All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 10 posts ] 
Author Message
 Post subject: Using VNR for a small 16Mbit SPI chip
PostPosted: December 12th, 2022, 18:21 
Offline
User avatar

Joined: March 30th, 2016, 15:52
Posts: 27
Location: Washington, USA
Hi all!
I am often asked to pull data from an assortment of different devices other than flash drives or SSDs.

Recently I came across a device I needed to pull data from which has a small Adesto 16Mbit SPI flash. I successfully read the entire contents of the NAND flash (as I have many other times with similar devices), but I notices something peculiar about the flash contents, and thinking, well, it is NAND, decided to take a look at it in VNR to see the structure needed to be fixed.

I've attached an image showing the structure in bitmap form. According to datasheet, page size is 528, each block is 4224 bytes.
Data area seems to be broken into 28 byte chunks followed by the SA containing LBN and ECC. The weird part comes in where the first 4 bytes appears to be a Data Area, followed by some SA, but those 4 Data area bytes seem like they should have been the END of the data area found at the end of the page (the last Data Area on the page is only 24 bytes and appears to line up in pattern to those first 4 bytes I mentioned).
What I'd like to try to do is take those first 4 bytes from each page and append them to the end of the last data area. Logically that makes sense to me, but I just don't know how to execute this plan in VNR.

Anyone have any ideas?


Attachments:
VNR2.png
VNR2.png [ 47.75 KiB | Viewed 5796 times ]
VNR1.png
VNR1.png [ 47.81 KiB | Viewed 5796 times ]
Top
 Profile  
 
 Post subject: Re: Using VNR for a small 16Mbit SPI chip
PostPosted: December 12th, 2022, 19:18 
Offline

Joined: October 24th, 2009, 15:22
Posts: 872
Location: Poland
You can do it with offsets and XOR elements. Probably other way too, maybe simpler way. But please do not ask how to do it, to complicated to explain ;) But create ticket on TS, I'm sure they will help.

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices


Top
 Profile  
 
 Post subject: Re: Using VNR for a small 16Mbit SPI chip
PostPosted: December 12th, 2022, 19:23 
Offline
User avatar

Joined: March 30th, 2016, 15:52
Posts: 27
Location: Washington, USA
arvika wrote:
You can do it with offsets and XOR elements. Probably other way too, maybe simpler way. But please do not ask how to do it, to complicated to explain ;) But create ticket on TS, I'm sure they will help.


Do you at least agree that this should be done in this case? I've figured out a way to do it.


Top
 Profile  
 
 Post subject: Re: Using VNR for a small 16Mbit SPI chip
PostPosted: December 13th, 2022, 2:29 
Offline

Joined: October 24th, 2009, 15:22
Posts: 872
Location: Poland
I don't know. I do not see full dump. For example if you choose wrong page size it could mislead you to wrong assumptions.

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices


Top
 Profile  
 
 Post subject: Re: Using VNR for a small 16Mbit SPI chip
PostPosted: December 13th, 2022, 3:30 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
crackz0r wrote:
What I'd like to try to do is take those first 4 bytes from each page and append them to the end of the last data area.

I could write a very simple tool to do this.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Using VNR for a small 16Mbit SPI chip
PostPosted: December 13th, 2022, 12:27 
Offline
User avatar

Joined: March 30th, 2016, 15:52
Posts: 27
Location: Washington, USA
fzabkar wrote:
crackz0r wrote:
What I'd like to try to do is take those first 4 bytes from each page and append them to the end of the last data area.

I could write a very simple tool to do this.


I was thinking of a way to script this in python, but wound up doing it manually in hex editor by just shifting the leading 4 bytes of every 'sector' to the end of that sector.
This was easy enough to do manually in this case since I am only dealing with a 16Mbit NAND.

arvika wrote:
I don't know. I do not see full dump. For example if you choose wrong page size it could mislead you to wrong assumptions.


Page size is definitely correct. For this specific IC default page size is 528.
Here is link to datasheet in case anyone was interested in looking.
https://datasheetspdf.com/pdf/820872/Adesto/45DB161E/1

Also, thanks to you both for your replies!

ALSO! Just realizing this that I forgot to mention, the first screenshot is of the end of the pages, and the second image is the beginning. You can see how those first 4 bytes of each page appear to be data followed by SA, and the end of the page is what I am assuming to be the preceding data of those 4 bytes.


Top
 Profile  
 
 Post subject: Re: Using VNR for a small 16Mbit SPI chip
PostPosted: December 13th, 2022, 13:22 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
Since the flash is read as a serial bitstream, is it possible that the leading 4 bytes of a particular sector are actually the last 4 bytes of the previous sector? In other words, could you just rotate the entire dump by 4 bytes to the left?

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Using VNR for a small 16Mbit SPI chip
PostPosted: December 13th, 2022, 13:39 
Offline
User avatar

Joined: March 30th, 2016, 15:52
Posts: 27
Location: Washington, USA
fzabkar wrote:
Since the flash is read as a serial bitstream, is it possible that the leading 4 bytes of a particular sector are actually the last 4 bytes of the previous sector? In other words, could you just rotate the entire dump by 4 bytes to the left?


So I was never familiar with the Rotate function until now...but...yes! That literally accomplished exactly what I needed, so, thanks!

Learn something new every day!


Top
 Profile  
 
 Post subject: Re: Using VNR for a small 16Mbit SPI chip
PostPosted: December 13th, 2022, 14:04 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
Which command did you use to dump the flash?

There is a "Continuous Array Read (Legacy Command: E8h Opcode)" which might explain the 4-byte shift.

Quote:
To perform a Continuous Array Read using the standard DataFlash page size (528 bytes), an opcode of E8h must be clocked into the device followed by three address bytes (which comprise the 22-bit page and byte address sequence) and four dummy bytes.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Using VNR for a small 16Mbit SPI chip
PostPosted: December 19th, 2022, 18:11 
Offline
User avatar

Joined: March 30th, 2016, 15:52
Posts: 27
Location: Washington, USA
fzabkar wrote:
Which command did you use to dump the flash?

There is a "Continuous Array Read (Legacy Command: E8h Opcode)" which might explain the 4-byte shift.

Quote:
To perform a Continuous Array Read using the standard DataFlash page size (528 bytes), an opcode of E8h must be clocked into the device followed by three address bytes (which comprise the 22-bit page and byte address sequence) and four dummy bytes.


I used FlashCat to dump the flash via SPI.

Turns out the "Rotate" function is NOT what I needed, but, my original method of manually shifting the ending 4 bytes to the beginning of each page proved successful for me to reconstruct the data.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 10 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 5 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group