Page 1 of 1

Crucial V4

Posted: October 21st, 2014, 5:15
by ici_lemmy
Hello,

I have a broken crusial V4. The controller is a PHISON PS3105-S5-1. I unsoldered and dumped one chip to see if I could do something.
So it doesn't seem encrypted but i'm having trouble getting the xor.

Can someone confirm (or not) that the xor is [ID=40: BLK=256 PG=8640 (1074-1070x7)] in PC3k Flash. It seems to work on the first two sectors of the page but not after...

For info, pictures of the drive :
recto.png

verso.png

Re: Crucial V4

Posted: October 21st, 2014, 6:28
by MarkGreenwood (KE)
what ECC did you detect ?

Re: Crucial V4

Posted: October 21st, 2014, 7:13
by ici_lemmy
No ECC detected... that's also a problem...
I'm starting to think I'm playing out of my league.

Re: Crucial V4

Posted: October 21st, 2014, 8:34
by Sasha Sheremetov
Just find a XOR key fragments and you'll see what's the problem. The best block for this is LBN0000/LBN0001.

As I remember there's nothing special in this key, here it's appearance (do not remember if it was "S" version.)

Re: Crucial V4

Posted: October 21st, 2014, 10:45
by ici_lemmy
Sasha Sheremetov wrote:Just find a XOR key fragments and you'll see what's the problem. The best block for this is LBN0000/LBN0001.
As I remember there's nothing special in this key, here it's appearance (do not remember if it was "S" version.)

http://rusolut.com/xor-key-library/ wrote:Controller generates one page of pattern for first page in block, then cyclically shift it -1 byte (-8 bits) for next pages in block. Pattern xored wih Data area of page only.
I don't think that PC3k can do that...

I'm still dumping the other chips in the mean time...

By the way, the https version of rusolut doesn't work !

Re: Crucial V4

Posted: October 21st, 2014, 13:25
by arvika
Can you upload to my FTP (PM) one dump? I can try find XOR for this.

Re: Crucial V4

Posted: October 23rd, 2014, 4:31
by GreyDKang
Just detect page structure.
mostly only first page bigger then other but this controller can have few bigger pages.
After detect all sector lenght in page add this for ECC.
if ecc detected run fix and post structure, page size and block size here.
I will make xor for use in PC3000.

Re: Crucial V4

Posted: October 23rd, 2014, 6:56
by arvika
Structure for this case is: DATA2048_SA8_ECC90_(DATA2048_SA2_ECC90)x3.

Re: Crucial V4

Posted: October 23rd, 2014, 10:05
by Sasha Sheremetov
Arvika is right.

Image

Considering this chip is MLC chip, block size must be 128 (256) pages = 1105920 (2211840) bytes.

Re: Crucial V4

Posted: October 24th, 2014, 2:40
by ici_lemmy
Dear Gurus, thank you for your comments.

Structure given by arvika seems ok but I still can't find and correct ECC... I'll work on that today.
The chip IDed 0x2CA805CB so block size seems to be 256 pages.

In the mean time i'll also try to work out something else.

Again thanks for your comments.

Re: Crucial V4

Posted: October 24th, 2014, 3:20
by arvika
Block is 512 pages.

Re: Crucial V4

Posted: October 24th, 2014, 4:03
by GreyDKang
This ECC not has in PC3000Flash.

Re: Crucial V4

Posted: November 7th, 2014, 6:35
by arvika
XOR was found for this case remotely :)