All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 19 posts ] 
Author Message
 Post subject: Kingston DT101 32g SK7831 controller chip dead
PostPosted: January 14th, 2015, 4:30 
Offline

Joined: August 8th, 2013, 6:12
Posts: 21
Location: france
Hi,

A friend wants me to repair his USB key which has a broken USB connector.

I have soldering the wire from the right to left (5v, d-,d+,gnd) but Windows says that USB key has a problem and can't use it.
Indeed, with geniuscheck, i see that PID and VID are both 0. I think le controller is in a bad state or bricked.
I suppose for this key the VID is 951 and PID is 1642 but I am not sure because on flashboot.ru (http://flashboot.ru/index.php?name=iflash) I can't find the right ship.

My controller chip is skymedi SK7831 and memory chip SanDisk.

Someone can help me? Or can provide me the firmware to reprogram the contoller?

Thank you


Attachments:
20150113_221804.jpg
20150113_221804.jpg [ 1.82 MiB | Viewed 13452 times ]
Top
 Profile  
 
 Post subject: Re: Kingston DT101 32g SK7831 controller chip dead
PostPosted: January 14th, 2015, 6:23 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 14945
Location: Australia
Can you measure +3.3V across the NAND's Vcc capacitor?

If there is a low value resistor (eg 2.2 ohm) in series with the +5V supply, you could determine the current draw by measuring the voltage drop across it.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Kingston DT101 32g SK7831 controller chip dead
PostPosted: January 14th, 2015, 9:20 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3779
Location: Adelaide, Australia
Repair or Data Recovery.

If Repair, then No not advisable. You can not trust a USB Flash drive after this amount of abuse. I know some might argue that it is an electronic circuit and should be fine onced fixed, but UFD's are very touchy. I would bin it and buy a new one.

If you want to recover the files, then trying to go about it this way will almost certainly lose your DATA.

If you didn't solder under a microscope it is possible you didn't get the connections right, or bridged something. I have seen some great looking repair attempts by naked eye, but under microscope the flaws show up. Also stressed devices such as tis can cause the BGA / LGA connections to the PCB to break, and that's impossible to check really.

The only real steps if repair for DR doesn't work is to take NAND chip off and read it. otherwise buy a new drive.


Top
 Profile  
 
 Post subject: Re: Kingston DT101 32g SK7831 controller chip dead
PostPosted: January 14th, 2015, 15:18 
Offline

Joined: August 8th, 2013, 6:12
Posts: 21
Location: france
Thank you for your help,

I want to recover files on the flash drive and in the same time learn as i learned on hard drive.
I find the vid=0951 and PID=162F.
I can take measure but i don't know where is the NAND's VCC capacitor.

I already thought about take off the NAND chip but it's only a final solution, i don't have tool and TSOP to read it.


Top
 Profile  
 
 Post subject: Re: Kingston DT101 32g SK7831 controller chip dead
PostPosted: January 14th, 2015, 16:49 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 14945
Location: Australia
It appears that the SanDisk SDIN4E2-32G is an iNAND eMMC.

I would measure the voltages across each of the capacitors (Cx). One or more should have 3.3V or perhaps 1.8V. If 1.8V is present, then I would expect to see a 1.8V LDO regulator, otherwise the Skymedi controller may have an embedded 1.8V regulator.

What are the markings on the small black component?

Could we see the other side of the PCB?

It's not the same device, but the SDIN5B2-32G "SanDisk iNAND has three power domains assigned to VCCQ, VCC and VDDi".

VCCQ = 3.3V or 1.8V
VCC = 3.3V
VDDi = "internal regulator connection to an external decoupling capacitor"

SanDisk iNAND e.MMC 4.41 I/F Preliminary Data Sheet (SDIN5B2-32G):
http://omapworld.com/iNAND_e_MMC_4_41_I ... sheet_v1_0[1].pdf

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Kingston DT101 32g SK7831 controller chip dead
PostPosted: January 14th, 2015, 18:30 
Offline

Joined: August 8th, 2013, 6:12
Posts: 21
Location: france
Please find the other side with the sk7831.

The black component near nand has 12.000 and 10 101E (not sure about the first 10) write on it.


