Monitoring tsop 48 nand data irt or in log can this be done?

Status
Not open for further replies.
psxpetey

psxpetey

Member
What am I trying to do: I am trying to swap a 48pin tsop nand but it appears to be married to the board somehow, it has no unique id, When I install the exact same chip exact same type: K9HAG08U1M, datasheet: https://datasheetspdf.com/pdf-file/607807/Samsung/K9HAG08U1M/1 It doesn't function doesn't show up and wont initialize even when programmed with a t56gecu programmer(weird it should work when programmed) So I thought what if I could monitor the chip to see what commands are sent to and from the chip from the data controller. I considered a few ideas but I do already have a teensy. The question is can the teensy actually monitor the pins of a tsop. I took a look through the connections etc but I need some guidance. Can a teensy monitor the 7 io pins of the nand if I connect them? what other materials will I need/ has anyone tried something like this?

I would like to monitor commands, what its reading and writing and to what addresses. This way I can initalize the device/ restore it and see what the device is expecting from the nand.
 
According to the data sheet on page 14, this is a 20ns access time part. A slower (presumably cheaper) version exists with 30ns access time, which is probably a sign whatever you're trying to reverse engineer is using this part with very fast timing, otherwise the original designers would have saved some money to choose the slower version.

Capturing signals on 20ns time scale is much too fast, even for Teensy 4.0 / 4.1. This is so far beyond what any microcontroller could do. Even many FPGAs would be hard-pressed to accomplish this, though faster ones could probably do it with careful design. That sort of design isn't easy. Odds of success as a beginner-level project and without access to high-end test gear would be very low.

One of the USB3 Saleae logic analyzers is probably the most realistic "budget" approach. But check the fine print carefully. While they advertise 500 MSample/sec capture, that speed is only for capturing a small number of signals. Also not usually mentioned on their website is the need for an extremely high end PC to achieve the fastest capture speeds. Buyer beware.

I should also mention, on this forum we generally only appreciate reverse engineering which is both legal and ethical.
 
This logic analyzer may (just) work for you.
You need 14 channels for this flash chip: IO0-IO7, CLE, ALE, CE, WE, RE, WP.
The U3Pro16 can sample 16 channels @ 500 MHz in Buffer mode or @ 125 MHz in Stream mode. Buffer mode means you can only store a finite number of samples before transferring the sampled data to your PC for analysis in the DSView application. So you have to set the trigger conditions wisely.

Paul
 
Frank B said:
Haha...shipping US $557.11
Ebay sucks.. they should stop that.
Click to expand...
you must be overseas, but ya I too hate ebay's shipping program. Why people use It I have no clue. Pitney Bowes is a joke nd they just add in more shipping
by sending it to their shipping hub. They then proceed to usually wreck or at least damage the package when opening it to check contents.
 
psxpetey said:
i might go for that one
Click to expand...
For what it's worth: I have been using the little brother DSLogic Plus now for over a year and it served me well. I especially liked the protocol-decoder built into the DSview program. The cables a.k.a. "fly wires" are sturdy and the clips are not the usual cheap stuff.
You can try the DSview program functionality yourself before purchasing - DSview has a "Demo Device" built in.
Took about 3 weeks after ordering before it arrived at my place. Not bad from China. And free shipping.

Paul
 
PaulS said:
For what it's worth: I have been using the little brother DSLogic Plus now for over a year and it served me well. I especially liked the protocol-decoder built into the DSview program. The cables a.k.a. "fly wires" are sturdy and the clips are not the usual cheap stuff.
You can try the DSview program functionality yourself before purchasing - DSview has a "Demo Device" built in.
Took about 3 weeks after ordering before it arrived at my place. Not bad from China. And free shipping.

Paul
Click to expand...

I just downloaded it, looks half decent, the demo device doesn’t seem to decode so I couldn’t really check that out. Does it have the nand protocol for decoding? Is it async serial maybe?

What do you typically use it for.
 
The demo device does decoding. Here is a screen shot of DSview in action. I set it to decode I2S on the top 3 signals.

DSview.jpg

The demo data is bogus ofcourse so the I2S decode shows garbage.

I've been using the analyzer mostly for checking I2S, CAN and I2C signals.

Paul
 
PaulS said:
The demo device does decoding. Here is a screen shot of DSview in action. I set it to decode I2S on the top 3 signals.

View attachment 23438

The demo data is bogus ofcourse so the I2S decode shows garbage.

I've been using the analyzer mostly for checking I2S, CAN and I2C signals.

Paul
Click to expand...

Apparently it doesn't have a nand flash decoder so I dunno how useful it would be to me.
 
You can add custom protocol decoders to DSview. DSview is open-source and can be found here.
The protocol decoders [written in Python] are here.
I'm not sure there is such a thing as a "nand flash decoder", so I believe you have to go the tedious way and either write a decoder yourself with the datasheet at hand or sample a lot of waveforms and do the decoding by yourself [again with the datasheet at hand].

With this Read flow chart and Mode selection table,

ReadFlowChart.PNG ModeSelection.PNG

and setting the appropriate triggers on the CLE, ALE, CE, WE, RE, WP signals, you should be able to look at data read from the flash.
But yeah, it's a tedious job...

BTW, I used this LA a lot at work in the 80's... $10K then, but it got the job done.

HP 1630G.jpeg

I'm happy that technology progressed over the years and prices dropped.

Paul
 
PaulS said:
You can add custom protocol decoders to DSview. DSview is open-source and can be found here.
The protocol decoders [written in Python] are here.
I'm not sure there is such a thing as a "nand flash decoder", so I believe you have to go the tedious way and either write a decoder yourself with the datasheet at hand or sample a lot of waveforms and do the decoding by yourself [again with the datasheet at hand].

With this Read flow chart and Mode selection table,

View attachment 23450 View attachment 23451

and setting the appropriate triggers on the CLE, ALE, CE, WE, RE, WP signals, you should be able to look at data read from the flash.
But yeah, it's a tedious job...

BTW, I used this LA a lot at work in the 80's... $10K then, but it got the job done.

View attachment 23452

I'm happy that technology progressed over the years and prices dropped.

Paul
Click to expand...

Ya I messaged the sigrok boys( ds uses sigrok software) and they said about the same. They said it might be called clocked parallel or something.
What a pain, in the salae software I saw synchronous and asynchronous serial and parallel no idea if those would work but I messaged them.

Yap tedious is right.

Anyways that la in the picture looks pretty awesome 10k my Lord! You must have been working on some really cool stuff 😎
 
Status
Not open for further replies.
Back
Top