HDD GURU FORUMS
http://forum.hddguru.com/

SmartNAND recovery?
http://forum.hddguru.com/viewtopic.php?f=10&t=38583		 Page 1 of 2
Author:  pcimage [ June 28th, 2019, 11:10 ]
Post subject:  SmartNAND recovery?
Got this THGBR2G5D1JTAI0 chip on a cheap Chinese flash.

Device just flashes the LED and does nothing.

Looked like a regular NAND chip to me so took it off and tried to ID in VNR/FE/PC3K readers, nothing. Just garbage 242424242 ID.

It seems to me by using Google that this is smartNAND?

The USB device without the chip on does get recognised by Windows as something and "Chp Genius" sees it as "B-READE" controller.

This leads me to believe there is a fault with this SMartNAND chip?

Never seen one before.

Anybody have any experience of these?

TIA!! :-)
Author:  pcimage [ June 28th, 2019, 11:39 ]
Post subject:  Re: SmartNAND recovery?
This is the flash device...

(Sorry I should also have said, the NAND is a TSOP48 package)...

Attachments:
IMG_2814.jpg
IMG_2814.jpg [ 585.24 KiB | Viewed 15744 times ]
Author:  fzabkar [ June 28th, 2019, 16:25 ]
Post subject:  Re: SmartNAND recovery?
AISI, you need to measure the voltages on the bypass capacitors to confirm the chip's supply rails. Other than that, the following Toshiba docs would suggest that the memory chip is a regular ONFI NAND with built-in ECC. The additional commands are a superset of the ONFI standard.

e-MMC vs. NAND with built-in ECC:
https://www.embedded.com/print/4218886

SLC NAND and BENAND:
https://business.toshiba-memory.com/content/dam/toshiba-ss/ncsa/en_us/taec/components/FAB/SLC-NAND-BENAND-FAB.pdf
Author:  fzabkar [ June 28th, 2019, 16:28 ]
Post subject:  Re: SmartNAND recovery?
AFAICT, your tools identify the controller incorrectly (MEX versus Mercury), so it would appear that it is not supported.
Author:  fzabkar [ June 28th, 2019, 16:47 ]
Post subject:  Re: SmartNAND recovery?
fzabkar wrote:
AFAICT, your tools identify the controller incorrectly (MEX versus Mercury), so it would appear that it is not supported.

Sorry, replied to wrong thread.
Author:  HaQue [ June 28th, 2019, 22:23 ]
Post subject:  Re: SmartNAND recovery?
what is that controller number there?

many times when non-standard flash is used on drives, they don't use any of the "extra" but wire directly to the NAND flash, which is usually a die similar to any other. such as when you see eMMC chips, they bypass eMMC stuff, MicroSD, wire as we would when recovering a monolith, SD car soldered to flash drive PCB same deal.

did you try with FE to ID it using 16-bit or 8-16?

Also if you look on PCB and identify ground and VCC and find which pins are GND and VCC on nand, which are they?

If you have device there, can you do a good pic of both sides?
Author:  pcimage [ June 29th, 2019, 3:18 ]
Post subject:  Re: SmartNAND recovery?
Thanks for the input guys, I’ll check these out on Monday
Author:  arvika [ June 29th, 2019, 4:09 ]
Post subject:  Re: SmartNAND recovery?
Look on traces/vias near TSOP48 pads. It could be completely in other place than TSOP48 NAND pinout should be.
Author:  fzabkar [ June 29th, 2019, 22:56 ]
Post subject:  Re: SmartNAND recovery?
Just FYI, here is a complete datasheet for a BENAND example (TC58BVG0S3HTA00):

http://pdf.datasheetcatalog.com/datasheets/toshiba/TC58BVG0S3HTA00.pdf
Author:  pcimage [ July 1st, 2019, 4:57 ]
Post subject:  Re: SmartNAND recovery?
fzabkar wrote:
Just FYI, here is a complete datasheet for a BENAND example (TC58BVG0S3HTA00):

http://pdf.datasheetcatalog.com/datasheets/toshiba/TC58BVG0S3HTA00.pdf


Pinout looks same as regular NAND
Author:  pcimage [ July 1st, 2019, 5:03 ]
Post subject:  Re: SmartNAND recovery?
HaQue wrote:
what is that controller number there?

many times when non-standard flash is used on drives, they don't use any of the "extra" but wire directly to the NAND flash, which is usually a die similar to any other. such as when you see eMMC chips, they bypass eMMC stuff, MicroSD, wire as we would when recovering a monolith, SD car soldered to flash drive PCB same deal.

did you try with FE to ID it using 16-bit or 8-16?

