March 31st, 2016, 19:50
Sector 199423
615FE00: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FE10: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FE20: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FE30: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FE40: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FE50: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FE60: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FE70: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FE80: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FE90: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FEA0: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FEB0: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FEC0: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FED0: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FEE0: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FEF0: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FF00: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FF10: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FF20: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FF30: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FF40: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FF50: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FF60: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FF70: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FF80: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FF90: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FFA0: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FFB0: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FFC0: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FFD0: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FFE0: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
615FFF0: FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
Sector 199424
6160000: EB 36 08 82 13 6D 10 04 - 26 DA 20 08 4C B4 41 10 ë6.‚.m..&Ú .L´A.
6160010: 98 68 83 20 30 D1 06 41 - 60 A2 0D 82 05 44 1B 04 .hƒ 0Ñ.A`¢.‚.D..
6160020: 0A 88 36 08 14 10 6D 10 - 28 20 DA 20 50 40 B4 41 ..6...m.( Ú P@´A
6160030: A0 80 68 83 85 01 D1 06 - 0A 03 A2 0D 14 06 44 1B .hƒ….Ñ...¢...D.
6160040: 28 0C 88 36 50 18 10 6D - A0 30 20 DA 85 61 40 B4 (..6P..m 0 Ú…a@´
6160050: CF C3 80 68 9E 87 01 D1 - F9 0F 03 A2 37 1F 06 44 ÏÃ.hž‡.Ñù..¢7..D
6160060: 6E 3E 0C 88 19 7C 18 10 - 32 F8 30 20 64 F0 61 40 n>...|..2ø0 dða@
6160070: C8 E0 C3 80 55 C1 87 01 - AA 82 0F 03 54 05 1F 06 ÈàÃ.UÁ‡.ª‚..T...
6160080: A8 0A 3E 0C 50 15 7C 18 - A0 2A F8 30 40 55 F0 61 ¨.>.P.|. *ø0@Uða
6160090: 80 AA E0 C3 C5 55 C1 87 - 4F AB 82 0F 9E 56 05 1F .ªàÃÅUÁ‡O«‚.žV..
61600A0: 3C AD 0A 3E 78 5A 15 7C - F0 B4 2A F8 25 69 55 F0 <..>xZ.|ð´*ø%iUð
61600B0: 8F D2 AA E0 DB A5 55 C1 - 73 4B AB 82 23 96 56 05 .ÒªàÛ¥UÁsK«‚#–V.
61600C0: 46 2C AD 0A 8C 58 5A 15 - 18 B1 B4 2A 30 62 69 55 F,..ŒXZ..±´*0biU
61600D0: 60 C4 D2 AA 05 88 A5 55 - 0A 10 4B AB D1 20 96 56 `ÄÒª..¥U..K«Ñ –V
61600E0: A2 41 2C AD 81 83 58 5A - 02 07 B1 B4 C1 0E 62 69 ¢A,..ƒXZ..±´Á.bi
61600F0: 82 1D C4 D2 C1 3B 88 A5 - 47 77 10 4B 8E EE 20 96 ‚.ÄÒÁ;.¥Gw.KŽî –
6160100: D9 DD 41 2C B2 BB 83 58 - 64 77 07 B1 0D EE 0E 62 ÙÝA,²»ƒXdw.±.î.b
6160110: 1A DC 1D C4 F1 B8 3B 88 - 27 71 77 10 4E E2 EE 20 .Ü.Äñ¸;.'qw.Nâî
6160120: 9C C4 DD 41 38 89 BB 83 - B5 12 77 07 6A 25 EE 0E œÄÝA8‰»ƒµ.w.j%î.
