Caviar Black (WD1001FALS) Crossflash -> RE3 firmware. Success... Sort of.

T

TerraPhantm

Gawd
Joined
May 7, 2006
Messages
687
I noticed that dell has firmware updates for various enterprise WD drives available on their FTP, so I decided I'd give it a shot. The firmware included in the MD3000/MD3000i package on Dell's website have the ".df" extension. These are pretty much the straight binary firmwares with a header attached. I stripped the header (first 0x113 bytes) and started the flashes (using hdparm with the "--fwdownload" switch)

First I updated my legit RE3 from 03.00C06 to 03.00C12, which worked fine. TLER got reset to 8s r/w. So then I decided to give it a shot on my caviar blacks.

I currently have 4 Caviar Blacks. One WD1001FALS-0J7B0, and the rest are WD1001FALS-0K1B0. All 4 of them had firmware version 05.00K05. The 0J7B0 drive flashed fine. On a reboot, it reports its firmware version as 03.00C12 like the RE3. TLER was set to 8s r/w. The 0K1B0 drives all fail at the very end. The drives still work fine, and they still report themselves as 05.00K05... so I'm guessing that there might be some kind of write protection. If anyone has a suggestion on how to flash the rest of my drives, please let me know!

Anyway if any of you want to do this, I can provide more detailed instructions. Do the flash at your own risk... i was lucky in that none of my drives failed, but obviously I can't guarantee that the same thing will always happen. I didn't see any real attempts at cross-flashing WD drives in my limited search, so I thought I'd post this. All of my drives were already TLER capable, but perhaps this could restore the TLER functionality in the newer ones.
 
Last edited:
thanks for the info. any more detail on your process would be very helpful.
 
Sure. If you extract this package and browse to: SATA/Western_Digital, you'll find a file called "WD_WDC_WD1002FBYS-18A6B0_0C12.df" Open it up in a hex editor and you'll see something like this (first 0x200 bytes; the real file obviously is much larger):

Code: 
00000000 44 72 69 76 65 5F 44 6F 77 6E 6C 6F 61 64 5F 46 69 6C 65 5F 48 65 61 64 65 72 00 00 00 00 00 00 01 Drive_Download_File_Header.......
00000021 00 00 00 A0 00 00 00 14 4F 1D 00 B4 05 69 1E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 57 44 ........O....i.................WD
00000042 43 20 57 44 31 30 30 32 46 42 59 53 2D 31 38 57 38 42 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C WD1002FBYS-18W8B0..............
00000063 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .................................
00000084 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 41 4C 4C 43 4F 44 45 20 41 63 74 69 6F ....................ALLCODE Actio
000000A5 6E 5F 44 65 73 63 72 69 70 74 6F 72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 74 00 n_Descriptor...................t.
000000C6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .................................
000000E7 00 02 00 00 00 00 4E 1D 00 00 00 00 00 01 07 A7 0E 00 00 00 92 00 00 00 00 00 00 00 00 00 00 00 00 ......N..........................
00000108 00 00 00 00 00 00 00 00 00 00 00 00 52 4F 59 4C 03 00 00 04 01 01 14 08 32 B0 03 A9 30 30 30 36 30 ............ROYL........2...00060
00000129 30 30 30 06 05 6E 00 AC 01 01 00 C1 00 30 35 43 36 30 30 30 31 00 00 00 00 00 00 00 00 02 01 02 00 000..n.......05C60001............
0000014A 1D 00 30 30 30 31 00 00 03 00 00 00 0D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ..0001...........................
0000016B 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .................................
0000018C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .................................
000001AD 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .................................
000001CE 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .................................
000001EF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                                                 .................

Delete the first 0x113 bytes so that you're left with something like this
Code: 
00000000 52 4F 59 4C 03 00 00 04 01 01 14 08 32 B0 03 A9 30 30 30 36 30 30 30 30 06 05 6E 00 AC 01 01 00 C1 ROYL........2...00060000..n......
00000021 00 30 35 43 36 30 30 30 31 00 00 00 00 00 00 00 00 02 01 02 00 1D 00 30 30 30 31 00 00 03 00 00 00 .05C60001..............0001......
00000042 0D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .................................
00000063 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .................................
00000084 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .................................
000000A5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .................................
000000C6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .................................
000000E7 00 00 00 00 00 00 00                                                                               .......
Save it as 0C12.bin (or whatever you want to call it) and stick it on a flash drive. On a side note, you may notice that there are other WD1002FBYS firmware files in the folder. Don't worry about them; they're identical asides from the drives identified in the header. With the header stripped out, each bit is the same. For those who don't want to modify the firmwares themselves, here's the one I made

Anyway, now we're going to want to boot into a linux livecd w/ hdparm included. I used gparted, but other distros are probably fine (I know Ubuntu has hdparm as well). Mount your flash drive to a directory (I mounted it to "/tmp/usb"). In terminal, run "fdisk -l" (may need root permissions) to find out what the HDD you want to flash shows up as (let's use /dev/sda in this example).

To start the flash, enter this command
Code: 
sudo hdparm --fwdownload /tmp/usb/0C12.bin --yes-i-know-what-i-am-doing --please-destroy-my-drive /dev/sda
"/tmp/usb/0C12.bin" can be replaced with whatever the path to your firmware file is. And yes, those last two switches are necessary.

The flash will start... it'll take a few minutes, and should say "Done" at the end. After you reboot, your drive should identify itself with FW version 03.00C12

As I mentioned in the beginning of this thread I only had success with 2 drives. They were:
WD1002FBYS-02A6B0 (original FW: 03.00C06)
WD1001FALS-00J7B0 (original FW: 05.00K05)

They *did* not work on my WD1001FALS-00K1B0 05.00K05 drives, but they didn't brick either. I can't say if it'd work one way or another on any other Caviar Black models (or any other RE3 models for that matter). I do have a couple other Caviar Blacks on RMA (for unrelated issues), which I may try flashing if they're not TLER capable.

