Kingston DT101 32g SK7831 controller chip dead

[coptere]

Hi,

A friend wants me to repair his USB key which has a broken USB connector.

I have soldering the wire from the right to left (5v, d-,d+,gnd) but Windows says that USB key has a problem and can't use it.
Indeed, with geniuscheck, i see that PID and VID are both 0. I think le controller is in a bad state or bricked.
I suppose for this key the VID is 951 and PID is 1642 but I am not sure because on flashboot.ru (http://flashboot.ru/index.php?name=iflash) I can't find the right ship.

My controller chip is skymedi SK7831 and memory chip SanDisk.

Someone can help me? Or can provide me the firmware to reprogram the contoller?

Thank you

Attachments

[fzabkar]

Can you measure +3.3V across the NAND's Vcc capacitor?

If there is a low value resistor (eg 2.2 ohm) in series with the +5V supply, you could determine the current draw by measuring the voltage drop across it.

[HaQue]

Repair or Data Recovery.

If Repair, then No not advisable. You can not trust a USB Flash drive after this amount of abuse. I know some might argue that it is an electronic circuit and should be fine onced fixed, but UFD's are very touchy. I would bin it and buy a new one.

If you want to recover the files, then trying to go about it this way will almost certainly lose your DATA.

If you didn't solder under a microscope it is possible you didn't get the connections right, or bridged something. I have seen some great looking repair attempts by naked eye, but under microscope the flaws show up. Also stressed devices such as tis can cause the BGA / LGA connections to the PCB to break, and that's impossible to check really.

The only real steps if repair for DR doesn't work is to take NAND chip off and read it. otherwise buy a new drive.

[coptere]

Thank you for your help,

I want to recover files on the flash drive and in the same time learn as i learned on hard drive.
I find the vid=0951 and PID=162F.
I can take measure but i don't know where is the NAND's VCC capacitor.

I already thought about take off the NAND chip but it's only a final solution, i don't have tool and TSOP to read it.

[fzabkar]

It appears that the SanDisk SDIN4E2-32G is an iNAND eMMC.

I would measure the voltages across each of the capacitors (Cx). One or more should have 3.3V or perhaps 1.8V. If 1.8V is present, then I would expect to see a 1.8V LDO regulator, otherwise the Skymedi controller may have an embedded 1.8V regulator.

What are the markings on the small black component?

Could we see the other side of the PCB?

It's not the same device, but the SDIN5B2-32G "SanDisk iNAND has three power domains assigned to VCCQ, VCC and VDDi".

VCCQ = 3.3V or 1.8V
VCC = 3.3V
VDDi = "internal regulator connection to an external decoupling capacitor"

SanDisk iNAND e.MMC 4.41 I/F Preliminary Data Sheet (SDIN5B2-32G):
http://omapworld.com/iNAND_e_MMC_4_41_I ... sheet_v1_0[1].pdf

[coptere]

Please find the other side with the sk7831.

The black component near nand has 12.000 and 10 101E (not sure about the first 10) write on it.

Attachments

[HaQue]

The black component with 12.000 on it is a 12MHz Crystal Oscillator. It is what provides timing to the USB circuit(laymans terms)

If you don't know what is what, testing is still possible.. 5 minutes and you could do something like this(example of ficticious values):

could you answer already given help from me & Fzabkar with responses?

[jeremyb]

R10 should be +5v, not 0v.. are you sure about that?

[HaQue]

like this(example of ficticious values):

[coptere]

Hi,

Please find the values.
Indeed something is wrong.

Thanks

Attachments

[jeremyb]

like this(example of ficticious values):

I hate you

[coptere]

Hi

Does it help you ?
I have to measure all components to find which is burned starting from +5v?

Thanks

[HaQue]

I don't think this issue is to do with components. often when the USB header gets snapped off, this happens... windows cannot communicate. Issues such as BGA/LGA chips breaking pad connections, NAND cracking inside or components having internal damage. I also think that the electrical surges that happen during the event can damage firmware of controller.

Your best solution is to get the chip read.

Send it to me in Australia, add any old 2 USB devices 32MB - 16GB for my research as a trade, and I will do it for you.

Or look for a data lab near you.

[coptere]

Thank you for your help but for now, i want to try myself.