6160130: D4 4A DC 1D A8 95 B8 3B - 50 2B 71 77 A0 56 E2 EE ÔJÜ.¨•¸;P+qw Vâî
6160140: 85 AD C4 DD CF 5B 89 BB - 5B B7 12 77 B6 6E 25 EE ….ÄÝÏ[‰»[·.w¶n%î
6160150: A9 DD 4A DC 97 BB 95 B8 - EB 77 2B 71 D6 EF 56 E2 ©ÝJÜ—»•¸ëw+qÖïVâ
6160160: 69 DF AD C4 17 BE 5B 89 - EB 7C B7 12 D6 F9 6E 25 iß.Ä.¾[‰ë|·.Öùn%
6160170: AC F3 DD 4A 58 E7 BB 95 - 75 CE 77 2B EA 9C EF 56 ¬óÝJX绕uÎw+êœïV
6160180: D4 39 DF AD 6D 73 BE 5B - DA E6 7C B7 71 CD F9 6E Ô9ß.ms¾[Úæ|·qÍùn
6160190: E2 9A F3 DD 01 35 E7 BB - C7 6A CE 77 8E D5 9C EF âšóÝ.5ç»ÇjÎwŽÕœï
61601A0: D9 AB 39 DF 77 57 73 BE - 2B AE E6 7C 56 5C CD F9 Ù«9ßwWs¾+®æ|V\Íù
61601B0: 69 B8 9A F3 17 70 35 E7 - EB E0 6A CE 13 C1 D5 9C i¸šó.p5çëàjÎ.ÁÕœ
61601C0: E3 82 AB 39 C6 05 57 73 - 8C 0B AE E6 DD 17 5C CD ã‚«9Æ.WsŒ.®æÝ.\Í
61601D0: 7F 2F B8 9A 3B 5E 70 35 - 76 BC E0 6A EC 78 C1 D5 ./¸š;^p5v¼àjìxÁÕ
61601E0: 1D F1 82 AB FF E2 05 57 - FE C5 0B AE 39 8B 17 5C .ñ‚«ÿâ.WþÅ.®9‹.\
61601F0: 72 16 2F B8 21 2C 5E 70 - 42 58 BC E0 41 B0 78 C1 r./¸!,^pBX¼àA°xÁ
Sector 199425
6160200: EB 36 08 82 13 6D 10 04 - 26 DA 20 08 4C B4 41 10 ë6.‚.m..&Ú .L´A.
6160210: 98 68 83 20 30 D1 06 41 - 60 A2 0D 82 05 44 1B 04 .hƒ 0Ñ.A`¢.‚.D..
6160220: 0A 88 36 08 14 10 6D 10 - 28 20 DA 20 50 40 B4 41 ..6...m.( Ú P@´A
6160230: A0 80 68 83 85 01 D1 06 - 0A 03 A2 0D 14 06 44 1B .hƒ….Ñ...¢...D.
6160240: 28 0C 88 36 50 18 10 6D - A0 30 20 DA 85 61 40 B4 (..6P..m 0 Ú…a@´
6160250: CF C3 80 68 9E 87 01 D1 - F9 0F 03 A2 37 1F 06 44 ÏÃ.hž‡.Ñù..¢7..D
6160260: 6E 3E 0C 88 19 7C 18 10 - 32 F8 30 20 64 F0 61 40 n>...|..2ø0 dða@
6160270: C8 E0 C3 80 55 C1 87 01 - AA 82 0F 03 54 05 1F 06 ÈàÃ.UÁ‡.ª‚..T...
6160280: A8 0A 3E 0C 50 15 7C 18 - A0 2A F8 30 40 55 F0 61 ¨.>.P.|. *ø0@Uða
6160290: 80 AA E0 C3 C5 55 C1 87 - 4F AB 82 0F 9E 56 05 1F .ªàÃÅUÁ‡O«‚.žV..
61602A0: 3C AD 0A 3E 78 5A 15 7C - F0 B4 2A F8 25 69 55 F0 <..>xZ.|ð´*ø%iUð
61602B0: 8F D2 AA E0 DB A5 55 C1 - 73 4B AB 82 23 96 56 05 .ÒªàÛ¥UÁsK«‚#–V.
61602C0: 46 2C AD 0A 8C 58 5A 15 - 18 B1 B4 2A 30 62 69 55 F,..ŒXZ..±´*0biU
61602D0: 60 C4 D2 AA 05 88 A5 55 - 0A 10 4B AB D1 20 96 56 `ÄÒª..¥U..K«Ñ –V
61602E0: A2 41 2C AD 81 83 58 5A - 02 07 B1 B4 C1 0E 62 69 ¢A,..ƒXZ..±´Á.bi
61602F0: 82 1D C4 D2 C1 3B 88 A5 - 47 77 10 4B 8E EE 20 96 ‚.ÄÒÁ;.¥Gw.KŽî –
6160300: D9 DD 41 2C B2 BB 83 58 - 64 77 07 B1 0D EE 0E 62 ÙÝA,²»ƒXdw.±.î.b
6160310: 1A DC 1D C4 F1 B8 3B 88 - 27 71 77 10 4E E2 EE 20 .Ü.Äñ¸;.'qw.Nâî
6160320: 9C C4 DD 41 38 89 BB 83 - B5 12 77 07 6A 25 EE 0E œÄÝA8‰»ƒµ.w.j%î.
