Does anyone has the pinnout for this chip ?

I've only been able to find the datasheet refering to HY27UV0BG5, i'm not sure if it will be the same as this one.

_________________
BTC Wallet - 3AoQPTBsz9PbfoanCx44Lw76Y2TwtKa1x5
Instagram https://www.instagram.com/datarecovery_morde.pt/

The "M" denotes "1st generation".

http://www.farnell.com/datasheets/1512974.pdf

BTW, I believe the correct part number is HY27UV08BG5M.

_________________
A backup a day keeps DR away.

You are correct, I've checked that previously here: http://www.elnec.com/device/Hynix/HY27U ... TSOP48%5D/

I'm just having trouble to understand what pins are for I/O, GND, CHEAP ENABLE, WP etc.

_________________
BTC Wallet - 3AoQPTBsz9PbfoanCx44Lw76Y2TwtKa1x5
Instagram https://www.instagram.com/datarecovery_morde.pt/

should be standard 8-bit ONFI pinout with 2 CE's I think

I'm trying to dump that chip using he ftdi board, however I'm going into some issues:

a) .py script isn't recognizing the full chip size: ie chip is 8gb and only shows 128mb.

b) when I dump it's only 00 00 00 00 00 all way long.

I'm using standard tsop 48 pinout, however I assume all this is due to bad wiring, I hope tomorrow I can find other pinouts I can try.

_________________
BTC Wallet - 3AoQPTBsz9PbfoanCx44Lw76Y2TwtKa1x5
Instagram https://www.instagram.com/datarecovery_morde.pt/

AIUI, your chip has a capacity of 4GiB (= 32Gbit).

08 = x8
BG = 32Gbit
5 = 2nCE & 2R/nB; Sequencial Row Read Disable

Where is your datasheet? Doesn't it tell you what you need to know?

_________________
A backup a day keeps DR away.

edited to correspond to other edits...



5 = 2nCE & 2R/nB; Sequencial Row Read Disable.

meaning 2 banks of 2GB each.

using the FTDI you would probably need to hook up CE1 and RB1, read, and call it dump0, then hook up CE2 and RB2 and call it Dump1

then the image gets put back together by reverse engineering the wear levelling algo.

mr DRUG.. can you put up a photo of the chip?

cant find a datasheet yet in the quick search I did, but many other Hynix datasheets are available. datasheet is probably a "family" datasheet containing quite a few similar devices, so searching for that exact number may not work well.

I have the chip with me as I'm trying some other things tonight, but I can't get a decent photo of it. I'll do it first thing in the morning.

One thing, in the 8 bit onfi standard CE1 is pin 9 and RB1 is pin 7 right ? I'll just have o struggle on where does that connects on the FTDI.

_________________
BTC Wallet - 3AoQPTBsz9PbfoanCx44Lw76Y2TwtKa1x5
Instagram https://www.instagram.com/datarecovery_morde.pt/

FTDI BDBUS6 --> NAND CE (9)
FTDI BDBUS7 -->NAND RB (7)

from BH Talk pdf

My FTDI is taking i's sweet time getting here >:-(

where can i get that pdf ?

Mine took also some time, and I've already did some modifications and ID'ed some more chips, after overcoming this struggle interpreting the datasheets and connections, its time to say:

The wear leveling algo is coming, you know nothing DRUG SNOW.

_________________
BTC Wallet - 3AoQPTBsz9PbfoanCx44Lw76Y2TwtKa1x5
Instagram https://www.instagram.com/datarecovery_morde.pt/

the pdf is in the 3rd post: http://forum.hddguru.com/viewtopic.php?f=10&t=31175

oh yes, I wasn't understanding that BH was blackhat, what about CE2 and RB2 ?

