Author Topic: OCZ Vertex 2 SSD firmware  (Read 149022 times)

0 Members and 1 Guest are viewing this topic.

Offline martonmiklosTopic starter

  • Contributor
  • Posts: 25
  • Country: hu
    • Blog
OCZ Vertex 2 SSD firmware
« on: November 06, 2014, 07:54:14 pm »
Hello all,

I have a dead OCZ Vertex2 SSD built around the Sandforce SF-1222. (PCB PN: PCB-0072-X01) It did not get recognized by the BIOS. I have opened it up and checked the console out.

I had got:
Code: [Select]
CLI> PINRST
*** ROM 106 Mar 12 2009 20:29:35 ***
FW_SRC 0 SHA PASS!
*** EEPROM 207 Jan  3 2011 18:36:43 BuildServer:FW_Common_Critical_Fixes:P1_EEPROM_2_0_7_drop-290232 ***
Hynix Timing EPch
*** Patch 1.4.1 Apr  8 2011 00:55:09 BuildServer:P1_3_6_1_MP4_Patch1_20110408:P1_3_6_1_MP4_Patch1_20110408-305073 ***
Hynix Timing EPch
RCPch SAK0+Fmgr

And then a lot of binary stuff at 115200. No it does not changes the baud but outputs binary stuff (I have checked it with my Saleae logic analyzer with autobaud).

The board itself did not shown any errors. Then I have removed the I2C EEPROM (ATH052 2ECL written to it -> it should be an 32K AT24C256 http://www.atmel.com/images/atmel-8568-seeprom-at24c256c-datasheet.pdf) and the console out changed:
Quote
CLI> PINRST
*** ROM 106 Mar 12 2009 20:29:35 ***
*** Patch 1.4.1 Apr  8 2011 00:55:09 BuildServer:P1_3_6_1_MP4_Patch1_20110408:P1_3_6_1_MP4_Patch1_20110408-305073 ***
RCPch SAK0+Fmgr
Failed to read EPA=200800C0, using ByteLaneMask=2, ByteLaneTable[0]=1
Failed to read EPA=200800C0, using ByteLaneMask=4, ByteLaneTable[1]=2
Failed to read EPA=200800C0, using ByteLaneMask=1, ByteLaneTable[2]=0
Failed to read EPA=200800C0, using ByteLaneMask=8, ByteLaneTable[3]=3
RCPch SHI
sysclk 150 MHz
JTAG En 0
Link ...
up

And the SSD got recognized as a 25GB drive

The OCZ offers firmware update for their drive, but it does not works until it detects the drive. According to the screenshots available on the web it offers BIOS and Firmware update for the drive.

Does anyone have the similar drive?
« Last Edit: August 14, 2016, 10:27:08 am by martonmiklos »
 

Offline ShawnD

  • Contributor
  • Posts: 12
Re: OCZ Vertex 2 SSD firmware
« Reply #1 on: November 08, 2014, 03:15:36 am »
I had two of them die in about 6 months.  They were replaced with different models.  There is a reason OCZ went bankrupt and I am pretty sure it was the high RMA rate.

I have no idea if they are repairable.
 

Online abyrvalg

  • Frequent Contributor
  • **
  • Posts: 823
  • Country: es
Re: OCZ Vertex 2 SSD firmware
« Reply #2 on: November 08, 2014, 07:23:15 am »
You can try this trick: solder the flash back, but short some of it's signals with tweezers during power on - this should get you into the same mode as w/o flash (so the drive will be detected), but the flash will be available for fw update. Never tried this on this particular model, but it's a common trick to bypass corrupted firmwares.
 

Offline Psi

  • Super Contributor
  • ***
  • Posts: 9889
  • Country: nz
Re: OCZ Vertex 2 SSD firmware
« Reply #3 on: November 08, 2014, 08:27:08 am »
There is a reason OCZ went bankrupt and I am pretty sure it was the high RMA rate.

OCZ is still around
Greek letter 'Psi' (not Pounds per Square Inch)
 

Tac Eht Xilef

  • Guest
Re: OCZ Vertex 2 SSD firmware
« Reply #4 on: November 08, 2014, 09:18:00 am »
There is a reason OCZ went bankrupt and I am pretty sure it was the high RMA rate.

