First off, thank you to the legends in this thread who figured this stuff out. After some messing around I am able to modify the firmware on my SC220s to have the SES EncServ bit set and flash them with sg_write_buffer. Sorry for the long post but at least I'll have some new information.
Some backstory: A few years ago I had the opportunity to grab 10 SC220s full of SSDs. Because I didn't need all of the space at the time and because my power bill was high enough, I opted to use four of them and set them up with TrueNAS core. This worked great. I lost one drive over the years and was able to use `sesutil` to locate the drive. I'm currently doing a hardware refresh and figured I'd bring four more SC220s online so I have a duplicate of my data, and also bring up all my reinstalled hosts using the new storage. That unfortunately turned into a bit of a headache.
While the first four I configured have been running fine, these next four have been continuously dropping drives whenever they feel like it. My new TrueNAS install is using Scale so there is no more `sesutil`, so I tried what
@Haim Gelfenbeyn suggested with sg_ses. This would not work for me. With the correct enclosure number and even though /sys/block/sdX/device/sas_address existed I would get "SAS address not found". I tried a bunch a different things but could not get any locate function to work. Having 96 drives to sort out without a location function is a nightmare. The best I could do was see which drives didn't have activity when doing a write.
At this point I decided to grab a magic cable from Amazon (the same one linked somewhere in this thread) and start messing with the enclosures. When the cable arrived I hooked it to my laptop and my trusty serial-to-USB adapter I've been using for I don't know how many years. Like others reported, when I rebooted the enclosure I received output but I could not type anything. Because I'm an idiot, I then ordered a cable from eBay rather than trying the serial port on my R740xd. As you can guess the next cable had the same problem. It turned out it was my serial-to-USB adapter. Both cables work fine when hooked to the serial port on my server.
So the next problem was I only have Proxmox to communicate with these enclosures. I use tio normally for serial communication and while it has xmodem capability, I could not get it to work. Using the _download function starts a timeout countdown for the transfer. I can then tell tio to send the file via xmodem but after doing that pressing any key will abort the transfer. At this point there was no more countdown but there was also not a progress bar. I am assuming the transfer was timing out in the background and that I actually needed to press a key to start it, but that keypress would abort it from the tio side. I tried a couple of things but was ultimately unsuccessful.
That brings me to trying to figure out the checksum issue. I could wipe firmware regions all day by letting the timeout finish with `_download (1/2) 0 y`, then reflash them with `sg_write_buffer -b 4k -m dmc_offs_save -I fw.bin /dev/sgXX` as long as it was the stock firmware. This was already discussed so that shouldn't be a surprise.
Before trying to figure this out myself I turned to our new lord and savior Claude. I uploaded the stock firmware image and basically asked if it was possible to figure out where the checksum was and how it was calculated. Not only did it respond with that, but without asking it wrote me a script to update the checksum for the modified version of the firmware. You can find the response with the script here:
Great news — the analysis is conclusive. Here's a full breakdown of what was fou - Pastebin.com
Sure enough, this works perfectly. I started by wiping region 1 and 2 (mainly to make sure that I wasn't confused if it was running stock 1.03 or my custom 1.03 version), then using sg_write_buffer to flash the first region, then power-cycling the unit. When it came back it was running the custom firmware. I used `sg_write_buffer` to flash the other region which also worked fine.
Some other notes: I actually did this on the 1.03 firmware on the first page rather than the MD12_106.bin firmware since I have SC220s. I was hoping it would contain the same hex data (05 12 3D 00 90) which it did, so I modified the 90 to D0 as suggested by
@wavejumper. encled works perfectly now. Later on I went one step further and modified the "1.03" that appears at the beginning of the file to "1.04" so I can easily tell which of my enclosures have the modified firmware. I don't know if that was a smart idea but it seems to be working fine.
I feel like a massive fraud using AI to solve the checksum issue after seeing all of the hard work you folks put in to figure this stuff out, but at least it gives another option to flash these units without needing ExtraPutty.