All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 25 posts ]  Go to page 1, 2  Next
Author Message
 Post subject: nice article on NAND Flash RE/hacking
PostPosted: December 23rd, 2014, 3:44 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3886
Location: Adelaide, Australia
Here is an article I found while looking for something else entirely. I like the explanation of using the FTDI chip for reading NAND.

http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Reverse-Engineering-NAND-Flash-Memory-POS-device-case-study-part/ba-p/6581528#.VJkbAZDAA


Top
 Profile  
 
 Post subject: Re: nice article on NAND Flash RE/hacking
PostPosted: December 31st, 2014, 4:29 
Offline

Joined: August 13th, 2014, 18:59
Posts: 27
Location: France
I made the hardware of this nand reader a few month ago, but no idea how to get software. Image


Top
 Profile  
 
 Post subject: Re: nice article on NAND Flash RE/hacking
PostPosted: December 31st, 2014, 7:09 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3886
Location: Adelaide, Australia
about 3/4 down the page

Quote:
DumpFlash – enhanced Flash reader/writer software

You need software to achieve bit-banging and for this there is a NANDTool open source project maintained by Bjoern Kerlers. I ported the entire C++ code to a Python project and created the DumpFlash project. I also added support for NAND Flash programming. Here are the highlights:

Read/Write support


Top
 Profile  
 
 Post subject: Re: nice article on NAND Flash RE/hacking
PostPosted: December 31st, 2014, 7:42 
Offline
User avatar

Joined: July 12th, 2010, 4:38
Posts: 1444
Location: Portugal
Nice article, but one question:
With this software he provides, we can recover the data of a flash drive for instance??
Any tests on this one?

_________________
http://www.pclab.com.pt facebook.com/PCLAB.A.T
ACELab partner


Top
 Profile  
 
 Post subject: Re: nice article on NAND Flash RE/hacking
PostPosted: December 31st, 2014, 10:12 
Offline

Joined: August 13th, 2014, 18:59
Posts: 27
Location: France
HaQue wrote:
about 3/4 down the page

I think there is no compiled program, and I have absolutely no idea what I should do with all these weird files. And he speaks about a Windows 7 machine, but I felt that it was a linux software. :?:


Top
 Profile  
 
 Post subject: Re: nice article on NAND Flash RE/hacking
PostPosted: December 31st, 2014, 11:37 
Offline
User avatar

Joined: May 3rd, 2011, 9:52
Posts: 177
Location: France
AesEbu wrote:
HaQue wrote:
about 3/4 down the page
And he speaks about a Windows 7 machine, but I felt that it was a linux software. :?:

If this is python it should work on linux and windows...
But IMHO, if you don't know what to do with "all these weird files", you shouldn't do it...

_________________
Lemmy


Top
 Profile  
 
 Post subject: Re: nice article on NAND Flash RE/hacking
PostPosted: December 31st, 2014, 12:06 
Offline
User avatar

Joined: February 9th, 2009, 16:13
Posts: 2541
Location: Ontario, Canada
If only flash recovery were as simple as getting a dump of the NAND chips.

_________________
Luke
Recovery Force Data Recovery


Top
 Profile  
 
 Post subject: Re: nice article on NAND Flash RE/hacking
PostPosted: December 31st, 2014, 12:36 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3886
Location: Adelaide, Australia
As Luke says, often getting the dump of the NAND is the easy part. You then have to deal with Wear levelling algorithms(many, many), XORed DATA in a variety of ways, encryption, different controller operations such as updates, etc etc.

and as ici_lemmy says, the files at https://github.com/ohjeongwook/DumpFlash are python scripts. You would need to go to the python webpage and download a windows install for python, after that these files should "run" from a command prompt.

also do this:
Quote:
Download the DumpFlash code first. You should also install prerequisite packages like pyftdi and libusbx. With everything set up, you can query basic Flash information using the –i option. (Figure 15)


then as seen in the part "DumpFlash – enhanced Flash reader/writer software", if you look at the screenshot you can see what he typed in to get the output.

IMHO, it is worth continuing with what you started as learning how to run python scripts opens another chapter for your computing and hacking around.

I often use it for manipulating files, wordlists and general things I need more than a batch file for.


Basically create a folder such as d:\nand_stuff and put all the files in. then in a command windows, type


Top
 Profile  
 
 Post subject: Re: nice article on NAND Flash RE/hacking
PostPosted: January 1st, 2015, 15:13 
Offline

Joined: August 13th, 2014, 18:59
Posts: 27
Location: France
Ok, thank you for your answer. In fact, I just want to recover an old ide ssd drive with only one nand chip (1GB). I already have the hardware for the nand reader, so why not try? If I can't do anything, I will buy another ssd drive, with unknown software already installed.

Image


Top
 Profile  
 
 Post subject: Re: nice article on NAND Flash RE/hacking
PostPosted: January 1st, 2015, 19:41 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3886
Location: Adelaide, Australia
Quote:
Ok, thank you for your answer. In fact, I just want to recover an old ide ssd drive with only one nand chip (1GB). I already have the hardware for the nand reader, so why not try? If I can't do anything, I will buy another ssd drive, with unknown software already installed.


That's interesting, and old IDE SSD... Exactly, why not try? If you have time for a bit of playing, how about show the model/type and some pics of the SSD drive? Is the SSD for some type of embedded system?
Maybe we can walk you through the process and help you recover it. I think you could dump this with not much more effort than what you have already done.

Quote:
If I can't do anything, I will buy another ssd drive, with unknown software already installed.

I am confused about this bit, can you elaborate on the unknown software bit.. why would it be unknown?

