Skymedi 6221 Xor key?

[techchimp]

Hello everyone,

I'm hoping someone has a key for me to try to descramble a Hynix NAND dump. The chip is from an old SD card (Kingston 1gb).
I was recently archiving off all of my storage devices and this was the only card that failed.

I can carve jpg data from the dump, but it isn't correct.

This is mostly for curiosity (and education). I'm not using any recovery software, just writing my own python scripts.

Any assistance is greatly appreciated.

[fzabkar]

I'm hoping someone has a key for me to try to descramble a Hynix NAND dump.

I can carve jpg data from the dump, but it isn't correct.

If it's scrambled, how can you tell that you have a JPEG? :-?

[arvika]

SK6221 or SK6621? First one usualy it is used at pendrives, second at SD cards and it not use XOR.

[techchimp]

I'm hoping someone has a key for me to try to descramble a Hynix NAND dump.

I can carve jpg data from the dump, but it isn't correct.

If it's scrambled, how can you tell that you have a JPEG?

I'm getting jpg signatures. But they can't be decoded in any viewer.

[techchimp]

SK6221 or SK6621? First one usualy it is used at pendrives, second at SD cards and it not use XOR.

Sorry, it's SK6621 AARC A0727

If that's true, then I'll keep trying to get a logical block image.

Thank you

[arvika]

This controller usualy use block pair. Of course you need also think about ECC correction.

[fzabkar]

@techchimp, can you dump the spare areas and upload them? I would be interested in examining the structure. I think you would need this info in order to build a translator.

[techchimp]

@techchimp, can you dump the spare areas and upload them? I would be interested in examining the structure. I think you would need this info in order to build a translator.

I can when I get home.

[techchimp]

@techchimp, can you dump the spare areas and upload them? I would be interested in examining the structure. I think you would need this info in order to build a translator.

I can when I get home.

I tried to upload but it stalled. Is there a file size limit for attachments? It's about 64mb.

[fzabkar]

Can you ZIP it?

[techchimp]

https://drive.google.com/file/d/1X-BgOb ... p=drivesdk

[techchimp]

Can you ZIP it?

I posted a google drive link that's waiting for moderation approval.

[fzabkar]

Your file is twice as big as it should be.

Attachments

spare_area_half.7z

(1.22 MiB) Downloaded 131 times

[fzabkar]

I have extracted the non-empty spare area records.

Code:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

001AEBF0  D7 8D 9C E9 D6 D7 2E EF 11 7D 6F 90 2D FF B0 16
001AEC00  B9 55 D0 28 1F 70 2D E2 98 C5 6F 90 2D FF B0 16
001AEC10  76 01 76 6F 30 CF D2 A6 AE FC 6F 90 2D FF B0 16
001AEC20  CC BE 84 9A E5 BC 64 05 4B 5E 6F 90 2D FF B0 16

001AEC30  F7 43 BD FE 4B 19 00 C5 48 83 6F 90 2E FF F9 02
001AEC40  E6 13 FF AB A2 A8 D1 28 5A BA 6F 90 2E FF F9 02
001AEC50  0E D5 73 B1 AB FA 75 A0 4A 53 6F 90 2E FF F9 02
001AEC60  05 B6 1B 58 5A 8C EB 4F 82 AF 6F 90 2E FF F9 02

001AEC70  B6 19 73 F3 1F E4 C0 99 95 55 6F 90 2F FF 2E EF
001AEC80  9C EA 9C 99 C6 59 67 8B 51 AC 6F 90 2F FF 2E EF
001AEC90  F7 49 0D D1 0F ED F7 13 84 73 6F 90 2F FF 2E EF
001AECA0  57 6B 61 BA 94 ED 4C 17 D3 2A 6F 90 2F FF 2E EF
........
001C6A30  FF FF FF FF FF FF FF FF FF FF 7A 80 71 FF 1E 8A
001C6A40  FF FF FF FF FF FF FF FF FF FF 7A 80 71 FF 1E 8A
001C6A50  FF FF FF FF FF FF FF FF FF FF 7A 80 71 FF 1E 8A
001C6A60  FF FF FF FF FF FF FF FF FF FF 7A 80 71 FF 1E 8A

