Using VNR for a small 16Mbit SPI chip

[crackz0r]

Hi all!
I am often asked to pull data from an assortment of different devices other than flash drives or SSDs.

Recently I came across a device I needed to pull data from which has a small Adesto 16Mbit SPI flash. I successfully read the entire contents of the NAND flash (as I have many other times with similar devices), but I notices something peculiar about the flash contents, and thinking, well, it is NAND, decided to take a look at it in VNR to see the structure needed to be fixed.

I've attached an image showing the structure in bitmap form. According to datasheet, page size is 528, each block is 4224 bytes.
Data area seems to be broken into 28 byte chunks followed by the SA containing LBN and ECC. The weird part comes in where the first 4 bytes appears to be a Data Area, followed by some SA, but those 4 Data area bytes seem like they should have been the END of the data area found at the end of the page (the last Data Area on the page is only 24 bytes and appears to line up in pattern to those first 4 bytes I mentioned).
What I'd like to try to do is take those first 4 bytes from each page and append them to the end of the last data area. Logically that makes sense to me, but I just don't know how to execute this plan in VNR.

Anyone have any ideas?

Attachments

[arvika]

You can do it with offsets and XOR elements. Probably other way too, maybe simpler way. But please do not ask how to do it, to complicated to explain But create ticket on TS, I'm sure they will help.

[crackz0r]

You can do it with offsets and XOR elements. Probably other way too, maybe simpler way. But please do not ask how to do it, to complicated to explain But create ticket on TS, I'm sure they will help.

Do you at least agree that this should be done in this case? I've figured out a way to do it.

[arvika]

I don't know. I do not see full dump. For example if you choose wrong page size it could mislead you to wrong assumptions.

[fzabkar]

What I'd like to try to do is take those first 4 bytes from each page and append them to the end of the last data area.

I could write a very simple tool to do this.

[crackz0r]

What I'd like to try to do is take those first 4 bytes from each page and append them to the end of the last data area.

I could write a very simple tool to do this.

I was thinking of a way to script this in python, but wound up doing it manually in hex editor by just shifting the leading 4 bytes of every 'sector' to the end of that sector.
This was easy enough to do manually in this case since I am only dealing with a 16Mbit NAND.

I don't know. I do not see full dump. For example if you choose wrong page size it could mislead you to wrong assumptions.

Page size is definitely correct. For this specific IC default page size is 528.
Here is link to datasheet in case anyone was interested in looking.
https://datasheetspdf.com/pdf/820872/Adesto/45DB161E/1

Also, thanks to you both for your replies!

ALSO! Just realizing this that I forgot to mention, the first screenshot is of the end of the pages, and the second image is the beginning. You can see how those first 4 bytes of each page appear to be data followed by SA, and the end of the page is what I am assuming to be the preceding data of those 4 bytes.

[fzabkar]

Since the flash is read as a serial bitstream, is it possible that the leading 4 bytes of a particular sector are actually the last 4 bytes of the previous sector? In other words, could you just rotate the entire dump by 4 bytes to the left?

[crackz0r]

Since the flash is read as a serial bitstream, is it possible that the leading 4 bytes of a particular sector are actually the last 4 bytes of the previous sector? In other words, could you just rotate the entire dump by 4 bytes to the left?

So I was never familiar with the Rotate function until now...but...yes! That literally accomplished exactly what I needed, so, thanks!

Learn something new every day!

[fzabkar]

Which command did you use to dump the flash?

There is a "Continuous Array Read (Legacy Command: E8h Opcode)" which might explain the 4-byte shift.

To perform a Continuous Array Read using the standard DataFlash page size (528 bytes), an opcode of E8h must be clocked into the device followed by three address bytes (which comprise the 22-bit page and byte address sequence) and four dummy bytes.

[crackz0r]

Which command did you use to dump the flash?

There is a "Continuous Array Read (Legacy Command: E8h Opcode)" which might explain the 4-byte shift.

To perform a Continuous Array Read using the standard DataFlash page size (528 bytes), an opcode of E8h must be clocked into the device followed by three address bytes (which comprise the 22-bit page and byte address sequence) and four dummy bytes.

I used FlashCat to dump the flash via SPI.

Turns out the "Rotate" function is NOT what I needed, but, my original method of manually shifting the ending 4 bytes to the beginning of each page proved successful for me to reconstruct the data.