Toshiba TH58NVG7D2HTA20

[crackz0r]

Hi all!

Was wondering if anyone has any info on a Toshiba NAND IC I am working with (not for a case or data recovery, just playing around and practicing)

It is a TH58NVG7D2HTA20 (there are 7 of these from some torn down SSD I found). Can't find a datasheet specifically for this IC. ID is 98DEA48276.

Rusolut VNR has the ID in its database but refers to it as a TC58NVG6D2HTA00. When looking at the dump (before and after a read), something just seems off.

Any pointers or anyone ever come across this IC before?

Thanks!

[fzabkar]

It doesn't answer your question, but the attached document has ~700 NAND chip IDs.

Attachments

cbm209x-flash-support-list20130407_compress.pdf

(942.91 KiB) Downloaded 169 times

[crackz0r]

It doesn't answer your question, but the attached document has ~700 NAND chip IDs.

Yeah this IC is not represented there, but handy doc to have!
Thanks!

[HaQue]

You can try and find similar datasheets and see if they list a READ ID, and include multiple chip numbers. or looking at a part number decoder might give you some insight. Newer Toshiba chip datasheets not that easy to find. Some chips I think may be produced for a certain vendor, and thus not widely distributed.

Toshiba Part decoder example:
http://www.triton-prog.ru/Dnl/Nand_Toshiba_NEW.pdf

[HaQue]

So if this is correct, the differences between the VNR config and your chip appears to be:

TH 58NV G7 D2HTA 20 - Multi Chip | G7 128(=27 ) Gbits =16GB | Single Channel, 2 /CE
TC 58NV G6 D2HTA 00 - Single Chip | G6 64(=26 ) Gbits =8GB | Single Channel, 1 /CE

[HaQue]

Found this site that decodes partnumbers... https://nand.gq/#/decode might be interesting for people investigating flash stuff.

this is the project: https://github.com/iTXTech/FlashDetector

iTXTech FlashDetector

Universal NAND Flash Part Number Decoder and Search Engine.

Universal NAND Flash ID Decoder and Search Engine.

Supported:

Flash Vendors:

Solidigm - Formerly Intel, now SK hynix
Micron
Western Digital - Formerly SanDisk
KIOXIA - Formerly Toshiba Memory
Samsung
SK hynix
YMTC

Controller Vendors:

Silicon Motion
ASolid
JMicron
Maxio
SandForce - Now Seagate
Chipsbank
Alcor Micro
Phison

[crackz0r]

Found this site that decodes partnumbers... https://nand.gq/#/decode might be interesting for people investigating flash stuff.

this is the project: https://github.com/iTXTech/FlashDetector

HaQue, these are incredible resources! Thank you so much for sharing!

I am getting closer to solving it. Like I mentioned, the 7 ICs I have were already removed from what ever SSD they were originally attached to, so I am not sure exactly what controller was on it, but It seems like it was probably a JM. SA is XOR'd, but looks like I might have to extract the key manually as VNRs XOR analyzer is not finding the correct match.

To be fair, I don't have much experience with SSDs. People always send me the totally obscure stuff (old NAND, software controlled, etc.) so I have been trying to give myself some experience with more common stuff by practicing.

Again, thanks so much for the resources, these are great tools!

[HaQue]

No worries, Sharing is Caring! If you have VNR, maybe support can help

[crackz0r]

No worries, Sharing is Caring! If you have VNR, maybe support can help

Bah! Where's the fun in that?!

Lol.

Since it's just for research/practice, I will keep trying until I succeed lol.
I am now on to organizing blocks! Manually deciphered ECC and XOR key just need to rebuild FS now!

[Arch Stanton]

It doesn't answer your question, but the attached document has ~700 NAND chip IDs.

Amazing all the stuff you find, Franc!