001C6A70  FF FF FF FF FF FF FF FF FF FF 7A 80 72 FF 57 9E
001C6A80  FF FF FF FF FF FF FF FF FF FF 7A 80 72 FF 57 9E
001C6A90  FF FF FF FF FF FF FF FF FF FF 7A 80 72 FF 57 9E
001C6AA0  FF FF FF FF FF FF FF FF FF FF 7A 80 72 FF 57 9E

001C6AB0  FF FF FF FF FF FF FF FF FF FF 7A 80 73 FF 80 73
001C6AC0  FF FF FF FF FF FF FF FF FF FF 7A 80 73 FF 80 73
001C6AD0  FF FF FF FF FF FF FF FF FF FF 7A 80 73 FF 80 73
001C6AE0  FF FF FF FF FF FF FF FF FF FF 7A 80 73 FF 80 73
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ######## ** %%%%%
            ECC bytes for data area     logical  |    |
                                        block?   |    |
                                                 |    |
                                           status?    |
                                                      |
                              ECC for previous 4 bytes?

I don't know what to make of this:

Code:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

001EEBB0  D3 44 3B A1 64 45 E0 53 40 84 B2 43 00 00 FB 1F
001EEBC0  FF FF FF FF FF FF FF FF FF FF B2 43 00 F5 66 8C
001EEBD0  FF FF FF FF FF FF FF FF FF FF B2 43 00 19 F7 DC
001EEBE0  FF FF FF FF FF FF FF FF FF FF B2 43 00 64 BB 7D

001EEBF0  D3 44 3B A1 64 45 E0 53 40 84 B2 43 00 00 FB 1F
001EEC00  FF FF FF FF FF FF FF FF FF FF B2 43 00 00 FB 1F
001EEC10  FF FF FF FF FF FF FF FF FF FF B2 43 00 19 F7 DC
001EEC20  FF FF FF FF FF FF FF FF FF FF B2 43 00 64 BB 7D

001EEC30  D3 44 3B A1 64 45 E0 53 40 84 B2 43 00 00 FB 1F
001EEC40  FF FF FF FF FF FF FF FF FF FF B2 43 00 00 FB 1F
001EEC50  FF FF FF FF FF FF FF FF FF FF B2 43 00 00 FB 1F
001EEC60  FF FF FF FF FF FF FF FF FF FF B2 43 00 64 BB 7D

001EEC70  D3 44 3B A1 64 45 E0 53 40 84 B2 43 00 00 FB 1F
001EEC80  FF FF FF FF FF FF FF FF FF FF B2 43 00 00 FB 1F
001EEC90  FF FF FF FF FF FF FF FF FF FF B2 43 00 00 FB 1F
001EECA0  FF FF FF FF FF FF FF FF FF FF B2 43 00 00 FB 1F

001EECB0  D3 44 3B A1 64 45 E0 53 40 84 B2 43 00 00 FB 1F
001EECC0  FF FF FF FF FF FF FF FF FF FF B2 43 00 00 FB 1F
001EECD0  FF FF FF FF FF FF FF FF FF FF B2 43 00 00 FB 1F
001EECE0  FF FF FF FF FF FF FF FF FF FF B2 43 00 00 FB 1F
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ######## ** %%%%%
            ECC bytes for data area     logical  |    |
                                        block?   |    |
                                                 |    |
                                           status?    |
                                                      |
                              ECC for previous 4 bytes?

Attachments

spare_area_half_used.7z

(1.22 MiB) Downloaded 126 times

[techchimp]

Yeah, the chip is 2gb even though the sd was 1gb hynix hy27UT088G2M

[pepe]

or the address overflowed and you read it twice, coz the same SA occurs at middle of your dump. It might be of use, now you have 2 copies...
What tool did you use to read it?

[fzabkar]

https://www.datasheetq.com/contents-image1/Hynix/855860-DI1.png

HY27UT088G2M --- 8Gbit, MLC, block type = LB, block size = 256K + 8K, page size = 2K + 64, 3.3V