All times are UTC - 5 hours [ DST ]


Forum rules


Please do not post questions about data recovery cases here (use this forum instead). This forum is for topics on finding new ways to recover data. Accessing firmware, writing programs, reading bits off the platter, recovering data from dust...



Post new topic Reply to topic  [ 14 posts ] 
Author Message
 Post subject: SSD Research - OCZ SSD
PostPosted: May 8th, 2015, 0:58 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3844
Location: Adelaide, Australia
This SSD seems to be bricked, now it is for research. I didn't get the cover with the board, so I don't know what the model was. In this thread I will post anything interesting I find. I hope to include things like:
- Console access
- JTAG, hooking up, output etc
- Firmware update, RE, tricks, tips
- Possibility of NAND chip off recovery
- Wear levelling/ECC/data Structures etc
- anything interesting

Feel free to add anything you might know or find out, or any comments, criticism etc. All I ask Is the thread stays on topic to this research.

Vendor: OCZ
Model: Unknown (OCZ Octane? http://www.playwares.com/xe/power_hdd/23075600
Type: SSD
capacity: Unknown (128GB?)
Interface: SATA
Manufactured: Around 2012
Condition: Not Working
Controller: Indilinx IDX300M01-BC
NAND chips: 16x 8GB
NAND Vendor: Hynix
NAND Laser code:H27UCG8T2MR
NAND ID: ad de 94 d2

Attachment:
OCZ-PCB-1.jpg
OCZ-PCB-1.jpg [ 1.39 MiB | Viewed 26980 times ]

Attachment:
OCZ-PCB-2.jpg
OCZ-PCB-2.jpg [ 1.54 MiB | Viewed 26980 times ]


On the board, a serial port is clearly marked with VCC TX RX and GND. I got Minimal output on a serial test with Putty using BAUD Rate 115200 and shorting J3 1-2
Code:
sata_task started: S= DRIVE_IDLE_STATE
drive state: DRIVE_SEND_ERROR_STATUS_STATE


The other unpopulated 10pin block, J10 I don't know what it is.

JTAG port is clearly marked with VCC, TDO, TDI, TMS, TCK and GND. I will test this soon. There are Test points on the board, TP1 - TP4 etc. Not sure if these are useful.


Top
 Profile  
 
 Post subject: Re: SSD Research - OCZ SSD
PostPosted: May 9th, 2015, 9:38 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3844
Location: Adelaide, Australia
I tried OpenOCD in windows, but seems Bus pirate wasn't supported in the binaries I downloaded - and I wasn't sure I would have time to compile for windows.

So started up a Kili Linux VM and apt-get'd all the reqirements for openOCD, compiled to support my Bus Pirate. Then updated the firmware of the Bus Pirate, hooked everything up to the board and was rewarded with:

Code:
HaQue@kali:~# telnet localhost 4444
Trying ::1...
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
>
>jtag arp_init-reset
JTAG tap: auto0.tap tap/device found: 0x10147043 (mfg: 0x021, part: 0x0147, ver: 0x1)

>scan_chain                     
   TapName             Enabled  IdCode     Expected   IrLen IrCap IrMask
-- ------------------- -------- ---------- ---------- ----- ----- ------
0 auto0.tap              Y     0x10147043 0x00000000     2 0x01  0x03
>


Looks like the board is not totally dead.

I will admit I am unsure of where to go from here, not having played around with JTAG for a LONG time.

happy to take any hints!


Top
 Profile  
 
 Post subject: Re: SSD Research - OCZ SSD
PostPosted: July 17th, 2015, 12:32 
Offline
User avatar

Joined: July 11th, 2015, 18:20
Posts: 8
Location: Mississippi
Use "dump_image 0.bin 0x0 0x10000" and "dump_image FFFF0000.bin 0xFFFF0000 0x10000" and start looking at the code to see other areas to dump. And post the files too since now I'm curious :-)

- George


Top
 Profile  
 
 Post subject: Re: SSD Research - OCZ SSD
PostPosted: July 17th, 2015, 12:35 
Offline
User avatar

Joined: July 11th, 2015, 18:20
Posts: 8
Location: Mississippi
GeorgeKJones62 wrote:
Use "dump_image 0.bin 0x0 0x10000" and "dump_image FFFF0000.bin 0xFFFF0000 0x10000" and start looking at the code to see other areas to dump. And post the files too since now I'm curious :-)

- George


Well, "halt" it first

- George


Top
 Profile  
 
 Post subject: Re: SSD Research - OCZ SSD
PostPosted: July 17th, 2015, 20:14 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3844
Location: Adelaide, Australia
Thanks George, I will give that a try.

I am looking at buying a better JTAG adapter first, I don't think this BP is up to any serious JTAGging


Top
 Profile  
 
 Post subject: Re: SSD Research - OCZ SSD
PostPosted: July 17th, 2015, 22:32 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3844
Location: Adelaide, Australia
tried it.

I don't seem to have the command "dump_image" available?

cant see it in help. I am using Open OCD 0.9.0-rc1-dev-00001

have to look into why, maybe need to recompile with different config or something. Need lots more JTAG experience ;)


Top
 Profile  
 
 Post subject: Re: SSD Research - OCZ SSD
PostPosted: July 20th, 2015, 9:34 
Offline
User avatar

Joined: July 11th, 2015, 18:20
Posts: 8
Location: Mississippi
HaQue wrote:
Thanks George, I will give that a try.

