Ok, let's try to start working on a flash adapater solution together:

My main objective is to have a flash adapter that is capable to dump/read BGA-316 chips.
Optional targets:
* Write+Erase support
* VSC support (I actually found some vendor specific commands and want a reader where I am able to play around with them)
* High speed
* Cheap price

I started to collect a market-overview of potentially interesting Flash adapters, both commercially available and DIY solutions:

https://docs.google.com/spreadsheets/d/ ... sp=sharing
(Should I provide a Non-Google-Docs version for anyone?)
Does anyone know any flash readers that I haven't covered yet? Any feedback or improvements are highly appreciated!

BGA-316 has defined approximately 80 balls (the standard defines up to 32 chip enable lines, the chips I have seem use ), so I took a look at the interface between the flash reader and the chip adapters and counted the number of pins. It seems that all the commercial data-recovery flash readers do not have enough pins for ONFI BGA-316.
I guess that we might be able to spare a few pins by sharing the data lines between the quad 8-bit data lines, which would slow the reading down, but would allow flash readers to be used with less pins. I am not sure, whether that works out electrically (whether the chips are able to drive the load of shared data lines), or whether we would get other signal integrity problems. If sharing the lines would be possible, what is the minimum number of pins we actually need to fully support BGA-316? (I have a friend who might be able to answer that question)

I took a look at the interface connector between the flash reader and the chip adapters, to see whether they are easily purchasable, whether it is possible to develop your own adapters, whether the wiring is high-speed capable.

Is any of the vendors able to use GPIO Extenders on the Flash Adapters? Using 2 I/Os for a GPIO extender that extends to the 32 CE lines might be a good idea to spare I/O lines between the flash reader and the adapters.

Another thing that surprised me is that I couldn't find any USB3 flash reader yet. But perhaps it would need a lot of effort for parallelisation for all the other things to make use of USB3 speed, and it would likely interfere with the linear dump-file concept the industry currently has.

Since I couldn't find any data-recovery capable flash reader with BGA-316 support, I also searched for universal programmers (the UP-828P looks really interesting!), and I researched how it would be possible to DIY. I also searched for single-board computers that have enough GPIOs to be usable, anything that can be turned into a NAND flash reader.

Since BGA316 is difficult from the hardware side and kind of a niche market, I thought it might be a good idea that we start with an easier ONFI compliant target instead first, so I chose TSOP-48 for it. I have a BGA-316 <-> TSOP-48 adapter (with 4CE), so whatever is to be learnt for TSOP-48 should be applicable to BGA-316 later.

I bought a 360-Clip for TSOP48 and used it with a logic-analyzer. One important warning: The 360-CLIP comes in 3 different versions: The 32-Pin version, the 48-Pin version and the 56-Pin version. I accidently bought the 32-Pin version, which provides only 2 CE lines, the 48-Pin version is my preferred version. If you have to deal with TSOP56 you want the 56-Pin version.
I think we should develop an ONFI decoder for SigRok, does anyone want to help there? I developed a few SigRok plugins in the past.

My research showed that many of the readers do not provide the programming voltage (VPP) on the pins, so those are not usable for Write/Erase. But they still might be usable for special VSC (vendor specific commands)

Does anyone know the maximum signal speed of the individual signal lines of ONFI? Can anyone recommend a certain logic analyzer for the job? Can anyone provide logic-analyzer dumps from a complete ONFI communication?

On the software-side, I have found several different interesting options:
I found a ANSI-C flash reader for one of the commercial tools
I found various ANSI-C flash readers that should be easily adaptable to various boards and systems.
The Linux kernel contains a lot of flash interface code and various tables for supporting various chips.
I found a ONFI compliant flash reader implemented in VHDL on OpenCores. I tried to get it converted to Verilog in an automated way, but I failed with that, I guess I would have to convert it manually to Verilog.
I took the Raspberry-Pi 360-Clip Flash-Reader code from GitHub that was posted in the forum and started enhancing it with testing functionality, I'll send it upstream to GitHub soon.
So from the software-side I am somewhat confident that we will be able to find a good solution.

Most of the commercial tools seem to just dump all pages in a linear way into a single dump file that can then be processed by most commercial tools. I think the single dump file itself is OK, but I personally would prefer that the flash reader also spits out all the flash parameters and things like the flash-ID and adds it somewhere to the file, which might be useful information for the analyzing tools later on.

