Strange Nand Image unpacking/extraction  - Page 1
Forum section: electronics / general

author: Franc
author_rank: Regular Contributor
timestamp: April 09, 2022, 10:13:18 pm
content: Hey all!!I got one challenge. I need to unpack this image from a NAND Dump that I extracted . It looks strange, I can see three images and one format different. 29F1G08A is the Nand Flash.Anyone has any idea what format is it? I think its FatFs. The OS is RTOS. I tried tools mkfatfs and FatFs R0.14b but no success.https://ln5.sync.com/dl/d0cd6bad0/dxx69ihg-kev5fbtk-5niurqf6-puwjbxadCheers!!

author: RoGeorge
author_rank: Super Contributor
timestamp: April 09, 2022, 11:12:24 pm
content: In a Linux terminal try commands likeCode:file MT29F1G08ABADA@TSOP48_1940_BestCode_01.04.07.04.BINstrings MT29F1G08ABADA@TSOP48_1940_BestCode_01.04.07.04.BIN | lesshexdump -C MT29F1G08ABADA@TSOP48_1940_BestCode_01.04.07.04.BIN | lessThefilecommand didn't see a file system ("MT29F1G08ABADA@TSOP48_1940_BestCode_01.04.07.04.BIN: big endian ispell hash file (?), and 26880 string characters"). It might help if you know the exact start address of the filesystem.At least it is not encrypted,stringsshows tons of plain text. There are some Windows style backslash, too, in the text output (e.g. "a:\bestCode\cij_fpga").

author: abyrvalg
author_rank: Frequent Contributor
timestamp: April 10, 2022, 11:13:50 am
content: There are two parts using different NAND page layouts. The first part (0-0x4200) uses 0x200+0x10 layout and contains a very small 1st stage loader (loaded by CPU’s BootROM I guess). The rest (from 0x4200) uses 0x800+0x40 layout and consists of several modules with headers of size 0x38:+0 dd magic “TGMI”+4 dd size - size of body excluding this header…not studied further yet

author: Franc
author_rank: Regular Contributor
timestamp: April 10, 2022, 11:56:50 am
content: thanks a lot RoGeorge /abyrvalg...I extracted 3 images from Dump.https://ln5.sync.com/dl/4c2e0d590/iy2buvj4-sp8z9n8c-fz9yhikn-xbztahqmI can see they are very similar, maybe three types of software for same device.All have similar starting with TGMI signature and there is one small starting boot before themI never worked before with RTOS but looks they are using one different storage method because this NAND is popular.Cheers!!!

author: abyrvalg
author_rank: Frequent Contributor
timestamp: April 10, 2022, 04:24:37 pm
content: Those 3 images are same actually. Single bit differences in some bytes are single bit correctable NAND errors (you've read the chip with a programmer I guess? so no ECC applied).What is your goal? Understand how it works? Patch something and write back? The dump seems to belong to some inkjet printer (Citronix?) Ink level/authentication bypass?

author: Franc
author_rank: Regular Contributor
timestamp: April 10, 2022, 04:53:27 pm
content: abyrvalg, yes, I want to understand how it works.I extracted the Image direct from Memory Map, it looks other image, I can see now Psid and HSLF magic positions.ECC, interesting!! Thanks for the idea!!

author: DavidAlfa
author_rank: Super Contributor
timestamp: April 10, 2022, 05:56:27 pm
content: Quote from: Franc on April 10, 2022, 11:56:50 amNand is just a storage medium, says nothing about how its contents are formatted, it's like paper, you can draw anything on it.You should tell a little more about the device it came from, it might not have any filesystem at all, just plain machine code.Why do you know it has RTOS?The ECC might be used or not, and if existing, the algorithm can be anything. Hopefully will be BCH or other known standard.Check:https://www.mickaelwalter.fr/dumping-a-slc-nand-flash-with-atmel-pmecc/https://github.com/SySS-Research/nand-dump-tools

author: abyrvalg
author_rank: Frequent Contributor
timestamp: April 10, 2022, 07:13:56 pm
content: That's internal RAM with parts of Loader image (present in your NAND dump, there are 6 "TGMI" images in total - DiagLoader, Loader, DiagApp and 3x 01.04.07.04 main app), partially modified by Loader code execution, partially empty (containing random power-on trash). The main app runs from 0x80000000 (external SDRAM I guess).

author: abyrvalg
author_rank: Frequent Contributor
timestamp: April 10, 2022, 11:47:52 pm
content: Main app image majority-decoded from 3 copies.

author: Franc
author_rank: Regular Contributor
timestamp: April 11, 2022, 10:53:15 am
content: Wow!! Awesome... thank so much