Re-programming the 2Wire NAND flash IC

Californian hacker RyanC suggested another method for unlocking the 2Wires:  re-purposing a SmartMedia or xD-Picture card reader to program the NAND flash memory. [1]

The SmartMedia format uses the standard ONFI command set for reading and programming the NAND flash. The xD-Picture specs are slightly more involved, being a superset of ONFI.

Simple, so far?

2Wire, however, has its own flash translation layer (FTL) to hold the logical-to-physical block mapping.  This mapping data is stored in the out-of-band (OOB) area of the NAND page.  Unfortunately, the average flash card reader cannot program arbitrary data to the OOB area, so can’t be used to reprogram a 2Wire flash.  All is not lost though..

Aside the professional NAND programmers costing $2000 or more, there is one consumer-grade NAND controller IC which offers raw read and write access to all areas of the flash device. The IC, codenamed the Alauda, is something of a mystery. No one is even sure who developed it, but it was probably on behalf of Fuji and/or Olympus.

The Alauda IC has a USB peripheral controller to interface very simply with the PC. This allows easy transfer of control messages and page data to the raw NAND device.  And it doesn’t matter if the NAND chip is embedded in a camera card, or in a TSOP48 surface mount package, as in the case of the 2Wire.

It was perhaps BrendanU who first publicly documented the capabilities of Alauda-based card readers. [2] An open source kernel driver was then developed for the Alauda by legendary Linux hacker Daniel Drake.[3]   Cory1492, a well-known XBox and PSP hacker, ported Daniel’s code, and built it against the userspace USB library, libusb. [4]   Cory’s efforts have made the tool available for most Unix platforms and even for Microsoft Windows.

Alauda NAND flash controller harnessed to TSOP48 cradle
256Mbit NAND from 2Wire board loose beneath
(click to enlarge)

The Alauda NAND controller IC
(click to enlarge)

The plan to exploit this hack and hardware was described earlier.  Briefly:

  • Gently lift the NAND flash IC off the PCB with a hot-air gun;
  • Dump contents with a NAND reader. For reasons above, the Alauda IC is ideal;
  • Rewrite “initd” XML table to re-enable secure shell daemon. See: http://pastebin.com/ss8sqMdu
  • Rewrite “user” XML table with new root password. See: http://pastebin.com/gucCEM3H
  • Update ECC in OOB areas of all modified pages. See: http://hack..error-correcting-code-ecc/
  • Re-program the modified NAND pages;
  • Re-install NAND IC on the 2Wire PCB;
  • Fingers crossed and boot!

Userspace tool for Alauda NAND reader by Cory1492

UPDATE:

This method was just trialled several times. While the NAND reading and writing works fine, the 2Wire board still won’t boot with our modified firmware image. The device just hangs with a solid red LED.

The search for that elusive 2Wire hack continues!

As for the NAND hack in general, it could be very useful in a range of other applications. Whether for unlocking routers, digital TV set-top boxes, or for reflashing PC BIOS chips, etc.

EDIT:

There are some more notes in the comments below. In the dueness of time, it can be properly documented and referenced.  The beauty of this NAND reader is that it costs scarcely $10 to make.

[1] https://plus.google.com/102161594653790479451/posts
[2] http://www.uchobby.com/index.php/2007/05/05/read-embedded-flash-chips/
[3] http://www.reactivated.net/weblog/
[4] http://www.xboxhacker.org/index.php?action=profile;u=15891 DEAD LINK
Mirrored at http://docs.google.com/folder/d/0B6wW18mYskvBOWE2OGQ5NzAtZjc4ZS00MjNkLWE5ODAtMjZkMjYwZTZkMmVj/edit

About these ads

42 thoughts on “Re-programming the 2Wire NAND flash IC

  1. Hi, do you have a pin layout for this please? I cant find a good reliable reference to use, I just need to know which pins on the xd-reader go to which pins on the tsop48 cradle. I have found various images but all seem to contradict each other, and the 1 I tried didnt work – found somewhere on the internet. Please can you tell me the configuration of this particular mod please?

