<story><title>Reverse Engineering a NAND Flash Device Management Algorithm</title><url>http://joshuawise.com/projects/ndfslave</url></story><parent_chain><item><author>jwise0</author><text>Ha, yes, good point :-) I didn&amp;#x27;t write about that, but I did take some pictures of failed attempts at that.&lt;p&gt;That&amp;#x27;s one of the first things I did, actually.  After dumping the contents of the flash off, I went on Amazon and hit &amp;#x27;reorder&amp;#x27; on the same SD card that I&amp;#x27;d bought before.  Unfortunately, it was not the same: in the picture [1], the left is the one I&amp;#x27;d purchased this time, and the right is the one I&amp;#x27;d destroyed.  The deals that low-cost SD card makers get on NAND flash vary greatly from day to day, so they just manufacture based on whatever controller and flash combination they can get cheapest on any given day: even the same SKU is unlikely to stay the same internally very long.&lt;p&gt;I did also try soldering to the BGA pads on the damaged one [2] [3], but no joy: I imagine that there were some traces that went backwards on the board before going towards the controller (for instance, to meet the TSOP leads), and on inserting the SD card into my laptop, I still had no signs of life.&lt;p&gt;[1] &lt;a href=&quot;http://joshuawise.com/photos/etc/sd-card/sd-fux-11.xscale.jpg&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;joshuawise.com&amp;#x2F;photos&amp;#x2F;etc&amp;#x2F;sd-card&amp;#x2F;sd-fux-11.xscale.jp...&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;http://joshuawise.com/photos/etc/sd-card/sd-fux-13.xscale.jpg&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;joshuawise.com&amp;#x2F;photos&amp;#x2F;etc&amp;#x2F;sd-card&amp;#x2F;sd-fux-13.xscale.jp...&lt;/a&gt;&lt;p&gt;[3] &lt;a href=&quot;http://joshuawise.com/photos/etc/sd-card/sd-fux-15.xscale.jpg&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;joshuawise.com&amp;#x2F;photos&amp;#x2F;etc&amp;#x2F;sd-card&amp;#x2F;sd-fux-15.xscale.jp...&lt;/a&gt;</text></item><item><author>Coko</author><text>I realize that this whole process was more than just data recovery (it&amp;#x27;s a very valuable learning experience too), but if it was &lt;i&gt;just&lt;/i&gt; about data recovery, couldn&amp;#x27;t he buy another SD card and re-solder the IC from the broken board to the new one?</text></item></parent_chain><comment><author>flashsd</author><text>5 minutes of googling == 6 months of reverse engineering :)&lt;p&gt;recovery tools for SM2683EN flash controller:
&lt;a href=&quot;http://www.usbdev.ru/files/smi/&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.usbdev.ru&amp;#x2F;files&amp;#x2F;smi&amp;#x2F;&lt;/a&gt;&lt;p&gt;xor formulas and block structure for Transcend card:
&lt;a href=&quot;http://flash-extractor.com/library/SM/EN2683/EN2683b%20BA__ec_de_d5_7a__2x2&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;flash-extractor.com&amp;#x2F;library&amp;#x2F;SM&amp;#x2F;EN2683&amp;#x2F;EN2683b%20BA__e...&lt;/a&gt;</text></comment>
<story><title>Reverse Engineering a NAND Flash Device Management Algorithm</title><url>http://joshuawise.com/projects/ndfslave</url></story><parent_chain><item><author>jwise0</author><text>Ha, yes, good point :-) I didn&amp;#x27;t write about that, but I did take some pictures of failed attempts at that.&lt;p&gt;That&amp;#x27;s one of the first things I did, actually.  After dumping the contents of the flash off, I went on Amazon and hit &amp;#x27;reorder&amp;#x27; on the same SD card that I&amp;#x27;d bought before.  Unfortunately, it was not the same: in the picture [1], the left is the one I&amp;#x27;d purchased this time, and the right is the one I&amp;#x27;d destroyed.  The deals that low-cost SD card makers get on NAND flash vary greatly from day to day, so they just manufacture based on whatever controller and flash combination they can get cheapest on any given day: even the same SKU is unlikely to stay the same internally very long.&lt;p&gt;I did also try soldering to the BGA pads on the damaged one [2] [3], but no joy: I imagine that there were some traces that went backwards on the board before going towards the controller (for instance, to meet the TSOP leads), and on inserting the SD card into my laptop, I still had no signs of life.&lt;p&gt;[1] &lt;a href=&quot;http://joshuawise.com/photos/etc/sd-card/sd-fux-11.xscale.jpg&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;joshuawise.com&amp;#x2F;photos&amp;#x2F;etc&amp;#x2F;sd-card&amp;#x2F;sd-fux-11.xscale.jp...&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;http://joshuawise.com/photos/etc/sd-card/sd-fux-13.xscale.jpg&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;joshuawise.com&amp;#x2F;photos&amp;#x2F;etc&amp;#x2F;sd-card&amp;#x2F;sd-fux-13.xscale.jp...&lt;/a&gt;&lt;p&gt;[3] &lt;a href=&quot;http://joshuawise.com/photos/etc/sd-card/sd-fux-15.xscale.jpg&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;joshuawise.com&amp;#x2F;photos&amp;#x2F;etc&amp;#x2F;sd-card&amp;#x2F;sd-fux-15.xscale.jp...&lt;/a&gt;</text></item><item><author>Coko</author><text>I realize that this whole process was more than just data recovery (it&amp;#x27;s a very valuable learning experience too), but if it was &lt;i&gt;just&lt;/i&gt; about data recovery, couldn&amp;#x27;t he buy another SD card and re-solder the IC from the broken board to the new one?</text></item></parent_chain><comment><author>tytytytyty</author><text>I&amp;#x27;m always humbled when I see other peoples soldering skills. goddamn. And I love reading this type of stuff, doing things just &amp;quot;because&amp;quot;. I found a rusty usb under a overpass a few months ago, after some cleaning&amp;#x2F;soldering&amp;#x2F;tricks I was finally able to read it and it turned out to be some kids schoolwork from 3 years ago haha&lt;p&gt;on a side I would suggest posting this over at hackaday, the marketers-pretending-to-be-hackers crowd here won&amp;#x27;t appreciate this.</text></comment>