Flash NAND Lite Memory Programmer! TSOP48

funak 386955 551

Treść została przetłumaczona

Zobacz oryginalną wersję tematu

Reply Cool? Ranking DIY | New topic

Notify about new articles

#31 16519370 08 Jun 2017 18:26

tplewa tplewa

Level 39

» | Helpful post? (+6)

Post #31
16519370 08 Jun 2017 18:26

@funak

Maybe give some other bearing as you can send the content. If something happens to my hand, I can rip and send it ... unfortunately, I do not have your programmer.
Unless you can run the program without it
ADVERTISEMENT
#32 16519397 08 Jun 2017 19:13

funak funak

Level 27

» | Topic author Helpful post? (+3)

Post #32
16519397 08 Jun 2017 19:13

You are installing the application from the previous post:
http://software.progelo.pl/NANDLite/publish.htm

Or you download the version without installing it, go to the Batch tab, click Add file ...
you select files and that's it ... upload is automatic, you just need to have the NANDLite application turned on.
You can close the application at any time, after turning it on again, the sending will resume.

Each file, regardless of its size, be it 2GB or 16GB, is divided into 1MB fragments and checked on the server. If the fragment exists, it is skipped, thus faster shipping.

Added after 33 [minutes]:

No physical programmer is required.
#33 16519520 08 Jun 2017 19:34

tplewa tplewa

Level 39

» | Helpful post? (0)

Post #33
16519520 08 Jun 2017 19:34

funak wrote:

Added after 33 [minutes]:

No physical programmer is required.

Clearance this is what I ment If I have any equipment, I will try to send the batches.
Maybe others will join because the project is cool as I mentioned
#34 16519528 08 Jun 2017 19:47

funak funak

Level 27

» | Topic author Helpful post? (0)

Post #34
16519528 08 Jun 2017 19:47

There may even be memory bits that don't work - that is, faulty. Each file made to measure gold.

In the days to come, I will also add a descriptive field to each load to provide additional information, e.g. which TV was read from, what memory, whether it is functional, or not, what are the symptoms.

Looking through the K9GAG08U0E memory batch, I can see that it has two bad blocks memory maps. In one of the batches there is no copy of the map. It also gives food for thought. The hypothesis is that when writing a map of damaged blocks, a write error may occur and there may be a problem here - hence the TV may not start - we will verify it soon.

Added after 4 [minutes]:

I already recognize in the batch 5 partitions, addresses, and their sizes. Each partition is preceded by a few to a dozen blocks with mysterious content (I suspect some kind of FTL - Flash Translation Layer), then the header of the FAT32 proper partition begins.
#35 16523996 11 Jun 2017 14:52

Sprut Sprut

Level 9

» | Helpful post? (+1)

Post #35
16523996 11 Jun 2017 14:52

This chip in the TV samsung K9GAG08U0E necessary, because this dampe blot shifts and puts under the sign
ADVERTISEMENT
#36 16524803 11 Jun 2017 22:56

funak funak

Level 27
» | Topic author Helpful post? (+4)

Post #36
16524803 11 Jun 2017 22:56

I spent the whole four days trying to finally figure out the BCH. But it worked.
The problem was due to the correct calculation of the Galois Field function.

GF (2 ^ m)

where:
m = 13 for a block of 512 bytes
m = 14 for a block of 1024 bytes.

And in the Linux documentation we find such primitive polynomials for m = 5 .. 15:

Code: text Expand Select all Copy to clipboard
/* default primitive polynomials */ static const unsigned int prim_poly_tab[] = { 0x25, 0x43, 0x83, 0x11d, 0x211, 0x409, 0x805, 0x1053, 0x201b, 0x402b, 0x8003}

Where the algorithm for m = 13 worked properly, while for m = 14 it was "crashing". It turned out that it is very important which primitive polynomials are applied and if it is not correct then the whole calculation is fruitless.

Out of curiosity, let me also say that e.g. Atmel ( Link ) in the SAM9G15 / G25 / G35 / X25 / X35 processors it has hardware support for BCH with GF (2 ^ 13) and GF (2 ^ 14) functions, however at m = 14 it uses different primimitive polynomials 0x4443.