_________________
BTC Wallet - 3AoQPTBsz9PbfoanCx44Lw76Y2TwtKa1x5
Instagram https://www.instagram.com/datarecovery_morde.pt/

don't make it so hard
FTDI BDBUS6 --> NAND CE (10)
FTDI BDBUS7 -->NAND RB (6)

just to expand on jermy, you read with

FTDI BDBUS6 --> NAND CE (9)
FTDI BDBUS7 -->NAND RB (7)

then disconnect from NAND chip 9 and 7, then read again with:

FTDI BDBUS6 --> NAND CE (10)
FTDI BDBUS7 -->NAND RB (6)

1 chip, but 2 dumps

Here it is:

_________________
BTC Wallet - 3AoQPTBsz9PbfoanCx44Lw76Y2TwtKa1x5
Instagram https://www.instagram.com/datarecovery_morde.pt/

Ok, thanks for pic. just an observation on the pins.. do you have a microscope? I would be checking between the pins for shorts and cleaning them a little. I use a sharp box-cutter knife blade and some 1200grit wet&dry sand paper. scraping the blade really gently to shave off the solder is the way, and be extremely careful.

I do have a microscope, however I'm looking for a new one since this one lens got damaged somehow (probably sunlight) for now, I'm using one borrowed and I'll do that.

I've been looking at the dumps using DFF, do you have a better software for this ?

_________________
BTC Wallet - 3AoQPTBsz9PbfoanCx44Lw76Y2TwtKa1x5
Instagram https://www.instagram.com/datarecovery_morde.pt/

I have EXCELLENT software for this.. but it is expensive. The standard DR tools you see people talk about, VNR http://www.rusolut.com for example.

I have a few questions:

1. what is the purpose of this particular read? Data Recovery for data you want or need? learning with test data? customer? etc..
2. the data.. does it look recogniseable? for example if you run "strings" on it.. do you get back any ascii? This will show if data is XORED first. You may be lucky being an older chip.
3. what do you expect to be on there, a fat32 filestem with pictures.. word docs.. video.. etc?
4. are you able to post any of the dump, say 2MB zipped? if it isn't private data?
5. what dis the chip come from.. if UFD, controller and pcb pics help.


I can have a look and show you how the service area works and how to recognise blocks, pages etc and possibly the wear levelling used.

cheers

I know how good VNR is, but since I can't afford it (yet) I'm doing the best i can to learn all I can related to flash (i don't do flash recovery, its always outsourced along with hdd's that need clean air enclosure work). The point of all this experiments is getting more familiar with the flash tech (i remember everyday the first response you ever gave me about how deceiving flash recovery was, it looks simple, but it isn't).

All the questions I've been asking are just for personal and experimental use.

1. The purpose is learning what I can achieve in a early stage while I dont have a budget for VNR.
2. I can only see 00 00 00 00 all the way long, that tells me Im not dumping correctly(yet) the ASCII is just .......
3. i expect to be fat32 with word docs and pictures (I've stored multiple doc extensions to be able to learn how to recognize them in the future.
4. I'll try to get a old flashdrive and store the contents to later remove the chip and do a correct dump to show you.
5. This chip comes from a flashdrive with fingerprint recognition (will this be relevant when acessing the data?)

_________________
BTC Wallet - 3AoQPTBsz9PbfoanCx44Lw76Y2TwtKa1x5
Instagram https://www.instagram.com/datarecovery_morde.pt/

1. fun isn't it?
2. do you have a logic analyser to watch what is happening?
4. try to find a flash drive with any of the following controllers, as these shouldn't have XOR...
UT165-L48, UP10, SM321QF, SM3251 Q BA, SM3252 Q BB, SM3253 L AE
5. maybe and maybe not. the fingerprint, if a digital representation is stored on the flash, would be VERY interesting to analyse. but it may be just an unlocker to the NAND, and controller-to-NAND is same as any other. I may have to look into these. Maybe take it apart and see how many chips. If there is an extra eeprom for example(could they be this stupid?) then probably nand is normal. One thing to check is the marketing material for the flash drive. If it mentions encryption, it could be a waste of time..