Need help to "hack" these drives

[voodooFX]

I have some Seagate Enterprise Capacity 3.5 HDD v5 4TB SAS (ST4000NM0025) drives which have been flashed by lenovo with a custom 3TB firmware because they were used to replace failed drives in a 3TB storage system.

Now the original system has been decommissioned, but since these drives have just a few months of life I would like to use them, but at their original capacity of 4TB, so I wonder if this can be done flashing back the correct firmware

At the moment I did the following

- found this page ( https://www.seagate.com/support/internal-hard-drives/enterprise-hard-drives/exos-7E/ ) and checked if I can download a Seagate firmware with the SN on my drives. Unfortunately it says that there are no firmware for this serial
- I did not give up and found some images in google of "vanilla" ST4000NM0025 SAS and used their SN to get the link for downloading the firmware

Now I have the firmware but I wonder how to proceed, is there a best practice? best OS to do this?
I'm sure I will have to use some very powerful "force anyway" command because it will not recognize the disk as Seagate.

I have also found that lenovo as the same drive with a 4TB lenovo firmware, but have no idea where I can find that firmware and if it will be any easier to flash

Any suggestion? Maybe some experience?

Thanks

P.S. I will ship for free one of the drives to those who will help me do this

 

[voodooFX]

no way... tried 3 different tools

# ./SeaChest_Firmware_252_1177_32 -d /dev/sg3 --downloadFW MakaraBPEntCapSAS-STD-512N-N004.LOD
==========================================================================================
 SeaChest_Firmware - Seagate drive utilities
 Copyright (c) 2014-2017 Seagate Technology LLC and/or its Affiliates, All Rights Reserved
 SeaChest_Firmware Version: 2.5.2-1_17_7 X86
 Build Date: Nov  2 2017
 Today: Mon Aug 27 14:26:07 2018
==========================================================================================

sg3 - ST3000NM0025 - ZC12KE4X0000R748NJXP - SCSI
.
Firmware Download failed

# ./seaflashlin_048_32 -s 64 -f MakaraBPEntCapSAS-STD-512N-N004.LOD -d /dev/sg3 -w
================================================================================
 Seagate Firmware Download Utility v0.4.8 Build Date: Feb 23 2016
 Copyright (c) 2016 Seagate Technology LLC, All Rights Reserved
 Mon Aug 27 14:42:36 2018
================================================================================
Flashing microcode file MakaraBPEntCapSAS-STD-512N-N004.LOD to /dev/sg3
Force write buffer command
 .  .  .  .  .  .  . sense_key=0x05
 !
FW Download FAILED

# sg_write_buffer -v --in=/root/MakaraBPEntCapSAS-STD-512N-N004.LOD --length=1630208 --mode=5 /dev/sg3
    Write buffer cmd: 3b 05 00 00 00 00 18 e0 00 00
write buffer:  Descriptor format, current;  Sense key: Illegal Request
 ASC=26, vendor specific qualification ASCQ=99 (hex)
  Descriptor type: Field replaceable unit
    code=0x3f
  Descriptor type: Vendor specific [0x80]
    00 00 05 26 99 3f ff ff ff ff ff ff 00 00
bad field in Write buffer cdb

 

[voodooFX]

well, after this I'm giving up...

# hdparm --yes-i-know-what-i-am-doing --please-destroy-my-drive --fwdownload /root/MakaraBPEntCapSAS-STD-512N-N004.LOD /dev/sdb

/dev/sdb:
SG_IO: bad/missing sense data, sb[]:  72 05 20 00 00 00 00 1c 02 06 00 00 cf 00 00 00 03 02 00 01 80 0e 00 00 05 20 00 01 ff ff ff ff
SG_IO: bad/missing sense data, sb[]:  72 05 20 00 00 00 00 1c 02 06 00 00 cf 00 00 00 03 02 00 01 80 0e 00 00 05 20 00 01 ff ff ff ff
 HDIO_DRIVE_CMD(identify) failed: Input/output error

 

[arglebargle]

You probably need to find an identical model drive with the original firmware (or just the functional logic board from one,) connect JTAG to it and dump the firmware off. Then use that dump to reprogram your drives' firmware over JTAG. That's the easy way. The harder way would be to JTAG dump your existing firmware and reverse engineer enough of it to understand how they capacity limited the drive, then undo the limitation.

