MultiDrive – free backup, clone & wipe disk utility from Atola Technology

Main » Forums home » Flash storage, SSD

All times are UTC - 5 hours [ DST ]



Post new topic Reply to topic  Page 1 of 1
  [ 17 posts ] 
  Print view Previous topic | Next topic 
Author Message
techchimp
 Post subject: Skymedi 6221 Xor key?
PostPosted: July 22nd, 2026, 17:24 
Offline

Joined: July 20th, 2026, 18:52
Posts: 8
Location: Uinted States
Hello everyone,

I'm hoping someone has a key for me to try to descramble a Hynix NAND dump. The chip is from an old SD card (Kingston 1gb).
I was recently archiving off all of my storage devices and this was the only card that failed.

I can carve jpg data from the dump, but it isn't correct.

This is mostly for curiosity (and education). I'm not using any recovery software, just writing my own python scripts.

Any assistance is greatly appreciated.
Top
 Profile  
 
fzabkar
 Post subject: Re: Skymedi 6221 Xor key?
PostPosted: July 22nd, 2026, 20:41 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 17217
Location: Australia
techchimp wrote:
I'm hoping someone has a key for me to try to descramble a Hynix NAND dump.

I can carve jpg data from the dump, but it isn't correct.

If it's scrambled, how can you tell that you have a JPEG? :-?

_________________
A backup a day keeps DR away.
Top
 Profile  
 
arvika
 Post subject: Re: Skymedi 6221 Xor key?
PostPosted: July 23rd, 2026, 0:26 
Offline

Joined: October 24th, 2009, 15:22
Posts: 922
Location: Poland
SK6221 or SK6621? First one usualy it is used at pendrives, second at SD cards and it not use XOR.

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices
Top
 Profile  
 
techchimp
 Post subject: Re: Skymedi 6221 Xor key?
PostPosted: July 23rd, 2026, 11:20 
Offline

Joined: July 20th, 2026, 18:52
Posts: 8
Location: Uinted States
fzabkar wrote:
techchimp wrote:
I'm hoping someone has a key for me to try to descramble a Hynix NAND dump.

I can carve jpg data from the dump, but it isn't correct.

If it's scrambled, how can you tell that you have a JPEG? :-?


I'm getting jpg signatures. But they can't be decoded in any viewer.
Top
 Profile  
 
techchimp
 Post subject: Re: Skymedi 6221 Xor key?
PostPosted: July 23rd, 2026, 11:24 
Offline

Joined: July 20th, 2026, 18:52
Posts: 8
Location: Uinted States
arvika wrote:
SK6221 or SK6621? First one usualy it is used at pendrives, second at SD cards and it not use XOR.


Sorry, it's SK6621 AARC A0727

If that's true, then I'll keep trying to get a logical block image.

Thank you :)
Top
 Profile  
 
arvika
 Post subject: Re: Skymedi 6221 Xor key?
PostPosted: July 23rd, 2026, 11:29 
Offline

Joined: October 24th, 2009, 15:22
Posts: 922
Location: Poland
This controller usualy use block pair. Of course you need also think about ECC correction.

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices
Top
 Profile  
 
fzabkar
 Post subject: Re: Skymedi 6221 Xor key?
PostPosted: July 23rd, 2026, 16:53 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 17217
Location: Australia
@techchimp, can you dump the spare areas and upload them? I would be interested in examining the structure. I think you would need this info in order to build a translator.

_________________
A backup a day keeps DR away.
Top
 Profile  
 
techchimp
 Post subject: Re: Skymedi 6221 Xor key?
PostPosted: July 23rd, 2026, 17:36 
Offline

Joined: July 20th, 2026, 18:52
Posts: 8
Location: Uinted States
fzabkar wrote:
@techchimp, can you dump the spare areas and upload them? I would be interested in examining the structure. I think you would need this info in order to build a translator.

I can when I get home.
Top
 Profile  
 
techchimp
 Post subject: Re: Skymedi 6221 Xor key?
PostPosted: July 24th, 2026, 12:38 
Offline

Joined: July 20th, 2026, 18:52
Posts: 8
Location: Uinted States
techchimp wrote:
fzabkar wrote:
@techchimp, can you dump the spare areas and upload them? I would be interested in examining the structure. I think you would need this info in order to build a translator.

