Reverse engineer experts only - Page 1
Forum section: electronics / general

author: Jane
author_rank: Frequent Contributor
timestamp: June 20, 2013, 08:01:19 am
content: There are many flash memory chips in a solid state drive.Not sure if everyone knows what SSD is.( I did not know it untill recently either).So, solid state drive( SSD) is a disk with many flash memory chips and that SSD works in a similar way like a typical harddisk.I suspect one of that flash chip( or at least a part of it) works as SSD's BIOS. Is it possible to find out which flash chip it is?

author: senso
author_rank: Frequent Contributor
timestamp: June 20, 2013, 08:33:14 am
content: Possibly the main proprietary controller that speaks to all the flash chips and to the SATA interconnect.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: June 20, 2013, 08:38:57 am
content: Quote from: Jane on June 20, 2013, 08:01:19 amFirst thing would be to look at all the chip-selects and see which one goes active first on startup.

author: EEVblog
author_rank: Unknown
timestamp: June 20, 2013, 09:15:23 am
content: Is there an odd number of flash chips?If so, one is likely devoted to the BIOS.And if that's the case, then it probably stands outs in terms of layout, and maybe even bus (I don't know SSD drive architecture off-hand)

author: marshallh
author_rank: Unknown
timestamp: June 20, 2013, 09:39:38 am
content: A ssd is going to have a bunch of NAND flash roms on it. The controller will perform write leveling and fault recovery (bad blocks develop over time and must be worked around).So while you could have say an ARM binary blob scattered across a nand, it could be inside the SSD controller itself. May even be a mask rom.Look up any info on the ssd controller IC and any surrounding chips. Without manually dumping each flash separately and carefully looking for arm executables (there may be redundant copies) i don't know.

author: Jane
author_rank: Frequent Contributor
timestamp: June 20, 2013, 10:08:35 am
content: Thank you ALL for the replies. A problem is that SSD is not detected by BIOS but voltages ( when compared with the good SSD) seem to be correct. Also some chips were replaced( including the main chip(SSD controller) SandForce. Yes, SSD is made by OCZ. So I guess the only possibility is BIOS of that SSD.@marshallh: what do you mean by :May even be a mask rom? Do you mean the SSD controler should work as a BIOS too?

author: kripton2035
author_rank: Super Contributor
timestamp: June 20, 2013, 10:46:57 am
content: ocz ssd are known for their high failure controller chip rates...then using a ssd drive without a regular backup is in my mind like suicide ...then if you have time to loose to try to recover this then it's your own thing !good luck.

author: nctnico
author_rank: Super Contributor
timestamp: June 20, 2013, 10:55:02 am
content: The first step is to get a datasheet and/or user manual on the controller chip. This will show whether the controller chip has an internal flash or has its firmware in NAND. Due to the nature of an SSD I expect the controller chip to have an internal flash. AFAIK most hard drives and SSDs allow firmware updates performed by the user nowadays.

author: free_electron
author_rank: Super Contributor
timestamp: June 20, 2013, 11:05:54 am
content: The flash pool does not hold the firmware.The ssd controller has its own flash on board that has the firmware. That gets decompressed into the on-board ram and runs.Some ssd s have a partial bootloader in the co troller while the rest is stored in an external eeprom like a 25cxxx type. 8 pin spi device.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: June 20, 2013, 11:24:06 am
content: Quote from: free_electron on June 20, 2013, 11:05:54 amBut does it store other critical stuff like the bad-block info?

author: amyk
author_rank: Super Contributor
timestamp: June 20, 2013, 12:48:05 pm
content: That should be stored in the spare area, along with the ECC.

author: smashedProton
author_rank: Frequent Contributor
timestamp: June 20, 2013, 01:54:29 pm
content: I took one of these apart recently. Look data input and follow the traces to a smaller looking chip. That chip is probably made by 'sandforce', they're the industry standard with this sort of thing. It does a whole lot more than just the BIOS. It's duties include: memory refresh, error correction, housekeeping, and maybe tamper switches.

