HDD GURU FORUMS

Hi,

I would like some feedbacks about NAND flash readers (in order to dump USB flash pens), but without necessarily buying --in a first time-- the softwares to decipher the dumps.

Some companies, like ACE, sell kits including software, the reader and adapter.

Soft-Center sells the reader/adapters separately from Flash-Extractor software.

Rusolut, seems selling the software, reader, and adapters separately.

In this interesting thread https://forum.hddguru.com/viewtopic.php?f=10&t=29920,
HaQue tells that VNR has the ability to adjust the voltage to the chip, and that this is important for new TLC chips.
Question:
- Is really the VNR software that does it -- so that adjusting the voltage could be used with third-party hardware ?
- Or is it the Rusolut's reader (hardware) ?
- Or do you need both software and hardware being from Rusolut ?

What about third-party programmers ?
I tried to order them by increasing price.

GQ-5X programmer :
http://www.mcumall.com/comersus/store/comersus_viewItem.asp?idProduct=4583
NAND only. ~200 USD

AEC LabTool-48UXP Intelligent Universal Programmer
http://www.aec.com.tw/
I'm not sure about the price.

EPOS FlashExtractor ?
http://www.epos.ua/view.php/en/products_epos_flashreader
It tells also supporting voltages lower than 3.3V :

Code:

Vcc 1,8 V / 2,7V / 3,3 V

For some idea about prices of EPOS Flash Extractor and accessories, see: http://hddoracle.com/viewtopic.php?f=103&t=673

Batronix BX48 Batego II :
http://www.batronix.com/shop/programmer/BX48/batego-II.html
487 USD

Xeltek Superpro programmers :
http://www.xeltek.com/
pricey ...

Other suggestions ?

Which one (brand, model) are you using, and which pros/cons do you find to it ?

Do you see benefits or drawbacks in getting first a NAND reader from a company other than ACE / Rusolut / Soft-Center and possibly purchasing their products later ?

Forget about strange solutions - usually not work, problem with reading nands correctly etc. Buy one of complete solutions. It is software-hardware connected. If you are masochist buy SC reader (cheapest one) and assembly data in Winhex

arvika wrote:Forget about strange solutions - usually not work, problem with reading nands correctly etc. Buy one of complete solutions. It is software-hardware connected. If you are masochist buy SC reader (cheapest one) and assembly data in Winhex

Totally agree on all points, especially about the masochistic winhex "solution" !

I am biased towards SC because I've been using it for many years and know how it works, I have Ace PC3k for flash but can't really get used to the software although the reader comes in useful with it's read-retry features (but SC tool now has a similar feature now).

Am considering buying VNR tool too, but I understand the learning curve is pretty steep

"One gun does not make an arsenal"

There are couple of issues with WinHex approach (which is still great tool for different work).
It just can't handle:

- bad columns removal
- ECC correction
- NAND config
- LBN extraction
- Page structure analysis is hardly possible
- Data decoding (de-scrambling/XOR)
- block arrangement
- reader's control
Plus about ~20-30 other reasons.

If you're doing business - don't waste TIME and money on reader that does just ~5% of job, instead of getting solution which is developed specifically for that purpose.
If you're doing diploma project/want to build you own tool then the standard reader is a way to go.

You can get the free documentation and articles to have a quick look at the technology:
http://rusolut.com/visual-nand-reconstr ... mentation/
http://rusolut.com/nand-recovery-case-samples/

I'm aware that specialized software is required and that using only an hexadecimal editor would be a pain.

However, you're not taking into consideration that dumps allow to outsource more easily.
Less shipping costs, faster recoveries, ...

Not that I'm not wanting doing flash recoveries in-house.
I already did several broken plugs repairs, and I'm probably going one day to buy VNR or PC-3000 Flash.

However, there is an important price gap between a NAND reader and a complete software+hardware solution.
With VNR, the learning curve seems steep, I don't have much time now to learn more about NAND.
PC-3000 doesn't handle all models of USB sticks.