I can when I get home.

I tried to upload but it stalled. Is there a file size limit for attachments? It's about 64mb.
Top
 Profile  
 
fzabkar
 Post subject: Re: Skymedi 6221 Xor key?
PostPosted: July 24th, 2026, 12:42 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 17217
Location: Australia
Can you ZIP it?

_________________
A backup a day keeps DR away.
Top
 Profile  
 
techchimp
 Post subject: Re: Skymedi 6221 Xor key?
PostPosted: July 24th, 2026, 16:21 
Offline

Joined: July 20th, 2026, 18:52
Posts: 8
Location: Uinted States
https://drive.google.com/file/d/1X-BgOb ... p=drivesdk
Top
 Profile  
 
techchimp
 Post subject: Re: Skymedi 6221 Xor key?
PostPosted: July 24th, 2026, 16:23 
Offline

Joined: July 20th, 2026, 18:52
Posts: 8
Location: Uinted States
fzabkar wrote:
Can you ZIP it?
I posted a google drive link that's waiting for moderation approval.
Top
 Profile  
 
fzabkar
 Post subject: Re: Skymedi 6221 Xor key?
PostPosted: July 24th, 2026, 23:06 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 17217
Location: Australia
Your file is twice as big as it should be.


Attachments:
spare_area_half.7z [1.22 MiB]
Downloaded 130 times

_________________
A backup a day keeps DR away.
Top
 Profile  
 
fzabkar
 Post subject: Re: Skymedi 6221 Xor key?
PostPosted: July 25th, 2026, 9:55 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 17217
Location: Australia
I have extracted the non-empty spare area records.

Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

001AEBF0  D7 8D 9C E9 D6 D7 2E EF 11 7D 6F 90 2D FF B0 16
001AEC00  B9 55 D0 28 1F 70 2D E2 98 C5 6F 90 2D FF B0 16
001AEC10  76 01 76 6F 30 CF D2 A6 AE FC 6F 90 2D FF B0 16
001AEC20  CC BE 84 9A E5 BC 64 05 4B 5E 6F 90 2D FF B0 16

001AEC30  F7 43 BD FE 4B 19 00 C5 48 83 6F 90 2E FF F9 02
001AEC40  E6 13 FF AB A2 A8 D1 28 5A BA 6F 90 2E FF F9 02
001AEC50  0E D5 73 B1 AB FA 75 A0 4A 53 6F 90 2E FF F9 02
001AEC60  05 B6 1B 58 5A 8C EB 4F 82 AF 6F 90 2E FF F9 02

001AEC70  B6 19 73 F3 1F E4 C0 99 95 55 6F 90 2F FF 2E EF
001AEC80  9C EA 9C 99 C6 59 67 8B 51 AC 6F 90 2F FF 2E EF
001AEC90  F7 49 0D D1 0F ED F7 13 84 73 6F 90 2F FF 2E EF
001AECA0  57 6B 61 BA 94 ED 4C 17 D3 2A 6F 90 2F FF 2E EF
........
001C6A30  FF FF FF FF FF FF FF FF FF FF 7A 80 71 FF 1E 8A
001C6A40  FF FF FF FF FF FF FF FF FF FF 7A 80 71 FF 1E 8A
001C6A50  FF FF FF FF FF FF FF FF FF FF 7A 80 71 FF 1E 8A
001C6A60  FF FF FF FF FF FF FF FF FF FF 7A 80 71 FF 1E 8A

001C6A70  FF FF FF FF FF FF FF FF FF FF 7A 80 72 FF 57 9E
001C6A80  FF FF FF FF FF FF FF FF FF FF 7A 80 72 FF 57 9E
001C6A90  FF FF FF FF FF FF FF FF FF FF 7A 80 72 FF 57 9E
001C6AA0  FF FF FF FF FF FF FF FF FF FF 7A 80 72 FF 57 9E

001C6AB0  FF FF FF FF FF FF FF FF FF FF 7A 80 73 FF 80 73
001C6AC0  FF FF FF FF FF FF FF FF FF FF 7A 80 73 FF 80 73
001C6AD0  FF FF FF FF FF FF FF FF FF FF 7A 80 73 FF 80 73
001C6AE0  FF FF FF FF FF FF FF FF FF FF 7A 80 73 FF 80 73
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ######## ** %%%%%
            ECC bytes for data area     logical  |    |
                                        block?   |    |
                                                 |    |
                                           status?    |
                                                      |
                              ECC for previous 4 bytes?