The designation of the BCH bits is necessary to make changes to the NAND image. At the moment, I already know where the bitmap with damaged memory blocks is, where the partitions are, how they are arranged and most importantly where to enter values to include the damaged blocks in the new memory.
All that's left is to put it together and add it as a function to the NANDLite programmer.

And, of course, to finally test whether the uploaded batch will work on the TV, because that's what we want.

Added after 1 [minutes]:

For the sake of curiosity, I will also write:

The calculation of the GF (2 ^ 14) function takes about 88 seconds for me.

Fortunately, this function only counts once.
#37 16526382 12 Jun 2017 21:11

Sprut Sprut

Level 9

» | Helpful post? (0)

Post #37
16526382 12 Jun 2017 21:11

To oprogramowanie z tv samsung ue32d5500 w archiwum są dwa pliki 11 1 jest uznawane za drugi tylko wymazać je .in bloka 2bed
Archiwum ue.5500 firmware dziala.
Jest możliwe, aby zmieścić chip skasowane?
Jest tam telewizor do eksperymentów.
Przepraszamy za niezdarnym polskim piśmie w języku rosyjskim i przełożyć GOOGL tłumacza.
These are firmware from tv samsung ue32d5500 in archive 11 two files 1 read second after erasing. they have 2bed bloka
Archive ue.5500 working firmware.
Can it be adjusted to an erased chip?
There is tv for experiments.
I apologize for the clumsy Polish, I write in Russian and translate with a googl translator.
https://drive.google.com/file/d/0B3udCQkp0OogMTdyNFc3SVA2Q0k/view?usp=drivesdk
https://drive.google.com/file/d/0B3udCQkp0OogNXN6ZF9kTHgwdms/view?usp=drivesdk
#38 16526492 12 Jun 2017 21:46

funak funak

Level 27

» | Topic author Helpful post? (0)

Post #38
16526492 12 Jun 2017 21:46

@Sprut

Enter the numbers of bad blocks in the new memory.

EN: List the corrupt blocks in the new memory K9GAG08U0E,
#39 16526977 13 Jun 2017 08:02

Sprut Sprut

Level 9

» | Helpful post? (+1)

Post #39
16526977 13 Jun 2017 08:02

blocks 1131 2073
ADVERTISEMENT
#40 16531717 14 Jun 2017 19:08

funak funak

Level 27
» | Topic author Helpful post? (+3)

Post #40
16531717 14 Jun 2017 19:08

Hello

Today I made an algorithm that checks the correctness of data blocks in a batch downloaded from the K9GAG08U0E memory.

For the 65 blocks of memory read, let me remind you, each page consists of 128 pages, and each page is divided into 8 fragments, the statistics are as follows:

STAT: OK = 42220 COR = 32 FF = 23704 00 = 0 ERR = 0 ERR24 = 604

where:

OK - a valid fragment was found, the calculated BCH matches the one in the memory
COR - The sum was in error but the bits were corrected or reconstructed
FF - all bytes contain 0xFF
00 - all bytes contain 0x00
ERR - an attempt to restore the bits has failed
ERR24 - the number of erroneous bits is greater than 24

Added after 10 [hours] 55 [minutes]:

Hello

Today there is an update of the statistics:
STAT: OK = 123574 COR = 1038 FF = 506936 00 = 2048 ERR = 0 ERR24 = 35076

00 - we have 2048, which means two full blocks damaged.

Please look at the large number of ERR24, here is an example:

