorial_english.pdf

T>/2 (Enter)  Enter Level2 : "work with drive using physical parameters"
2>S006b (Enter) sx,y Positioning to cylinder "x" , head "y"
2>R21,01 (Enter) ry,z Read sector from current service area track , y initial sector number , z number of sector
2>C0,570 (Enter) cx,y,z Compares buffer blocks : "x" beginning of the first block : "y" beginning of the second block ,  "z"  block lenght
2>W20,01 (Enter) Wx,y,z Save System Sector from RAM to service area on disk surface (System sector includes adaptive data among other components) x, y noy used, z=must be equal to 22

If S/R 2d and 3d digit are : JR (from S/N: 5JRETEX5)

• APLUS SN=JR TYPE=F0 HEADS=1
• * Certs : Offset_SA=0x47 Sectors=2F8h
• * ATA_Ovl Offset_SA=0x49 Sectors=61h
• * Vendor Offset_SA=0x4B Sectors=12h
• * AppCode Offsets_SA=0x15,0x16,0x2C,0x2D Sectors=180h Buffer=80
• * Cert_table Offset_SA=0x47 Offset_track=2F8h Sectors=13h

printf "0x%x\n" 21 = 0x15 is this AppCode ?

• http://xdr5tgy7ujmcft67uhgbvvgy75thn.files.wordpress.com/2008/08/st310014ace-label.jpg#
• 16,383 CYL - 16 HDS - 63 SECT - LBA 20,005,650
• http://www.donordrives.com/media/catalog/product/cache/1/image/9df78eab33525d08d6e5fb8d27136e95/d/o/donor_1165.jpg# 5JREZ1L2

S006b could be number of cyl (see U Series X) 

• http://www.slideshare.net/er0080/pc-seag-bara# page30

Series X  

ACE LabU Series X  Длина Key ID Номера цилиндров сектор (секторов) 

Key ; ID ; Стартовый (секторо) ;  Длина (секторов) ; Номера цилиндров
    ;    ; starting (sector) ; lenght  (sectors) ; Number cylinder
0x0A ; SYS1 ; 0x00A ; 0x005 ; 0x6B 0x7F 0x93
 

key=43130131

• https://en.wikipedia.org/wiki/Cylinder-head-sector

Size_in_Bytes = Cylinders*heads*sectors*512 

Seagate ST380811AS [80 GB SATA] data sheet:
Bytes per sector 512
Default sectors per track 63
Default read/write heads 16
Default cylinders 16,383

cat alpine_rd.cmd 
// ST380011A FW:3.06
// Barracuda 7200.7 Alpine M.14
// SA start cyl. F68E, SPT: 0x280

 cat alpine_rd.txt 
// ST380011A FW:3.06
// Barracuda 7200.7 Alpine M.14
// SA start cyl. E99B, SPT: 0x280

• http://forum.hddguru.com/viewtopic.php?f=13&t=27119&start=40 7200.7 unlock zoc script

• http://hackaday.com/2013/08/02/sprite_tm-ohm2013-talk-hacking-hard-drive-controller-chips/
• http://files.hddguru.com/index.php?action=downloadfile&filename=ST_MEM_FREE_28_12_06.ZIP&directory=Software/Seagate&# SeaGate

@TaG: AtA RpI SeriaL HdD IdE