Switch to full style
In-depth technology research: finding new ways to recover data, accessing firmware, writing programs, reading bits off the platter, recovering data from dust.

Forum rules

Please do not post questions about data recovery cases here (use this forum instead). This forum is for topics on finding new ways to recover data. Accessing firmware, writing programs, reading bits off the platter, recovering data from dust...
Post a reply

SSD Research - OCZ SSD

May 8th, 2015, 0:58

This SSD seems to be bricked, now it is for research. I didn't get the cover with the board, so I don't know what the model was. In this thread I will post anything interesting I find. I hope to include things like:
- Console access
- JTAG, hooking up, output etc
- Firmware update, RE, tricks, tips
- Possibility of NAND chip off recovery
- Wear levelling/ECC/data Structures etc
- anything interesting

Feel free to add anything you might know or find out, or any comments, criticism etc. All I ask Is the thread stays on topic to this research.

Vendor: OCZ
Model: Unknown (OCZ Octane? http://www.playwares.com/xe/power_hdd/23075600
Type: SSD
capacity: Unknown (128GB?)
Interface: SATA
Manufactured: Around 2012
Condition: Not Working
Controller: Indilinx IDX300M01-BC
NAND chips: 16x 8GB
NAND Vendor: Hynix
NAND Laser code:H27UCG8T2MR
NAND ID: ad de 94 d2

OCZ-PCB-1.jpg

OCZ-PCB-2.jpg


On the board, a serial port is clearly marked with VCC TX RX and GND. I got Minimal output on a serial test with Putty using BAUD Rate 115200 and shorting J3 1-2
Code:
sata_task started: S= DRIVE_IDLE_STATE
drive state: DRIVE_SEND_ERROR_STATUS_STATE


The other unpopulated 10pin block, J10 I don't know what it is.

JTAG port is clearly marked with VCC, TDO, TDI, TMS, TCK and GND. I will test this soon. There are Test points on the board, TP1 - TP4 etc. Not sure if these are useful.

Re: SSD Research - OCZ SSD

May 9th, 2015, 9:38

I tried OpenOCD in windows, but seems Bus pirate wasn't supported in the binaries I downloaded - and I wasn't sure I would have time to compile for windows.

So started up a Kili Linux VM and apt-get'd all the reqirements for openOCD, compiled to support my Bus Pirate. Then updated the firmware of the Bus Pirate, hooked everything up to the board and was rewarded with:

Code:
HaQue@kali:~# telnet localhost 4444
Trying ::1...
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
>
>jtag arp_init-reset
JTAG tap: auto0.tap tap/device found: 0x10147043 (mfg: 0x021, part: 0x0147, ver: 0x1)

>scan_chain                     
   TapName             Enabled  IdCode     Expected   IrLen IrCap IrMask
-- ------------------- -------- ---------- ---------- ----- ----- ------
0 auto0.tap              Y     0x10147043 0x00000000     2 0x01  0x03
>


Looks like the board is not totally dead.

I will admit I am unsure of where to go from here, not having played around with JTAG for a LONG time.

happy to take any hints!

Re: SSD Research - OCZ SSD

July 17th, 2015, 12:32

Use "dump_image 0.bin 0x0 0x10000" and "dump_image FFFF0000.bin 0xFFFF0000 0x10000" and start looking at the code to see other areas to dump. And post the files too since now I'm curious :-)

- George

Re: SSD Research - OCZ SSD

July 17th, 2015, 12:35

GeorgeKJones62 wrote:Use "dump_image 0.bin 0x0 0x10000" and "dump_image FFFF0000.bin 0xFFFF0000 0x10000" and start looking at the code to see other areas to dump. And post the files too since now I'm curious :-)

- George


Well, "halt" it first

- George

Re: SSD Research - OCZ SSD

July 17th, 2015, 20:14

Thanks George, I will give that a try.

I am looking at buying a better JTAG adapter first, I don't think this BP is up to any serious JTAGging

Re: SSD Research - OCZ SSD

July 17th, 2015, 22:32

tried it.

I don't seem to have the command "dump_image" available?

cant see it in help. I am using Open OCD 0.9.0-rc1-dev-00001

have to look into why, maybe need to recompile with different config or something. Need lots more JTAG experience ;)

Re: SSD Research - OCZ SSD

July 20th, 2015, 9:34

HaQue wrote:Thanks George, I will give that a try.

