All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 25 posts ]  Go to page 1, 2  Next
Author Message
 Post subject: Kingston - DT50 16GB Chipoff [ PS2250-07-V Controller ]
PostPosted: June 7th, 2020, 14:19 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 3464
Location: CDRLabs @ Chandigarh [ India ]
Hi Boys ,
Got a PS2250-07-V Controller On The Kingston DT50 "16GB " ,Its a TSOP48 And it Will Be Fun Working On It Using VNR ,Lets See If Igors And Sasha's Student Has Any Brain To Nail This Or Not ,I Would Be Taking This Chip Out Tomorrow And Working On It At Night ,Lets See If i Get Stuck In Uncharted Waters Somewhere . I Would Be Making a Youtube Video On This . :mrgreen:

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com


Top
 Profile  
 
 Post subject: Re: Kingston - DT50 16GB Chipoff [ PS2250-07-V Controller ]
PostPosted: June 8th, 2020, 22:41 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 3464
Location: CDRLabs @ Chandigarh [ India ]
Wow ,
I Am Shocked At The No of BAD Blocks bit errors in the chip used in this pendrive ,Comeon Kingston Use Some Better NAND Chip ,This is Really POS .I Read The Dump @ 2 Volts And Corrected Bit Errors ,I Am Now Trying To Correct Bit Errors in Data Only Areas , Using 3.3 Volts For 3 Passes And Then i Will Keep Going Down Step By Step In Voltage ,Lets See The End Result ,System is a Bit Slow But its OK .

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com


Top
 Profile  
 
 Post subject: Re: Kingston - DT50 16GB Chipoff [ PS2250-07-V Controller ]
PostPosted: June 11th, 2020, 22:53 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 3464
Location: CDRLabs @ Chandigarh [ India ]
Hi Friends ,
For the time being i have shifted this to PC3000 Flash Ver 7.4.11 .I am roman are working on correcting bit errors on this dump . The Chip in question is

AD3A1803 0050AD3A

PS : Roman Said " They have Seen Approx 60+ Cases in 2020 " For These Failed Kingston NAND And the quality of this NAND chips in very bad .I will appreciate if a VNR or PC3K Flash User can tip me how to correct the same .Thanks guys the boys with tech toys :mrgreen:

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com


Top
 Profile  
 
 Post subject: Re: Kingston - DT50 16GB Chipoff [ PS2250-07-V Controller ]
PostPosted: June 11th, 2020, 23:15 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 3464
Location: CDRLabs @ Chandigarh [ India ]
Correction = "I and roman "

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com


Top
 Profile  
 
 Post subject: Re: Kingston - DT50 16GB Chipoff [ PS2250-07-V Controller ]
PostPosted: June 12th, 2020, 9:00 
Offline

Joined: August 26th, 2013, 3:50
Posts: 8
Location: Russia
Hi Amarbir,
read-retry for this chip is supported since version 3.7. Did you try to reread with the read-retry?


Top
 Profile  
 
 Post subject: Re: Kingston - DT50 16GB Chipoff [ PS2250-07-V Controller ]
PostPosted: June 13th, 2020, 0:39 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 3464
Location: CDRLabs @ Chandigarh [ India ]
Igor_Loskutov wrote:
Hi Amarbir,
read-retry for this chip is supported since version 3.7. Did you try to reread with the read-retry?


Well,
RR-15 You Mean ? . I was trying it on data only areas as this was a xor case ,but the thing was not correcting as many errors as it should ,I want to know if i directly heat or cool the chip will it make any difference ? .

PS : i have seen SGdata do this ,Issue is in learning process no one helps ,This is very sad ,specially when we are very dedicated to work

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com


Top
 Profile  
 
 Post subject: Re: Kingston - DT50 16GB Chipoff [ PS2250-07-V Controller ]
PostPosted: June 14th, 2020, 15:04 
Offline

Joined: October 24th, 2009, 15:22
Posts: 872
Location: Poland
Amarbir[CDR-Labs] wrote:
Hi Friends ,
For the time being i have shifted this to PC3000 Flash Ver 7.4.11 .I am roman are working on correcting bit errors on this dump . The Chip in question is

AD3A1803 0050AD3A

PS : Roman Said " They have Seen Approx 60+ Cases in 2020 " For These Failed Kingston NAND And the quality of this NAND chips in very bad .I will appreciate if a VNR or PC3K Flash User can tip me how to correct the same .Thanks guys the boys with tech toys :mrgreen:


IMHO this chip just need special read retry reading mode. Thats all.