OCZ is still around

The OCZ everyone knows and loved/hated (OCZ Technology) filed bankruptcy in late 2013. Toshiba started a subsidiary called OCZ Storage to buy most of OCZ Technology's assets, and OCZ Technology renamed itself to ZCO.

ZCO - the shell of the "original" OCZ containing its remaining liabilities - was liquidated a couple of months ago.

 

Offline martonmiklosTopic starter

  • Contributor
  • Posts: 25
  • Country: hu
    • Blog
Re: OCZ Vertex 2 SSD firmware
« Reply #5 on: December 05, 2014, 07:20:17 pm »
You can try this trick: solder the flash back, but short some of it's signals with tweezers during power on - this should get you into the same mode as w/o flash (so the drive will be detected), but the flash will be available for fw update. Never tried this on this particular model, but it's a common trick to bypass corrupted firmwares.
It is an SPI flash. If I short any of the relevant pins it will not detect so I will end up in the unsoldered state. My problem is that I cannot get the drive to a state where the uploader tool could rewrite the flash.

I see two more possibility:
Social engineering: The tool itself is written in Qt,  by an Indian programmer.

The following itresting string can be found in the binary:
update.ocz.com
http://%s/firmware/tools.xml
tools.xml
minver
http://%s/firmware/fum.php?d=%s&f=%s&v=%s
fwinfo.xml
http://%s/firmware/flood.php?d=%s

Pick one preferably unique string: the "fum.php?d="
Do a google search and you will get one result:
http://www.overclock.net/t/1330730/ocz-firmware-2-25-trim-doesnt-work-bug-regression-bad-ocz-experience
The folks over that forum are trying to downgrade a firmware by mimicing the update.ocz.com.

Ah and they shared a link to a working fum.php url:
http://update.ocztechnology.com/firmware/fum.php?d=latest&f=22853&v=2.22

Check that XML. Do a quick google search for the "release/sf/ppro" string.
You will have two results the forum above and a qtcentre.org forum entry:
http://www.qtcentre.org/threads/51057-How-to-parse-this-xml-file

If you check his/her posts on the forum: there are a lot of SATA and sql related posts.
So that (s)he should know how the web backend should work, so how could I download my drive's firmware. I have written a PM to him, but he have not answered. He does not seems to be active anymore on that forum.

The second way is the good old reveng:
Disassembling of the updater tool to get out the resource files contents and hope that:
- The actual hardware - firmware association is stored in some kind of db (xml, sqlite, etc.)
- The firmware files are not encrypted and can be written to the flash raw.

The Qt has a resource system to store files in the binary itself. The binwalk shows a lot of LZMA compressed headers which is the same algorithm what is used by the qrc files.

Any idea or more experienced reverse engineering hints are welcome. 
« Last Edit: December 05, 2014, 07:41:40 pm by martonmiklos »
 

Offline martonmiklosTopic starter

  • Contributor
  • Posts: 25
  • Country: hu
    • Blog
Re: OCZ Vertex 2 SSD firmware
« Reply #6 on: December 05, 2014, 07:22:44 pm »
They were replaced with different models. 
You have replaced them on your budget or it was RMA-ed and you got back different drives?
If the first case: do you still have these drives?
If yes: is your drives recognisable by the BIOS/OS?
 


Offline martonmiklosTopic starter

  • Contributor
  • Posts: 25
  • Country: hu
    • Blog
Re: OCZ Vertex 2 SSD firmware
« Reply #8 on: December 09, 2014, 10:22:54 pm »
For Vertex 2:
http://update.ocztechnology.com/firmware/fum.php?d=latest&f=12222&v=1.37
http://update.ocztechnology.com/firmware/release/sf/p1/12222
http://update.ocztechnology.com/firmware/release/sf/p1/12223

Thanks man! I do not know how did you figured it out, but I would be curious!

Looking into the firmware files it does not seems to be straighforward to figure out where are the EEPROM contents.
I do not know what level of security did they implemented, but it would not be surprising if the EEPROM contents would be encrypted.

Meanwhile I have hooked up my logic analyzer, and figured out that the EEPROM is an I2C one.
The marking says ATH052 2ECL. It should be an AT24C256C:
http://www.atmel.com/Images/doc8568.pdf



 

Offline Rasz

  • Super Contributor
  • ***
  • Posts: 2616
  • Country: 00
    • My random blog.
Re: OCZ Vertex 2 SSD firmware
« Reply #9 on: December 11, 2014, 02:58:02 am »
ssd firmware is bigger than 32KB of that eprom, most likely controller chip has its own flash memory
Who logs in to gdm? Not I, said the duck.
My fireplace is on fire, but in all the wrong places.
 

