The scope screenshot is an ID command request, there is no answer because actually there is no Nand connected, haven't received my adapter yet :/
I installed a pull-up on D0 to simulate a "01 01 01 01" ID and it works.
Also tried page read command, there is no valid data of course but was able to confirm the software is Okay, and was able to tune the timings to read as fast as possible.

From what I found on internet, my eMMC Nand should have this ID : "AD D7 94 91 60".
And the Xor key used is "498383" (first 3 byte of the Xor key).

Is someone knows where I can find the complete xor key file ?

So 4GB. 8832 page looks correct as well. You are lucky as well that it is standard protocol. You may be able to extract XOR Key from the dump itself. I am not sure where else you would find the XOR key though, unless someone shares it.

In fact the eMMC is 8GB, but maybe it have 2 independents nand chips inside (thus 2 chip select)

I optimized my software in the nucleo eval board, now I can reach 4.5MB/s read rate

My eMMC nand adapter should arrive Tuesday, I am in a hurry to receive it and try to decrypt its content

How are you checking this without a NAND connected.. simulation? You could try reading a TSOP48 chip in the meantime to see if the data you read is fine. If you have an old flash drive laying around, 2GB or 4GB you could write a few folders of .jpg, dump it and send dump for checking... work on something likely easy to get a bit of a taste

Except the busy signal of the Nand, there is no other interaction with the Nand, thus it's possible to entirely simulate the Nand reading without Nand connected (I just read all data 0x00 because of pull-down resistor on D0-->D7). And I checked if all signals are good with my logic analyser and they are

Unfortunately I actually don't have Nand chip to test :/

Nice work nlc, you are very ambitious, but soon you'll meet with several walls. If you get data form this chip I will be impressed.

Thank you
Yes I know what I have done is the easiest part, I will meet several walls, that's true.
But if it was too easy it wouldn't be funny

Anyone can send me a small dump part of a H26M42003GMRA chip if someone have one, to begin to play ?

Some news
I received the Nand adapter !

First problem was to find the way to disable the internal controller to not have conflict with my own nand control signals. I naively thought that after power up the control signal from the controller are high impedance. They are not...
I spent a lot of time to find a magic pad to disable the controller, use lower voltage,etc... but nothing!

Because the adapter also have the MMC/SD mode, I tried it and seen I was not able to detect the chip on the computer, but it works with my 80$ standard BGA adapter. I investigated with my oscilloscope and found there are no decoupling capacitors for VCC and VCCq as close as possible to the chip. I added some and was able to detect the chip on the computer in MMC mode (but always bad data of course).
At this moment I discovered the controller releases the Nand control signals after initialisation with MMC protocol !

I connected my nand reader, but nothing, no answer to my read ID command
I spent a lot of time to understand because with my logic analyser connected on the outputs of my home made nand reader all signals was perfects.
I decided to open the Nand adapter to put the logic analyser as close as possible to the chip, and discovered some signals was missing!!

In the Nand adapter kit there were some female to female wires (like arduino wires), I used them to connect my board to the Nand adapter, and some of them was bad, no continuity between the 2 sides!!

I replaced all of them by security by home made wires...
And I was able to read the nand device ID,yes!!

After I tried to read the unique ID data (2x16 bytes), which is stored in Flash (the device ID is not).
And it worked, and because the 2nd 16 bytes block is the XOR of the first one, I know the reading is good

After I tried to read my first 8832 bytes data page, but for now it doesn't work. The Nand doesn't answer my command,for now I don't understand why

Next chapter tomorrow

Do you mean the 2nd 16 bytes is XORED with 1st 16 bytes plus something? how do you know wht the XOR key is for it? Or do you mean it is inverted? I have always used tools to read NAND so never had to look at this read ID in detail as yet.

Also, what ID did you get? was it "AD D7 94 91 60" as expected? I am sure this chip will need Read Retry implemented as well.

If I could get one of these I could send a LA trace of it initialising and starting a read. If I get time I will look at possible sources.

edit- I bought one, but likely blank, from eBay. may be ok for testing though.

By Xoring the first 16 byte block with the 2nd 16 byte block we must get 16 bytes 0xFF, and it's what I get. Because these data are in flash it means at least I can read these 32 byte without error and read retry

Multicom also said me this nand is really difficult to read and they spent 2 month to be able to read it correctly with read retry. But it can be because of missing decoupling capacitor, MLC nand stores multiple bits of data in one cell by analogic value, and I am sure the nand needs good supply quality to be reliable.

I also discovered the VCCi ball of the chip is not connected on the adapter. And it's not good because all mmc datasheet tells a decoupling capacitor must be installed between this ball and GND. It's to filter an internal voltage regulator output. And I discovered yesterday that the internal nand is supplied by this internal supply, because all signals between controller and nand are 1.8V.

Don't know if it's really the reason why this chip is difficult to read correctly without ECC errors, but it's possible!

for the NAND, do you need both VCC: 3.3V and VCCQ: 18V ?

No, it's not possible, capacitors not magically resolve error problems, even best supply quality not help. In Hynix nand memory leaks charge of cell are common, and only RR help.
Nand memory that you can read without errors are that's one who have build-in hardware ECC aka E2NAND or EZ-NAND. So, for this memory you must have ECC and RR, and it's not all, you will find out sooner or later.

I don't say it will resolve anything for now. I say the datasheet says some pins need decoupling capacitor as close as possible to the ball.
For sure they matter, in particularly when pcb track between supply and chip are long and inductive. If not, the datasheet wouldn't say to install them.
I do hardware engineering for more than 20 years now, and without decoupling capacitors you can have some strange behavior, in particular with high speed digital components. You can try with any microcontroler , without good decoupling, it can works, but your analog/digital conversion result will be less good than with decoupling capacitor.
You can open any electronic product you want, you will find them everywhere.

With decoupling capacitor now the nand adapter also works like a charm in SD/MMC mode. Without, it doesn't work.

Ofc capacitors are important, and could help, but in this particularly case, we speak about NAND protocol not only SD. I thing you agree that read 16bytes without errors proves nothing. You deal with 8832*256*2048*2=9261023232 bytes

Sorry but it make no difference, take any nand datasheet, they also require decoupling capacitors.
Nand is also high speed digital devices, they require a stable supply. MLC nand chip use analog value to store bits, any conversion noise because unstable VCC can cause bit flip during analog reading if bit are close to the threshold.

If you have not tested, you can't affirm reading quality will not be better with it.
Have you tested ?

But that's true I can't affirm it will be better with it. It will be difficult to test, because I don't have access to the VCCi ball.



32 bytes
Of course it proves nothing, and I have no decoupling capacitor on VCCi, can't test with/without for now.
But trust me, I am stubborn, I will build my own nand adapter, with all decoupling capacitors as close as possible to chip, to compare reading result without RR


News of the day, because the internal flash is 1.8V supplied, I build a passive level translator to send 1.8V controls signals to the nand (instead 3.3V yesterday). Have some high level problem during reading (I read 0 instead 1), but with logic analyser I can see the nand is answering correctly (Read ID, Unique ID). Now Read page is responding correctly, but page I tested answered 0xFF.
After complete SD/MMC initialization, the Nand ID changes to "AD E7 94 91 60 44", seems to be H27UBG8T2CTR Nand ?

is that the Datasheet for the eMMC? generally they do not include the Raw NAND details, or even the pads from the NAND chip, so we basically read it as if it is just a NAND chip. a 1k resistor between VCC in and RB may be required though.

That's an eMMC datasheet, but not this model in particular. But all models require decoupling capacitors.

The Nand part and pad position are not documented, and yes RB need pull-up