how can we testing electronics on Flash pen drives?

[fzabkar]

I atach pics wit measusres

Sorry about the LED (I'm colourblind). As for your measurements, they don't make any sense to me. ISTM that you have the ground and +5V supply the wrong way round.

[Dmitri]

The "green resistor" appears to be a polyswitch.

Thanks, fzabkar. I'm not a native speaker and had no idea it's called in English this way. So instead of "self-restorable protector" and "thermal resistor" (which sounds more like a temperature sensor) I decided to call it just a resistor on Friday night adding its non-standard color :)
I do not work with flash drives myself (perhaps a bit of SSD play only), so my flash expertise is limited, but yes, that's the part, which dies rarely in flash drives, but still worth replacing with a piece of wire.

hhddrec, Also what happens / how the flash drive behaves when you insert it into a USB port?

[fzabkar]

One very interesting project I found today:

https://bitbucket.org/flowswitch/phison

Phison PS2303 (PS2251-03) framework

This project's goal is to turn PS2303-based USB flash drive into a cheap USB 3.0 development platform (i.e. fast USB 3.0 to FPGA bridge).

A PS2303-based USB stick must be in BootROM mode to be able to load and run custom code. This can be achieved in several ways:
1.Use host/go_isp.py script to reboot PS2303 from normal mode to BootROM (simplest, temporary)
2.Disrupt NAND probing at power up shorting some DATA lines with tweezers (temporary)
3.Desolder NAND completely (permanent)
4.Erase NAND firmware (permanent)

I'm wondering whether there are times when the NAND firmware becomes corrupt so that the controller remains busy. If so, then placing the controller in BootROM mode by shorting a link or by invalidating the NAND during power-up should enable the controller to identify itself via USB, thus eliminating it and the USB interface as suspects. I wonder if it's even possible to read the NAND flash in "raw" mode in this state.

[fzabkar]

yes, that's the part, which dies rarely in flash drives, but still worth replacing with a piece of wire.

If there is a resistor at that location, then measuring the voltage drop across it would tell us the current draw of the pen drive. That may be useful to know.

[HaQue]

One very interesting project I found today:

https://bitbucket.org/flowswitch/phison

Phison PS2303 (PS2251-03) framework

This project's goal is to turn PS2303-based USB flash drive into a cheap USB 3.0 development platform (i.e. fast USB 3.0 to FPGA bridge).

A PS2303-based USB stick must be in BootROM mode to be able to load and run custom code. This can be achieved in several ways:
1.Use host/go_isp.py script to reboot PS2303 from normal mode to BootROM (simplest, temporary)
2.Disrupt NAND probing at power up shorting some DATA lines with tweezers (temporary)
3.Desolder NAND completely (permanent)
4.Erase NAND firmware (permanent)

I'm wondering whether there are times when the NAND firmware becomes corrupt so that the controller remains busy. If so, then placing the controller in BootROM mode by shorting a link or by invalidating the NAND during power-up should enable the controller to identify itself via USB, thus eliminating it and the USB interface as suspects. I wonder if it's even possible to read the NAND flash in "raw" mode in this state.

If that was the case, and the NAND chip is toast(Ive never seen any firmware upgrades available for NAND Chips) then continuing with recovery wouldnt be of any use. it comes down to motivation. If the goal is to try and fix electrical issues to recover from the drive itself without de-soldering NAND, i believe much time would be used up compared to regular NAND off recovery.
If motivation is research, then go for it, but be prepared for some late nights.
I also think that doing any of this without a good logic analyser and understanding of microcontrollers, embedded code, buses, USB communication and other features of controller such as ECC, Bad Block management, NAND architecture and the ability to disassemble firmware and debug it is going to be really difficult. There may be times when a 5% resistor is out to 25% of its value, and still the crcuit works, a resistor in another place could cause data corruption or the USB Bus to fail or something. These devices are very low part count but quite a complex little system. The less parts in the system, the more important each part becomes.