I am looking at buying a better JTAG adapter first, I don't think this BP is up to any serious JTAGging


I agree. Try the Bus Blaster instead. Still cheap, but decent support in Open OCD

_________________
- George


Top
 Profile  
 
 Post subject: Re: SSD Research - OCZ SSD
PostPosted: July 20th, 2015, 9:37 
Offline
User avatar

Joined: July 11th, 2015, 18:20
Posts: 8
Location: Mississippi
HaQue wrote:
tried it.

I don't seem to have the command "dump_image" available?

cant see it in help. I am using Open OCD 0.9.0-rc1-dev-00001


Well that's strange... I'd point at the documentation but sourceforge seems to be having issues. So I'll just point at someone with a much older version who has it available

http://techwithdave.blogspot.com/2013/0 ... enocd.html

I'm a bit of an Open OCD novice myself. But maybe it has to do with your configuration thinking it can't read memory?

_________________
- George


Top
 Profile  
 
 Post subject: Re: SSD Research - OCZ SSD
PostPosted: January 17th, 2018, 4:35 
Offline

Joined: January 17th, 2018, 4:28
Posts: 6
Location: homestead
Maybe your problem is on the U20 IC or the U1 (this one get's burned on many of the boards).
U20 seem like a QFA-16 but i cant read the code on it.
Could you tell what's writen on them?


Top
 Profile  
 
 Post subject: Re: SSD Research - OCZ SSD
PostPosted: January 17th, 2018, 9:42 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3844
Location: Adelaide, Australia
Hi,


Thanks for the replies. I haven't had time to re-visit these but will soon.

U1 is made by ST and is marked: 25P40VP


U20 is marked:
AJFJ
L150


Top
 Profile  
 
 Post subject: Re: SSD Research - OCZ SSD
PostPosted: January 17th, 2018, 16:40 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
EP53A8LQI, Enpirion/Altera, PowerSoC, Voltage Mode Synchronous PWM Buck with Integrated Inductor, 1A, Vin = 2.4V - 5.5V, marking AJxx, QFN-16:
https://www.altera.com/content/dam/alte ... _03651.pdf

M25P40VP is a 4Mbit (512K x 8) Serial Flash memory.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: SSD Research - OCZ SSD
PostPosted: January 19th, 2018, 3:31 
Offline

Joined: January 17th, 2018, 4:28
Posts: 6
Location: homestead
A fastest thing, to see if it is the chip or not, it would be
to check the SMD resistors and the SMD capacitors for some short circuit..
If it's one of them, change it and you're good to go.


Top
 Profile  
 
 Post subject: Re: SSD Research - OCZ SSD
PostPosted: January 19th, 2018, 15:33 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
blackwolf511 wrote:
A fastest thing, to see if it is the chip or not, it would be
to check the SMD resistors and the SMD capacitors for some short circuit.

I would start by measuring the voltages. If one is missing, or out of spec, then I would look for a cause. A shorted resistor would be extremely unlikely (I don't recall ever seeing one).

In any case, HaQue is getting output from the UART port, so this means that the controller must be alive, which in turn means that Vcore and Vio must be OK. I don't know if there would be any message from the UART if the NAND supply were missing.

For reference:

EP53A8LQI, Enpirion/Altera, PowerSoC, Voltage Mode Synchronous PWM Buck with Integrated Inductor, 1A, Vin = 2.4V - 5.5V, marking AJxx, QFN-16, external divider, VS = 0.8V - 1.5V:
https://www.altera.com/content/dam/altera-www/global/en_US/pdfs/literature/ds/ep53a8xqi_03651.pdf

EP53A8HQI, Enpirion/Altera, PowerSoC, Voltage Mode Synchronous PWM Buck with Integrated Inductor, 1A, Vin = 2.4V - 5.5V, marking AMxx, QFN-16, VS = 1.8V - 3.3V:
https://www.altera.com/content/dam/altera-www/global/en_US/pdfs/literature/ds/ep53a8xqi_03651.pdf

EP53F8QI, Enpirion/Altera, PowerSoC, Voltage Mode Synchronous PWM Buck with Integrated Inductor, 1500mA, Vin = 2.4V - 5.5V, marking APxx:
https://www.altera.com/content/dam/altera-www/global/en_US/pdfs/literature/ds/ep53f8qi_01542.pdf

Intel Enpirion Power Solutions Product Marking Information - Altera:
https://www.altera.com/content/dam/altera-www/global/en_US/pdfs/literature/ds/prodmarkspec_l01a.pdf

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: SSD Research - OCZ SSD
PostPosted: January 21st, 2018, 9:38 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3844
Location: Adelaide, Australia
Thanks Franc for the detailed response. I will pick this up pretty soon and do some measurements. Thanks also to the other replies. I ordered a better JTAG adapter for some other Marvell investigation so I will try it out as well. I also don't know if I tried shorting the technological mode pins when I was looking at the serial port, so will also try that.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 14 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 15 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group