    Thanks

    • Dear Aaron,

      Thanks for your message. Are you sure you want the xD-Picture card reader? It’s just that the xD-Picture flash device has additional commands that have to be used, over and above the standard ONFI NAND command set.

      Whether that should matter depends on the card reader itself. It’s irrelevant for the two Alauda-based devices – the Olympus MAUSB-10 and the Fujifilm DPC-R1. The Alauda controller handles the lower hardware driver layer and Cory’s userspace code can simply fire off the USB resource blocks to read and write the NAND page or NAND block requested.

      As for the pinouts for the xD-Pic and the SmartMedia cards, imvho, it’s best to stick with those published in the official specs. Third party pinouts seemed correct, but some were reversed, iyswim. So pin 20 was shown as pin 1, 19 as 2, etc. Presumably because they were counting the pins on the reader whereas in the specs they count on the card itself. A real cause for confusion! Both the SM and the XD specs are knocking about the internet. If you get stuck, please drop me an email.

      Regarding the NAND “clips”: not sure what the proper name is but they’re as little as CNY50 (£5) on Taobao:

      See: http://item.taobao.com/item.htm?id=14657923902
      See: http://item.taobao.com/item.htm?id=8233481399

      There seem to be two main types of NAND clip or socket. Both convert the TSOP48 pinout to a set of 2.54mm pitch header pins or sockets. One NAND socket, the green one in the links above, has two header pin rows separated by a ~15mm gap. It is a bit more cumbersome but would be slightly easier to fit than the type I used. That second socket type designed for the half-functional… TL866 IC reader, is red in the photograph above. It has two pairs of two rows of pins immediately adjacent to each other. This format makes it inconvenient for veroboard.

      cheers, a

      • Hi,

        Thanks for your reply and time. I have been reading about making a nand reader for a while but my knowledge is still fairly limited on the subject. You say the xD-Picture flash device has additional commands that have to be used, over and above the standard ONFI NAND command set but I dont really know what ONFI is – I googled it and found there website but I’m not sure what i’m looking at to be honest. What I’d like to be able to do Is read NAND chips from flash drives etc, and also from devices with nand chips which contain firmware for the device which I can read/write to. I have the olympus MAUSB-10 and a NAND chip holder which I found on ebay using the search term ‘NAND Programmer’, but before I use these components I wanted to do a test prototype using cheaper components – in mycase a ceahp xd card reader which cost me 99p and a TSOP-48 to DIP-48 pcb which i got for £2. I know this card reader doesnt support raw read/write if thats the correct way to say it but I just want to get the configuration correct at this point, even if I can just use it to read a NAND chip from a flash drive to see it working. After googling around a bit more I found this http://www.omnimaga.org/index.php?topic=7077.msg168078#msg168078 but im not sure if its what I want. – Where would I get the ‘Official Specs’.

        Thanks for your time.

        Aaron

  2. Hi again,

    Perhaps it’s easier to link to a 13MB ZIP containing all the relevant docs that are here:

    https://docs.google.com/open?id=0B6wW18mYskvBcTdvc1Z6eHh3LVU

    The pinouts should all be in there.

    Maybe we are looking at different devices on ebay, because that search is finding a serial (SPI) NAND programmer. Hmm.. Nice and cheap though :-P

    http://www.ebay.co.uk/itm/330641018724

    Which NAND controller is on your 99p xD/SM card programmer? Is it like the one below, with a Genesys Logic GL827 controller? IIRC, there were a few ideas posted to kitz.co.uk about that IC. Didn’t we already chat about this on kitz.co.uk?

    GL827-based card reader repurposed for raw NAND

    The GL827 reader like the one above is physically only an xD-Picture card reader: it only has (or had) an xD slot. Although the GL827 IC also supports SmartMedia, configured in hardware by pulling up and down certain pins. So that means modding the PCB of the reader:


    Genesys Logic GL827

    Here’s a tip that might be helpful: the ‘finger’ pitch of the xD card is 1.0mm. The same pitch is used on PCI and AGP cards. (But not the same pitch as PCIe which is finer.)