Also if you look on PCB and identify ground and VCC and find which pins are GND and VCC on nand, which are they?

If you have device there, can you do a good pic of both sides?


Controller is horrible, says...

CAPU03080.1
1640SRZ


16-Bit or 8-16 does not produce good ID, just 27 27 27 27

Will post good pics shortly.

I'm beginning to think this is a dead duck :-(

It's not a high-paying job at all, just curious now!! :-)
Author:  HaQue [ July 1st, 2019, 5:55 ]
Post subject:  Re: SmartNAND recovery?
sorry to ask but any chance of a nice pic of top of controller? I don't recognise logo and cant find any reference to it or numbers, apart from generic Chinese site with like a million numbers.

this is the closest I can find, but don't think it is it

Attachment:
Ic_manuf_logo--Axtal_Advanced_Crystal_Products.gif
Ic_manuf_logo--Axtal_Advanced_Crystal_Products.gif [ 280 Bytes | Viewed 15545 times ]
Author:  pcimage [ July 1st, 2019, 15:56 ]
Post subject:  Re: SmartNAND recovery?
Update...

I actually got PC3K flash to ID the chip using a different reading mode, and it’s reading the chip now.

FE or VNR still will not ID it.
Author:  pcimage [ July 1st, 2019, 15:57 ]
Post subject:  Re: SmartNAND recovery?
HaQue wrote:
sorry to ask but any chance of a nice pic of top of controller? I don't recognise logo and cant find any reference to it or numbers, apart from generic Chinese site with like a million numbers.

this is the closest I can find, but don't think it is it

Attachment:
Ic_manuf_logo--Axtal_Advanced_Crystal_Products.gif



I’ll get you that tomorrow :-)
Author:  pcimage [ July 2nd, 2019, 11:55 ]
Post subject:  Re: SmartNAND recovery?
Photos...

Attachments:
IMG_2851.jpg
IMG_2851.jpg [ 251.4 KiB | Viewed 15378 times ]
IMG_2850.jpg
IMG_2850.jpg [ 121.72 KiB | Viewed 15378 times ]
Author:  fzabkar [ July 2nd, 2019, 23:27 ]
Post subject:  Re: SmartNAND recovery?
AppoTech Ltd:

http://www.appotech.com/
https://www.usbdev.ru/files/appotech/
https://www.google.com/search?q=%22b-reade%22%20controller
Author:  pcimage [ July 3rd, 2019, 13:43 ]
Post subject:  Re: SmartNAND recovery?
Sadly the dump looks like total garbage, no visible data/SA/ECC borders.

Pretty sure Appotech controllers have strange XOR to be applied across data and SA.

Gonna call it a day on this one, having seen similar ones declared unrecoverable every time.

As I said, it’s a low paying job and it’s not worth putting time into the research on this due to the rarity of these devices.
Author:  fzabkar [ July 3rd, 2019, 17:57 ]
Post subject:  Re: SmartNAND recovery?
pcimage wrote:
Pretty sure Appotech controllers have strange XOR to be applied across data and SA.

If the "smart" NAND generates its own ECC, then one would think that the controller would not be able to write to the ECC byte(s).
Author:  arvika [ July 4th, 2019, 1:50 ]
Post subject:  Re: SmartNAND recovery?
Sean, if you want you can put dump on my FTP, I will check it.
Author:  HaQue [ July 4th, 2019, 1:55 ]
Post subject:  Re: SmartNAND recovery?
I doubt that that comes into play as normally when strange devices are hooked up to flash drives, the NAND is wired to directly. and whatever the device is (eMMC, SD, MicroSD) does not use its internal controller, but uses the one on the flash drive PCB.


nothing gets thrown out in China, it is passed down the line to get refurbished as much as possible. Even to the level that a NAND crystal is dead in a chip, they will use the second one still.


Yes, ones like the DM8261 are rarely solved. If some of the flash controller firmware hackers that work for the companies that get all types of crazy crap working cheap flash drives were to help out the DR people - then we would be in business. They MUST have access to privileged documentation from controller vendors.
Page 1 of 2 All times are UTC - 5 hours [ DST ]
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
http://www.phpbb.com/