Start by installing python package that suits your system from https://www.python.org/ then the prerequisites of http://libusbx.org/ and https://github.com/eblot/pyftdi.
try and figure out how to install the packages on your own because this process really helps to get you familiar with how all this works. If you have trouble, post your issues, as these types of things are tricky sometimes for a variety of reason.. even for people that do this type of thing all the time. But often it is surprisingly easy.

after you have dumped the chip, a look in a hex editor will help to see what comes next.

What files/filesystem or filetypes are you expecting? is it a system or individual files you need off it?

good luck!


Top
 Profile  
 
 Post subject: Re: nice article on NAND Flash RE/hacking
PostPosted: January 2nd, 2015, 8:19 
Offline

Joined: November 29th, 2006, 10:08
Posts: 7858
Location: UK
As far as I know, some of the knock-off Chinese PC3K PCI software came on a little IDE "Flash HDD" or something like that, maybe that's it? :-)

_________________
PC Image Data Recovery
http://www.pcimage.co.uk

New!! HDD-PCB.COM for all your PCB and donor HDD requirements!


Top
 Profile  
 
 Post subject: Re: nice article on NAND Flash RE/hacking
PostPosted: January 2nd, 2015, 13:59 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 3522
Location: CDRLabs @ Chandigarh [ India ]
pcimage wrote:
As far as I know, some of the knock-off Chinese PC3K PCI software came on a little IDE "Flash HDD" or something like that, maybe that's it? :-)


No What Was Long Ago ,
They Had a 40GB HDD Version And Once Those HDD's Were Hard To Find They Also Had it Working With higher capacity once .Anyway i am thinking whats the use of this project .Is he sure after taking the dump he can extract data .Might be might be not .And for Nand Reading Anyone can use a higher end programmer or the nand reader from many companies like softcenter ,etc etc .

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com


Top
 Profile  
 
 Post subject: Re: nice article on NAND Flash RE/hacking
PostPosted: January 5th, 2015, 19:02 
Offline

Joined: August 13th, 2014, 18:59
Posts: 27
Location: France
HaQue wrote:
Is the SSD for some type of embedded system?

You're right, that's a video monitor.

Image

There is a label on the pc motherboard, where it says "Windows XP Embedded". The mystery is lifted.

ImageImage

I had the same problem there is a year or two, I bought a new ssd, and the monitor has booted normally. I thought it was the same thing this time, but I just saw a lot of bad capacitors on the motherboard. It's certainly the real problem. :oops:


Top
 Profile  
 
 Post subject: Re: nice article on NAND Flash RE/hacking
PostPosted: January 5th, 2015, 22:18 
Offline

Joined: December 8th, 2010, 11:37
Posts: 738
Location: Ottawa, Canada
AesEbu wrote:
I had the same problem there is a year or two, I bought a new ssd, and the monitor has booted normally. I thought it was the same thing this time, but I just saw a lot of bad capacitors on the motherboard. It's certainly the real problem. :oops:
Are you referring to bad caps on the motherboard pictured in your post? I don't see any. Did you test them with an ESR meter or something, are you referring to another MB, or am I going blind?

_________________
Sabo Computer Repairs & Data Recovery


Top
 Profile  
 
 Post subject: Re: nice article on NAND Flash RE/hacking
PostPosted: January 5th, 2015, 23:04 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3886
Location: Adelaide, Australia
I don't either but I suspect the ones in red circle first and blue possibly second choice. I would have thought the blue circled ones would go first though
Attachment:
439548moninsideCircled.jpg
439548moninsideCircled.jpg [ 852.84 KiB | Viewed 19438 times ]


Top
 Profile  
 
 Post subject: Re: nice article on NAND Flash RE/hacking
PostPosted: January 5th, 2015, 23:44 
Offline

Joined: December 8th, 2010, 11:37
Posts: 738
Location: Ottawa, Canada
They look okay to me, although it's hard to see the ones in the corner clearly. Because they appear to be the same size as healthy others on the board, I suspect they are fine. The ones in the blue circle look fine, too. That white stuff is just the gunk they put on them to keep them from vibrating, I believe. (I used to see a lot of that in CRT monitors and sure wish I knew of a source. It's terrific stuff!)

_________________
Sabo Computer Repairs & Data Recovery


Top
 Profile  
 
 Post subject: Re: nice article on NAND Flash RE/hacking
PostPosted: January 6th, 2015, 5:08 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 16412
Location: Australia
AesEbu wrote:
I had the same problem there is a year or two, I bought a new ssd, and the monitor has booted normally. I thought it was the same thing this time, but I just saw a lot of bad capacitors on the motherboard.

Did you try to access the SSD via an IDE motherboard in a regular PC?

Did you measure the voltage outputs of the PSU at the LHS?

As for the capacitors, I would take LarrySabo's advice and test them in-circuit with an ESR meter.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: nice article on NAND Flash RE/hacking
PostPosted: January 7th, 2015, 15:14 
Offline

Joined: August 13th, 2014, 18:59
Posts: 27
Location: France
I made an adapter for my ide/sata to usb converter, and the ssd is fine, I can see files and directories.

Image

So I have to change the bad caps and see what happens.

Image


Top
 Profile  
 
 Post subject: Re: nice article on NAND Flash RE/hacking
PostPosted: January 7th, 2015, 15:44 
Offline

Joined: December 8th, 2010, 11:37
Posts: 738
Location: Ottawa, Canada
They are clearly bad. I hope new ones help clear things up.

_________________
Sabo Computer Repairs & Data Recovery


Top
 Profile  
 
 Post subject: Re: nice article on NAND Flash RE/hacking
PostPosted: January 8th, 2015, 2:31 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3886
Location: Adelaide, Australia
Great, I think you are well on the way to a working system again :)


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 25 posts ]  Go to page 1, 2  Next

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 16 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group