Offline richcj10

  • Supporter
  • ****
  • Posts: 201
  • Country: us
Re: OCZ Vertex 2 SSD firmware
« Reply #10 on: December 11, 2014, 05:19:30 am »
I use OCZ vertex II drives. Never had a problem...
 

Offline Mr.B

  • Supporter
  • ****
  • Posts: 1237
  • Country: nz
Re: OCZ Vertex 2 SSD firmware
« Reply #11 on: December 11, 2014, 07:06:48 am »
I have had endless premature failures with OCZ SSD.
I have been really disappointed with their performance life.
I now stump up the extra dosh and purchase Intel and Samsung SSDs.
I approach the thinking of all of my posts using AI in the first instance. (Awkward Irregularity)
 

Offline M. András

  • Super Contributor
  • ***
  • Posts: 1014
  • Country: hu
Re: OCZ Vertex 2 SSD firmware
« Reply #12 on: December 11, 2014, 09:25:33 am »
my vertex 2 still works after 4years as system drive but 1 corsair died with the same sandforce controller within a year
 

Offline G-Man

  • Newbie
  • Posts: 1
  • Country: us
Re: OCZ Vertex 2 SSD firmware
« Reply #13 on: June 24, 2016, 11:43:25 am »
I know this is a dated thread, but I’ve scoured the web for help with little results. I have a long out-of-warranty OCZ Vertex 2 SSD 120G that is no longer recognized by any BIOS on any machine I try. Research leads me to deduce the culprit as the windows sleep-wake bug that trashed this SSD (both red and green LEDs stuck on during power up).

I don’t need to recover any data, but hope someone could guide me through some JTAG instructions so I could at least unbrick it long enough to update firmware and make it usable again.

Go easy on me as I only know a bit about JTAG, but am great at using step-by-step instructions. I am PC literate and handy with a soldering iron as I have successfully custom built my own JTAG connectors for serial and USB access in a couple of past projects. With instructions I can find my way around Windows based Putty for terminal emulation, and have dabbled with Linux a bit too. I have at my disposal several hobby PCs which I constantly reconfigure for projects as needed (i.e. to run legacy Win XP apps or install versions of Linux). I sure hope someone can help. Thanks.
 

Offline martonmiklosTopic starter

  • Contributor
  • Posts: 25
  • Country: hu
    • Blog
Re: OCZ Vertex 2 SSD firmware
« Reply #14 on: August 14, 2016, 08:37:28 pm »
Just to make some notes if someone struggling with the same.
I have been able to read the EEPROM with a Pickit3:
https://dl.dropboxusercontent.com/u/4295670/OCT_PCB-0075-x02_unknown.BIN.zip

I have found an another EEPROM dump here which is quite similar, but from board PCB-0075-02:
http://www.mobile-files.com/forum/showthread.php?345247-%D0%94%D0%B0%D0%BC%D0%BF-%D0%95%D0%9F%D0%A0%D0%9E%D0%9C-U5-AT24C256-%D0%BD%D0%B0-SSD-OCZSSD2-2VTXE60G

It has a string "hasnladsrudyvlad" at the beginning. It is strange because if I look at the I2C traffic this portion is read separately then the others.

I have managed to erase it, and the UART output is the same when I depopulate it:

Code: [Select]
CLI> PINRST
*** ROM 106 Mar 12 2009 20:29:35 ***
*** Patch 1.4.1 Apr  8 2011 00:55:09 BuildServer:P1_3_6_1_MP4_Patch1_20110408:P1_3_6_1_MP4_Patch1_20110408-305073 ***
RCPch SAK0+Fmgr
Failed to read EPA=200800C0, using ByteLaneMask=2, ByteLaneTable[0]=1
Failed to read EPA=200800C0, using ByteLaneMask=4, ByteLaneTable[1]=2
Failed to read EPA=200800C0, using ByteLaneMask=1, ByteLaneTable[2]=0
Failed to read EPA=200800C0, using ByteLaneMask=8, ByteLaneTable[3]=3
RCPch SHI
sysclk 150 MHz
JTAG En 0
Link ...
up

I have tried to program back the original contents, but it fails to write it properly. Maybe the EEPROM had been written too many times?
 