I don't want to purchase an expensive tool if I cannot find the time to progress enough during six month after the purchase. I prefer learning more about NAND memories and buy when I feel ready (although I'm aware that one is never "ready" and has to learn permanently).
The technology evolves and NAND successors will gradually replace it.
(http://www.computerworld.com/article/29 ... d-end.html)
So, better wait till the hardware tools are also able to support the NAND's successors.
Meanwhile, other softwares may also arise. Well, this is a never ending problem and of course, one has to invest at some point.

With the price difference, between a complete solution and a NAND reader, I can also buy other useful equipement.
So, it's also a question of prioritizing investments.

If the readers coming with the complete solutions are better than others, why not.
But can they work without the whole kit, i.e. do they come with a free dump extraction software?
This doesn't seem.

In this regard, EPOS FlashExtractor as well as Batronix BX48 Batego II look interesting as they come with software.

I wonder how much flash recovery softwares and hardware are bound.
Can one use VNR on dumps made by either PC-3000 Flash, SC FlashExtractor, or vice versa?

Forget about strange solutions - usually not work, problem with reading nands correctly etc.

@arvika: Can you please tell more? I'm surprised that tools like Batronix BX48 Batego II or Xeltek would not read NAND correclty as they look truely professional (and pricey) tools. If you look at their product ranges, you'll see they have tools to program NAND at an industrial level.
Can you please tell which NAND readers you tried that were not reading NANDs correclty and which kind of other problems you encountered?

I have all 3 solutions. I read your post and my advice if you not want invest money: buy cheapest reader but DEDICATED to NAND flash - choice is simply, SC reader (210$) - soft for reading nands is free. Than outsource dumps to someone by FTP (we make service like this and some others too).
I do not have Batronix BX48 Batego II or Xeltek, but it is programmer for many other chips, they do not dedicated for NAND. I think they can read some simple memories, but not new one with complicated internal structure.

in 2016,u had this question. how's your progress now?
now i'm having this question also

i'm thinking to outsource nand flash recovery after dumping out from nand chip, while keeping cost low.

i'm wondering what makes the hardware part of PC3000 flash, FE , different from others? which results in the nand dump different ?

the only near simple experience i had is laptop bios remove,read,write with TL866.
but with software side of flash recovery, i think there's a lot more.

Hello,

For the first time of my life, I need to recover a memory chip, an eMMC from Hynix
The internal controller is died. I unsoldered the chip from the board, buy a BGA153 adapter and was able to recover 100% of data from 2 partitions.
But on 2 other partitions (128MB and 5.2GB), the eMMC answers 128MB of zeroes and 5.2GB of zeroes.....
After the read of a lot of documentation to understand how eMMC work, I discovered it's possible to directly access the low level Flash Nand memory of the eMMC, because all manufacturer install non documented pad under the BGA chip, probably for test or initial programming purpose ?
Thus I ordered the right BGA adapter to be able to access these specific Nand signal without soldering. I hope it will arrive quickly

The first step was to access this nand signal, when I will receive the adapter, it will be okay.

The second step will be to dump the Nand content, and thus to have a Nand flash programmer. I just have one chip to read, I don't want to put a lot of money.
And I love the diy concept )
I know it's not very difficult to read Nand, because I am an hardware/embedded software developer and already designed board with processor + nand flash.
So I think the best 2 options for low cost Nand reader are :
- FT2232 chip + Linux software (I only work with Linux) : https://spritesmods.com/?art=ftdinand&page=2
- STM32 development board, with custom software.

I bought the 2 boards (should arrive tomorrow), but my preferred solution is the STM32 development board with custom embedded software. I choose the NUCLEO-F446ZE board.
With a 180Mhz and hardware bus natively compatible with Nand signal, the dump will be quicker than the F232 chip + linux software solution.

I am absolutely not worried about this second step

The third step will be to understand the dump. For now I am not worried because I also read a lot of documentation, and I absolutely understood every concept we need to understand.
Of course there are high level software to do that, like Visual Nand Recovery, but for a single flash to recover, it's not possible to buy a licence, that's too expensive :/
So I played with some raw Nand dump available on internet, and begun to play with them. In all case, was able to understand the nand page formatting, where and how to find bad columns, data zone, spare area zone, etc...
It's very easy to detect this parameters with a Visual view of the dump. No need too have complex software, it's easy to open the raw data as raw image, I use Gimp for example :





On the first one, the repetitive pattern we can see is the XOR key (All the block containing zeroes with XOR key = XOR key), and it's relatively easy to get it graphically and export it to file.