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices


Top
 Profile  
 
 Post subject: Re: Kingston - DT50 16GB Chipoff [ PS2250-07-V Controller ]
PostPosted: June 15th, 2020, 7:45 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 3464
Location: CDRLabs @ Chandigarh [ India ]
arvika wrote:
Amarbir[CDR-Labs] wrote:
Hi Friends ,
For the time being i have shifted this to PC3000 Flash Ver 7.4.11 .I am roman are working on correcting bit errors on this dump . The Chip in question is

AD3A1803 0050AD3A

PS : Roman Said " They have Seen Approx 60+ Cases in 2020 " For These Failed Kingston NAND And the quality of this NAND chips in very bad .I will appreciate if a VNR or PC3K Flash User can tip me how to correct the same .Thanks guys the boys with tech toys :mrgreen:


IMHO this chip just need special read retry reading mode. Thats all.


Well,
Once Roman Is Finished With His Process I Will Start Read Retry In VNR And Report Back ,What a Shitty Ship

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com


Top
 Profile  
 
 Post subject: Re: Kingston - DT50 16GB Chipoff [ PS2250-07-V Controller ]
PostPosted: June 15th, 2020, 11:18 
Offline

Joined: August 26th, 2013, 3:50
Posts: 8
Location: Russia
Amarbir[CDR-Labs] wrote:
Igor_Loskutov wrote:
Hi Amarbir,
read-retry for this chip is supported since version 3.7. Did you try to reread with the read-retry?


Well,
RR-15 You Mean ? . I was trying it on data only areas as this was a xor case ,but the thing was not correcting as many errors as it should ,I want to know if i directly heat or cool the chip will it make any difference ? .

Yes, and what do you mean when you say that it doesn't work as it should? Sometimes a chip may be in a really bad condition, so the errors are not corrected. This read retry was tested with this chip and it worked, but anyway, we'll retest it again. Can't say about the effect of heating/colling on this particular chip. It's a matter of try, this one wasn't tested.


Top
 Profile  
 
 Post subject: Re: Kingston - DT50 16GB Chipoff [ PS2250-07-V Controller ]
PostPosted: June 15th, 2020, 11:36 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 3464
Location: CDRLabs @ Chandigarh [ India ]
Igor_Loskutov wrote:
Yes, and what do you mean when you say that it doesn't work as it should? Sometimes a chip may be in a really bad condition, so the errors are not corrected. This read retry was tested with this chip and it worked, but anyway, we'll retest it again. Can't say about the effect of heating/colling on this particular chip. It's a matter of try, this one wasn't tested.


Sir ,
I Think We Will Let PC3K Work On The Chip .Once Done We Will Work On VNR And Then Might You Developers Can Work on This Live Case And See If Read Retry Works Positively .But i need a few days to work on pc3k on this

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com


Top
 Profile  
 
 Post subject: Re: Kingston - DT50 16GB Chipoff [ PS2250-07-V Controller ]
PostPosted: September 22nd, 2020, 13:57 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 3464
Location: CDRLabs @ Chandigarh [ India ]
Well,
Boys VNR And PC3K Cannot Correct These Chip IMHO ,I Do Not Have FE So i Cannot Say About That Tool ,This chip id can have 40% to 60% errors pheewwww

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com


Top
 Profile  
 
 Post subject: Re: Kingston - DT50 16GB Chipoff [ PS2250-07-V Controller ]
PostPosted: September 22nd, 2020, 15:58 
Offline

Joined: October 24th, 2009, 15:22
Posts: 872
Location: Poland
In VNR it is possible, you must use correct read retry settings.

