Nasty Intelli Park on WD Scorpio Blue 1T 2.5''

WD10JPVT, every 5 - 6 seconds of idle time causes the hdd to be parked. so everytime when this happens I have to wait 2 seconds for the drive to spin up again to get access. Who the **bleep** need this “feature”. This is big design failure! WD please fix this with a new Firmware. wdile3 all versions won’t work on this one. neither does the open source tool.

Here is a workaround:
http://www.tumblr.com/tagged/advanced-power-management?before=1325834364

Edit: I believe that in order to disable APM, one needs a setting of 255 or 254, not 0.

A potentially better solution may be to add a hdparm command line to a BAT file. Hdparm launches, executes, and then terminates, leaving no impact on resources.

Thanks fzabkar for the link. This may be a solution in some cases. Similar test I have done with Crystal Disk Info, which also has the ability to turn off APM on the fly.

But I use it as an external HDD and carry it around. Can’t put tool on every computer it will be connected to. :cry:

Why can’t WD bring out a firmware with a fix of this. It’s just a change of value 5 to any bigger value in the program and recompile. such an easy task for them… Too bad there is no hacks of  firmware out there.

Update: HDDScan’s command line ‘-APM 0’ doesn’t seem to work here. I just tested it. It still spin down after few seconds. Crystal Disk Info can disable it wthin the current connection.

If you have a model that does respond to WDIDLE3, then there are ways to find out exactly which byte in the firmware holds the APM setting. All you need to do is to save the existing firmware (there are freeware tools for this), apply WDIDLE3, save the modified firmware, and then compare the two sets of firmware. Since you know the APM values before and after the changes, it should be easy to determine which byte is affected.

I have used the above technique to locate the PUIS flag in the flash memory of a WD PCB, so I would expect that the same method should work in this case.

Of course your WD10JPVT drive may not store the APM setting in exactly the same byte, but it may store it within the same firmware module, for example MOD 02.

nice tip! I will try it when I have time :smiley:

Any way to point a way to the freeware tool? :flushed:

Try these utilities:
http://nazyura.hardw.net/000006.htm

Note that they were written for earlier IDE models, so they expect that your SATA controller will be configured in BIOS for legacy IDE mode. That is, the controller should occupy either of the traditional primary or secondary ISA port addresses.

Here is a more recent utility, but with a Russian user interface:
http://travibot.com/WDMarvel.rar

The following site has a large database of HDD firmware that was extracted from actual drives using various commercial data recovery tools (eg PC3000, HRT, Salvation Data):
http://www.datadonor.net/

If you examine a few of the downloads, you will see that they consist of the PCB ROM code (flash memory) plus various modules (MODs) in the System Area on the platters, ie the “negative” tracks.

Be aware that Nazyura’s utilities expect that the ROM’s size is limited to 128KB, and that the MOD IDs consist of a single byte, ie MODs 01 - FF. Current drives have a larger ROM (192KB or 256KB), and the MOD IDs are two bytes long. Also be aware that the ROMs and MODs have checksums, so these will need to be recalculated whenever the code is modified.

Anyway, Nazyura’s utilities are read-only, so you should be safe.

thanks for the details. I will need some time for these stuffs :smiley:

This WDMarvel tool seems to be able to read some ROM from this Scorpio modell. But the changing of idle3 value doesn’t reflect any changes in the resulted BIN files (256KB). I don’t understand Russian and the translation of ModDescr.ini file in WDMarvel into English text(Used google translator) doesn’t change the UI texts. It seems to be a very useful tool though.

I would try Nazyura’s tools. Hopefully the APM byte(s) will be somewhere in MODs 01 - FF. Otherwise you’re on your own with WDMarvel (I don’t have a suitable setup at the moment).

BTW, WDMarvel.exe has been packed with UPX. You can unpack it with the same tool. Once you do this, you will be able to see the text strings. Some will be in English, others in Russian unicode. If you’re a capable hacker, you might be able to extract the Russian text, translate it, write it back in English, and then repack the executable.

UPX: the Ultimate Packer for eXecutables:
http://upx.sourceforge.net

I have tried Nazyura’s tool. But on my laptop, it says time out for all 4 values. In BIOS I have already change AHCI to ATAP for my SATA HDD. Maybe I need to try it on other board when possible. For me I will try to unpack WDMarvel first. Thanks for the link!

Perhaps your laptop uses PCI IDE port addresses rather than the original 0x1F0 and 0x170.

BTW, I believe that in order to disable APM, you would need a setting of 255 or 254, not 0.

yes, you are right, it says 0xF110. Btw. when I use idle3-tool, I tried 254 also. Then under wdidle 1.05 it says 3780 seconds. But the platte still stop spinning after 6 seconds.

Update: changed the 0x1F0 in those COM file into 0xF110, seems to be working with 00 as parameter. resulted ROM file .FLS is 256 Kb big.