[fzabkar]

If the goal is to try and fix electrical issues to recover from the drive itself without de-soldering NAND, i believe much time would be used up compared to regular NAND off recovery.

AIUI, a frequent problem with flash drives is corruption of the Flash Translation Layer. In such cases it would be useful to extract the raw data from the NAND by reading sequential physical addresses and bypassing the FTL. Surely the controller manufacturer has some way to do this via USB, perhaps in test mode or bootROM mode, or maybe even with some test code that could be uploaded to a reserved section of NAND. In fact, how do manufacturers of pen drives test the NAND flash chips once they are soldered to the board? And what proprietary commands do they use to upload the NAND firmware in the first place?

[HaQue]

If the goal is to try and fix electrical issues to recover from the drive itself without de-soldering NAND, i believe much time would be used up compared to regular NAND off recovery.

AIUI, a frequent problem with flash drives is corruption of the Flash Translation Layer. In such cases it would be useful to extract the raw data from the NAND by reading sequential physical addresses and bypassing the FTL. Surely the controller manufacturer has some way to do this via USB, perhaps in test mode or bootROM mode, or maybe even with some test code that could be uploaded to a reserved section of NAND. In fact, how do manufacturers of pen drives test the NAND flash chips once they are soldered to the board? And what proprietary commands do they use to upload the NAND firmware in the first place?

manufacturers dont test flash chips after soldering to the board apart from doing test writes and reads with the end user application, such as similar to h2wtest.. they might use a large USB hub and use specialised test versions but do so through the standard way.

I do not think there is any way a controller bypasses the FTL. The way NAND is read and written is not a software only process, the device is structured in LUNs, blocks and pages and the commands to read and write are essentially hard coded. There is no way to address a byte, a commant to read involves sending the commands through the data lines to open a page, specify a LUN, Block and Page. there are a few methods and some tricky page access, delayed write and other things but the way we read a NAND is essentially the same way a Flash controller does. Bad Blocks are mapped by Manufacturer and in some cases a dynamic Bad Block management is enabled. The FTL works in a variety of ways, but is absolutely required to read a NAND (well thats my understanding and would love to see documentation if it is wrong)
regards

[hhddrec]

I atach pics wit measusres

Sorry about the LED (I'm colourblind). As for your measurements, they don't make any sense to me. ISTM that you have the ground and +5V supply the wrong way round.

Thanks fzabkar for your help, and do not worry about LED. probably pic qulity problems,

i atach another time some measures, think i am measuring correctly but you will see.

Thakns another time

Attachments

[hhddrec]

hhddrec, Also what happens / how the flash drive behaves when you insert it into a USB port?

Hi Dmitri!

I attach a pic about behaviours about flash

but, when i attach the pen-drive to my computer i can see flash atached to computer but not access to data

NOTE: i resoldered all pins. before re-iron, i could see the drive sometimes, and sometimes not

Attachments

[fzabkar]

You are measuring incorrectly. The black probe should be on the ground pin. The red probe should connect to each of the components.

The actual voltage at the polyswitch is 4.97V / 4.62V, and the voltage across the capacitors is 3.0V. Those appear to be OK, even though one might expect 3.3V for the NAND. Others might want to offer their own opinions, though.

[hhddrec]

You are measuring incorrectly. The black probe should be on the ground pin. The red probe should connect to each of the components.

The actual voltage at the polyswitch is 4.97V / 4.62V, and the voltage across the capacitors is 3.0V. Those appear to be OK, even though one might expect 3.3V for the NAND. Others might want to offer their own opinions, though.

Sorry fzabkar!

you are in true.

In the LED measure as you suggest me is: 3.00 V

the other measured i will review it another time

thanks for your help

[hhddrec]

i upload another time measures

Attachments

[HaQue]

Just for the record is this drive a fully functioning one, or is it faulty?

[hhddrec]

Just for the record is this drive a fully functioning one, or is it faulty?

this is faulty drive