Code: text Expand Select all Copy to clipboard
BCH: T:1 L:0 B:653 P:30 Offset:0 Count bit:166 ERR BIT>24 BCH: T:1 L:0 B:653 P:30 Offset:1 Count bit:162 ERR BIT>24 BCH: T:1 L:0 B:653 P:30 Offset:2 Count bit:158 ERR BIT>24 BCH: T:1 L:0 B:653 P:30 Offset:3 Count bit:175 ERR BIT>24 BCH: T:1 L:0 B:653 P:30 Offset:4 Count bit:169 ERR BIT>24 BCH: T:1 L:0 B:653 P:30 Offset:5 Count bit:159 ERR BIT>24 BCH: T:1 L:0 B:653 P:30 Offset:6 Count bit:176 ERR BIT>24 BCH: T:1 L:0 B:653 P:30 Offset:7 Count bit:160 ERR BIT>24 BCH: T:1 L:0 B:653 P:32 Offset:0 Count bit:182 ERR BIT>24 BCH: T:1 L:0 B:653 P:32 Offset:1 Count bit:150 ERR BIT>24 BCH: T:1 L:0 B:653 P:32 Offset:2 Count bit:174 ERR BIT>24 BCH: T:1 L:0 B:653 P:32 Offset:3 Count bit:165 ERR BIT>24 BCH: T:1 L:0 B:653 P:32 Offset:4 Count bit:162 ERR BIT>24 BCH: T:1 L:0 B:653 P:32 Offset:5 Count bit:172 ERR BIT>24 BCH: T:1 L:0 B:653 P:32 Offset:6 Count bit:175 ERR BIT>24 BCH: T:1 L:0 B:653 P:32 Offset:7 Count bit:159 ERR BIT>24 BCH: T:1 L:0 B:653 P:33 Offset:7 Count bit:1 OK BCH: T:1 L:0 B:653 P:34 Offset:0 Count bit:163 ERR BIT>24 BCH: T:1 L:0 B:653 P:34 Offset:1 Count bit:151 ERR BIT>24 BCH: T:1 L:0 B:653 P:34 Offset:2 Count bit:182 ERR BIT>24 BCH: T:1 L:0 B:653 P:34 Offset:3 Count bit:166 ERR BIT>24 BCH: T:1 L:0 B:653 P:34 Offset:4 Count bit:158 ERR BIT>24 BCH: T:1 L:0 B:653 P:34 Offset:5 Count bit:166 ERR BIT>24 BCH: T:1 L:0 B:653 P:34 Offset:6 Count bit:172 ERR BIT>24 BCH: T:1 L:0 B:653 P:34 Offset:7 Count bit:169 ERR BIT>24 BCH: T:1 L:0 B:653 P:35 Offset:5 Count bit:177 ERR BIT>24 BCH: T:1 L:0 B:653 P:36 Offset:0 Count bit:153 ERR BIT>24 BCH: T:1 L:0 B:653 P:36 Offset:1 Count bit:167 ERR BIT>24 BCH: T:1 L:0 B:653 P:36 Offset:2 Count bit:188 ERR BIT>24 BCH: T:1 L:0 B:653 P:36 Offset:3 Count bit:179 ERR BIT>24 BCH: T:1 L:0 B:653 P:36 Offset:4 Count bit:172 ERR BIT>24 BCH: T:1 L:0 B:653 P:36 Offset:5 Count bit:178 ERR BIT>24 BCH: T:1 L:0 B:653 P:36 Offset:6 Count bit:165 ERR BIT>24 BCH: T:1 L:0 B:653 P:36 Offset:7 Count bit:172 ERR BIT>24

Strongly different bits indicate that the data in this passage has been abandoned and saved elsewhere. According to the specificity of Wear Leveling.

I do not find the position yet where information is written about which fragments are currently used - that is, they are important.

Added after 9 [hours] 15 [minutes]:

Today I made the statistics of a certain batch to K9GAG08U0E marked as OK named: GQ5X_K9GAG08U0E_D5500_OK.bin.
Due to a minor error, only 2064 blocks were calculated instead of 2074, but the following conclusions can be drawn:

STAT Block: 2064 OK = 768953 COR = 13780 FF = 1104967 00 = 24576 ERR = 0 ERR24 = 201260

And below is the statistic of the number of fragments with differing bits (0- means that the bits did not differ):
STAT: 0 = 768953
STAT: 1 = 13125
STAT: 2 = 632
STAT: 3 = 22
STAT: 4 = 1

The conclusion is that the theoretically efficient memory had 13,780 fragments with bad bits, but could be corrected. Most were 4 bits incorrect in a single fragment.

But the more strange thing is that there are fragments that do not have the correct parity bits and there are a lot of them, as much as 9.5% of the entire capacity. If statistically speaking, the number of parity error bits is in the range of about 150-180 bits.