Attachments:
20150114_231041.jpg
20150114_231041.jpg [ 1.72 MiB | Viewed 13371 times ]
20150114_231336.jpg
20150114_231336.jpg [ 1.63 MiB | Viewed 13371 times ]
Top
 Profile  
 
 Post subject: Re: Kingston DT101 32g SK7831 controller chip dead
PostPosted: January 14th, 2015, 19:28 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3779
Location: Adelaide, Australia
The black component with 12.000 on it is a 12MHz Crystal Oscillator. It is what provides timing to the USB circuit(laymans terms)

If you don't know what is what, testing is still possible.. 5 minutes and you could do something like this(example of ficticious values):
Attachment:
test.jpg
test.jpg [ 159.01 KiB | Viewed 13357 times ]


could you answer already given help from me & Fzabkar with responses?


Top
 Profile  
 
 Post subject: Re: Kingston DT101 32g SK7831 controller chip dead
PostPosted: January 16th, 2015, 20:56 
Offline

Joined: July 30th, 2012, 3:37
Posts: 308
Location: Fairfield, CT USA
R10 should be +5v, not 0v.. are you sure about that?

_________________
Recover My Flash Drive


Top
 Profile  
 
 Post subject: Re: Kingston DT101 32g SK7831 controller chip dead
PostPosted: January 16th, 2015, 21:41 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3779
Location: Adelaide, Australia
Quote:
like this(example of ficticious values):


:wink:


Top
 Profile  
 
 Post subject: Re: Kingston DT101 32g SK7831 controller chip dead
PostPosted: January 18th, 2015, 14:52 
Offline

Joined: August 8th, 2013, 6:12
Posts: 21
Location: france
Hi,

Please find the values.
Indeed something is wrong.

Thanks


Attachments:
volt.png
volt.png [ 3.75 MiB | Viewed 13219 times ]
Top
 Profile  
 
 Post subject: Re: Kingston DT101 32g SK7831 controller chip dead
PostPosted: January 20th, 2015, 1:34 
Offline

Joined: July 30th, 2012, 3:37
Posts: 308
Location: Fairfield, CT USA
HaQue wrote:
Quote:
like this(example of ficticious values):


:wink:

I hate you

_________________
Recover My Flash Drive


Top
 Profile  
 
 Post subject: Re: Kingston DT101 32g SK7831 controller chip dead
PostPosted: January 23rd, 2015, 17:24 
Offline

Joined: August 8th, 2013, 6:12
Posts: 21
Location: france
Hi

Does it help you ?
I have to measure all components to find which is burned starting from +5v?

Thanks


Top
 Profile  
 
 Post subject: Re: Kingston DT101 32g SK7831 controller chip dead
PostPosted: January 23rd, 2015, 18:23 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3779
Location: Adelaide, Australia
I don't think this issue is to do with components. often when the USB header gets snapped off, this happens... windows cannot communicate. Issues such as BGA/LGA chips breaking pad connections, NAND cracking inside or components having internal damage. I also think that the electrical surges that happen during the event can damage firmware of controller.

Your best solution is to get the chip read.

Send it to me in Australia, add any old 2 USB devices 32MB - 16GB for my research as a trade, and I will do it for you.

Or look for a data lab near you.


Top
 Profile  
 
 Post subject: Re: Kingston DT101 32g SK7831 controller chip dead
PostPosted: January 30th, 2015, 18:18 
Offline

Joined: August 8th, 2013, 6:12
Posts: 21
Location: france
Thank you for your help but for now, i want to try myself.

So as you said, possibles reasons are:
    Crystal,
    Microfailure,
    Capacitor or resitance,
    Nand,
    ....

I found that the controller doesn't do hardware encryption based on http://www.usbdev.ru/cics/icskymedi/ :
SK7831 Card Reader Controller => :!: :?:

Description:
The SK7831 is a high performance, highly integrated single chip multi-interfaced flash card reader/writer controller. By leveraging the built-in high-speed USB2.0 device controller and universal transceiver macro (UTM), the SK7831 supports both 480Mbps high-speed transfer rate and full speed 12Mbps of the USB1.1 specification.
Designed with an enhanced power control circuit, the SK7831 fully complies with USB power specifications for bus-powered devices, making it capable of bus-powered operation. Featuring best compatibility, best performance, and high integration, SK7831 is the best choice that enables host devices with USB slot transmitting/receiving data to/from NAND type flash memory cards.