Offline macboy

  • Super Contributor
  • ***
  • Posts: 2252
  • Country: ca
Re: OCZ Vertex 2 SSD firmware
« Reply #15 on: August 15, 2016, 12:47:44 pm »
what is the part number of the EEPROM? Some can be write-protected (effectively write-once). E.g. the SPD EEPROM on memory modules is commonly write protected to prevent fraudsters re-programming and re-selling cheap modules as faster ones.
 

Offline p30n

  • Newbie
  • Posts: 1
  • Country: fi
Re: OCZ Vertex 2 SSD firmware
« Reply #16 on: February 16, 2017, 08:46:01 am »
Hey all!

Did you have any luck in unlocking or fiddling with the firmware via JTAG ?
I have been able to read mine but have no idea how to go about flashing via JTAG or just unlocking the controller so I can get the drive working again.

I have a Vertex II 80Gb that is in panic lock and all else seems to be owrking just that it wont recognize the drive in BIOS.

My terminal output from JTAG is as follows:

Code: [Select]
CLI> PINRST
*** ROM 106 Mar 12 2009 20:29:35 ***
FW_SRC 0 SHA PASS!
*** EEPROM 207 Jan  3 2011 18:36:47 BuildServer:FW_Common_Critical_Fixes:P1_EEPROM_2_0_7_drop-290232 ***
IMFT25 Timing EPch
*** Patch 1.4.1 Feb  3 2011 11:57:33 BuildServer:FW_Common_Critical_Fixes:P1_3_4_H_Drop-294933 ***
IMFT25 Timing EPch
RCPch SAK0

And after this only gibberish with some readable words like: ".dump.elf" ".clistrings1" ".strtab" and ".symtab"

No idea what to make of it or how to proceed.

Please help if you have any ideas, thanks in advance! :)
 

Offline jutme321

  • Newbie
  • Posts: 3
  • Country: us
Re: OCZ Vertex 2 SSD firmware
« Reply #17 on: May 03, 2017, 03:03:17 am »
I know this thread is old, but just want to post something that might be useful for people searching around.

In order to fix the Vertex 2 when not recognized by the BIOS, you will need the manufacturing tool called mp_tool by Sandforce together with the license file *.lic and the firmware package file *.dst.  All of these are posted in a site in China so use baidu.com to search for it.  The mp_tool is included in an image of 1.2GB or so which you will need to write to a USB drive and boot from the USB drive.  The site that posts the tool included the instruction so follow it.

As far as the Vertex 2 SSD goes, you will need to connect P8 and P9 (the two copper pads in the back of the PCB) when powering it up to force it into manufacturing mode to allow the mp_tool to talk to it via the SATA cable.  So jump those two pads, connect the power cable and after a few second disconnect the two pads because when the mp_tool talks to the drive, at some point in time it will reboot the drive and you don't want to force it into manufacturing mode at that time.

If your drive configuration is not included in the *.lic file, it gets much harder because you will have to modify the mp_tool itself to overwrite things, which I am not going into details beside the fact that the tool is written in python script and you should be able to decompile it and modify the script as you like.

As far as the serial port goes, there is a tool called ecli.exe that will decode the output and display something readable, which might be useful when the mp_tool fail, you could find out why it fail from the serial output.
 
The following users thanked this post: edavid, tautech, martonmiklos, aleksio, KBDE

Offline tautech

  • Super Contributor
  • ***
  • Posts: 28136
  • Country: nz
  • Taupaki Technologies Ltd. Siglent Distributor NZ.
    • Taupaki Technologies Ltd.
Re: OCZ Vertex 2 SSD firmware
« Reply #18 on: May 03, 2017, 03:52:50 am »
I know this thread is old, but just want to post something that might be useful for people searching around.

In order to fix the Vertex 2 when not recognized by the BIOS, you will need the manufacturing tool called mp_tool by Sandforce together with the license file *.lic and the firmware package file *.dst.  All of these are posted in a site in China so use baidu.com to search for it.  The mp_tool is included in an image of 1.2GB or so which you will need to write to a USB drive and boot from the USB drive.  The site that posts the tool included the instruction so follow it.

