Patching The New Archgon UHD drives to allow flashing

[starkiller]

Hello,

I have developed a patch for the USB to SATA IC in the new Archgon md-8107s-u3-uhd enclosure (Type C) to allow for drive flashing, this will restore the functionality of the old version (Micro B).

FW:

INIC3639F_v157_3bc_forward.bin.zip

https://pixeldrain.com/u/dap64Cqr (mirror)
https://files.catbox.moe/7q4lob.zip (mirror)

Prerequisites:
A Windows computer (for now)
A copy of the patched firmware (found in this post)
A copy of the MPTools for the INIC-3639 (https://www.usbdev.ru/files/initio/initio3639smptool/)

Instructions:

Extract the MPTools archive.

Move the patched FW to InitioMptoolV9.0.4.2VT29/AppData/Firmare/3639S/

Plug in your drive

Run InitioMPTool.exe located in InitioMptoolV9.0.4.2VT29/Release/
A control panel should appear and it should say "USB Device (1)" if it doesn't click refresh

Open the Settings menu, it will ask you for a password. The password is 123456.
Leave VName source, PName source, WWN, and S/N on Disk.
In Function Ctrl enable "PASS THROUGH (Only MaskROM)" and change USB 2.0 max power to "fa" and USB 3.0 max power to "70" - you need to do this or else you will have power issues

In the top right of the settings page change the firmware to the patched INIC3639F_v157_3bc_forward.bin
Select save in the bottom right

Click Initialization
The text under the "USB device" should become Green

Click Start
It should say Operate Success on the right under "Status"

The enclosure will now allow you to flash the drive over USB.


Right now, until further notice, it is recommended that you flash to 1.03 MK and then to 1.00 DE using the SDF flasher tool


If you have any questions feel free to post them below



SHA-512 - 8d16b9b2688028a9b033770ffb8500cc2dd1aebe375492a6b8956790cc1fb0a199af6f3c377b9b9b9ab0fbf403a99c180ea61e3fdd8b13e8a9e9b1d8fe50ae5e

This software is provided "as is" without any warranty of any kind, either expressed or implied.
Please feel free to use, modify, and distribute this firmware for non commercial purposes, provided that any derivatives also be used non commercially.


Edit: I thought it would be easier to just attach the fw file to this post; new easier and updated instructions with screen shots coming soon

[starkiller]

How The Patch Works

What the problem was:
The issue was that the INIC3639 (I assume) was initially designed not for ODDs but for SSDs - to be used in applications like M.2 or MSATA enclosures. Because of this this oversight and the fact that the programmers at Initio needed to be able to flash firmware to the USB to SATA converter, they hijacked the 0x3B (WRITE BUFFER) and 0x3C (READ BUFFER) SCSI opcodes completely. The problem with this, is that these opcodes are critical to flashing the ODD, and thus completely hijacking them breaks functionality. Based on testing, I am also highly certain that Libredrive also uses these opcodes for loading the temporary patch that allows it to function.

How It works now:
Instead of unconditionally diverting these commands to the bridge IC, as bridge-local vendor commands, the INIC3639 now forwards all commands other than 0x3C mode 0x01 (used to read the bridge’s 64-byte identity/configuration window) and 0x3B mode 0x10 (used to access the MPTool vendor channel) to the SATA interface which allows the MPTool to continue functioning properly and flashing and Libredrive to work correctly.

How it was implemented:
This was done by placing a 50 byte dispatcher in unused 0xFF padding.

[RibShark]

Oh wow nice, that's super helpful! It would be cool if this could be ported to the INIC-3619 which is a common chip in generic enclosures; can't find any tool to flash or read from flash for those though, but maybe they are similar enough that the 3139 tool works?

[starkiller]

Oh wow nice, that's super helpful! It would be cool if this could be ported to the INIC-3619 which is a common chip in generic enclosures; can't find any tool to flash or read from flash for those though, but maybe they are similar enough that the 3139 tool works?

The 3639 MPtool does not seem compatible with the 3619, and I also have not been able find the correct tool for the 3619. It is probably possible, but we would need a firmware dump of the 3619 to start off of. Because we don't have the correct MPtool this would probably need to be done using a SOIC clip on the flash/nvram that the 3619 uses.

[Billycar11]

just posting to confirm i tested this and it works

[Billycar11]

im receiving reports that mk fw does not work for libredrive
but my de fw does
also seems lgs unlocked flasher does not work

not a big deal but something to note you must use de fw not mk
but of course you must first go to mk fw to de on modern drives

[starkiller]

Thank you for letting me know. I will look into fixing the mk firmware problem. I saw that u/beerisg00d on reddit was having some issues. I used sdf so I didn't realize that the unlocked flasher had an issue.

[keydb_helper]

Instead of unconditionally diverting these commands to the bridge IC, as bridge-local vendor commands, the INIC3639 now forwards all commands other than 0x3C mode 0x01 (used to read the bridge’s 64-byte identity/configuration window)

The CDB used to enable LibreDrive after uploading the microcode blob on MT1959 drives is:

Code: Select all

3c 01 45 00 00 00 00 00 04

and the various LibreDrive command CDBs follow the pattern:

Code: Select all

3c 01 44 xx 00 00 00 00 yy

The DE (non-MK) MT1959 use distinct CDBs for these purposes and my recollection is they won't collide with your CDB filtering.