author: Jane
author_rank: Frequent Contributor
timestamp: June 20, 2013, 02:17:31 pm
content: @smashedProton: Data input from what?Do you have a picture of that smaller looking chip?Thanks

author: smashedProton
author_rank: Frequent Contributor
timestamp: June 20, 2013, 02:26:43 pm
content: I will take it apart and get you a picture later today when I have time. I meant the sata interface

author: andersm
author_rank: Super Contributor
timestamp: June 20, 2013, 03:30:52 pm
content: Just about any enthusiast site review will have PCB pictures. Maybe not high-resolution enough to make out all the component markings, but enough to give a good idea about the design. Ex:http://www.hardocp.com/article/2013/05/28/crucial_m500_480gb_ssd_review/3#.UcMfnOuk1X0http://www.tomshardware.com/reviews/vertex-450-256gb-review,3517.htmlhttp://www.storagereview.com/sandisk_extreme_ii_ssd_review

author: free_electron
author_rank: Super Contributor
timestamp: June 20, 2013, 05:20:47 pm
content: Quote from: mikeselectricstuff on June 20, 2013, 11:24:06 amBad blocks in flash work differently. The flash chip actually has more than 1024 meg. The built in address decoder translates. I can" t remeber the real numbers off the top of my head but for a 4 gb flash there are 32 extra pages ( 8 per die i believe. A 4gb used to be made from 4 dies).A failure in a page gets a remap done by the on chip decoder.This is done at factory to improve yield.A secondary error map is handled by the FTL (flash translation layer). That marks off bad 'sectors' just like a regular filesystem does. That info is stored in the BAT ( block aging table) So that info is indeed stored on flash.The BAT lies outside the user flash .If the ftl has wear leveling of itself the os does not know. If a page is bad we simply set its netry im the bat as 'nad'

author: marshallh
author_rank: Unknown
timestamp: June 20, 2013, 08:12:40 pm
content: On that HardOCP link there is very clearly a SPI NOR flash rom on the pcb under the controller chip. Labeled 25P16It's a ST Micro M25P16 16-megabit rom. Probably holds program code for whatever CPU is on the Marvell SoC (MIPSor ARM)

author: mariush
author_rank: Super Contributor
timestamp: June 20, 2013, 10:35:21 pm
content: The rom only contains the firmware.The controller often fails even when the flash memory chips are perfectly fine.Not only there's extra memory in each memory chip as free_electron says (to get better yields by recuperating chips with a few bad cells) but manufacturers also hide from user a portion of the storage space.. ex a 64 GB drive shows up as a 64.000.000.000 bytes just like regular/classic hard drives would, so that's about 61 GB usable disk space. Some controllers reserve even more space.This reserved space is used by the controller for various things... the controller has algorithms which spread out the writes to various memory cells to keep the writes even, because each memory page in a flash chip can only be written about 1000-3000 times depending on memory geometry... as it gets close to the maximum writes, the controller just maps the data to one of the reserved unused blocks and therefore user doesn't notice anything.A part is also used to spread writes when ssd is close to being fully used - imagine having 10-100 MB free space on ssd and user browses various pages and firefox/chrome/etc keeps caching files to disk in those 10-1000 MB. Those 10 megs would get written thousands of times within days. So the controller writes to the reserved space instead to keep the cell write count low.The reserved space is also used when the ssd tries to recover blocks of memory ... flash memory is arranged in pages of let's say 512 KB and blocks of 4 KB in those pages ... the controller can write a 4 KB block but can only erase a full page of 512 KB. So for performancee reasons, sometimes the controller works in background searching for pages with just a few 4 KB blocks used in a 512K page, copies them to reserved space and marks the 512 KB page as "can be deleted if needed and filled with 512 K of data"Anyway.. there's lots of things about ssd that are interesting.Anandtech did a bunch of articles that have loads of good information :The SSD Anthology: Understanding SSDs and New Drives from OCZhttp://www.anandtech.com/show/2738/5The SSD Relapse: Understanding and Choosing the Best SSDhttp://www.anandtech.com/show/2829

author: Stonent
author_rank: Super Contributor
timestamp: June 20, 2013, 11:11:13 pm
content: Quote from: marshallh on June 20, 2013, 08:12:40 pmOk that confirms my theory that they weren't going to waste dollars on another NAND flash for something that could be stored on sub 1 dollar SPI prom/eprom/eeprom

author: amyk
author_rank: Super Contributor
timestamp: June 21, 2013, 09:24:55 am
content: Quote from: mariush on June 20, 2013, 10:35:21 pmI remember being very happy when the first flash USB drives came out in power-of-2 sizes that actually had that usable capacity... 16MB would reallly be 16,777,216 bytes.