    So the 1.0mm pitch ribbon cable used by a PCI slot extender can be re-purposed very cheaply for this. And with a hot air solder gun, the re-purposed raw NAND reader is easy to build. The (full) PCI ribbon cable is wide and doubles up for the double-edged card rows on the card, so you get plenty of bites at the cherry should it go wrong!

    http://hackingbtbusinesshub.files.wordpress.com/2012/11/pci_extender_cable.jpg?w=714

    Since the GL827 uses a pseudo-SCSI interface, that’s what the userspace code has to utilise. I only got as far as making the read functions work. When the GL827 controller was found to be no good for re-writing the redundant page area of the NAND, the code was abandoned. So the SCSI write functions need developing, which will be more complicated. What code there is for the GL827 can be dug out if you need it.

    cheers, a

  3. Hi, thanks for all that info, those documents look kwl and ill read through them all soon as i get a min, also using the ribon cable is a pretty good idea, I have actually already soldered the cables to the xd reader a few days ago to get it ready but I used the copper cables from an ethernet cable, I thought the colours would be easy to see, then I just put a bit of hot glue over the top just to make it a bit stronger (although the solder is strong anyway)

    Here’s a picture if your interested…

    aaron-messenger-xdreader

    and the 99p reader is exactly the same as the 1 in your image. We may have chatted about this on kitz but I’ve been on so many websites I cant remember :p

    Oh yes and heres a link to the adapter I got http://www.ebay.co.uk/itm/DIP48-TO-TSOP48-TSSOP48-Yamaichi-IC-Programmer-Adapter-/251029010509?pt=LH_DefaultDomain_0&hash=item3a727eb84d

    Image Hosted by PicturePush - Photo Sharing

    I didnt pay that much though as this is a different supplier.

    Although this 99p reader will only support reading the nand and not writing, I assume the pin layout is the same for when I make the next 1 using my olympus, is this correct? I’ll have a read through those docs, thanks for this

  4. Hi Aaron,

    Looks like you’ve done a good soldering job!

    I’ll add more a bit later, but just to say quickly, that the two outermost pins at each end of the reader should respectively be used to pull their neighbouring pins to GND and to Vcc.

    i.e.

    a) what would be “Pin 0″ is strapped to pin 1 (Card Detect / CD)
    b) what would be “Pin 19″ is strapped to pin 18 (Vcc)

    The reasons:

    a) The TSOP48 specs require two Vcc to power the NAND IC. One Vcc goes to NAND Pin 12 and the other to NAND Pin 37. You can obtain Vcc from Pin 18 on the reader. But for the second Vcc, it’s easiest to strap “Pin 19″ on the reader to Pin 18 on the reader.

    b) The insertion of the “xD card” in the reader needs to be simulated. That is best achieved with strapping Pin 1 (Card Detect) to “Pin 0″ (GND) on the reader. If this isn’t done, the Card Detect logic state is left floating. A second GND is required on the NAND any way.

    See images below (click to enlarge):

    Image Hosted by PicturePush
    Re-purposed Genesys Logic GL827 with strapped Card Detect and Vcc pins

    Image Hosted by PicturePush
    xD-Picture card pinout (Official Specs)

    Image Hosted by PicturePush
    TSOP48 NAND x8 x16 pinouts

    Next task is to modify the card presence logic on the Genesys Logic GL827, so that the controller thinks a SmartCard has been inserted, rather than an xD card. Best understood by studying the GL827 datasheet.

    cheers, a

  5. Hi again,

    Ah I wondered about the second vcc, so If I just bridge pin 0 and pin 1 then pin 18 with pin 19 with a bit of solder would this be correct? Then just solder another cable to each for the additional pins used on the nand? and i’ll checkout that datasheet.

