Patching The New Archgon UHD drives to allow flashing

[starkiller]

Hello,

I have developed a patch for the USB to SATA IC in the new Archgon md-8107s-u3-uhd enclosure (Type C) to allow for drive flashing, this will restore the functionality of the old version (Micro B).


FW (V2):

INIC3639F_v157_forward_v2.bin.zip

https://pixeldrain.com/u/J4m3D2iS
https://files.catbox.moe/5v85kl.zip (mirror)

Prerequisites:
A Windows computer (for now)
A copy of the patched firmware (found in this post)
A copy of the MPTools for the INIC-3639 (https://www.usbdev.ru/files/initio/initio3639smptool/
(mirror) https://pixeldrain.com/u/QYDAWZXs

Instructions:

Extract the MPTools archive.

Move the patched FW to InitioMptoolV9.0.4.2VT29/AppData/Firmare/3639S/

Plug in your drive

Run InitioMPTool.exe located in InitioMptoolV9.0.4.2VT29/Release/
A control panel should appear and it should say "USB Device (1)" if it doesn't click refresh

Open the Settings menu, it will ask you for a password. The password is 123456.
Leave VName source, PName source, WWN, and S/N on Disk.
In Function Ctrl enable "PASS THROUGH (Only MaskROM)" and change USB 2.0 max power to "fa" and USB 3.0 max power to "70" - you need to do this or else you will have power issues

In the top right of the settings page change the firmware to the patched INIC3639F_v157_3bc_forward.bin
Select save in the bottom right

Click Initialization
The text under the "USB device" should become Green

Click Start
It should say Operate Success on the right under "Status"

The enclosure will now allow you to flash the drive over USB.


It was previously recommended that you flash to 1.03 MK and then to 1.00 DE using the SDF flasher tool

Now with the updated version (v2) it is recommended to just flash to 1.03MK using the SDF flasher tool


If you have any questions feel free to post them below



SHA-256 - 9025ac176454b6336f98a8c7135055bfbbb75ca03831c18fecbab9b93cb63f72

This software is provided "as is" without any warranty of any kind, either expressed or implied.
Please feel free to use, modify, and distribute this firmware for non commercial purposes, provided that any derivatives also be used non commercially.


Edit: updated post for v2

[starkiller]

How The Patch Works

What the problem was:
The issue was that the INIC3639 (I assume) was initially designed not for ODDs but for SSDs - to be used in applications like M.2 or MSATA enclosures. Because of this this oversight and the fact that the programmers at Initio needed to be able to flash firmware to the USB to SATA converter, they hijacked the 0x3B (WRITE BUFFER) and 0x3C (READ BUFFER) SCSI opcodes completely. The problem with this, is that these opcodes are critical to flashing the ODD, and thus completely hijacking them breaks functionality. Based on testing, I am also highly certain that Libredrive also uses these opcodes for loading the temporary patch that allows it to function.

How It works now:
Instead of unconditionally diverting these commands to the bridge IC, as bridge-local vendor commands, the INIC3639 now forwards all commands other than 0x3C mode 0x01 (used to read the bridge’s 64-byte identity/configuration window) and 0x3B mode 0x10 (used to access the MPTool vendor channel) to the SATA interface which allows the MPTool to continue functioning properly and flashing and Libredrive to work correctly.

How it was implemented:
This was done by placing a 50 byte dispatcher in unused 0xFF padding.

[RibShark]

Oh wow nice, that's super helpful! It would be cool if this could be ported to the INIC-3619 which is a common chip in generic enclosures; can't find any tool to flash or read from flash for those though, but maybe they are similar enough that the 3139 tool works?

[starkiller]

Oh wow nice, that's super helpful! It would be cool if this could be ported to the INIC-3619 which is a common chip in generic enclosures; can't find any tool to flash or read from flash for those though, but maybe they are similar enough that the 3139 tool works?

The 3639 MPtool does not seem compatible with the 3619, and I also have not been able find the correct tool for the 3619. It is probably possible, but we would need a firmware dump of the 3619 to start off of. Because we don't have the correct MPtool this would probably need to be done using a SOIC clip on the flash/nvram that the 3619 uses.

[Billycar11]

just posting to confirm i tested this and it works

[Billycar11]

im receiving reports that mk fw does not work for libredrive
but my de fw does
also seems lgs unlocked flasher does not work

not a big deal but something to note you must use de fw not mk
but of course you must first go to mk fw to de on modern drives

[starkiller]

Thank you for letting me know. I will look into fixing the mk firmware problem. I saw that u/beerisg00d on reddit was having some issues. I used sdf so I didn't realize that the unlocked flasher had an issue.

[keydb_helper]

Instead of unconditionally diverting these commands to the bridge IC, as bridge-local vendor commands, the INIC3639 now forwards all commands other than 0x3C mode 0x01 (used to read the bridge’s 64-byte identity/configuration window)

The CDB used to enable LibreDrive after uploading the microcode blob on MT1959 drives is:

Code: Select all

3c 01 45 00 00 00 00 00 04

and the various LibreDrive command CDBs follow the pattern:

Code: Select all

3c 01 44 xx 00 00 00 00 yy

The DE (non-MK) MT1959 use distinct CDBs for these purposes and my recollection is they won't collide with your CDB filtering.

[starkiller]

Thank you for letting me know, that is very useful information. I didn't realize that DE and MK used different CDBs.

The bridge and MPTool use:

Code: Select all

3c 01 00 00 00 00 00 00 40

So I changed the firmware to now pass-through:

Code: Select all

3c 01 nn xx xx xx xx xx xx (nn != 00)

I have not yet tested it and probably won't have time until later this week; so I will post it here for people who want to try it, and will update the instructions once I have time to use it with some discs.

https://pixeldrain.com/u/J4m3D2iS

Edit: I tested it and it works with 1.03MK

SHA-256 - 9025ac176454b6336f98a8c7135055bfbbb75ca03831c18fecbab9b93cb63f72

[rumokeenme]

Very cool! What are the odds that this would be available for Linux folks who don't have access to Windows machines?

[starkiller]

Very cool! What are the odds that this would be available for Linux folks who don't have access to Windows machines?

I have done some reverse engineering of the MPTool but I don’t have time to keep working on it right now. You would have to emulate the usb commands that it uses to communicate with the sata bridge ic. It is doable but in the short term it might make more sense right now to just use a qemu vm and pass through your usb controller.

Edit: as you can probably tell by the way I put the paths in, I don’t use windows very often