All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 17 posts ] 
Author Message
 Post subject: Read NAND flash serial number
PostPosted: September 27th, 2022, 9:16 
Offline

Joined: September 27th, 2022, 7:09
Posts: 10
Location: Europe
Is it possible to read the serial numbers of the individual NAND chips attached to flash storage (like USB, SSD, NVME) from the operating system or do you need access on the firmware level? Can any of the commercial tools do that?
Or is this not possible in general without poking the individual chips directly?


Top
 Profile  
 
 Post subject: Re: Read NAND flash serial number
PostPosted: September 29th, 2022, 3:19 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
ChipGenius can get flash ID for UFD's

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
 Post subject: Re: Read NAND flash serial number
PostPosted: September 29th, 2022, 4:44 
Offline

Joined: September 27th, 2022, 7:09
Posts: 10
Location: Europe
Yeah, I used ChipGenius quite a while ago and iirc I saw something related.
So I guess this is possible in general? Or is there any reason why it should not be possible on an NVME or SSD disk?
Is it possible to write the NAND serial?


Top
 Profile  
 
 Post subject: Re: Read NAND flash serial number
PostPosted: September 30th, 2022, 9:06 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
No idea, probably the UFD controller/firmware allows for getting NAND ID. If firmware prevents it you can not get to it. Why on earth you want to change the NAND ID?

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
 Post subject: Re: Read NAND flash serial number
PostPosted: October 2nd, 2022, 11:26 
Offline

Joined: August 13th, 2016, 17:10
Posts: 192
Location: Vienna, Austria
ChipGenius does the NAND identification through Vendor-Specific-Commands on the USB bus, most pendrives offer commands that let it retrieve the NAND IDs. But each pendrive vendor has different commands, so ChipGenius has to try a lot of commands to see which one works. Usually each vendor has one method in it's firmware and keeps it that way for all it's chips. ChipGenius seems to be the only tool on the market that can identify about 99% of the NANDs. But I also had a few ones it could not identify.


Top
 Profile  
 
 Post subject: Re: Read NAND flash serial number
PostPosted: October 3rd, 2022, 7:41 
Offline

Joined: September 27th, 2022, 7:09
Posts: 10
Location: Europe
Any reason why this should not work in principle for NVME/SSD devices?
Is it possible to change the serial number of NAND flash through software or is it really OTP?


Top
 Profile  
 
 Post subject: Re: Read NAND flash serial number
PostPosted: October 3rd, 2022, 17:59 
Offline

Joined: August 13th, 2016, 17:10
Posts: 192
Location: Vienna, Austria
I would say the serial number is changeable in theory, but you need good software with firmware level access.


Top
 Profile  
 
 Post subject: Re: Read NAND flash serial number
PostPosted: October 10th, 2022, 7:16 
Offline

Joined: October 4th, 2007, 12:07
Posts: 115
sourcerer wrote:
ChipGenius does the NAND identification through...

Do you know where I can get a virus free version of ChipGenius?


Top
 Profile  
 
 Post subject: Re: Read NAND flash serial number
PostPosted: October 10th, 2022, 10:16 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
SoftPedia.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
 Post subject: Re: Read NAND flash serial number
PostPosted: October 11th, 2022, 8:36 
Offline

Joined: October 4th, 2007, 12:07
Posts: 115
Arch Stanton wrote:
SoftPedia.

Thanks!


Top
 Profile  
 
 Post subject: Re: Read NAND flash serial number
PostPosted: October 11th, 2022, 13:02 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15440
Location: Australia
Arch Stanton wrote:
SoftPedia.

How do people decide whether an antivirus scan is producing false positives?

"14 security vendors and no sandboxes flagged this file as malicious" (ChipGenius_v4_19_0319_softpedia.zip from SoftPedia)

https://www.virustotal.com/gui/file/ac0a542f0998dd9906c0f8e3fd3d874833dbbe69a0b012b120fe270f56efe5bf

If I unpack FlashMaster.exe with UPX, the resultant file generates 28 AV hits:

https://www.virustotal.com/gui/file/db750ec3fcc075805939a0c1d14cc2e55bf1884519ec8a503ed65ae85cbb5661

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Read NAND flash serial number
PostPosted: October 11th, 2022, 18:28 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
fzabkar wrote:
Arch Stanton wrote:
SoftPedia.

How do people decide whether an antivirus scan is producing false positives?

"14 security vendors and no sandboxes flagged this file as malicious" (ChipGenius_v4_19_0319_softpedia.zip from SoftPedia)

https://www.virustotal.com/gui/file/ac0a542f0998dd9906c0f8e3fd3d874833dbbe69a0b012b120fe270f56efe5bf

If I unpack FlashMaster.exe with UPX, the resultant file generates 28 AV hits:

https://www.virustotal.com/gui/file/db750ec3fcc075805939a0c1d14cc2e55bf1884519ec8a503ed65ae85cbb5661


They're all results from heuristic engines, some AV vendors even make A.I. claims. For a file that has been around for a while, and ALL detections being 'heuristic' there's a good chance it is false positive. These heuristics scans are dead stupid and annoying.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
 Post subject: Re: Read NAND flash serial number
PostPosted: October 11th, 2022, 21:26 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15440
Location: Australia
Arch Stanton wrote:
They're all results from heuristic engines, some AV vendors even make A.I. claims. For a file that has been around for a while, and ALL detections being 'heuristic' there's a good chance it is false positive. These heuristics scans are dead stupid and annoying.

I guess "heuristics" is really the only way you can anticipate new viruses, so AV vendors will continue to make use of these engines.

One potentially disturbing implication of my scan results is that real malware can be hidden in an EXE file simply by packing it with UPX. This means that a sandbox would be the only way to expose it.

BTW, there is a second EXE in the same package. It has PK0 and PK1 components, and these also appear to be packed, but not with UPX.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Read NAND flash serial number
PostPosted: October 12th, 2022, 8:23 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
Anyways, to avoid the often sketchy ChipGenius downloads you can also use https://www.antspec.com/usbflashinfo/.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
 Post subject: Re: Read NAND flash serial number
PostPosted: October 12th, 2022, 11:54 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
Quote:
One potentially disturbing implication of my scan results is that real malware can be hidden in an EXE file simply by packing it with UPX.


Which is why UPX packed executable or DLL is a heuristic 'trigger' putting in enough weight by itself to cause an alert.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
 Post subject: Re: Read NAND flash serial number
PostPosted: October 12th, 2022, 18:11 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15440
Location: Australia
I uploaded several Windows 10 EXEs, and they all fell foul of one or more AV scanners. Even my FreeBASIC source code files are flagged.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Read NAND flash serial number
PostPosted: October 13th, 2022, 8:07 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
fzabkar wrote:
I uploaded several Windows 10 EXEs, and they all fell foul of one or more AV scanners. Even my FreeBASIC source code files are flagged.


:lol:

Yup, I have seen experiments before from people creating totally harmless exe's getting detected by multiple of the heuristic and 'crowd wisdom' driven scans. I have same problem that each time I release an update there's always at least one that 'detects' it as potentially harmful. I got a list of emails which you can use to report false positives and before I release I always spam them, all of them. Unfortunately there's those (Chinese ones often) that don't even offer the option for reporting false positives.

IMO virustotal should ban half of those they're listing due to demonstrable crapiness.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 17 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 12 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group