    Thanks

  6. Hi,

    will do, thanks for your help, I’ll try and finish it off over the weekend and post results. Theres something I have forgotten about though untill now and its the software, I see in the original post ‘Alauda USB NAND interface V0.6′ is being used on a linux machine to interact with the NAND chip but I cant seem to find a download for it, also I’d prefer to use windows so is there a port of this software to run on windows do you know? or is there something else I could use instead?

    Thanks

    • Hi Aaron,

      The Windows software, written by Cory1492 is here [1]. But maybe contact Cory to see if he has a new version? He no doubt likes to hear from new users! [2]

      Cory’s code was patched a tiny bit to get it running again on Linux again, and to support different NAND devices.

      Lots more could be done with his code. e.g. for the 2Wire project, we only need to modify one or two pages in the whole flash memory. There’s no need to re-write every page. It’s not necessary and brings a greater risk of the device failing. So that could usefully be developed – a write_nth_page function.

      There’s also the minimal SCSI driver code that was hacked to dump the NAND using a GL827. I’ll dig that out if you need it. It’s far from finished, in fact it was scarcely started.

      That’s about it really. Out of curiosity, what is your project? What is the embedded hardware?

      Good luck with it!

      cheers, a

      [1] http://www.xboxhacker.org/index.php?topic=15596.msg135856
      [2] http://www.xboxhacker.org/index.php?action=profile;u=15891

  7. Hi thanks for the info I’ll have a go with the software you recommended, What I want out of all this is 2 things really, to recover data from NAND chips which have come out of broken hardware such as thumb drives, But I wanted something which I could backup/restore my PS3′s NAND if i’m allowed to say that here – Hope I have gone about this whole thing correctly for the things I want it for :)

    I’m guna try and get the prototype finished at somepoint today at least if time permits (I’m at work atm) and I’ll let you know how it all went

    Thanks

  8. Thanks, that sounds an interesting idea, I was wondering if it would be possible to remove the ps3′s nand and solder an xd reader (or at least the physical slot) to some long wires in its place and have a piece cut out of the plastics – to store the firmware on an xd card which can be easily swapped for booting different firmwares. If an XD card is essentially a nand chip in a shiny package then in theory this could be done right? I like the idea of having a TSOP cradle there though as this would be a convenient way to quickly swap the nand chips. I have a working ps3 which I dont use – i’ll do some experimenting with it over the next few weeks and see what I can come up with.

    I finished the prototype with the cheap xd-reader and tsop48 board and the computer is detecting the nand chip – if you try and open in my computer it aknowledges its there and asks to format it. It cant format I guess due to the fact the xd readers limitations and I cant read anything on the chip which I guess because I dont have the software to properly interact with it through the xd reader – I shall replicate the prototype using the olympus and cradle with the software you linked me to and see what happens :) Ill post back with an update soon. Thanks for all your help – Ill also provide my ‘schematics’ soon aswell.

    • Hi Aaron,

      Good progress! Are you using Linux or Windows? Not sure how to do it in Microsoft, but in Nix, the kernel driver for the card reader needs to be de-attached before any other driver code can be run. The Alauda driver causes a spectacular kernel crash otherwise!

      For the xD picture card reader, it’ll need low level SCSI read commands to be sent in USB resource blocks (packets). The SCSI commands are surprisingly simple. It’s programming the NAND flash that is much harder.

      Viz soldering xD card reader slot to device, have a look around the work that Cory1492 and friends have already done. Maybe it was on a Play Station Portable (1.8v NAND flash) rather than the XBox. Can’t remember now. Same principle though. It isn’t so much the NAND flash on an xD card that’s limiting but the xD card reader itself, iyswim. But if you’re only using the xD card slot, maybe there’s no issue at all?

      Look forward to hearing how you get on!

      cheers, a

      EDIT: Here’s the TSOP48 cradle/socket (£6.25 on ebay, not much less from China). Those ones have an alignment lug on the bottom that needs cutting or melting off. They are a bitch to solder onto a board though! The plastic melts at quite low temp, the pins invariably get bridged by solder, and when the gull wings are snapped shut, the force lifts the tracks off the PCB, etc etc!


      http://www.ebay.co.uk/itm/110693509695

  9. Hi,
    I am using windows, I could use linux if I have to – I used to use it few years ago but went back to windows as I’m the occasional steam user :) and thanks for that link I was struggling to find 1 – that would actually be perfect for putting into the console so I’ll order 1, I can always look at the xd-slot later on once the reader/writer is working correctly.

