NAND Decoder available as Trial for all

[Bolo]

Hello guys,

Feel free to use our NAND Decoder which we use for NAND technological pinout discovery - you can find it at https://multi-recovery.com/decoder_beta.php. Coomparing to others , ours offer some benefits as:

- additional filtering by Read ID command (90h)
- huge database ID which is updated monthly
- additional filtering by Read Page command (30h) - not available in TRIAL

For what are those ?
Well..... if you are trying to find NAND technological pinout you will for sure stop at position where you need to sort in correct order data lines. In basic cases and ID you can use even Excel for this which will allows you decode Binary to HEX according what you read from Logic Analyzer. In some more complex situations you will you can get in some situations case where multiple lines switch is needed to get correct ID. In such cases filters by Read ID command and more advanced Page Read can give you 100% informaiotn what need to be switched on your Data Line order.


Link: https://multi-recovery.com/decoder_beta.php

Got ideas about what can be addedd more ? Feel free to contact me.

[HaQue]

Nice, thank you for helping the community!

You may want to fix the spelling mistake on the second purple button. "Decode NAND ID From (not Form) BIN

[Bolo]

@HaQue: Thx - fixed

[fzabkar]

I just tried to ID this NAND from an ST500LM000 SSHD, but it wasn't recognised:

Code:

Flash Statistics:
BridgePSMDriverID = 0x0009
FlashID 98D7 8493 72D7
Flash Manufacturer: Toshiba19nm
Flash Capacity = 00008 GB MLC

[Bolo]

Hm... I checked and it's there 98D78493

To explain - let's assume that after connecting LA you decode data byes lines as 0x19 0x77 0x41 0x33, enter those and you will see your real ID and Data lines order so 0x98D78493 and

LINE: 0 -> DATA: 7
LINE: 1 -> DATA: 0 DATA: 1
LINE: 2 -> DATA: 6
LINE: 3 -> DATA: 3
LINE: 4 -> DATA: 4
LINE: 5 -> DATA: 0 DATA: 1
LINE: 6 -> DATA: 2
LINE: 7 -> DATA: 5

This means that your LINE 0 is in fact IO7/Data7, Line 1 can be IO0/Data0 or IO1/Data1, Line 2 are IO6/Data6.... etc.
To filter possibility od Data0/Data1 in this case we can use 90h ID command filter or additionaly available in Fullversion Page read filter (30h) - then hit are 100% without any additional need for checking possiblities.

If you will find any ID that are not available let me know - since we are also using this tool we are updating database once it's possible

[Amarbir[CDR-Labs]]

Hm... I checked and it's there 98D78493

To explain - let's assume that after connecting LA you decode data byes lines as 0x19 0x77 0x41 0x33, enter those and you will see your real ID and Data lines order so 0x98D78493 and

LINE: 0 -> DATA: 7
LINE: 1 -> DATA: 0 DATA: 1
LINE: 2 -> DATA: 6
LINE: 3 -> DATA: 3
LINE: 4 -> DATA: 4
LINE: 5 -> DATA: 0 DATA: 1
LINE: 6 -> DATA: 2
LINE: 7 -> DATA: 5

This means that your LINE 0 is in fact IO7/Data7, Line 1 can be IO0/Data0 or IO1/Data1, Line 2 are IO6/Data6.... etc.
To filter possibility od Data0/Data1 in this case we can use 90h ID command filter or additionaly available in Fullversion Page read filter (30h) - then hit are 100% without any additional need for checking possiblities.

If you will find any ID that are not available let me know - since we are also using this tool we are updating database once it's possible

Hello,
Can you make a small demo for this please ,Would be really helpful

[HaQue]

I think it is pretty clear : in above example, if the chip doesn't ID as 98D78493 with:

LINE: 0 -> DATA: 7
LINE: 1 -> DATA: 0
LINE: 2 -> DATA: 6
LINE: 3 -> DATA: 3
LINE: 4 -> DATA: 4
LINE: 5 -> DATA: 1
LINE: 6 -> DATA: 2
LINE: 7 -> DATA: 5

then rewire to switch LINE 1 & LINE 5 to:

LINE: 0 -> DATA: 7
LINE: 1 -> DATA: 1
LINE: 2 -> DATA: 6
LINE: 3 -> DATA: 3
LINE: 4 -> DATA: 4
LINE: 5 -> DATA: 0
LINE: 6 -> DATA: 2
LINE: 7 -> DATA: 5

sounds like a paid version may be able to take away that small problem as well. The actual finding of the data lines in the first place would be something a lot may be stuck on.

[fzabkar]

@Bolo, thanks, I see what your tool does now.

I revisited this thread:

https://forum.hddguru.com/viewtopic.php?f=10&t=38304

Your tool produced the same result as I did, but the OP was unsuccessful with it.

[fzabkar]

ISTM that the tool(s) would be more useful if it/they were to additionally support the 90/20 READ ID command. This command returns an "ONFI" text string.

AISI, the two READ ID commands would enable us to identify the lines corresponding to data bits 0, 3, 5 and 6. There would be two possible line combinations for data bits 4 and 7, and two combinations for bits 1 and 2. The final result would be 4 possible combinations for the real flash ID.

[fzabkar]

AISI, the two READ ID commands would enable us to identify the lines corresponding to data bits 0, 3, 5 and 6. There would be two possible line combinations for data bits 4 and 7, and two combinations for bits 1 and 2. The final result would be 4 possible combinations for the real flash ID.

I think I made a mistake. ISTM that it should be possible to do better than that.

https://user.eng.umd.edu/~blj/CS-590.26/micron-tn2919.pdf

There are 28 possible combinations of lines 0 - 7 corresponding to the 90h/00h READ ID command. One combination will produce a 4-byte/5-byte ID. This identifies the two lines corresponding to data bits 4 and 7, but not necessarily in that order.

There are now 6 remaining lines, one of which corresponds to data bit 5. We now execute the 90h/20h READ ID command until we get a result. This identifies data bit 5, and it gives a result which we know is an "ONFI" text string.

Comparing "ONFI" bytes 0 and 1 gives us the line corresponding to data bit 0.

Now that we have identified data bits 0, 4, 5, 6 and 7, it only remains to find bits 1, 2, and 3.

Comparing the "F" and "I" bytes gives us the line corresponding to data bit 1.

Comparing the "N" and "F" bytes now gives us the lines corresponding to data bits 2 and 3.

Now we know all the data bits except for 4 and 7, but this leaves us with only two possible combinations.

[fzabkar]

Data bit 6 is identified by performing a bitwise AND of all four "ONFI" bytes. That is, bit 6 is the only bit which is set in all 4 bytes.

[Bolo]

ONFI is not the way.... it's becouse only Micron and Intel handle it correctly as it schould - if you will get Samsung then forget about decoding ONFI. We already thinked about this way