Reading NAND flash chips without removing them

Here’s an interesting method of reading data off of a NAND flash chip. Often we see these chips desoldered in order to read and write data, but not this time. This method uses hacked adapters to match the pin pitch of the various chips. Above you see parts of a breakout board cut down to use as wedges. These are drag soldered to the pins of the chip, then the appropriate breakout pins were connected to a Smartmedia card reader, which can read NAND chips. There is also an example showing the flexible connector cable for a DVD rom used as the adapter to solder to a smaller chip. We still looks pretty tricky, but it might be less labor intensive than relocating the flash chip like we saw on that Sega Game Gear hack, as long as you only need to read or write the data once.

[Thanks Laurdy]

Comments

  1. cool!
    now can someone use this to kludge together a wifi xd card please?
    in theory it is possible but i have never seen one.

    also could be worthwhile making a pcb which has an xd port on one end and an array of flash pads on the other with a digital switch chip so multiple chips can be soldered to it and switched between the single xd port.

  2. BiOzZ says:

    i have tried methods like this before with reading them with out removing them (in one of my own circuits) and i have had problems with 3 major things
    1) powering the memory powered the MCU and caused reading conflict … i tried fixing with a diode but than
    2) i blew an enable transistor … i dont know why
    than i fixed that than
    3) i kept on getting corruption in the extracted data

    i find that programming in some debug lines for pulling flash off inside of the microcontroller to be the easiest method but its slow and would only help if you made the circuit your self

    • salec says:

      Like DarkFader said, keep the MCU in reset, most micros power up with their pins safe (high Z).

      If you can’t force it to stay in reset (e.g. it has internal power-on circuit), choke it’s main clock source (unless it too is internal, a RC). When you do so, the MCU will come out of reset but it won’t execute on-chip hardware configuration routine and pins will remain passive

  3. CouldNotHelpIt says:

    > chip. We still looks pretty tricky,

    I think you a word there!

  4. DarkFader says:

    You might have to keep the target in reset to prevent address-line conflicts. (besides cutting the enable/select line)
    Keep wires short too.

  5. 24601 says:

    I would think a clamp-on adapter would be better than one you have to solder onto the chip. Wouldn’t you run the risk of desoldering the chip from its board when it comes time to remove the adapter?

  6. Roberto says:

    I know from experience that different brands of NOR chips have different init, reading and writing protocols, even if they are of the same spec and pin-compatible.
    I hope this is not the case for NAND.

  7. BiOzZ says:

    @24601
    i have tried to find clamp on adapters for these but the pin spacing is to close and the profile of the chip is to small

  8. cantido says:

    If you’re going to solder to the chip anyhow why not just remove it, read it, solder it back on.
    It seems to me this would be a method that you would guess would be faster but would eventually turn out to take ages and get extremely annoying.

  9. peachy says:

    Now articles like these are what I call quality Hackaday content. Can we have more interesting hardware hacks and less Arduino projects, please?

  10. Duggasco says:

    If I’m not mistaken, the board in the picture is from a cvs disposable video camera. I used to belong to a hacking community for them and this method was used to read the NAND chips since we didn’t have an unlock yet for the newer cameras. Oh the good old days

  11. @BiOzZ what about combining the two approaches, use some of those fine pitch elastomers from the pound world “live test” screwdrivers, and two pcb segments from a surplus lcd panel for the fine pitch leads.
    ought to work…
    also shouldn’t damage the chip as these are resistive.

  12. Haku says:

    Now that’s what I call dedicated.

    I once desoldered the 4x 1GB SSD chips from an Asus Eee 701 and soldered them into an Eee 900 whose SSD died, the transplant didn’t work so I transplanted them back into the original Eee 701 and they continued to work in that without problem.

  13. BiOzZ says:

    @zeropointmodule

    i think your on to something there

    if the resistance is not to much and you get your alignment just right i don’t see how that method would not work

    i take it you mean with the rubber conductive spacer/cable thing that attaches the lcd to the board?

  14. @BiOzZ Yeah, I tried using one as an OLED contact but unfortunately it didn’t work as well as I’d hoped due to the contacts being too fine a pitch.

    Would work well for this application though.
    Also these are relatively cheap and readily obtainable.

  15. SaturnNiGHTS says:

    wow…that’s a blast from the past. i’m like “hey, didn’t we read NAND like that to dump firmware?”

  16. Twinsen says:

    This is an intersing solution. I once had the same problem, read a NAND flash chip in circuit. I used JTAG Boundary Scan to bit bangle the pins of the CPU and create proper NAND read sequences. It was awfully slow and took 2 days to write the code, but it worked. ;)

  17. iHME says:

    I think this has been posted here before.
    Still, I love it.

  18. Oliver says:

    the site is down :-(

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Follow

Get every new post delivered to your Inbox.

Join 96,421 other followers