    Thanks

  10. Hello again, I seem to have got quite far, I have soldered another tsop48 board to the olympus xd reader (going to wait for some better wire to be delivered before I use the socket) and I have attached a 128mb nand chip to the board & installed the drivers for the olympus from the PSP package file and the reader is picked up by the PC – It doesnt appear in my computer though like the cheap reader did, so I used the alut.exe in command prompt and it does pick up the reader however it crashes when I try to read the nand. I use the command alut -x -r filename.ext and it picks it up, then tells me to hold the switch, but then it crashes, I have tried this on an xp machine aswell which does the same. Am I missing something do you think? Icould try linux but dont currently have a linux machine to hand but dont think its a windows thing.
    This is as far as the cmd gets…
    ———————————————-
    Alauda USB NAND interface V0.5
    ———————————————-
    Initializing USB device…
    Olympus MAUSB-10 detected (vid: 0x07b4 pid: 0x010a)
    Insert media and close lid switch
    xD NAND is present
    Media signature: 0×00000000
    NAND info : Unknown NAND (32M defaulted)
    NAND initialized successfully!
    Device reports ready!
    Opening file: file.ext
    Reading – do not remove card or open lid!

    CRASHES HERE!

    Do you think its because the nand chip is larger than 32mb? I’m a bit stuck now :)

    thanks

    • Hello Aaron,

      Sounds like you’re very almost there. I wouldn’t like to comment on why Windows crashes! Are you sure it isn’t meant to crash?!

      Maybe put some debug comments in the Alauda driver code, recompile it, to pin-point where and why it is crashing. In Linux, if the kernel driver hasn’t been de-attached, it throws a major Kernel Oops! Could that be the same problem in Windows? A hardware driver is presumably removed or disabled in the Windows Control Panel thingie? Has that been done?

      It probably won’t be the size of the NAND that’s causing the crash. A 1Gbit NAND was used here for experiments and while the addressing was all skewy (wrong page size and erase block size, etc), that didn’t in itself cause a crash.

      Not much of a suggestion, but Linux is normally loads easier to get things going : )

      Sorry, not much help. Don’t give up though!

      cheers, a

  11. Hi,

    I dont think its supposed to crach on windows as it just creates a new file called filename.ext which is 0 bytes. And putting debug comments in the driver code is beyond me tbh, I have only ever made basic graphical scripts with autoit – ill google around though to see how I can do it and hopefully I can find something. I guess it may be doing the same thing as linux when it has a kernel panic (if this is the correct term). Also how do I detach a kernel driver in linux, is this what the ‘modprobe’ command would be used for? and would this be the equivalant of disabling a driver in windows?

    thanks for ur help

    • Hi Aaron,

      Sorry, that was meant to be a joke about Windows crashing :-P “Design feature”!

      Don’t know about other Linuxes, but Debian and Ubuntu keep a list of blacklisted kernel modules that shouldn’t be loaded automatically.

      Under /etc/modprobe.d/ a file called alauda-blacklist.conf would be created, with the contents:

      # This blacklists the Alauda SM/XM card reader driver/s,
      # since they appear to crash amd64 kernels (maybe x86 too?)
      # asbokid <ballymunboy@gmail.com 05/09/2012
      blacklist ums-alauda
      blacklist alauda
      

      If you’ve got a 64bit PC then this pre-compiled driver should work? Or it could be compiled statically to be sure. It could be dropped into a Linux Live CD build, which boots and runs directly from CD.