You'll want to warm up your Google-fu and search for things like "hard disk firmware hacking", which should give you some useful results like:
Hard Disk Firmware Hacking (Part 1) - MalwareTech
Sprites mods - Hard disk hacking - Intro

Pages like those should give you some idea of how this process works, you'll obviously want to do quite a bit more research.

Also, be warned, there might actually be a reason why the drives are limited to 3TB rather than 4 -- they could actually be masked for a reason (just enough surface damage that they can't be sold as 4TB, for example.) I'm not saying they are, just that I'd definitely run a thorough surface test after restoring them to 4TB and before trusting them with any data.

 

[voodooFX]

Hi arglebargle,

Thanks, I will look the links.
Actually I'm more or less trying to do what you said, but instead of having dumped the firmware from a 4TB drive I have downloaded it from Seagate.
Model Number and Product Number are exactly the same so it should really work.

If you look at this output you can see what lenovo did

/dev/sg1  0 0 0 0  0  /dev/sdb  LENOVO-X  ST3000NM0025      LK87

Basically they flashed the 3TB version of the FW, the one for ST3000NM0025 drives and they also changed the vendor label.
I have 25 of this drives so I'm not afraid to loose one, my plan at the moment is to use hdparm or sg_write_buffer to download the firmware.

I found why hdparm command is failing

# hdparm -I /dev/sg1
/dev/sg1:
SG_IO: bad/missing sense data, sb[]:  72 05 20 00 00 00 00 1c 02 06 00 00 cf 00 00 00 03 02 00 01 80 0e 00 00 05 20 00 01 ff ff ff ff
SG_IO: bad/missing sense data, sb[]:  72 05 20 00 00 00 00 1c 02 06 00 00 cf 00 00 00 03 02 00 01 80 0e 00 00 05 20 00 01 ff ff ff ff
 HDIO_DRIVE_CMD(identify) failed: Input/output error

Basically it's failing with any command, maybe the controller is somehow limiting the communication.
I will try another computer with a onboard SAS controller in order to remove anything in the middle.

 

[chinesestunna]

Hi arglebargle,

Thanks, I will look the links.
Actually I'm more or less trying to do what you said, but instead of having dumped the firmware from a 4TB drive I have downloaded it from Seagate.
Model Number and Product Number are exactly the same so it should really work.

If you look at this output you can see what lenovo did

/dev/sg1  0 0 0 0  0  /dev/sdb  LENOVO-X  ST3000NM0025      LK87

Basically they flashed the 3TB version of the FW, the one for ST3000NM0025 drives and they also changed the vendor label.
I have 25 of this drives so I'm not afraid to loose one, my plan at the moment is to use hdparm or sg_write_buffer to download the firmware.

I found why hdparm command is failing

# hdparm -I /dev/sg1
/dev/sg1:
SG_IO: bad/missing sense data, sb[]:  72 05 20 00 00 00 00 1c 02 06 00 00 cf 00 00 00 03 02 00 01 80 0e 00 00 05 20 00 01 ff ff ff ff
SG_IO: bad/missing sense data, sb[]:  72 05 20 00 00 00 00 1c 02 06 00 00 cf 00 00 00 03 02 00 01 80 0e 00 00 05 20 00 01 ff ff ff ff
 HDIO_DRIVE_CMD(identify) failed: Input/output error

Basically it's failing with any command, maybe the controller is somehow limiting the communication.
I will try another computer with a onboard SAS controller in order to remove anything in the middle.

Are you using the same drive that failed FW flashes with hdparm -I command? Could it be that drive is already nuked?

 

[voodooFX]

Uhm no, tried another "untouched" disk but still

SG_IO: bad/missing sense data, sb[]: 72 05 20 00 00 00 00 1c 02 06 00 00 cf 00 00 00 03 02 00 01 80 0e 00 00 05 20 00 01 ff ff ff ff
SG_IO: bad/missing sense data, sb[]: 72 05 20 00 00 00 00 1c 02 06 00 00 cf 00 00 00 03 02 00 01 80 0e 00 00 05 20 00 01 ff ff ff ff
HDIO_DRIVE_CMD(identify) failed: Input/output error

I have also tried the disk in a couple of servers without hw raid controller but for some reason they can't see the disk, possibly because they are SATA only?