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices


Top
 Profile  
 
 Post subject: Re: Kingston - DT50 16GB Chipoff [ PS2250-07-V Controller ]
PostPosted: September 22nd, 2020, 16:50 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 3464
Location: CDRLabs @ Chandigarh [ India ]
arvika wrote:
In VNR it is possible, you must use correct read retry settings.


Well,
i still have that case ,Would you like to look at it remotely or shall i ask for rusolut support ,The RR in VNR Thats Selected For This Chip By Default DOES NOT WORK

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com


Top
 Profile  
 
 Post subject: Re: Kingston - DT50 16GB Chipoff [ PS2250-07-V Controller ]
PostPosted: September 22nd, 2020, 17:01 
Offline

Joined: October 24th, 2009, 15:22
Posts: 872
Location: Poland
It need special mode. Cant do it remotely.

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices


Top
 Profile  
 
 Post subject: Re: Kingston - DT50 16GB Chipoff [ PS2250-07-V Controller ]
PostPosted: September 22nd, 2020, 23:10 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 3464
Location: CDRLabs @ Chandigarh [ India ]
arvika wrote:
It need special mode. Cant do it remotely.


Well,
This implies for general public it does not work ,We cannot create special mode

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com


Top
 Profile  
 
 Post subject: Re: Kingston - DT50 16GB Chipoff [ PS2250-07-V Controller ]
PostPosted: September 23rd, 2020, 1:24 
Offline

Joined: October 24th, 2009, 15:22
Posts: 872
Location: Poland
You can. There is Power up actions in config. You can use it.

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices


Top
 Profile  
 
 Post subject: Re: Kingston - DT50 16GB Chipoff [ PS2250-07-V Controller ]
PostPosted: September 23rd, 2020, 14:37 
Offline
User avatar

Joined: December 29th, 2016, 18:13
Posts: 141
Location: Poland
@Amarbir: There are few options to use RR but you need first understand what RR really do. ReadRetry (RR) are commands that are sended to NAND and by this it change threshold of cells. To set proper RR you need to know address which is reponsible to change threshold (called registers) and their data to set (so called values). You can have 4, 6, ..... 32 registers. Many chip uses same RR but there are some that doesn't work on standard library codes and you need to set it up by your own (look for all 8bytes for ID) ... there are few ways:

- Sniff them using Logic Analyzer when you get working device (so called donor) so how controller communicate with NAND... ( a lot of time.... for us called lost of time but it's possible)
- Bruteforce them so apply all values from 0x00 to 0xff into correct address (this option was addedd to FE few weeks ago but require to know correct address - if you not have correct address then you cannot use it. The addresses are "hidden" under for example Hynix v1/v2/v3/v4 etc)
- read those values from NAND OTP if OTP area exist (this way we prefer and we found a way to get it long time ago and use it till now)

You can set own RR with VNR (Rusolut) in Config / Power UP actions (as Michal writes) or in FE by using Before Read option to give commands to NAND before read page. I don't see option to use own RR in PC3K and this sometimes make impossible to read leatest 3D TLC v4 chip correctly but this is talk for other time.

Now question from where you get those addresse/correct value ? In FF you can see values but not address ! Most important thing is to know correct registers address - nobody will share those for you since this knowledge requires a lot of work and time spend on research.... that why producers code this into software and not share anywhere. Due this you see RR1/RR2/RR3 in VNR for example.....

For someone who know how RR works and are able to read it from OTP settings correct threshold takes usually not more that 2-10 minutes to get perfect readout (this example is from eMMC that everyone claims was unrecoverable - https://www.youtube.com/watch?v=_iBkOclbMmM)

P.S
One more thing: values in registers are depend from each other in leatest chip - changing A reflect to B for example but they vary also in temperature... so perfect RR to chip readed in +24C will usually not work in temp. -20C or +60C

_________________
Best regards,
Boguslaw Rzepka,
Multi-COM Ltd., Poland


Top
 Profile  
 
 Post subject: Re: Kingston - DT50 16GB Chipoff [ PS2250-07-V Controller ]
PostPosted: September 23rd, 2020, 16:26 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 3464
Location: CDRLabs @ Chandigarh [ India ]
Wow ,
Thank You For This Wonderful Explanation ,I will Be Sending You a Email Soon .