I had a lot of ideas in the past about interposers that would allow not just logic analyzing but even man-in-the-middle tampering with ONFI flash, some of them I have documented in the TheMissingManual already. And I even found interposers for BGA-316 on the market, but they are only usable for logic-analyzing.

some quick notes as I'm working and don't have time to really dig in yet:

for the interposer thing, I know Bunnie did some work using custom made ribbon cable. I think it was for his purpose built hacking computer, a search should find it .. I quickly found a reference to it:


BGA-316 adapters: https://forum.hddguru.com/viewtopic.php?t=35238

I have read BGA-316 with these on NR and works well.

NR has a tool called NAND_Console_v1.rar which I assume you can send commands to chips, but I havent played with it yet. http://www.flash-extractor.com/downloads/Other/

As for LA, good luck getting anyone to actually recommend one, as it just turns into a pissing match about specifications or interpretations of them, without anyone recommending a make/model and giving an explanation of why it was chosen.

you want to analyse the nand chips protocol, so I suggest saying that to any potential vendor you contact when looking for a product. You would want protocol decoding, and I assume you would need to write your own decoder for some chips (VSC's) as I guess many would be close to standard NAND but not exactly.. again I havent done enough work in this sector to be of much help.

I have the Romulator flex cable that Bunnie designed, and that was also a great inspiration for me. I haven't actually tried it yet, but that's a good idea. That's the schematic of the romulator: http://bunniefoo.com/novena/romulator/S ... r-pvt1.PDF

What exactly do you mean with NR? VNR from Rusolut? Or NAND-Reader from Soft-Center?

Thanks for reminding me about the BGA-316 adapaters from JAKC LEE, I had forgotten about them again. Now that opens quite a lot of possibilities again.
I have one question regarding power-management for you: With those BGA-316 adapters, can the power supply to Vdd and VddQ be configured seperately by Flash Extractor? And does it have a seperate Vpp voltage that can be configured too?
Back then when I investigated the BGA-316 adapters from JAKC LEE, I errorneously thought that the supply voltage is configured by the adapter, but now I realized that the flash reader actually produces the required voltages and the adapter just passes them on to the chips.

Is it possible with the converters from Multi-Recovery to use the BGA-316 adapters from JAKC-LEE with the other commercial flash readers as well?

Has anyone here ever used any of the flash adapters for writing/erasing? Can you tell me more about which products support that?

Does anyone have pinouts for the flash adapter interfaces?

Regarding the Logic-Analyzer, I think I want more than 16 channels, so most likely 32 Channels. I guess I will try to measure the speeds with one channel first, to see what the maximum speed is that I need.

Just not sure how much man in the middling NAND is going to get you early on.


Nand Reader from Soft Center


NR - no control over voltage, if you need to change VddQ or want to play with Vcc, then you would use an external PS. You can add Vcc to other pins as documented in the manual pages, but that's it. No write voltages anymore.

VNR yes you can change Vcc and Vccq independent of each other. again I don't think there is any write functionality.

PC3K - I don't know.



Some of the other flash readers may not support the type of NAND we are talking about. Most of those are for firmware type NAND, but don't have enough support or aren't able to read the different WL versions, DDR etc. could be wrong here these days.


NR supports writing with a very old NR software version, but I don't know what chips it would support. I doubt there is any write support on any of the top 3 tools.

very doubtful, apart from SC adapter dimensions in their manual.


I know someone uses a LAP-C 322000 http://www.zeroplus.com.tw/logic-analyzer_en/products.php?pdn=7&product_id=314
last time I looked they were mucho $$$

There is another possibly up and coming reader you can add to the list:

https://www.embeddedcomputers.net/products/FlashcatUSB_Mach1/

I don't have this one yet, but will probably get one this month.

I have a classic, Pro and an XPORT (using it here: http://forum.hddguru.com/viewtopic.php?f=10&t=38520&start=20)

and very easy to use and does what it says on the tin. Products are being updated at a good steady rate.

the manual is available in the latest version of the software download. Not sure about how the write support goes, but at least there is this:

I analyzed the CE (ChipEnable) pins now, and found that my BGA316 chips have 8 CE pins, so I need a reader that supports at least 8 CE pins, which unfortunately rules out a lot of the options.
The ONFI standard for BGA316 defines up to 32 CE pins but I don't know whether any Flash chips actually use more than 8 CE pins yet.
TSOP48 is only defined with 4 CE pins in the ONFI standard.

you could build an adapter board with jumpers/dip switches to "banks" of 4 CE pins.

read 4, set jumpers, read another 4 and so on. the rare cases you would see more than 8 wouldn't be that much of a time penalty.

Something like this exists for VNR from FE interface standard, support BGA316 and BGA 272 https://multi-com.eu/,details,id_pr,22263,key,fe-converter-to-vnr-for-8ce-8bit.html