I am looking at buying a better JTAG adapter first, I don't think this BP is up to any serious JTAGging


I agree. Try the Bus Blaster instead. Still cheap, but decent support in Open OCD

Re: SSD Research - OCZ SSD

July 20th, 2015, 9:37

HaQue wrote:tried it.

I don't seem to have the command "dump_image" available?

cant see it in help. I am using Open OCD 0.9.0-rc1-dev-00001


Well that's strange... I'd point at the documentation but sourceforge seems to be having issues. So I'll just point at someone with a much older version who has it available

http://techwithdave.blogspot.com/2013/0 ... enocd.html

I'm a bit of an Open OCD novice myself. But maybe it has to do with your configuration thinking it can't read memory?

Re: SSD Research - OCZ SSD

January 17th, 2018, 4:35

Maybe your problem is on the U20 IC or the U1 (this one get's burned on many of the boards).
U20 seem like a QFA-16 but i cant read the code on it.
Could you tell what's writen on them?

Re: SSD Research - OCZ SSD

January 17th, 2018, 9:42

Hi,


Thanks for the replies. I haven't had time to re-visit these but will soon.

U1 is made by ST and is marked: 25P40VP


U20 is marked:
AJFJ
L150

Re: SSD Research - OCZ SSD

January 17th, 2018, 16:40

EP53A8LQI, Enpirion/Altera, PowerSoC, Voltage Mode Synchronous PWM Buck with Integrated Inductor, 1A, Vin = 2.4V - 5.5V, marking AJxx, QFN-16:
https://www.altera.com/content/dam/alte ... _03651.pdf

M25P40VP is a 4Mbit (512K x 8) Serial Flash memory.

Re: SSD Research - OCZ SSD

January 19th, 2018, 3:31

A fastest thing, to see if it is the chip or not, it would be
to check the SMD resistors and the SMD capacitors for some short circuit..
If it's one of them, change it and you're good to go.

Re: SSD Research - OCZ SSD

January 19th, 2018, 15:33

blackwolf511 wrote:A fastest thing, to see if it is the chip or not, it would be
to check the SMD resistors and the SMD capacitors for some short circuit.

I would start by measuring the voltages. If one is missing, or out of spec, then I would look for a cause. A shorted resistor would be extremely unlikely (I don't recall ever seeing one).

In any case, HaQue is getting output from the UART port, so this means that the controller must be alive, which in turn means that Vcore and Vio must be OK. I don't know if there would be any message from the UART if the NAND supply were missing.

For reference:

EP53A8LQI, Enpirion/Altera, PowerSoC, Voltage Mode Synchronous PWM Buck with Integrated Inductor, 1A, Vin = 2.4V - 5.5V, marking AJxx, QFN-16, external divider, VS = 0.8V - 1.5V:
https://www.altera.com/content/dam/altera-www/global/en_US/pdfs/literature/ds/ep53a8xqi_03651.pdf

EP53A8HQI, Enpirion/Altera, PowerSoC, Voltage Mode Synchronous PWM Buck with Integrated Inductor, 1A, Vin = 2.4V - 5.5V, marking AMxx, QFN-16, VS = 1.8V - 3.3V:
https://www.altera.com/content/dam/altera-www/global/en_US/pdfs/literature/ds/ep53a8xqi_03651.pdf

EP53F8QI, Enpirion/Altera, PowerSoC, Voltage Mode Synchronous PWM Buck with Integrated Inductor, 1500mA, Vin = 2.4V - 5.5V, marking APxx:
https://www.altera.com/content/dam/altera-www/global/en_US/pdfs/literature/ds/ep53f8qi_01542.pdf

Intel Enpirion Power Solutions Product Marking Information - Altera:
https://www.altera.com/content/dam/altera-www/global/en_US/pdfs/literature/ds/prodmarkspec_l01a.pdf

Re: SSD Research - OCZ SSD

January 21st, 2018, 9:38

Thanks Franc for the detailed response. I will pick this up pretty soon and do some measurements. Thanks also to the other replies. I ordered a better JTAG adapter for some other Marvell investigation so I will try it out as well. I also don't know if I tried shorting the technological mode pins when I was looking at the serial port, so will also try that.
Post a reply