EDIT: btw this one has is seen as "Constellation ES.3 / ST3000NM0023" even if it's the same Ent. Capacity V5 4TB as the previous. Looks like Lenovo has flashed these drives randomly with 3TB Seagate SAS drives...

 

[cesar.daniel.lopez@gmail.]

my case
in front of drive see Exos 7E8 ST4000NM0025 FW 6F07

SeaChest_SMART
/dev/sg2 - DKS2G-H4R0SS -
Firmware Revision: 6F08

ok lets flash
sudo ./EntCap-MakaraBP-STD-SAS-512N-N004/command\ line\ tools/seaflashlin/seaflashlin_048_64 -f EntCap-MakaraBP-STD-SAS-512N-N004/firmware/MakaraBPEntCapSAS-STD-512N-N004.LOD -d /dev/sg2
. . . . . . . sense_key=0x05
!
FW Download FAILED

mmm go again

sudo sg_write_buffer -v --in EntCap-MakaraBP-STD-SAS-512N-N004/firmware/MakaraBPEntCapSAS-STD-512N-N004.LOD --length=1630208 --mode=5 /dev/sg2

sending single write buffer, mode=0x5, mpsec=0, id=0, offset=0, len=1630208
Write buffer cdb: 3b 05 00 00 00 00 18 e0 00 00
Write buffer:
Descriptor format, current; Sense key: Illegal Request
ASC=26, vendor specific qualification ASCQ=99 (hex)
Descriptor type: Field replaceable unit code: 0x3f
Descriptor type: Vendor specific [0x80]
00 00 00 00 00 00 00 00 00 00 00 00 00 00
Write buffer failed: Illegal request, type: sense key, apart from Invalid opcode

.... another try

sudo hdparm --yes-i-know-what-i-am-doing --please-destroy-my-drive --fwdownload EntCap-MakaraBP-STD-SAS-512N-N004/firmware/MakaraBPEntCapSAS
-STD-512N-N004.LOD /dev/sdc

/dev/sdc:
SG_IO: bad/missing sense data, sb[]: 72 05 20 00 00 00 00 1c 02 06 00 00 cf 00 00 00 03 02 00 01 80 0e 00 00 00 00 00 00 00 00 00 00
SG_IO: bad/missing sense data, sb[]: 72 05 20 00 00 00 00 1c 02 06 00 00 cf 00 00 00 03 02 00 01 80 0e 00 00 00 00 00 00 00 00 00 00
HDIO_DRIVE_CMD(identify) failed: Input/output error
SG_IO: bad/missing sense data, sb[]: 72 05 20 00 00 00 00 1c 02 06 00 00 cf 00 00 00 03 02 00 01 80 0e 00 00 00 00 00 00 00 00 00 00
SG_IO: bad/missing sense data, sb[]: 72 05 20 00 00 00 00 1c 02 06 00 00 cf 00 00 00 03 02 00 01 80 0e 00 00 00 00 00 00 00 00 00 00
HDIO_DRIVE_CMD(identify) failed: Input/output error



any ideas?

 

[azev]

I've had no luck on converting vendor locked firmware with publicly available firmware from the same manufacture for the same part#. This applies to both spinners, ssd, nvme, basically all form factors, and all type of interfaces from sata/sas/nvme.
If you are lucky you might be able to get the vendor's updated firmware with their upgrade tools, and use that to upgrade them.

One thing others have not recommend to check is to check for HPA (Host Protected Area) which can be used to essentially re-size a drive.

 

[nihonjin]

Maybe I'm late but, did you try to resize the drive with hdat2?

 

[Fritz]

Maybe I'm late but, did you try to resize the drive with hdat2?

I have the same situation with a Hitachi 4TB drive. I emailed the author of hdat2 and he replied saying "sorry, hdat2 doesn't support SAS drives at this time."

It was sold as a 3TB drive and the seller was honest and up front about it. In the end I just accepted that it's a 3TB drive with a 4TB label.