author: Jane
author_rank: Frequent Contributor
timestamp: June 21, 2013, 01:46:42 pm
content: Here is the mainboard of the SSD I was talking about. Can anyone show me where the BIOS is?Thank you

author: Stonent
author_rank: Super Contributor
timestamp: June 21, 2013, 10:54:41 pm
content: I can't read anything on the chips, the pictures aren't high enough resolution.

author: Jane
author_rank: Frequent Contributor
timestamp: June 22, 2013, 06:05:33 am
content: Here are better pictures. However we did not find any additional flash/eeprom chip with BIOS, except a possibility that the BIOS is in one of the Hynix flash chip.Thank you for help

author: marshallh
author_rank: Unknown
timestamp: June 22, 2013, 07:05:27 am
content: That controller is a mass market integrated solution so probably has ondie flash (mentions upgradable firmware). The manufacturer (now LSI) mentions that you can use an EEPROM for additional settings storage. It stores data on the nands encrypted with AES-128. The language was vague on whether it contained firmware on the nands themselves, but it is 100% guaranteed that housekeeping, bad block tables etc are stored in set aside space on the nands.Additiionally there are RS232 debug outputs on the chip! These may be broken out on the pcb. Stick a LA on them while powering up the drive, maybe you'll find some diag. messageshttp://www.lsi.com/downloads/Public/Flash%20Storage%20Processors/LSI_PB_SF-1000_RefEvalSSDs.pdf

author: free_electron
author_rank: Super Contributor
timestamp: June 22, 2013, 07:44:43 am
content: Most likely U3. It sits right on top of the jtag traces (to allow factory flashing). The jtag could do double duty.Remains the question : why do you need access to the firmware ? You cant modify that anyway. Nor do you have the equipment to flash it that way.All you could do is swap that chip from a known good drive.

author: Rasz
author_rank: Super Contributor
timestamp: June 22, 2013, 09:17:09 am
content: Quote from: Jane on June 20, 2013, 08:01:19 amYour suspicion is wrong.>SandForceoh, you bought cheap crappy SSD, bin it, buy Samsungas for the theory of SSD operation:Pictures you uploaded show physical damage to power chip U4, it is visibly crackedbtw RS232 is on J1

author: Jane
author_rank: Frequent Contributor
timestamp: June 22, 2013, 09:34:52 am
content: Thank you ALL for the replies.@Rasz:Why do you think BIOS is not a part of a NAND chip? Then, where is that BIOS?As you say: "Pictures you uploaded show physical damage to power chip U4, it is visibly cracked", I thought the same, so I swapped it with U4 from a working SSD. And that visibly cracked worked.I checked J1 but there are 4 holes.But I would expect only 3 holes( pins) that is TX,RX, GND. Do you know what is that 4th hole for? And do you know which hole is for Tx and Rx?Thank you for help

author: mariush
author_rank: Super Contributor
timestamp: June 22, 2013, 11:24:42 am
content: The controller has embedded flash, just like microcontrollers have flash inside. The "bios" is written there, there's firmware which loads up withsome minimal settings and then reads all it needs to know from the memory chips, from some space reserved from the start..

author: Jane
author_rank: Frequent Contributor
timestamp: June 22, 2013, 11:35:59 am
content: @mariush: The problem is that we swapped the controller(SandForce) from a good SSD and still the saem ; the SSD is not detected by BIOS on PC. So, not sure, that the BIOS of SSD is really in that controller

author: Rasz
author_rank: Super Contributor
timestamp: June 22, 2013, 11:41:15 am
content: pinouts:http://images.anandtech.com/reviews/storage/OCZ/Agility3/_DSC6566.jpgThere is no bios, there is firmware (most likely on U3 SPI flash)Problem with SSDs is they rely too much on NAND content, and often die when there is bad data in NAND (not bad nand, just unexpected data). Sandforce is the leader in shitty firmwares and unreliability.

author: Jane
author_rank: Frequent Contributor
timestamp: June 22, 2013, 12:04:35 pm
content: @Rasz: Thank you for the pinouts.Do you think that if I change U3( BIOS of SSD), then BIOS on PC must find that SSD?And if you have a look at the picture of my SSD, do you think U3 is also BIOS of my SSD?What chip is used on that SSD, the picture you posted?( I did not find that U3 there. It is probably from the other side).Thanks.