I don't know what to make of this:

Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

001EEBB0  D3 44 3B A1 64 45 E0 53 40 84 B2 43 00 00 FB 1F
001EEBC0  FF FF FF FF FF FF FF FF FF FF B2 43 00 F5 66 8C
001EEBD0  FF FF FF FF FF FF FF FF FF FF B2 43 00 19 F7 DC
001EEBE0  FF FF FF FF FF FF FF FF FF FF B2 43 00 64 BB 7D

001EEBF0  D3 44 3B A1 64 45 E0 53 40 84 B2 43 00 00 FB 1F
001EEC00  FF FF FF FF FF FF FF FF FF FF B2 43 00 00 FB 1F
001EEC10  FF FF FF FF FF FF FF FF FF FF B2 43 00 19 F7 DC
001EEC20  FF FF FF FF FF FF FF FF FF FF B2 43 00 64 BB 7D

001EEC30  D3 44 3B A1 64 45 E0 53 40 84 B2 43 00 00 FB 1F
001EEC40  FF FF FF FF FF FF FF FF FF FF B2 43 00 00 FB 1F
001EEC50  FF FF FF FF FF FF FF FF FF FF B2 43 00 00 FB 1F
001EEC60  FF FF FF FF FF FF FF FF FF FF B2 43 00 64 BB 7D

001EEC70  D3 44 3B A1 64 45 E0 53 40 84 B2 43 00 00 FB 1F
001EEC80  FF FF FF FF FF FF FF FF FF FF B2 43 00 00 FB 1F
001EEC90  FF FF FF FF FF FF FF FF FF FF B2 43 00 00 FB 1F
001EECA0  FF FF FF FF FF FF FF FF FF FF B2 43 00 00 FB 1F

001EECB0  D3 44 3B A1 64 45 E0 53 40 84 B2 43 00 00 FB 1F
001EECC0  FF FF FF FF FF FF FF FF FF FF B2 43 00 00 FB 1F
001EECD0  FF FF FF FF FF FF FF FF FF FF B2 43 00 00 FB 1F
001EECE0  FF FF FF FF FF FF FF FF FF FF B2 43 00 00 FB 1F
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ######## ** %%%%%
            ECC bytes for data area     logical  |    |
                                        block?   |    |
                                                 |    |
                                           status?    |
                                                      |
                              ECC for previous 4 bytes?


Attachments:
spare_area_half_used.7z [1.22 MiB]
Downloaded 125 times

_________________
A backup a day keeps DR away.
Top
 Profile  
 
techchimp
 Post subject: Re: Skymedi 6221 Xor key?
PostPosted: July 25th, 2026, 12:00 
Offline

Joined: July 20th, 2026, 18:52
Posts: 8
Location: Uinted States
Yeah, the chip is 2gb even though the sd was 1gb hynix hy27UT088G2M
Top
 Profile  
 
pepe
 Post subject: Re: Skymedi 6221 Xor key?
PostPosted: July 25th, 2026, 12:23 
Offline

Joined: October 3rd, 2005, 0:40
Posts: 4808
Location: Hungary
or the address overflowed and you read it twice, coz the same SA occurs at middle of your dump. It might be of use, now you have 2 copies...
What tool did you use to read it?

_________________
Adatmentés - Data recovery
Top
 Profile  
 
fzabkar
 Post subject: Re: Skymedi 6221 Xor key?
PostPosted: July 25th, 2026, 16:57 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 17217
Location: Australia
https://www.datasheetq.com/contents-image1/Hynix/855860-DI1.png

HY27UT088G2M --- 8Gbit, MLC, block type = LB, block size = 256K + 8K, page size = 2K + 64, 3.3V

_________________
A backup a day keeps DR away.
Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  Page 1 of 1
  [ 17 posts ] 

Main » Forums home » Flash storage, SSD

All times are UTC - 5 hours [ DST ]

Who is online

Users browsing this forum: No registered users and 69 guests

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Switch to mobile style
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group