So as you said, possibles reasons are:

Crystal,
Microfailure,
Capacitor or resitance,
Nand,
....

I found that the controller doesn't do hardware encryption based on http://www.usbdev.ru/cics/icskymedi/ :
SK7831 Card Reader Controller =>

Description:
The SK7831 is a high performance, highly integrated single chip multi-interfaced flash card reader/writer controller. By leveraging the built-in high-speed USB2.0 device controller and universal transceiver macro (UTM), the SK7831 supports both 480Mbps high-speed transfer rate and full speed 12Mbps of the USB1.1 specification.
Designed with an enhanced power control circuit, the SK7831 fully complies with USB power specifications for bus-powered devices, making it capable of bus-powered operation. Featuring best compatibility, best performance, and high integration, SK7831 is the best choice that enables host devices with USB slot transmitting/receiving data to/from NAND type flash memory cards.

Features:
USB2.0 High-Speed Interface
Supported Memory Card Host Interfaces : SDHC/SDXC/MS-Pro HG
– Secure Digital Card (SD) / MultiMedia Card (MMC)
– Memory Stick PRO (MS PRO) / MS-Pro HG
Supported OS :
– Window Vista, Win XP, Win 2000, Win-Me, Win 98 ( Skymedi Driver )
– Mac OS 9.x and above
– Linux Fedora 5 and above
Outstanding Read/Write Performance
Very Low System BOM Cost
– Built-in power switch ( x 1)
– Built-in VDT / POR
– Built-in Regulator (5V — > 3.3V/1.8V) => fzabkar supposed that
– Proprietary robust USB2.0 PHY for EMI-free design
Complete System Verification :
– Different OSs : Windows, Mac OS and Linux
– Hosts : EHCI, OHCI/UHCI, PCI-to-USB adaptor
– Hubs : USB2.0 Hub, USB1.1 Hub and 2-stage Hubs (USB1.1+USB2.0 or USB2.0+USB1.1)
– Card Test : Plug-and-Play (PnP), Performance Test and Compatibility Test
Others :
– Support 8 sets of built-in PID/VID for inventory control and user selection => ok so it's possible to control that ?!
– Support “Suspend under Request” feature
– Support LED indicator for operating status
– Support external ICE for micro controller interface

Good news if i want to access directly to the NAND (NAND can do encryption ?)

Next attempt: check the crystal

[jeremyb]

Thank you for your help but for now, i want to try myself.

So as you said, possibles reasons are:

Crystal,
Microfailure,
Capacitor or resitance,
Nand,
....

I found that the controller doesn't do hardware encryption based on http://www.usbdev.ru/cics/icskymedi/ :
– Built-in Regulator (5V — > 3.3V/1.8V) => fzabkar supposed that
– Support 8 sets of built-in PID/VID for inventory control and user selection => ok so it's possible to control that ?!

Good news if i want to access directly to the NAND (NAND can do encryption ?)

Next attempt: check the crystal

I doubt its the crystal
Not all components use +5v from USB eg: NAND uses 3.3v or both 1.8v & 3.3v
I'm guessing the OEM might want to customize the USB ID number for their product. Maybe for a custom application.
The drive doesn't do AES encryption but it does XOR encryption.

Take it to a DR shop if you want the data.

[HaQue]

ok if you are adamant you want to do it yourself, then read this to get an understanding of what you are up against.
http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Reverse-Engineering-NAND-Flash-Memory-POS-device-case-study-part/ba-p/6581528#.VJkbAZDAA

also make sure you have a couple of months spare.

[jeremyb]

Have fun

[coptere]

I'm not adamant (or maybe) but just want to learn and understand.
For the HDD, with your help, it took one year with success.
I have already read this article. I follow this kind of research for many years without practicing.

I know my limits and take off the chip is not an option for me without good tools but i think it's possible for the crystal. In previous posts you always asked about crystal, but here with sometimes 0v i don't know.

I have many times, but my friend i don't know and i have already mention your proposition.

[fzabkar]

The crystal oscillator circuit is probably of the following type:

http://upload.wikimedia.org/wikipedia/c ... or.svg.png

The inverter (U1) would be implemented within the controller. The DC voltage at each pin of the crystal (X1) would be half the Vio supply voltage (3.3V / 2 = 1.65V). A value of 1.47V (3.08 / 2 = 1.54V) seems about right.