Which NAND flash reader ?

[nlc]

Dump of blocks 2048/2049/2050/2051 (begin part of the blocks)

Attachments

[nlc]

End part of the block :

[nlc]

We can see block separation, and there are at the beginning of pages :

- 1 bit always 0
- 12 bits always 0

And 48 bytes of 0xFF at the end.

I though the always zero bits can be bad columns, but that's very curious because these potential bad columns are same in the 2 planes of the first chip (CE0), but also the same in the 2 planes of second chip (CE1) !!

Seems everything is Xored (data+spare areas) !?

[nlc]

I spied communication between controller and nand during mmc initialization, it reads some pages but only the first 32 bytes, and after a small pause it reads next data of the page.
Thus it make sense with my dump, the blank column is the 32th byte, it's the spare area. and because there are 48 byte 0xFF a the end, the page mapping is :

32 byte SA + 8 x (1024 data byte + 70 byte ecc) + 48 data byte 0xFF = 8832 bytes

In 15 min the full dump will be finished

[nlc]

The SA seems scrambled or XORed but I think it's not the case because one bit is always 0.
Maybe the 256 pages inside a block are not in the right order, or maybe they are interleaved with others blocks/planes/crystals

[Arch Stanton]

This is kinda ridiculously cool! What's the size of the dump?

[nlc]

2 chips select * 2 planes * 1046 blocks * 256 pages * 8832 bytes = 8.81GiB

[arvika]

Based on my expirience when I look on bitmap, it shows me information that dumps was read with terrible quality. Generally it was read wrong.

[nlc]

I have some bad bits in the dump :

But I think the dump quality is good, because the white column is 12 bits wide, and on a dump sample of 8192 pages, thus 98304 bits, I counted only 89 bad bits (0.00091%)
If I'm not mistaken, the 70 bytes ECC for 1024 data byte (total 8752 bits) can correct up to 40 bit errors, thus up to 40/8752 = 0.004%

Last edited by nlc on May 31st, 2020, 11:40, edited 1 time in total.

[nlc]

Based on my expirience when I look on bitmap, it shows me information that dumps was read with terrible quality. Generally it was read wrong.

Thank you, you confirmed my intuition

Now I need to try to find the XOR key....

[arvika]

As I write, dump was read wrong.

[Arch Stanton]

As I write, dump was read wrong.

This is encouraging ..

[nlc]

As I write, dump was read wrong.

Oups sorry I don't understood that

What is wrong on the dump ? I think it's just page order which are not good, but look the blank column, only 91 bads bit per 98304 bits !?

[nlc]

This is encouraging ..

Yes

[arvika]

nlc, first work on dump quality. Finding XOR when dump is wrong is completly waste of time.
Noise on bitmap looks not good, it should look other. At this case bit errors on white column lead you in wrong direction.

[nlc]

Which noice ?

Looked on other blocks for example, here 4 block :

Maybe SA is not good and has no sense because page are mixed, but I see no difference with some tutorials which explain data recovery ?

[arvika]

Look much better. You can send me few blocks, I will check ECC.

[Arch Stanton]

Look much better. You can send me few blocks, I will check ECC.

Maybe even upload the dump somewhere ... ?

[nlc]

I attached a 2 blocks dump sample (512 pages)

block.data.zip

(4.22 MiB) Downloaded 819 times

[nlc]

But to test ECC, XOR should be applied first, no ?