Features:
USB2.0 High-Speed Interface
Supported Memory Card Host Interfaces : SDHC/SDXC/MS-Pro HG
– Secure Digital Card (SD) / MultiMedia Card (MMC)
– Memory Stick PRO (MS PRO) / MS-Pro HG
Supported OS :
– Window Vista, Win XP, Win 2000, Win-Me, Win 98 ( Skymedi Driver )
– Mac OS 9.x and above
– Linux Fedora 5 and above
Outstanding Read/Write Performance
Very Low System BOM Cost
– Built-in power switch ( x 1)
– Built-in VDT / POR
– Built-in Regulator (5V — > 3.3V/1.8V) => fzabkar supposed that
– Proprietary robust USB2.0 PHY for EMI-free design
Complete System Verification :
– Different OSs : Windows, Mac OS and Linux
– Hosts : EHCI, OHCI/UHCI, PCI-to-USB adaptor
– Hubs : USB2.0 Hub, USB1.1 Hub and 2-stage Hubs (USB1.1+USB2.0 or USB2.0+USB1.1)
– Card Test : Plug-and-Play (PnP), Performance Test and Compatibility Test
Others :
– Support 8 sets of built-in PID/VID for inventory control and user selection => ok so it's possible to control that ?!
– Support “Suspend under Request” feature
– Support LED indicator for operating status
– Support external ICE for micro controller interface

Good news if i want to access directly to the NAND (NAND can do encryption ?)

Next attempt: check the crystal


Top
 Profile  
 
 Post subject: Re: Kingston DT101 32g SK7831 controller chip dead
PostPosted: January 30th, 2015, 19:51 
Offline

Joined: July 30th, 2012, 3:37
Posts: 308
Location: Fairfield, CT USA
coptere wrote:
Thank you for your help but for now, i want to try myself.

So as you said, possibles reasons are:
    Crystal,
    Microfailure,
    Capacitor or resitance,
    Nand,
    ....

I found that the controller doesn't do hardware encryption based on http://www.usbdev.ru/cics/icskymedi/ :
– Built-in Regulator (5V — > 3.3V/1.8V) => fzabkar supposed that
– Support 8 sets of built-in PID/VID for inventory control and user selection => ok so it's possible to control that ?!

Good news if i want to access directly to the NAND (NAND can do encryption ?)

Next attempt: check the crystal


I doubt its the crystal
Not all components use +5v from USB eg: NAND uses 3.3v or both 1.8v & 3.3v
I'm guessing the OEM might want to customize the USB ID number for their product. Maybe for a custom application.
The drive doesn't do AES encryption but it does XOR encryption.

Take it to a DR shop if you want the data.

_________________
Recover My Flash Drive


Top
 Profile  
 
 Post subject: Re: Kingston DT101 32g SK7831 controller chip dead
PostPosted: January 31st, 2015, 7:16 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3779
Location: Adelaide, Australia
ok if you are adamant you want to do it yourself, then read this to get an understanding of what you are up against.
http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Reverse-Engineering-NAND-Flash-Memory-POS-device-case-study-part/ba-p/6581528#.VJkbAZDAA

also make sure you have a couple of months spare.


Top
 Profile  
 
 Post subject: Re: Kingston DT101 32g SK7831 controller chip dead
PostPosted: January 31st, 2015, 18:29 
Offline

Joined: July 30th, 2012, 3:37
Posts: 308
Location: Fairfield, CT USA
Have fun :-)

_________________
Recover My Flash Drive


Top
 Profile  
 
 Post subject: Re: Kingston DT101 32g SK7831 controller chip dead
PostPosted: January 31st, 2015, 19:20 
Offline

Joined: August 8th, 2013, 6:12
Posts: 21
Location: france
I'm not adamant (or maybe) but just want to learn and understand.
For the HDD, with your help, it took one year with success.
I have already read this article. I follow this kind of research for many years without practicing.

I know my limits and take off the chip is not an option for me without good tools but i think it's possible for the crystal. In previous posts you always asked about crystal, but here with sometimes 0v i don't know.

I have many times, but my friend i don't know and i have already mention your proposition.


Top
 Profile  
 
 Post subject: Re: Kingston DT101 32g SK7831 controller chip dead
PostPosted: January 31st, 2015, 20:44 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 14945
Location: Australia
The crystal oscillator circuit is probably of the following type:

http://upload.wikimedia.org/wikipedia/c ... or.svg.png

The inverter (U1) would be implemented within the controller. The DC voltage at each pin of the crystal (X1) would be half the Vio supply voltage (3.3V / 2 = 1.65V). A value of 1.47V (3.08 / 2 = 1.54V) seems about right.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 19 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Google [Bot] and 10 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group