6160330: D4 4A DC 1D A8 95 B8 3B - 50 2B 71 77 A0 56 E2 EE ÔJÜ.¨•¸;P+qw Vâî
6160340: 85 AD C4 DD CF 5B 89 BB - 5B B7 12 77 B6 6E 25 EE ….ÄÝÏ[‰»[·.w¶n%î
6160350: A9 DD 4A DC 97 BB 95 B8 - EB 77 2B 71 D6 EF 56 E2 ©ÝJÜ—»•¸ëw+qÖïVâ
6160360: 69 DF AD C4 17 BE 5B 89 - EB 7C B7 12 D6 F9 6E 25 iß.Ä.¾[‰ë|·.Öùn%
6160370: AC F3 DD 4A 58 E7 BB 95 - 75 CE 77 2B EA 9C EF 56 ¬óÝJX绕uÎw+êœïV
6160380: D4 39 DF AD 6D 73 BE 5B - DA E6 7C B7 71 CD F9 6E Ô9ß.ms¾[Úæ|·qÍùn
6160390: E2 9A F3 DD 01 35 E7 BB - C7 6A CE 77 8E D5 9C EF âšóÝ.5ç»ÇjÎwŽÕœï
61603A0: D9 AB 39 DF 77 57 73 BE - 2B AE E6 7C 56 5C CD F9 Ù«9ßwWs¾+®æ|V\Íù
61603B0: 69 B8 9A F3 17 70 35 E7 - EB E0 6A CE 13 C1 D5 9C i¸šó.p5çëàjÎ.ÁÕœ
61603C0: E3 82 AB 39 C6 05 57 73 - 8C 0B AE E6 DD 17 5C CD ã‚«9Æ.WsŒ.®æÝ.\Í
61603D0: 7F 2F B8 9A 3B 5E 70 35 - 76 BC E0 6A EC 78 C1 D5 ./¸š;^p5v¼àjìxÁÕ
61603E0: 1D F1 82 AB FF E2 05 57 - FE C5 0B AE 39 8B 17 5C .ñ‚«ÿâ.WþÅ.®9‹.\
61603F0: 72 16 2F B8 21 2C 5E 70 - 42 58 BC E0 41 B0 78 C1 r./¸!,^pBX¼àA°xÁ
Sector 199426
6160400: EB 36 08 82 13 6D 10 04 - 26 DA 20 08 4C B4 41 10 ë6.‚.m..&Ú .L´A.
6160410: 98 68 83 20 30 D1 06 41 - 60 A2 0D 82 05 44 1B 04 .hƒ 0Ñ.A`¢.‚.D..
6160420: 0A 88 36 08 14 10 6D 10 - 28 20 DA 20 50 40 B4 41 ..6...m.( Ú P@´A
6160430: A0 80 68 83 85 01 D1 06 - 0A 03 A2 0D 14 06 44 1B .hƒ….Ñ...¢...D.
6160440: 28 0C 88 36 50 18 10 6D - A0 30 20 DA 85 61 40 B4 (..6P..m 0 Ú…a@´
6160450: CF C3 80 68 9E 87 01 D1 - F9 0F 03 A2 37 1F 06 44 ÏÃ.hž‡.Ñù..¢7..D
6160460: 6E 3E 0C 88 19 7C 18 10 - 32 F8 30 20 64 F0 61 40 n>...|..2ø0 dða@
6160470: C8 E0 C3 80 55 C1 87 01 - AA 82 0F 03 54 05 1F 06 ÈàÃ.UÁ‡.ª‚..T...
6160480: A8 0A 3E 0C 50 15 7C 18 - A0 2A F8 30 40 55 F0 61 ¨.>.P.|. *ø0@Uða
6160490: 80 AA E0 C3 C5 55 C1 87 - 4F AB 82 0F 9E 56 05 1F .ªàÃÅUÁ‡O«‚.žV..
61604A0: 3C AD 0A 3E 78 5A 15 7C - F0 B4 2A F8 25 69 55 F0 <..>xZ.|ð´*ø%iUð
61604B0: 8F D2 AA E0 DB A5 55 C1 - 73 4B AB 82 23 96 56 05 .ÒªàÛ¥UÁsK«‚#–V.
