Samsung SSD Failed Controller - Options?

[sourcerer]

Did you ever find a solution to this problem? I just had my PM 851 fail in the same manner

Could you please provide details about it? What is the exact failure situation?

[Tyra Misoux]

I am also JTAGGING an PM851 now since it's firmware maybe affected by a pretty resistant rootkit.
The MEX-script did not work with latest OpenOCD (I am using a Raspberry PI as the interface).
debugging it works nice after changing the script to

Code:

source [find interface/raspberrypi-native.cfg]
transport select jtag
adapter_khz 100
reset_config none

# enable tcl_port of course when using the scripts
# currently just connected using telnet
tcl_port disabled

#jtag newtap auto0 tap -irlen 1 -expected-id 0x25966f0f
jtag newtap auto0 tap -irlen 4 -expected-id 0x4ba00477

dap create mydap -chain-position auto0.tap

target create mex1 cortex_r4 -dap mydap -coreid 0
target create mex2 cortex_r4 -dap mydap -coreid 1 -dbgbase 0x80002000
target create mex3 cortex_r4 -dap mydap -coreid 2 -dbgbase 0x80003000

init
targets
halt



btw the connector is 4-Pin JTAG only. There is NO sRST or tRST available

Looks like it uses other memory regions. I cannot dump 0x8A0000 for example but having lot other readable regions.
I will check the dumps now and try to find the proper regions.

Would be nice to have a genuine firmware image for PM851

Attachments

[Tyra Misoux]

The 1MB-Files from SAMSUNG are XORED
Looks like the FW itself is in a serial flash on the backside.
I guess the 128KB at address 0 is a bootloader.

JTAG works stable up to about 400kHz

[Tyra Misoux]

ahhh - "Temperature sensor" - NOT Flash.... Finally found the "lost manual".
Also found the de-obfuscator. So not just a simple XOR. Looked to me like that because of all those "0x10"

Hmmm - but where is firmware located within the chip?

[fzabkar]

Also found the de-obfuscator. So not just a simple XOR.

This?

SSD firmware hacking:
http://forum.hddguru.com/viewtopic.php?f=13&t=31127

[Tyra Misoux]

Yes. I compiled the version from GITHUB. Found that link in the "MissingManual".
https://raw.githubusercontent.com/ddcc/ ... /samsung.c

I found two firmware-Versions in the internet:
EXT49D0Q and EXT08D0Q but it looks like I have an earlier one.
0x5c000 from the image is mapped to 0 in then Controllers addressspace but starts to differ (a little bit) from about 0xba0. The latest version differs most.

I am no expert in multi-core controllers as well as no ARM expert.. Maybe I am one when finished this

[vinibali]

Yes. I compiled the version from GITHUB. Found that link in the "MissingManual".
I am no expert in multi-core controllers as well as no ARM expert.. Maybe I am one when finished this

Did you spend more time on it?

[Rao Shaheryar]

The SSD controller suffers from media corruption. Media Corruption occurs within the chip that controls the connection between the drive and the computer. Corruption can modify or destroy important information which can render a storage device inoperable and inaccessible.

[HaQue]

The SSD controller suffers from media corruption. Media Corruption occurs within the chip that controls the connection between the drive and the computer. Corruption can modify or destroy important information which can render a storage device inoperable and inaccessible.

This exact text was posted on the 1st page of this topic by @mattsbsmith (1/2 way down the page)

spam