Nice hack! BTW, if you use the CHECK_FL tool to verify the checksums for the 256KB ROM image, you will probably see an error in the 7th or 8th PMCBlk. That’s because it crosses the 128KB boundary.

Earlier you referred to the ModDescr.ini file in WDMarvel. This file lists each firmware module by ID, and describes its function. It does not have any bearing on the program menu, as you have discovered.

For example, MOD 02 contains identity information such as model, serial number, and capacity. MOD 11 is the ATA code (referred to as the “loader”), MODs 20, 21, etc contain SMART stuff, MOD 34 contains the grown defect list (G-List), and MODs 102 - 109 are copies of MODs at the end of the ROM image. When a PCB is damaged beyond repair, these latter SA MODs are used to reconstruct the PCB ROM. If you examine the ROM code, you will see several “ROYL” text strings near the end. These are the headers for their respective MODs.

The following URL should shine a little more light on the structure:
http://nazyura.hardw.net/Part02.htm

Yes, as you said, CHECK_FL will complain about error at PMCBlk 00/01. It means this tool is useless in this case?

I have compared the files during IDLE3 timer value change. The value is store in the same MOD, i.e. MOD 02, at offset 0x3A9, and the bytes near 0xD seems to be something for checksum. But since any IDLE3 value won’t affect the IntelliPark in this Firmware, I don’t see the reason to tweat this value. Maybe there is some other byte which instructs the new Firmware to turn off APM / IntelliPark at all? But the existence is one thing, finding its location is another thing.

The other tasks is to calculate the new checksum after modding and flash it back into PCB ROM. Flashing can be done by HDMarvel, but the checksum…

Btw. I have succeeded by using upx to unpack HDMarvel and edit some string resource in GUI. But other String which does not belong to GUI resouce can’t be edited at this time with my tool. But I think this is enough for now, because at least I know which one is for SA area formating :slight_smile:

Congratulations on some nice work!

As you say, bytes 0xC - 0xF constitute a 32-bit little endian checksum over the MOD’s contents. The overall sum should be 0x00000000.

The following checksum calculator was written by Pete Disdale:
http://forum.hddguru.com/download/file.php?id=4921

The MOD ID and size (in sectors) are stored in the preceding bytes.

As for an analysis of the ROM and MODs, I have done some detective work at HDD Guru.

http://forum.hddguru.com/the-problem-701640-with-external-rom-t21809.html
http://forum.hddguru.com/wdc-wd5000abys-01tna0-re2-needs-recovered-t21632.html

If you would like to explore this subject further, I would be happy to send you all my findings. For example, I have written a tool that recalculates and updates the MOD checksum.

thanks for you many good advices, fzabkar!

I have fired up CHK_CSUM for MOD checking, it complains about almost all MODs I got from MAVR_R. Like this:

 CS:[EC] BAD Corr:[4C]  CorrGOOD:[14]  Header:[     ]  Name → 02_0005.MOD

Under WDMarvel similar error when using MOD checking function. I have not changed anything yet :laughing:

It seems there are some stuff to be studied for this thing.

Nazyura’s utilities were written for the older (pre-ROYL) models. IIRC, those had a single-byte checksum at a different location.

If you use Pete Disdale’s checksum utility, as follows, then most of the MODs should sum to 0.

chksum2 -32 *.MOD > MOD_chk.log

Don’t be surprised if a few of them don’t sum correctly. I don’t know why, but this seems to happen even on good drives.

You may find that some MODs contain a “NOT INIT” text string. I believe that this means that these have not been initialised at the factory, and are therefore not used.

BTW, MAVR_R reports the names of the MODs as “ID_size.MOD”. For example, the name “02_0005.MOD” refers to MOD 02, and is indicating that it occupies 5 sectors in the System Area (SA).

FYI, MOD 02 is targeted by HDDHackr. HDDHackr enables WD’s Scorpio drives to be used as replacements for other brands of HDD (eg Fujitsu) in Xbox applications. It does this by editing the model number, serial number, and capacity information in MOD 02 (and the firmware version in MOD 0D). If you know which byte to modify, then you could use it to make the IDLE3 changes via an UNDO.BIN file.

http://www.users.on.net/~fzabkar/HDD/HddHackr_analysis.html

I came cross that HDDHackr too, before I knew WDMarvel and Nazyura’s Tool. At that time I didn’t know how to extract ROM from HDD, so gave up on that one. Now it seems to be a good choice to write back 02 Module. Thanks for mention that :slight_smile: Btw. I have sent you a PM :wink:

Hi fzabkar, and sorry for hijacking this thread. I have followed your informative comments also on hddguru.com, but I do not find the answer for where the module checksum is stored, and how it is computed for the pre-ROYL drives. Please, can you provide me that information? Thank you.