REVELTRONICS

Hello,
i've this 25Q20BWVIG SPI rom from Western Digital hard drive WD10EZEX-00WN4A0 with PCB number 2060-800039-001.
I did try to read the rom with Revelprog 1.6 (last version) by selecting device W25Q20EW on software menu, but programmer reads only half of it.
This is 256 KB memory and needs to be powered at 1.8 V

Programmer reads good only the first half of rom memory (you can see on pic that good part starts with pattern 5A 04 at offset 0x20000h on programmer buffer memory), second half part is truncated at offset 0x40000h (pattern B8 52).
The first good half part of rom memory got definitely shifted in second half part on Revelprog buffer memory.





I was able to read complete ROM memory by selecting chip W25Q40EW on device selection, which is 512 KB memory.
I saved buffer memory on BIN file.


Here you can download ROM that i've dump by selecting W25Q20EW device (256 KB):


Here you can download ROM that i've dump by selecting W25Q40EW device (512 KB):


Then i've edited the 512 KB output file with Hex Workshop by deleting junk pattern from following offset:
0x0 ----> 0x20000
0x40000 ----> 0x60000

This is the final output file that Revelprog should dump if worked properly:


Please, tell me if this is a bug and in case when you will correct it ?
Thank you.

Hi Michael, thank you for reporting it, but I have some doubts.
Please take a look at W25Q20BWVIG datasheet on page 17:
http://www.winbond.com.tw/resource-file ... 112213.pdf
Device ID for 2 Mbit device should be EFh 50h 12h

You have read ID EFh 50h 13h which means that you have 4Mbit device on PCB (W25Q40BW).
Please take a look at W25Q40BW datasheet page 16:
https://www.winbond.com/resource-files/ ... 101113.pdf
W25Q40BWVIG fits to your device ID (EFh 50h 13h)

So it seems that you are trying to read 4Mbit FLASH SPI as 2Mbit and that's why you have issues. When you read it as 4Mbit than it is correct. I do not understand why you need to modify offsets in dump when you read it as 4Mbit (maybe there are the same HDD boards on market with 2Mbit and 4Mbit variants and you are comparing to 2Mbit version?) - In my opinion 4Mbit read is correct.

Could you confirm it?

Thank you for the answer,
but i'm sure about what i wrote.

My SPI rom is 25Q20BWVIG (it is written on chip).
If you want you can download hard drive WD10EZEX-00WN4A0 with PCB number 2060-800039-001 firmware from this link:
http://www.alldataback.com/datarecovery ... f=61&t=105

Download RAR file, extract it and open ROM_05-19H_05-20H_00-0A.bin file with a hex editor program.
(you will find rom file in folder WDC WD10EZEX-00WN4A0-01-01A01-WD-WCC6Y4ZE0S7N 800039-001 00050019 1578 0-1/Data/SABackup/ROM).

As you can see, rom of this device is 2 Mbit (256 KB) and is very similar to my rom (the last file that i have posted after editing because revelprog doesn't dump it correctly).

Revelprog detect my rom chip as EFh 50h 13h, so this is a confirm that it doesn't detect it properly.

Could you send us this chip for tests? Because in my opinion there is no option than ID is read incorrectly. And 4Mbit read looks also fine. I checked latest firmware on few FLASH SPI 25..020 and everything works fine.

michael chiklis wrote:Revelprog detect my rom chip as EFh 50h 13h, so this is a confirm that it doesn't detect it properly.

In my opinion it confirms that FLASH is 4Mbit. If read ID is wrong than you will have FFh FFh FFh or 00h 00h 00h (or random read each try) - in your case manufacturer ID is fine, device ID MSB is fine and device ID LSB pointing for 4Mbit - it is no way that read id is wrong. I guess designation is wrong - which is strange, but possible (could you make a picture?).

Stock firmware may have 2Mbit and flash may have multiple capacity (e.g. 2/4/8 etc.) and it will work - but offsets may be required. It is often practice e.g. for motherboards, routers etc.

If you read 2Mbit device as 4Mbit you will have 1st half (0x0 - 0x3FFF) and 2nd half (0x4000 - 0x7FFF) exactly the same because 0x00 address is equal to 0x4000 in memory space for 2Mbit device (it overlaps) - if you can have different values stored in in these adresses than it is one more argument that it is 4 Mbit FLASH

You can make one more test:
1. select 25..020 [PP] 1.8V and generate random dump (CTRL+R in application) and write it to flash - does it pass verification?
2. make the same thing with 25..040 [PP] 1.8V (you need to CTRL+R one more time) - does it pass verification?
If it passes verification on 2Mbit but not on 4Mbit than it is 2Mbit. If it passes verification on both (or only on 4Mbit) than it is 4Mbit.

I can't send you the chip because is of my customer hard drive, but i can show you the pic


You might get identical hard drive somewher and dump the firmware with WDMarvel Demo
https://wdmarvel.com/en/demo/

it will dump rom code properly...

Please make a test which I mentioned before. I'm very curious.
If it not pass verification for 4Mbit than we'll be thinking about next steps

Meanwhile I'll look for drive with this FLASH or similar and make some tests.

At the moment i can't do any test directly on this chip, because if i write into it i would damage hard drives adaptives that are included into rom code which are unique and essential to make it work.

If you would like to give a look, rom adaptives are the following modules:
0A - 0B - 0D - 4F - 20B - 30 - 47 (inside rar archive that i've linked to you).
All this modules are included into rom and are very important for make work the hard drive because they are unique.
Adaptives molules start from offset 0x3D000 in rom.

I will try the test that you have suggested on donor rom when i will receive donor pcb.

I thought about test on chip only in adapter (As I good understood you have already safe copy of working dump to restore it later).
At the beginning I'd like to find out if it is 2Mbit or 4Mbit, because at the moment READ ID is pointing that it is 4Mbit (on the other hand designation on your photo is for 2Mbit) and your dump read as 4Mbit has unique values in memory space which does not exist for 2Mbit variant which points also that it has greater capacity. If it does not pass verification as 4Mbit than we will have some conflict facts which will be very strange and it will need more deeply investigation.

I soldered chip on my adapter because when i try to read it from included adapter, i always get some little differences every time i try to read it.
I compared bytes from saved files with Hex Workshop, if i read rom when the chip is direclty soldered on my adapter i get always same bytes reading (this means that pins connection is better when they are soldered).

I don't feal safe to write directly on my customer chip, in the data recovery field we DRs try to avoid it as much as possible, even if i already did a dump.

My chip is 25Q20BWVIG, this is sure!!
25Q20BWVIG is 2 Mbit SPI rom, this is also sure!!

(on the other hand designation on your photo is for 2Mbit) and your dump read as 4Mbit has unique values in memory space which does not exist for 2Mbit variant.

That's because the programmer reads junk pattern that occupy space memory on buffer, that's why rom dump results truncated if i read as i should do (by selecting proper chip device W25Q20EW).
The only way to read all rom memory in somehow, is by extending buffer reading of the programmer, this can be done by selecting double memory chip device as W25Q40EW. Problem is that in this way i obviously still get all those junk pattern but at least i get all rom dump, i just have to correct it manually by deleting those junk pattern with hex editor software.

You might find just PCB 2060-800039-001 on following sites:
http://www.donordrives.com/wd10ezex-00w ... 5-pcb.html
https://www.harddrivesforsale.com/it/bo ... 01-aa.html
http://www.onepcbsolution.com/800039.html

then you can do all checks you want on rom, you will find out by yourself what i'm talking about.