author: Rasz
author_rank: Super Contributor
timestamp: June 22, 2013, 12:38:16 pm
content: ?U3, the same one free_electron pointed out

author: Jane
author_rank: Frequent Contributor
timestamp: June 24, 2013, 06:55:37 am
content: Thank you for the reply.But I am not sure if U3 is really BIOS of SSD.Please see a pictureHere I wrote the details from the U3 again: ATH11 2ECL 0J6883ADo you know what voltage should be on Vcc pin of J1? I measured only about 2.8VThank you

author: Rasz
author_rank: Super Contributor
timestamp: June 24, 2013, 08:54:28 am
content: https://www.google.pl/search?q=spi+flash+pinoutSandforce chip is 2.8V so everything will be 2.8v CMOS logic

author: amyk
author_rank: Super Contributor
timestamp: June 24, 2013, 12:05:03 pm
content: Thats aAT24C256C.

author: Rasz
author_rank: Super Contributor
timestamp: June 24, 2013, 01:11:48 pm
content: Quote from: amyk on June 24, 2013, 12:05:03 pmyou are righthttp://www.newark.com/atmel/at24c256c-xhl-t/dp/68T4117not spi then, and not firmware :/

author: Jane
author_rank: Frequent Contributor
timestamp: June 24, 2013, 01:37:53 pm
content: Thank you for the replies.So I swapped U3. (I used U3 from the same SSD model but working SSD.) Yet, no progress.BIOS of PC can not detect that SSD.Also main chips ( SandForce) were also swapped. Still the same.So one of my last hopes could be RS232 debug outputs on J1.But Sandforce chip is 2.8V and valid signals in RS-232 are ±3 to – ±15V. Also Vcc on J1 is about 2.8V ONLY.Does it mean I can NOT use PC com port?But can I use UART port?Thank you for the reply

author: mariush
author_rank: Super Contributor
timestamp: June 24, 2013, 02:04:20 pm
content: You can get a MAX232 chip which converts the low voltage signals to standard rs-232 :http://www.ti.com/lit/ds/symlink/max232.pdfOr have a look at some of the usb to serial chips, some of not most of them accept low voltage serial input.

author: Jane
author_rank: Frequent Contributor
timestamp: June 24, 2013, 02:43:31 pm
content: So, finally I solved the voltage level but there is not any output on that J1 when PC starts( detecting SSD. I checked on the working SSD). Can anyone test /confirm that on his SSD model?Thank you

author: Rasz
author_rank: Super Contributor
timestamp: June 24, 2013, 04:05:28 pm
content: This might be just a debug port (enabled only after giving a password first, or with special firmware).If you need the data there is always drivesavers, if you want to fix it and are very stubborn you can try the other way around, move chips to the working pcb, but from what I read Sandforce is doing live AES on writes so its entirely possible that every controller chip has unique key for its set of flash chips.

author: Jane
author_rank: Frequent Contributor
timestamp: June 24, 2013, 05:50:32 pm
content: @Rasz: Thank you for your reply.I was also thinking about moving chips( HYNIX) to that working SSD but there is a high rate of my fault when soldering chips.Fixing the drive( saving data from that SSD) is the next step. As the first step I would need PC BIOS to identify that SSD is being connected. But still no success. PC BIOS still can not see that SSD. Do you have any further idea what I should try? Thanks

author: Rasz
author_rank: Super Contributor
timestamp: June 25, 2013, 08:35:59 am
content: well, first step would be identifying what was brokenMost often cause of SSD death are power supply problems on ssd pcn - bad caps, shorts, broken pcb tracks, fuses. Then you have dead chips and invalid data.Amateur can only count on fixing the power ones, recovery house can manage dead main controller chip (but even one nand dead = no data) and they are able to fix logical errors (if they have enough support from SSD vendors).

author: amyk
author_rank: Super Contributor
timestamp: June 25, 2013, 11:14:43 am
content: Quote from: Rasz on June 24, 2013, 04:05:28 pmOr maybe the key is in that EEPROM... can you read it and take a look? Firmware will have repeating patterns, maybe even text strings, but encryption keys look like random data. (But then again, so will compressed/encrypted firmware...)

author: Jane
author_rank: Frequent Contributor
timestamp: June 26, 2013, 03:33:55 pm
content: But that EEPROM was also changed