Determine NAND Flash chip type and dump contents

Question

I have a USB stick with a NAND Flash chip that has only a few unhelpful markings on the chip. I desoldered the chip and I have a universal programmer, but I'm having trouble using it with my NAND Flash chip since I can't identify what make/model of chip I have.

Any suggestions on how to determine the NAND Flash chip type if there are not any helpful markings on the package? I don't have the USB BOM either...

I was thinking I might decap an exemplar chip and see if there are more helpful markings on the top layer of the silicon chip itself, but I'd prefer some kind of less invasive method.

Any suggestions or direction to external books/sites are very welcome.

Answer 1

If it's really a NAND flash chip conforming to ONFI standard and if you have an universal programmer, it should be possible to read its ID.

www.onfi.org/~/media/onfi/specs/onfi_2_1_gold.pdf — refer to section 5.5 "Read ID Definition"

Also, your programmer may prompt you to specify what kind of NAND chip you're trying to read in order to determine its pinout. Thing is, you could probably get usable results by selecting a NAND chip in the same package with the same (more or less) capacity. Pinout will likely be very similar or the same, ID will be different, but should at least be readable.

Answer 2

The site flashboot.ru collects various utilities for working with USB flash drives, including identification tools which can detect the vendor and device ID of the device, and in some cases even the exact flash chip:

http://flashboot.ru/files/vidpid/

Answer 3

Igor certainly knows six or seven orders of magnitude more on this subject than me, but it seems to me that if you're trying to get at the flash chip, not the USB controller, you probably won't get that from the VID/PID. I am probably wrong, bc Igor, and bc I'm unfamiliar with USB Flash Drive designs.

But if I'm right, and if it is an SPI chip, you can try to get the JEDEC manufacturer ID via a fairly standard SPI master command. You'll need to figure out the pinout to talk to it via SPI, but if you have any markings on the USB controller chip you might be able to figure out which pins can be used for SPI. Do a continuity test to the pads where you removed the chip and figure out which pins on your flash chip are which SPI pins. Wire it up and use something like the Adafruit FTDI 2232 breakout board or whatever you have on hand to try to run flashrom and ID the chip. I wish I could remember the exact command over SPI to get back the JEDEC ID, but here's the JEDEC ID spec http://www.softnology.biz/pdf/JEP106AR.pdf. Look at the flashrom code if you need to figure out the exact command that needs to be sent. Sorry, this is not the most helpful answer in the world, but maybe points in a direction you can go.

Answer 4

You should check this talk at BlackHat 2014 and this one from Bunnie & Xobs at 30CCC.

I could go about some details but it's so vast, it is meaningless to try to explain the details of reversing a chip here. Decapping can be helpful if you're willing to probe the IC using needles and an oscilloscope and reverse engineer a protocol or extract data; or use a microscope to take snapshots which you could compare to some already existing chips, ... Here's a very nice Hackaday talk with very interesting links and techniques.

I would recommend getting the data sheet of the chip first -if you can identify it- or check out the manufacturer on-line to see if there's any info about the end product in general that could lead to identifying the components or the manufacturer of the component; or if anybody tried to tinker with the same product or found that same chip in another product. Use the Chinese search engine, most of these chips are made in China and, for example, Baidu can return some helpful links and even documentation and tools. Bear in mind that sometimes unmarked chips are knock-offs of well known chips, you can check a known Flash manufacturer data sheets and compare the pin positions and even probe the pins using an oscilloscope to see if they match the data sheet description.

If you have any deeper technical questions about the output of a process/analysis I'll be able to help more. You need to workout a set of thorough steps before you dive into reversing a chip because it can get VERY confusing at times.

Helpful publication 1

Helpful publication 2

Helpful publication 3

Helpful publication 4

Check out these guys too : link, they have developed a whole hardware platform for hardware reversing. Its quite expensive (700€ ~ 680$) but very handy, especially the chip database.