XOR C5F6-128

[hddguy]

4GB flash, of which I assume you have a 4GB dump.
It has 4 MB data on it, and the rest I assume are zeros?
That should be trivial, because

[zeros] XOR [pattern] = [pattern].

if you run the same statsitical computation as described above, it will give you the [pattern] perfectly.

it would be more difficult if you have 4GB flash filled to the brim with data. Still, that gives us 4K times pattern length, so should not be a problem.

The problem actually becomes worse if the length of the pattern is not known in advance. Not knowing the pattern length is the most significant difficulty I see.

This is assuming you know that the media contains zeros. XOR pattern looks random, so does data. Unless you know that the original content is zeros and the length of XOR pattern then you will not decipher.

But I am happy to be proven wrong, in fact would make Flash Recovery a little more interesting for me

[ReclaiMe]

drc, try this?

Attachments

pattern.zip

(624 Bytes) Downloaded 622 times

[drc]

drc, try this?

Good

I can't see any way around needing to know the length however, which is why the standard approach is to get a similar device and zerofill, then read the NAND manually

[ReclaiMe]

I suppose we can figure the length out as well, just not in under fifteen minutes.

[drc]

I guess it depends on how badly someone wants the data

[ReclaiMe]

drc, is there any practical limit on the pattern length? so that we can assume "pattern length is no larger than X"? And also, can we assume the pattern length to be a power of two? Or just an even number?

[lcoughey]

Wow! You guys are making my head hurt. I'm curious to know how much you are charging for this project to make it worth all the effort.

[drc]

drc, is there any practical limit on the pattern length? so that we can assume "pattern length is no larger than X"? And also, can we assume the pattern length to be a power of two? Or just an even number?

Haven't worked on enough XORed flash to make a generalized statement like that. Most people wanting recovery from a flash drive expect to pay $25-50 and realize that their files weren't that important when they hear the actual price

[ReclaiMe]

lcoughey,

Project? What project?

[ReclaiMe]

drc, care to provide one more sample?

Same size, but different data, and now you pick any pattern length between 8 and 512. Looks like I got the solution for the unknown pattern length, though I'm much less sure on this one. And there are some problems with it because it is damn slow.

[drc]

Sure. Will be later today or tomorrow, got a lot on my plate right now

[Vladus]

C5 F6 - first two bytes in XOR block in hex / XOR block starts with these values
128 - length of XOR block is 128 pages of chip in dec