      See http://live.debian.net/

      cheers, a

  12. lol ok, :) I was using 32-bit ubuntu (live cd) so ill put this into a file called alauda-blacklist.conf in the folder /etc/modprobe.d/ on a 64-bit debian live cd if I understood correctly, and with any luck I should be good. Will let you know how it goes. cheers

    • Just looked at your output from alauda.exe and it looks like the NAND IC isn’t seated properly in the cradle.. Device ID 0×00000000 is a giveaway., or has been for me. The pins on the right hand side of the chip (data I/Os) look like they are not aligned properly. Maybe try pushing the clip down and, using a toothpick, nudge the chip up on the RHS.

      cheers, a

  13. Hi,

    I’ve got an Alauda-based reader and a need to read and write to the whole area of a NAND chip – cory1492′s alut tool looks like an excellent bet as I’m not skilled enough to write my own. However, xboxhacker.org seems to be down on a fairly long-term basis – I don’t suppose you could provide me with a copy of the source that you’re using?

    -Tom

  14. Hello again, sorry its been a long while since I last replied, I have been very busy with work over the last few months but I’ve finally got time to get back to this project :).
    I kinda lost tarck where I was upto so I re-read through the comments and now I’m back to where I left off.

    OK so heres where I’m up to, If I connect the card reader to windows and run the alut etc I get so far before it crashes. I started again from the beginning with a fresh olympus, new wires with the headers on the end (So I dont have to keep soldering and desoldering to get the pin configuration right) and i’m using the good (pricey) tsop clip so I know i’m getting a good connection to the chip.

    I have built it to the exact same spec as the first attempt and now i’m upto the same place.

    Just to confirm here is what I get when running alut on windows…

    “Initializing USB device…
    Olympus MAUSB-10 detected (vid: 0x07b4 pid: 0x010a)
    Insert media and close lid switch
    xD NAND is present
    Media signature :0×00000000
    NAND info: Unknown NAND (32m defaulted)
    NAND initialized successfully!
    Device reports ready!
    Opening file file.bin
    Reading – d not remove card or open lid!

    CRASHES

    So I installed ubuntu on a spare machine from scratch, connected the card reader which caused the kernel panic as expected. Then I did the blacklist conf as you previously suggested and it now doesnt crash ubuhtu when I connect it. But I dont know how to go about getting the data off the chip with ubuntu.

    I also tried building 1 of these using the SmartMedia pins but I couldn’t even get it to detect the NAND chip using the alut program so I guess my configuration was just incorrect.

    The only thing I know now for sure is the NAND chip is definitly secure in the clip and all pins are making a proper connection. I dont think I have missed anything…

    Please can you advise on where to go from here?

    Thanks for your time.

    Aaron

  15. Hi,

    This is gr8 thanks I appreciate it. Just have a slight problem with permissions though, it says permission denied and i’m logged in the terminal as sudo, do I need to change permissions on the alut file? It does say i’m the owner in properties though.

    Also as im using the XD reader I simply miss out the -s correct? as -x is default?

    Do you think i’m going about this the right way or do you think it would be better if I get it connected up with the sm reader? Only problem is I can never seem to find a working pin layout.

    Thanks a lot

    Aaron

    • Hi Aaron,

      Not sure what the permissions relate to. Maybe the executable bit needs setting (chmod +x filename)

      The reader works just the same whether using the SM or XD tracks. It’s just that XD is marginally easier to solder if you’ve got some pre-stripped PCI ribbon cable of 1mm pitch. The fingers on the XD reader pads are also 1mm pitch.

      cheers, a

  16. Hi,

    Thanks for the info, ill have a play with the permissions, not sure why i’m getting the error message so i’ll have a play around and try and find out whats happening. I’ll give you an update when I have some news,

    Cheers

    Aaron

  17. Hi again,

    I just posted on the ubuntu forums to see if anyone knows how I can get around the permission problems, in the mean time I thought maby i should try to compile the program again on my computer using the compile code in your readme, When I try this I get a message saying ‘usb.h no such file or directory’ if i’m not mistaken this is a header file and should be part of the compilation software correct? if not I have the usb.h file from another download of the source but putting it in the folder with the rest of the source doesnt use it during the compilation. Is there something i’m missing? and do you think if I compile it myself on the machine im using will get around the permission problem?