When the internal architecture is understood, I think I will be able to extract and build the logical data with some hours of coding in C or Python

I can see that is a tesla you are working on.
You should talk to multi-com.pl they have made a couple of recoveries from tesla emmc.
regards jesper

Well,
I Would Recommend You Buy Softcenter Flash Extractor Reader ,Read Dumps And Outsource ,Its a Pity VNR Does Not Make And Sell Just The Reader And Reader Software ,Sasha You Peeps Need To Consider This .

jriis wrote:I can see that is a tesla you are working on.
You should talk to multi-com.pl they have made a couple of recoveries from tesla emmc.
regards jesper

Yes, I seen. But I am a geek and I want to try by myself
If I fail I will send them mc to them

I am biased towards SC

Im interested in how you got the binary dump to display in GIMP like that?

It's really easy, just set .data extension to the file, and open the file with Gimp as "raw data". In the preview windows, you just have to set black and white 1 bit image :



You have have to choose the right width. You can open a first time with 256 pixels width and 600 pixels height, and normally you are able to understand the page size because you will see some repeated pattern like white or black line :



Here the end of white line is on coordinates 256/288, thus 73728 bits. So the Nand has 73728/8 = 9216 bytes per page. 8192 for data and 1024 bytes for spare(s) area(s)
You can after open the raw data with this right width.
Warning if you want to display a lot of page, image will be big. I have 16GB Sdram on my laptop thus it's not a problem ^^

Thank you for the explanation. I spent an hour last night fiddling with it but I see I was going down the wrong path.

My laptop is 32GB RAM. I will have a play and see how I go.



I've tried finding image manipulation programs and data visualization ones as well, but nothing really could display the required page size bitmaps. Just opening 128GB dumps is a challenge.

I have a partially coded one I am working on, but each hour of coding is about 5 hours of reading.. file I/O and random access and keeping track of where you are in a file... with trying to add page size controls and getting it to display is damn hard. There is not much previous work around to cut'n'paste..

I think I will be able to afford VNR before I ever half-finish this util! It has the ideal bitmap viewer. VNR team have some superb coders.


Thanks again!

You could cut some parts of the dump and display that... ?
pepe

Yes I already do that pepe, some tools limitations require it, plus often you don't need the whole dump.

But it drives me crazy when I have the want to do it, and it doesn't work the way I want! I should have paid more attention at Uni in Objects and Algorithms class during Software Engineering.

I just don't understand why, when I have 32GB RAM in laptop... a 2GB dump crashes it.

try not loading it at once, only load the part you are dealing with.
Programming is always a mistery. I usually face the most hideous problems that nobody ever saw
Nothing works the way it is described on the net or the documentation.
Ok, not nothing, but with every prog i run into a few silly problems. Not sure it's just me or that's just how programming works.
I can't imagine this is normal though

pepe

In the Gimp preview page, you can also choose the data offset you want. Thus you can Display any part of the dump, with the number of page you want.
I think it's not needed to display the entire dump file. The goal is to view some blocks, just to understand how the page data are formatted : data zone(s), ecc zone(s), logical page number, logical block number, etc....
When the structure is found, I think all the next steps can be run in a console, without the dump view.
To manipulate the dump file quickly and reorder blocks to build the logical dump, I plan to just use a tmpfs on Linux. Thus all file manipulations will be done in RAM, thus no hard disk access, it's really fast.

Some news : I wait for my eMMC nand adapter, but my nand reader based on a Nucleo F429ZI dev board is ready :





The board is attached with ethernet to my computer, my linux software sends read page command to the board with the desired address (with a simple UDP based home made protocol), and the board answers with the page data (8832 bytes for the Nand I need to read I think).

I am really happy I can reach ~2.5MB/s read rate

Nice work. Are you able to issue an ID command, what is the ID of the NAND?

I saw the offset selection, yes most cases this is enough. GIMP crashes attempting too large a load. I haven't had much time to play yet, so not sure how much it can deal with. But definitely useful, and thanks again!

And I found my laptop Has RAM limit of 16GB and is actually 16GB not 32GB, must have been thinking of my work one.