61604C0: 46 2C AD 0A 8C 58 5A 15 - 18 B1 B4 2A 30 62 69 55 F,..ŒXZ..±´*0biU
61604D0: 60 C4 D2 AA 05 88 A5 55 - 0A 10 4B AB D1 20 96 56 `ÄÒª..¥U..K«Ñ –V
61604E0: A2 41 2C AD 81 83 58 5A - 02 07 B1 B4 C1 0E 62 69 ¢A,..ƒXZ..±´Á.bi
61604F0: 82 1D C4 D2 C1 3B 88 A5 - 47 77 10 4B 8E EE 20 96 ‚.ÄÒÁ;.¥Gw.KŽî –
6160500: D9 DD 41 2C B2 BB 83 58 - 64 77 07 B1 0D EE 0E 62 ÙÝA,²»ƒXdw.±.î.b
6160510: 1A DC 1D C4 F1 B8 3B 88 - 27 71 77 10 4E E2 EE 20 .Ü.Äñ¸;.'qw.Nâî
6160520: 9C C4 DD 41 38 89 BB 83 - B5 12 77 07 6A 25 EE 0E œÄÝA8‰»ƒµ.w.j%î.
6160530: D4 4A DC 1D A8 95 B8 3B - 50 2B 71 77 A0 56 E2 EE ÔJÜ.¨•¸;P+qw Vâî
6160540: 85 AD C4 DD CF 5B 89 BB - 5B B7 12 77 B6 6E 25 EE ….ÄÝÏ[‰»[·.w¶n%î
6160550: A9 DD 4A DC 97 BB 95 B8 - EB 77 2B 71 D6 EF 56 E2 ©ÝJÜ—»•¸ëw+qÖïVâ
6160560: 69 DF AD C4 17 BE 5B 89 - EB 7C B7 12 D6 F9 6E 25 iß.Ä.¾[‰ë|·.Öùn%
6160570: AC F3 DD 4A 58 E7 BB 95 - 75 CE 77 2B EA 9C EF 56 ¬óÝJX绕uÎw+êœïV
6160580: D4 39 DF AD 6D 73 BE 5B - DA E6 7C B7 71 CD F9 6E Ô9ß.ms¾[Úæ|·qÍùn
6160590: E2 9A F3 DD 01 35 E7 BB - C7 6A CE 77 8E D5 9C EF âšóÝ.5ç»ÇjÎwŽÕœï
61605A0: D9 AB 39 DF 77 57 73 BE - 2B AE E6 7C 56 5C CD F9 Ù«9ßwWs¾+®æ|V\Íù
61605B0: 69 B8 9A F3 17 70 35 E7 - EB E0 6A CE 13 C1 D5 9C i¸šó.p5çëàjÎ.ÁÕœ
61605C0: E3 82 AB 39 C6 05 57 73 - 8C 0B AE E6 DD 17 5C CD ã‚«9Æ.WsŒ.®æÝ.\Í
61605D0: 7F 2F B8 9A 3B 5E 70 35 - 76 BC E0 6A EC 78 C1 D5 ./¸š;^p5v¼àjìxÁÕ
61605E0: 1D F1 82 AB FF E2 05 57 - FE C5 0B AE 39 8B 17 5C .ñ‚«ÿâ.WþÅ.®9‹.\
61605F0: 72 16 2F B8 21 2C 5E 70 - 42 58 BC E0 41 B0 78 C1 r./¸!,^pBX¼àA°xÁ
March 31st, 2016, 20:07
March 31st, 2016, 20:14
HaQue wrote:at a quick glance, without looking at it closely... It may be what Sergey calls "each 3 pages is the same" which could mean it is a wl ver2 chip..
what is the nand ID, and monolith/pinout type?
It could also be the XOR key, maybe a virus but that's rare
March 31st, 2016, 23:29
Sorry I should have clarified. This is the Hex data before a pinout, just with a Hex reader of what is actually on the chip.
April 1st, 2016, 3:52
April 1st, 2016, 12:46
HaQue wrote:ahh..Sorry I should have clarified. This is the Hex data before a pinout, just with a Hex reader of what is actually on the chip.
you mean opening the device in DMDE or winhex through its normal USB interface? Then probably not worth monolith recovery via nand pinout. I would do an image of the whole device and then scan it. Maybe look for IOC's on the systems it was used on (check your DR Rig as well!!!)
then have you tried scanning with r-studio or the like?
whats supposed to be on it? files, camera photo data, video, phone data?
Is there a FAT?
you may be looking at sector updates, where the controller caches sectors and consolidates the changes into one write when worthwhile.
could be encryption as well. hard to know without context.
arvika wrote:It is worth read via pinout. It is very common when you have repeating sectors when controller is dead. Usually read directly from nand and assembly the image give good result.
April 1st, 2016, 12:53
April 1st, 2016, 13:27
lcoughey wrote:I've seen this a lot with both with monolithic and Lexar CF cards over the past year. Chip off / pinout recoveries are the only option.
Powered by phpBB © phpBB Group.