Please help with my bad flashed 3650 (SATA)

vbimport

#1

as fool as i am, i tried to trans-flash my 3650 into something like 4650/4651.
i’ve found and unpacked that “necbcfl” tool (upx) and modifed the id codes in order to get the drive id’s correct and to be recongnized by the program.
i’ve checked up the 4650 firmware to confirm it’s drive is should be “K460” (3650 as K365).

but the following things went very wrong.
the modified tool completed the operations with success as it reported. before doing the flash, i thought it just does some changes to id codes and get the check sum right, not the real boot code it self. but i’m not so sure about that now.
the drive is dead, with a blinking led, no respond to button press and cannot be detected by bios. just blinking all the time. binflash -scan returns nothing about the drive in dos and win32 cmd box.

does the blinking means there’s still some bootcode functioning or something?
can i save it by some blind flashing? will some hotswap working? or short some pin on the board of the drive to get into “fail safe” mode or “factory mode”? please help, anything.


#2

Welcome to the forum.
As i think you have now found out, messing with the drives bootcode is not wise unless you know exactly what you are doing.
The drive is in safe mode. You may be able to recover it by continually pressing the eject button during post boot until the drive tray ejects. You then may be able to flash the original firmware back to the drive. If not the drive is dead. Bin it and buy a new one, do not RMA the drive.


#3

thanks for the amazingly quick reply.
by “continually pressing”, do you mean press the button for many times or press and holding the button?
if it’s not working, will a flash chip replacement work? (i hope)


#4

The blinking probably means that the bootcode is actually working, so x55x drives and x56x drives seem to be very similar in their hardware.

Unfortunately your drive is now waiting for data on a parallel ATA interface that it does not have. So unless you have a backup of your drive’s bootcode and can flash it with an external flash device there’s not much you can do except for binning the drive and buying a new one.


#5

thanks very much. i’ll try the recovery procedure. if it’s not working, i’m going to consider to get a 2nd-handed 3650 to get a flash chip(maybe replace the whole board directly) or buy a good one and backup and flash the chip to get two working 3650’s.
i’ve just opened my drive up. there’s a sticker in it with “K460” printed on it.
it’s a fairly fine burner actually. except the annoying sata interface. it causes several compatiability problems with various hardware and software.


#6

btw: is there any way to dump the bootcode (or whole flash) with a working drive without dissembling the flash chip? so maybe i can get somebody to extract their bootcode for me from their units.

btw2: the button pressing recovery seems not working. the tray won’t eject no matter what and how i press the button while powering on the unit.


#7

Do not replace the whole flash chip or board. The flash chip also contains calibration data for your drive and I guess it contains information that depends upon the board AND the optical hardware.

It’s possible to dump the drive’s bootcode with software, but I don’t think these tools are available to public and I won’t publish them either.

I doubt that pressing the eject button will help at all. IF there are routines to handle this, they would be in the bootcode that you replaced with the wrong data.


#8

i’ve found this czech page, it seems describing a method to read and write boodcode with plscsi utility.
http://www.cdr.cz/a/diskuze/6280/29
but i don’t read czech and google can’t translate it either, so going to catch on with that later.

also, i’ve found some pin points which looks like those lovely jtag points.

the upper left conner of the picture shows TP(test pin?) DMS/DCK/DDI/DDO and of course, GND.

if it is the jtag connection, so that flashchip should be able to be flashed by that. am i right?

i’m ordering a 4650, it will arrive in the next 2 days.

i’ve checked up the datasheet of the flash chip:
http://www.datasheets.org.uk/datasheet.php?article=2895908

would you provide me with some specification of the parameters to use with jtag tools on this NEC D63645GM microprocessor chip?


#9

ok, i’ve got a jtag cable connected. this cable worked with my broadcom wireless router. but seems not working with 3650 right now. the cable is made without 100ohm resistors. but i think that maybe the problem why it’s not working now although it some how worked on the router.
i’m gonna buy some resistors tomorrow to c if it will work as expected.


#10

seems the jtag thing is not working.
with power connected, jtag reads all "00"s. nothing else.
cannot probe cpu id or anything else.
seems nec had taken some precautions to make end users not able to use jtag that easy.
gonna try some burn flash chip directly thing when i’ve got that 4650.


#11

ok, got that 4650. and i’ve got boot code and settings dumped out of it.
it even has a firmware version 1.04, and i think i’m gonna submit it to that nec firmware collection.


#12

finally, i have got my 3650 backup and running again now.
of course, by flashing a whole new flash memory into the chip by some eprom programmer.
as i do not have a 3650 boot code, i used the 4650 one, that 16KB, and combined it with the settings data backed up from the flash chip by the eprom programmer, another 8KB.
the settings data from the bad flashed chip shows something “K460”, i think that was the modified (by the fool of me) necbcfl who had modified the settings data in the flash.
the “reserved” data (40KB) was from the dump from the chip too. as it’s not all “FF” or “00”, so i think it’s better to use it. then the firmware dumped out of the 4650. that’s the first 64KB of the flashchip. following the firmware dumped by binflash. and some "00"s at the end to make a full 2MB.

the 3650 is now recongnized as 4650 v1.04. at least, it is working.
thanks for diggy, dee and crazycat’s information on the layout of the flashchip and methods of getting the data to flash in. thank you very much, again. :bow:


#13

it’s the first time for me to desolder a TSOP chip and solder it on again. but it seems a piece of cake to me now, just need to align the legs and the soldering points very carefully, solder one or to pin legs at one corner, and soler some others on the opposite corner in order to fix the location of the chip first is a good idea.
just easy work, works great now.


#14

Not necessarily. I’ve already seen 4650 drives with K365 and 3650 drives with K460. Made it difficult to support these drives in Binflash and I’m still not 100% sure that the current implementation won’t break anything :o


#15

seems it won’t, at least have not did any. :smiley: but the current problem is that i have a drive recongnized as 4650, and working well, but it does not have the function of 4650, no RAM support in nero info tool. neither read nor write.
is the function controlled by some tags in those “settings” area?


#16

the necbcfl tool is for 355x + 455x drives…


#17

I guess sunshinejnjn already know this - now. :bigsmile:


#18

:o
i didn’t think about that utility has the 3550/4550/4551 bootcode embeded in it… i thought it was some universal modifier which can be modified to modify those x65x ones as they are the sata version of x55x drives… :sad:

and again, does those functions like dvd-ram support need to be enabled in the “settings” of the drive? and liggy, do you have a 4651 firmware avaliable?