All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 30 posts ]  Go to page Previous  1, 2
Author Message
 Post subject: Re: Unable to find Spare Area for Micron FT32G08UCM1-15
PostPosted: October 17th, 2017, 11:23 
Offline

Joined: October 20th, 2014, 5:25
Posts: 138
Location: Sweden
Thanks Sasha.

May I ask what kind of magic do you use in the BCH code words, and how were these found out? Because I never managed to ECC-correct all bit faults, so my own logical image was full of errors and completely unsalvageble.


Top
 Profile  
 
 Post subject: Re: Unable to find Spare Area for Micron FT32G08UCM1-15
PostPosted: October 17th, 2017, 12:01 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3844
Location: Adelaide, Australia
I am guessing the general principal and some examples were found out by the engineers collectively, from backgrounds in flash, electronic engineering, forensics etc, and maybe access to things like SDK's or even proprietary info when flash was a little younger. And in the lab they could apply the knowledge to move forward and figure out other schemes. maybe some used services like chipworks to reverse engineer, I don't know.

This is a primer on ECC http://processors.wiki.ti.com/index.php/Raw_NAND_ECC I haven't delved into the algos, but I have always assumed they were not that complex for flash, being for error correction the algo would be fairly standard, and as not for security, probably not in-learnable. Indeed this doc http://www.cypress.com/file/203021/download states:
Quote:
Conclusion
Hamming based block codes are the most commonly used ECC for SLC NAND. Hamming codes are relatively
straightforward and simple to be implemented in either software or hardware. The disadvantage of Hamming
codes is its limited error correction capabilities, with two bit errors detection and only one bit error correction.
Therefore, it is mainly used in SLC NAND flash applications.
Reed-Solomon and BCH are able to handle multiple errors. Both codes are powerful and able to handle both
random and burst errors. Reed-Solomon code is a subset of the BCH. However, BCH is simpler than Reed-
Solomon to decode and implement.

and this page has an excel BCH calculator down the bottom if you want to get into the weeds. https://community.cypress.com/docs/DOC-9263 I am sure implementations differ between vendors too.
The magic in userland is basically : " I will try "x" in this case because in case "abc" we used "x" and it worked. I will try "y" and "z" modifications to "x" because in other cases, these were the variables that changed.


Top
 Profile  
 
 Post subject: Re: Unable to find Spare Area for Micron FT32G08UCM1-15
PostPosted: October 17th, 2017, 15:17 
Online

Joined: October 24th, 2009, 15:22
Posts: 867
Location: Poland
BCH is very simple. Here you can find some basic information and mathematical formula: https://en.wikipedia.org/wiki/BCH_code
;)

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices


Top
 Profile  
 
 Post subject: Re: Unable to find Spare Area for Micron FT32G08UCM1-15
PostPosted: October 17th, 2017, 16:29 
Offline

Joined: July 2nd, 2014, 8:05
Posts: 201
Haha, yeah, as Arvika pointed out BCH codes are very simple :D
Especially when you have built-in decoder in VNR.
Infact in VNR for the end used the whole formula is pretty simple.
Usually codeword = Data area chunk + Spare area chunk + ECC area chunk.
Where DA+SA = payload; ECC = parity.
In BCH element you have several codewords depending on how many DA chunks you have in page.
Payload and parity positions are just relative offsets of each area from 0 which is beginning of page (consider page as vector of bits or in other words horizontal line of bits/bytes as we see in bitmap).
Polynomial is a coefficients of the formula, usually same for one vendor.
Inv/Rotation are specific settings of ECC code (you have to brute force them, usually just 4 combinations of flags which is easy).

We will add one sweeet feature for unknown/new BCH code analysis for the specified (or all!) Galois field with variable boundaries of areas.

Right now the biggest challenge is scrambled parity area but still doable for most of cases.

_________________
VISUAL NAND RECONSTRUCTOR. A big revolution in chip-off data recovery


Top
 Profile  
 
 Post subject: Re: Unable to find Spare Area for Micron FT32G08UCM1-15
PostPosted: October 17th, 2017, 16:34 
Offline

Joined: July 2nd, 2014, 8:05
Posts: 201
bos wrote:
Because I never managed to ECC-correct all bit faults, so my own logical image was full of errors and completely unsalvageble.


Make sure that you turn power ON on BCH (activate ECC correction) element before saving data/image!

_________________
VISUAL NAND RECONSTRUCTOR. A big revolution in chip-off data recovery


Top
 Profile  
 
 Post subject: Re: Unable to find Spare Area for Micron FT32G08UCM1-15
PostPosted: October 17th, 2017, 16:36 
Offline

Joined: October 20th, 2014, 5:25
Posts: 138
Location: Sweden
I did, but the ECC-map was way more red than green, meaning I failed miserably on something on the way. I'm just not sure what :D


Top
 Profile  
 
 Post subject: Re: Unable to find Spare Area for Micron FT32G08UCM1-15
PostPosted: October 17th, 2017, 16:51 
Offline

Joined: July 2nd, 2014, 8:05
Posts: 201
Are we still talking about this tablet's dump?
If so, I tested BCH and it was green.
You just need to skip first 10-20 blocks with FW they not protected by ECC so appears as red (one square element in ECC map is one page usually (or one codeword, depends..).
Scroll down to the middle of dump and check 5-10 blocks/places.

_________________
VISUAL NAND RECONSTRUCTOR. A big revolution in chip-off data recovery


Top
 Profile  
 
 Post subject: Re: Unable to find Spare Area for Micron FT32G08UCM1-15
PostPosted: October 17th, 2017, 18:42 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3844
Location: Adelaide, Australia
definitions of "simple" vary :-) !!!


Top
 Profile  
 
 Post subject: Re: Unable to find Spare Area for Micron FT32G08UCM1-15
PostPosted: October 18th, 2017, 7:20 
Offline

Joined: October 20th, 2014, 5:25
Posts: 138
Location: Sweden
Sasha Sheremetov wrote:
Are we still talking about this tablet's dump?
If so, I tested BCH and it was green.

Yes.

The thing is, when I clicked the yellow lamp in BCH elements, I only found 2 matches in one codeword, while in your case you have a lot of codewords. That's why I was asking "May I ask what kind of magic do you use in the BCH code words, and how were these found out?" earlier, because I couldn't figure out how or even what you did in that step.

Here's when I click the bulb:
Attachment:
bch.png
bch.png [ 14.46 KiB | Viewed 12262 times ]



Here's your codewords:
Attachment:
bch2.png
bch2.png [ 8.97 KiB | Viewed 12262 times ]


Top
 Profile  
 
 Post subject: Re: Unable to find Spare Area for Micron FT32G08UCM1-15
PostPosted: October 18th, 2017, 18:24 
Offline

Joined: July 2nd, 2014, 8:05
Posts: 201
Ah I got it.
The BCH element works very flexible (yeah, unlike in other tools!) so you have two modes - manual and automatic.
I made completely new BCH code for your device manually so you have it in BCH element as a formula.
Now if you save a code as file and place it into BCHcodewords folder autodetection will find it (most likely) when you run it next time.
There's a button in BCH codewords editor - save/load.

_________________
VISUAL NAND RECONSTRUCTOR. A big revolution in chip-off data recovery


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 30 posts ]  Go to page Previous  1, 2

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 3 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group