SM2685F

[SirA]

Looking for a pinout or datasheet for the Silicon Motion SM2685F SMD. I have the Controller (SM2685F) and the associated NAND, but do not know the connections of the controller to pull the data from the NAND.

I am sure the expensive options would read it just fine, but I do this as a hobby and do not have the funds to purchase DR equipment.

Thank you for any assistance.

[Amarbir[CDR-Labs]]

Looking for a pinout or datasheet for the Silicon Motion SM2685F SMD. I have the Controller (SM2685F) and the associated NAND, but do not know the connections of the controller to pull the data from the NAND.

I am sure the expensive options would read it just fine, but I do this as a hobby and do not have the funds to purchase DR equipment.

Thank you for any assistance.

Hello,
I am interested in seeing a photo of your device

[SirA]

This is a picture of the IC on the board of the cheap MP3 Player I was given.

Attachments

[Amarbir[CDR-Labs]]

This is a picture of the IC on the board of the cheap MP3 Player I was given.

Well,
Thank you for the photo ,This has a tsop NAND ,If you are really interested in a result you can send it over to india to me ,I love woking of NAND Devices and might give you a solution FREEEEEE .

[fzabkar]

This controller has an SD card interface. If we can see the whole PCB, perhaps we may be able to identify the SD pins.

https://www.usbdev.ru/?wpfb_dl=334

[Amarbir[CDR-Labs]]

This controller has an SD card interface. If we can see the whole PCB, perhaps we may be able to identify the SD pins.

https://www.usbdev.ru/?wpfb_dl=334

Hello ,
We now wants to reinvent the wheel ,To get data out he needs NAND pinout which is public domain ,Once he reads the NAND he can analyse the dump and get it out ,Thats why we have tools like pc3k flash vnr flash extractor etc

[SirA]

Thank you for the responses. I have pinouts for the Toshiba chip, and I think I have determined most of the pinouts on the IC. The SD Interface pins are noted on the board, and I have connected to them to a microSD breakout to connect them to my computer.

When trying to read the device turns off, which disconnects the chip. Most of the reason I am looking for the actual datasheet, is to determine pinout for power and ground to the chip, so I can try to read the NAND through the controller with the devices removed.

I am new to performing these board level reverse engineering feats, as I am self taught, and am stumbling through learning in my spare time. I have a successful dump of the NAND, but I am unable to make any sense of the structure. I know the FS on the chip is a version of FAT, most likely Fat32, NTFS.

I will follow up with a picture of the board and I will draw up the Pinout as I have determined it from toning out the board.

[fzabkar]

This controller has an SD card interface. If we can see the whole PCB, perhaps we may be able to identify the SD pins.

https://www.usbdev.ru/?wpfb_dl=334

Hello ,
We now wants to reinvent the wheel ,To get data out he needs NAND pinout which is public domain ,Once he reads the NAND he can analyse the dump and get it out ,Thats why we have tools like pc3k flash vnr flash extractor etc

If the SM controller and NAND are functional, then one would only need to access the data via the SD interface. No need for expensive tools.

[fzabkar]

Most of the reason I am looking for the actual datasheet, is to determine pinout for power and ground to the chip, so I can try to read the NAND through the controller with the devices removed.

That's usually an easy task. I could help with that.

I know the FS on the chip is a version of FAT, most likely Fat32, NTFS.

NTFS is not FAT.

[Arch Stanton]

I have a successful dump of the NAND

How? I understood you could not clone/image because it disconnects all the time.

FWIW, I have been able to successfully image such drives (dropping all the time) like so (skips boring part and me screwing up): https://youtu.be/ggNTCRzT7qw?t=831. Same YKUSH device can be used with HDDSuperClone.

[SirA]

How? I understood you could not clone/image because it disconnects all the time.

I performed a chip-off NAND dump with my T56 programmer. The player does not allow me to connect to the SD Card interface while the controller and memory are on the player, at least not that I know how to. I get what appears to be a valid dump, as I get no errors on the verify, and it is not filled with repeating characters like a bad dump commonly contains.

I pulled the Controller and the NAND from one of the players I have, and tried to use the controller to read the NAND off board, but I have poor quality prototyping equipment, so the connections are not stable. I am waiting on some perfboard to prototype the setup correctly, to see if I can get a good read. I have a feeling that there is more to the setup than just the controller and the NAND. It is possible that there is some secure communication or interface logic between the Controller and the Processor in the MP3 Player, that I am unaware of.

Later versions of the player used an EN2685F populated in a different spot on the board for the controller. It does not appear to be a drop in replacement (The spot above the SM2685F).

[fzabkar]

Try to dump the NAND via SD after disabling the crystal for the STMP3780 chip.

I can see two coils. They would be parts of two step-down buck converters.

[SirA]

Try to dump the NAND via SD after disabling the crystal for the STMP3780 chip.

I will give that a shot tomorrow night. Thanks for the suggestion