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com


Top
 Profile  
 
 Post subject: Re: Kingston - DT50 16GB Chipoff [ PS2250-07-V Controller ]
PostPosted: February 9th, 2022, 14:20 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 3464
Location: CDRLabs @ Chandigarh [ India ]
Haa Haa ,

Got Another One Today its a PS2251-7-V Kingston DTSwivl Model With The Same Lousy Chip ,We are in VNR 6.01 Now and i would like to see if VNR can RR this Chip Now ,No Access To Version 7.5 of PC 3000 Flash [ Using Ver 7.4 ] and waiting for version 7.6 ,FE is do not have " Saving Money For the Same " .

PS : Many Kingston models use this combination ,I am very sure this is a great controller as it can work with such lousy quality chips and if we can use a good quality chip and use factory tool to program it we have a great pendrive :mrgreen:

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com


Top
 Profile  
 
 Post subject: Re: Kingston - DT50 16GB Chipoff [ PS2250-07-V Controller ]
PostPosted: March 20th, 2023, 21:20 
Offline
User avatar

Joined: July 8th, 2019, 12:27
Posts: 147
Location: 中国大陆浙江省湖州市
Bolo wrote:
@Amarbir: There are few options to use RR but you need first understand what RR really do. ReadRetry (RR) are commands that are sended to NAND and by this it change threshold of cells. To set proper RR you need to know address which is reponsible to change threshold (called registers) and their data to set (so called values). You can have 4, 6, ..... 32 registers. Many chip uses same RR but there are some that doesn't work on standard library codes and you need to set it up by your own (look for all 8bytes for ID) ... there are few ways:

- Sniff them using Logic Analyzer when you get working device (so called donor) so how controller communicate with NAND... ( a lot of time.... for us called lost of time but it's possible)
- Bruteforce them so apply all values from 0x00 to 0xff into correct address (this option was addedd to FE few weeks ago but require to know correct address - if you not have correct address then you cannot use it. The addresses are "hidden" under for example Hynix v1/v2/v3/v4 etc)
- read those values from NAND OTP if OTP area exist (this way we prefer and we found a way to get it long time ago and use it till now)

You can set own RR with VNR (Rusolut) in Config / Power UP actions (as Michal writes) or in FE by using Before Read option to give commands to NAND before read page. I don't see option to use own RR in PC3K and this sometimes make impossible to read leatest 3D TLC v4 chip correctly but this is talk for other time.

Now question from where you get those addresse/correct value ? In FF you can see values but not address ! Most important thing is to know correct registers address - nobody will share those for you since this knowledge requires a lot of work and time spend on research.... that why producers code this into software and not share anywhere. Due this you see RR1/RR2/RR3 in VNR for example.....

For someone who know how RR works and are able to read it from OTP settings correct threshold takes usually not more that 2-10 minutes to get perfect readout (this example is from eMMC that everyone claims was unrecoverable - https://www.youtube.com/watch?v=_iBkOclbMmM)

P.S
One more thing: values in registers are depend from each other in leatest chip - changing A reflect to B for example but they vary also in temperature... so perfect RR to chip readed in +24C will usually not work in temp. -20C or +60C

According to the experiment, I think the first register address of FE, HYV1 read retry option should be A7 instead of AC, please check
For the read retry address of AD3A1803, I think the current version also has a major bug, which will cause sometimes the ECC bitmap gives green, but the data is actually wrong. According to my experiment, AD3A1803 has 31-bit register address


Attachments:
HYV1.jpg
HYV1.jpg [ 164.61 KiB | Viewed 8262 times ]

_________________
Auxiliary Tool Used For MonoLith Data Recovery, featuring the industry's most extensive Monolith pinouts
http://flash-matrix.com/
Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 25 posts ]  Go to page 1, 2  Next

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 4 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group