This method may work for other WD drives too if you use the appropriate firmware. Dell may have firmwares for other models available too (perhaps even consumer models). If other companies release WD firmwares, you can probably modify their files in a similar manner, but the header size may be different.
 
Isn't there a way to extract the original firmware from the drive ?
 
Aesma said:
Isn't there a way to extract the original firmware from the drive ?
Click to expand...

Not with the standard ATA commands. The firmware is stored in something called the Service Area of the platter. Basically "negative sectors"... There are tools that can do it, but they're not cheap.

With that said, I think the guy who wrote "HDDHackr" (tool to mod WD drives into Xbox 360 compatible drives) can probably figure out how to dump it (his tool already dumps a portion of the firmware). Too bad his source code isn't available
 
I have an WD1001FALS-00J7B1 What can you benefit by doing this flash? faster speeds?
 
oMek said:
I have an WD1001FALS-00J7B1 What can you benefit by doing this flash? faster speeds?
Click to expand...

I'm not sure what the exact differences are from fw to fw, my goal was to have all of my raid drives on the same firmware. I've read in multiple places that caviar blacks and re drives are identical asides from the firmware, and that the firmware has various raid optimization (no idea if this goes beyond TLER). I think it would enable TLER on the ones that don't have it
 
Do you think it is possible to flash Dell's hard drive firmware to a normal consumer drive of the same type? The MD3000i only will accept hard drives that are "Dell Certifiied" so for example flash the Dell 500GB SATA RE4 firmware to a WD 500GB SATA RE4?

I have a drive I can brick and would like to test this out...
 
oMek said:
I have an WD1001FALS-00J7B1 What can you benefit by doing this flash? faster speeds?
Click to expand...

The main benefit is about enabling TLER which you only want when using the drive in parity raid (raid 5/6 50 60 ...)
 
AMDWiZARD said:
Do you think it is possible to flash Dell's hard drive firmware to a normal consumer drive of the same type? The MD3000i only will accept hard drives that are "Dell Certifiied" so for example flash the Dell 500GB SATA RE4 firmware to a WD 500GB SATA RE4?

I have a drive I can brick and would like to test this out...
Click to expand...

Might work, but depends on how Dell checks the drives. If its based purely on the fw version, then yes this should work. If however they check based on those last 6 digits after the model number, then no, since the fw update doesn't touch the model number.

With that said, I do know of a round about way to change it. That program HDDHackr - it can mod any WD HDD into an Xbox 360 HDD. When you do this, it makes an "undo" file that contains your HDD's model number and serial number. Hex edit the model number in that file, and restore it to your HDD.
 
I'd like to give this a shot. After all I have a MD3000i sitting there because I refuse to purchase Dell certified drives. To my knowledge it does a firmware check to check if the firmware is compatible. If I do this, I'll share my results.
 
Good luck - I think the drives should accept the firmware. If it gives an IO error, then there may be some obscure issue with hdparm itself.

One thing that I need to work on is reverse engineering the few official WD firmware update exes that are out there. They seem to be packed, and I'm not able to do too much with them since they're 16-bit executables... but I'll try to figure something out.
 
Just wanted to update this. So I got one of my RMA'd caviar blacks in. It's a WD1001FALS-00Y6A0. Manufactured on November 17 2011. Firmware 05.01.D05. Not TLER capable. The PCB is quite different visually from the rest of my caviarblacks and my RE3. I attempted to flash it, and it failed before it even began. So I guess this is a new revision.

There may be a shot if I can find an RE3/RE4 firmware for the same revision drive. But I won't hold my breath. I'll probably just stick this drive in my DVR
 
Thanks for your post.

Wondering if you've had any success with the WD1001FALS-00Y6A0 rev.
 
AMDWiZARD said:
I'd like to give this a shot. After all I have a MD3000i sitting there because I refuse to purchase Dell certified drives. To my knowledge it does a firmware check to check if the firmware is compatible. If I do this, I'll share my results.
Click to expand...

Hey AMDWiZARD,

Have you had any luck with this? If so, I'd love to hear about your process. I've got a similar issue... the same drives that are "allowed", but they're not from Dell, so therefore not "certified."

Thanks!
 
KrisB,

Hang tight. I just got around to doing this. I ordered a test drive so I can burn it if need be. I'm going to do this on Monday and see if I can be successful. I have an MD3000i thats laying around because I refuse to pay Dell's rediculous prices for a "certified" drive.
 
I tried on a 2TB WD2002FYPS and the message I got was 5G08.df file size (2065172) is not a multiple of 512... any help trying to get it to a multiple of 512?
 
To pad the file size out you would need to reverse the binary and add CPU NO OP instructions (essentially a no-op sled). roughly, you need to find the current actual size and the needed size, find cpu documentation detailing CPU op-codes, disassemble the binary, add the nop instructions till it reaches the correct size, etc.
 
How come he was able to flash it with just changing the header? Shouldn't this error occur for every drive since the file sizes dont add up with a multiple of 512? Perhaps this was an older version of hdparm? Anyone want to provide some feedback?
 
I never ran into the 512 issue. You sure you stripped the right # of bits? I haven't really touched this in a while since my drives were all working okay. FWIW, the header I stripped was not essential to the firmware - it's just some data Dell added so that their flash utility recognizes the file. The part that remains after stripping is nearly identical in structure to other WD firmwares that have been officially released over the years.
 
I am curious about the chance to crossflash a standard drive to Dell specs for the MD3000i, as I have one sitting right next to me without any drives in it.

Any updates would be greatly appreciated.
 
You must log in or register to reply here.
Back
Top