As far as the Vertex 2 SSD goes, you will need to connect P8 and P9 (the two copper pads in the back of the PCB) when powering it up to force it into manufacturing mode to allow the mp_tool to talk to it via the SATA cable.  So jump those two pads, connect the power cable and after a few second disconnect the two pads because when the mp_tool talks to the drive, at some point in time it will reboot the drive and you don't want to force it into manufacturing mode at that time.

If your drive configuration is not included in the *.lic file, it gets much harder because you will have to modify the mp_tool itself to overwrite things, which I am not going into details beside the fact that the tool is written in python script and you should be able to decompile it and modify the script as you like.

As far as the serial port goes, there is a tool called ecli.exe that will decode the output and display something readable, which might be useful when the mp_tool fail, you could find out why it fail from the serial output.
Thanks for sharing this knowledge and welcome to the forum.

I've got a couple of OCZ SSD's that have never given an ounce of trouble and of course I hope they never do.  :scared:
Anyway, your tips might help someone else out of a hole.  :-+
Avid Rabid Hobbyist
Siglent Youtube channel: https://www.youtube.com/@SiglentVideo/videos
 

Offline retiredcaps

  • Super Contributor
  • ***
  • Posts: 3575
  • Country: ca
Re: OCZ Vertex 2 SSD firmware
« Reply #19 on: May 03, 2017, 04:52:45 am »
I know this thread is old, but just want to post something that might be useful for people searching around.
Thanks for sharing.  I picked up a couple of used OCZ Vertex 2 drives for $5 each.  Perfect for my small linux lightweight distros that I use on a daily basis.
 

Offline jutme321

  • Newbie
  • Posts: 3
  • Country: us
Re: OCZ Vertex 2 SSD firmware
« Reply #20 on: May 03, 2017, 08:21:49 am »
If you plan on using these SSDs with the Sandforce SF-1200 series controller, it is a good idea to download these tools now and save them somewhere for later since they will probably won't be available forever.  The links below are completely DOWNLOAD AT YOUR OWN RISK!!!!  I recommend using a junk computer for all of these activities since the files are from China so please be very careful using them.

Link to mptool, firmware, and license file download:
http://pan.baidu.com/s/1m9Oia#list/path=%2FSF1222
(Use Tampermonkey browser add-on to download if you don't have a baidu account.  You could copy the link generated by the add-on and use a download manager to connect as many connection as you can at the same time because a connection is normally slow and timeout very quickly before you could download much at all.)

Russian forum where I got the link above from, it also got the link to the instruction:
http://forum.ru-board.com/topic.cgi?forum=84&topic=4797&start=0&limit=1&m=6#1

Here is the link to the eCLI application used for SF-2000 series, but seem to work fine with SF-1200 series:
http://www.upantool.com/ssd/tool/sandforce/10232.html

 
The following users thanked this post: martonmiklos, aleksio, KBDE

Offline retiredcaps

  • Super Contributor
  • ***
  • Posts: 3575
  • Country: ca
Re: OCZ Vertex 2 SSD firmware
« Reply #21 on: May 04, 2017, 01:36:57 am »
The links below are completely DOWNLOAD AT YOUR OWN RISK!!!!
Understood. Thanks for the links.
 

Offline martonmiklosTopic starter

  • Contributor
  • Posts: 25
  • Country: hu
    • Blog
Re: OCZ Vertex 2 SSD firmware
« Reply #22 on: May 06, 2017, 11:08:23 am »
Could you please send me a link to the tampermonkey script?
Thanks in advance!
 

Offline PA0PBZ

  • Super Contributor
  • ***
  • Posts: 5121
  • Country: nl
Re: OCZ Vertex 2 SSD firmware
« Reply #23 on: May 06, 2017, 11:56:46 am »
Keyboard error: Press F1 to continue.
 
The following users thanked this post: martonmiklos

Offline jutme321

  • Newbie
  • Posts: 3
  • Country: us
Re: OCZ Vertex 2 SSD firmware
« Reply #24 on: May 06, 2017, 09:50:28 pm »
Here is the link to Tampermonkey on Firefox:
https://addons.mozilla.org/en-US/firefox/addon/tampermonkey/

Don't know about other operating systems, but on Ubuntu I just click on "Add to Firefox", restart the browser, then when you click on the download icon from baidu, the browser will just ask you to save the file without having to install any other script.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf