SmartNAND recovery?

[pcimage]

Got this THGBR2G5D1JTAI0 chip on a cheap Chinese flash.

Device just flashes the LED and does nothing.

Looked like a regular NAND chip to me so took it off and tried to ID in VNR/FE/PC3K readers, nothing. Just garbage 242424242 ID.

It seems to me by using Google that this is smartNAND?

The USB device without the chip on does get recognised by Windows as something and "Chp Genius" sees it as "B-READE" controller.

This leads me to believe there is a fault with this SMartNAND chip?

Never seen one before.

Anybody have any experience of these?

TIA!!

[pcimage]

This is the flash device...

(Sorry I should also have said, the NAND is a TSOP48 package)...

Attachments

[fzabkar]

AISI, you need to measure the voltages on the bypass capacitors to confirm the chip's supply rails. Other than that, the following Toshiba docs would suggest that the memory chip is a regular ONFI NAND with built-in ECC. The additional commands are a superset of the ONFI standard.

e-MMC vs. NAND with built-in ECC:
https://www.embedded.com/print/4218886

SLC NAND and BENAND:
https://business.toshiba-memory.com/content/dam/toshiba-ss/ncsa/en_us/taec/components/FAB/SLC-NAND-BENAND-FAB.pdf

[fzabkar]

AFAICT, your tools identify the controller incorrectly (MEX versus Mercury), so it would appear that it is not supported.

[fzabkar]

AFAICT, your tools identify the controller incorrectly (MEX versus Mercury), so it would appear that it is not supported.

Sorry, replied to wrong thread.

[HaQue]

what is that controller number there?

many times when non-standard flash is used on drives, they don't use any of the "extra" but wire directly to the NAND flash, which is usually a die similar to any other. such as when you see eMMC chips, they bypass eMMC stuff, MicroSD, wire as we would when recovering a monolith, SD car soldered to flash drive PCB same deal.

did you try with FE to ID it using 16-bit or 8-16?

Also if you look on PCB and identify ground and VCC and find which pins are GND and VCC on nand, which are they?

If you have device there, can you do a good pic of both sides?

[pcimage]

Thanks for the input guys, I’ll check these out on Monday

[arvika]

Look on traces/vias near TSOP48 pads. It could be completely in other place than TSOP48 NAND pinout should be.

[fzabkar]

Just FYI, here is a complete datasheet for a BENAND example (TC58BVG0S3HTA00):

http://pdf.datasheetcatalog.com/datasheets/toshiba/TC58BVG0S3HTA00.pdf

[pcimage]

Just FYI, here is a complete datasheet for a BENAND example (TC58BVG0S3HTA00):

http://pdf.datasheetcatalog.com/datasheets/toshiba/TC58BVG0S3HTA00.pdf

Pinout looks same as regular NAND

[pcimage]

what is that controller number there?

many times when non-standard flash is used on drives, they don't use any of the "extra" but wire directly to the NAND flash, which is usually a die similar to any other. such as when you see eMMC chips, they bypass eMMC stuff, MicroSD, wire as we would when recovering a monolith, SD car soldered to flash drive PCB same deal.

did you try with FE to ID it using 16-bit or 8-16?

Also if you look on PCB and identify ground and VCC and find which pins are GND and VCC on nand, which are they?

If you have device there, can you do a good pic of both sides?

Controller is horrible, says...

CAPU03080.1
1640SRZ


16-Bit or 8-16 does not produce good ID, just 27 27 27 27

Will post good pics shortly.

I'm beginning to think this is a dead duck

It's not a high-paying job at all, just curious now!!

[HaQue]

sorry to ask but any chance of a nice pic of top of controller? I don't recognise logo and cant find any reference to it or numbers, apart from generic Chinese site with like a million numbers.

this is the closest I can find, but don't think it is it

Ic_manuf_logo--Axtal_Advanced_Crystal_Products.gif (280 Bytes) Viewed 12012 times

[pcimage]

Update...

I actually got PC3K flash to ID the chip using a different reading mode, and it’s reading the chip now.

FE or VNR still will not ID it.

[pcimage]

sorry to ask but any chance of a nice pic of top of controller? I don't recognise logo and cant find any reference to it or numbers, apart from generic Chinese site with like a million numbers.

this is the closest I can find, but don't think it is it

Ic_manuf_logo--Axtal_Advanced_Crystal_Products.gif

I’ll get you that tomorrow

[pcimage]

Photos...

Attachments

[fzabkar]

AppoTech Ltd:

http://www.appotech.com/
https://www.usbdev.ru/files/appotech/
https://www.google.com/search?q=%22b-reade%22%20controller

[pcimage]

Sadly the dump looks like total garbage, no visible data/SA/ECC borders.

Pretty sure Appotech controllers have strange XOR to be applied across data and SA.

Gonna call it a day on this one, having seen similar ones declared unrecoverable every time.

As I said, it’s a low paying job and it’s not worth putting time into the research on this due to the rarity of these devices.

[fzabkar]

Pretty sure Appotech controllers have strange XOR to be applied across data and SA.

If the "smart" NAND generates its own ECC, then one would think that the controller would not be able to write to the ECC byte(s).

[arvika]

Sean, if you want you can put dump on my FTP, I will check it.

[HaQue]

I doubt that that comes into play as normally when strange devices are hooked up to flash drives, the NAND is wired to directly. and whatever the device is (eMMC, SD, MicroSD) does not use its internal controller, but uses the one on the flash drive PCB.


nothing gets thrown out in China, it is passed down the line to get refurbished as much as possible. Even to the level that a NAND crystal is dead in a chip, they will use the second one still.


Yes, ones like the DM8261 are rarely solved. If some of the flash controller firmware hackers that work for the companies that get all types of crazy crap working cheap flash drives were to help out the DR people - then we would be in business. They MUST have access to privileged documentation from controller vendors.