    Thanks

    • Hi again Aaron,

      If you cut-and-paste the permissions error message it might be easier to see what is causing it, and how to remedy it.

      The missing “usb.h” when you try to compile means you need to install the libUSB development package with:

      $ sudo apt-get install libusb-dev

      Though that wouldn’t be related to the perms problem.

      cheers, a

  18. Thanks for that, I installed the libusb-dev as you said and it has successfully compiled the source and it executes without the permission problem. Im soo close now, it dumps the file without any errors but the file is 0 bytes, if I do alut -i the media signature is still 0×00000000 I have tried 3 different chips, 1 blank new 4gb, a 128mb chip from an old usb drive and a chip from an sd card (cant remember size) all give sig 0×0*. Do you think my pin configuration could be incorrect? I made a diagram of my pinout, does it look right to you? this is the only thing I can think may be incorrect now, everything else seems to be in place.

    Thanks for your help

    Aaron

    • In the diagram the pin numbers need correcting. The pins are incrementally numbered anti-clockwise with the pin nearest the dot being pin 1.

      Have you used a soldered board then? If you have, there’s little scope for failure.

      Otherwise, it’s perhaps a case of giving the NAND a little wiggle in the cradle, and checking for continuity (and checking for shorts) for each of the 48 pins on the cradle and on the card reader PCB.

      Can’t really think of any other suggestions.

      Sounds like you’re almost there though :-)

      cheers, a

    • P.S. Just to add. Do you have a spare SM card that you can slot into the reader, just to eliminate the software as the cause of the failure.

      cheers, a

  19. Ok thanks for the suggestions, when I drew the diagram originally I used a soldered board which I could clearly see where the traces went, I’m thinking I should correct it the way you said – anticlockwise from the dot being pin 1 and see what happens, my cradle however is very unclear, there is a marking indicating pin 1 although the tracks are very ‘messy’ you cant see where there going. I have tried to correct the wireing on the cradle based on what you said with no luck so I think i’ll go back to the solder board for the time being to see how it goes, at least I can see whats happening on these boards. I’ll probably have an update on monday if not 2moro, so thanks for helping and have a nice weekend.

  20. Morning.

    I’m 1 step closer this morning :) I have remade the reader using my other olympus and I have soldered the cables to a solder-board tsop48 in the correct order, pin 1 starting at top corner with the circle and moving anticlockwise. The media signature in ubuntu picks up as 0x1c1c1c1c but I still get the 0 byte file – the exact ending sentence of the program is “Floating Point Exception (Core Dumped)”.

    In windows xp it picks up and does exactly the same but crashes – I guess this is the same problem on both os’s just ubuntu is displaying the message where as windows isnt. Do you know what this specific error message means? also does this signature look like a correct sig to you? I can feel its so close now :)

    Thanks

    • Hi Aaron.. Nearly there! I don’t know what the Exception is about. Some sort of division error probably (percentage of time completed, or some such). Not much use :-(

      The signature doesn’t look valid, no.

      Can you put a genuine card in the spare slot (the xD if you’ve hacked the SM and vice-versa).

      That way you can confirm that the software is running okay.

      cheers, a

  21. Ok thanks, no probs, I’ll just have to source a sm card to test with, im thinking ebay :) They are quite pricey though, If I got an XD to SM adapter so I could put the xd card in the sm slot this would still work correctly shouldnt it? cos I have spare xd cards but both the xd slots have been removed from the readers, so I only have the sm reader left – just dont want to pay sm card prices really.

  22. hello
    i found that sd card reader was used to dump an xbox 360(corona v2) nand (4GB hynix)
    like the methode used here with xD readers
    so is thas can be useful for all nands ?

  23. Hello! Do you know if they make any plugins to protect against hackers?

    I’m kinda paranoid about losing everything I’ve worked hard on.
    Any recommendations?

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s