At the moment, I am not able to explain why this is happening and where is the logic here. Even if I considered this data to be irrelevant, i.e. saved earlier, but already out of date, because there is a new version of data saved in a different memory area, including Wear Leveling, I still cannot understand why the parity bits do not match. The more that this memory has the NOP (Number of programming) parameter is 1.

Enclosed is the complete file from the batch analysis process.

Attachments:

statystyka.txt Download (683.01 KB)
#41 16580810 11 Jul 2017 12:53

lukasis6 lukasis6

Level 17

» | Helpful post? (0)

Post #41
16580810 11 Jul 2017 12:53

Hello and welcome. Are the bones K9GAG08U0E programming with 2GB batch for Samsung TVs already programmed correctly?
#42 16581664 11 Jul 2017 19:55

funak funak

Level 27

» | Topic author Helpful post? (+1)

Post #42
16581664 11 Jul 2017 19:55

At the moment, the algorithms are ready and awaiting introduction to the NAND Lite application. Later, tests on televisions.
#43 16585873 13 Jul 2017 19:09

lukasis6 lukasis6

Level 17

» | Helpful post? (+1)

Post #43
16585873 13 Jul 2017 19:09

funak wrote:
At the moment, the algorithms are ready and awaiting introduction to the NAND Lite application. Later, tests on televisions.

Ok - I'm waiting impatiently - I have some new bones, a working batch and a TV set
#44 16592099 17 Jul 2017 09:22

funak funak

Level 27

» | Topic author Helpful post? (0)

Post #44
16592099 17 Jul 2017 09:22

Hello

I will buy / borrow TOSHIBA memory to test the algorithms in the NANDLite programmer:

TC58NVG6T2FTA00
The memory is 64Gbit = 8GB

If anyone has such a memory, please contact me
#45 16623511 03 Aug 2017 16:57

sashabok sashabok

Level 2

» | Helpful post? (0)

Post #45
16623511 03 Aug 2017 16:57

Thank you very much!! Works great !!
#46 16630337 07 Aug 2017 21:49

lukasis6 lukasis6

Level 17

» | Helpful post? (0)

Post #46
16630337 07 Aug 2017 21:49

funak wrote:
At the moment, the algorithms are ready and awaiting introduction to the NAND Lite application. Later, tests on TVs.

Something on the topic?
#47 16649962 18 Aug 2017 17:15

funak funak

Level 27
» | Topic author Helpful post? (+5)

Post #47
16649962 18 Aug 2017 17:15

There is a new version of the application: 1.0.1014.79.

http://software.progelo.pl/NANDLite/publish.htm

And in the new version, the long-awaited K9GAG08U0E memory programming functionality used in SAMSUNG D5500 TV sets.
The D5700 is said to be as well.

To do this:

1. Launch the NAND Lite application!
2. Connect to a programmer
3. Detect the system, select the correct one from the list -> K9GAG08U0E
4. Go to the Transfer tab
5. Delete the memory
6. Press the button Prepare file D5500
7. Select the source file with "good" TV input
8. Indicate the file to which the "new" batch is to be saved
9. Wait for the function button to end (approx. 2-5 minutes)
10. Click Save to Memory and select the write batch
11. Program
12. Optionally verify, although it is an MLC memory, therefore, distorted bits are normal
12. Check if the memory in the TV is working

Screenshot of wipe memory:

Screenshot of preparing a new batch taking into account damaged blocks of new memory:

As the first file for analysis I downloaded from my colleague Sprut.
It shows one damaged block marked in the BBT table.

And application LOG:

Code: text Expand Select all Copy to clipboard
Rozpoczęto przytowanie pliku do zapisu Ustawiam parametry kodera BCH Generuję tablicę BCH Obliczam GF Postęp GF:530 Postęp GF:659 Postęp GF:752 Postęp GF:822 Postęp GF:875 Postęp GF:921 Postęp GF:960 Postęp GF:995 Postęp GF:1026 Postęp GF:1054 Postęp GF:1081 Postęp GF:1105 Postęp GF:1125 Postęp GF:1140 Postęp GF:1154 Postęp GF:1167 Postęp GF:1178 Zakończono obliczanie GF Wykonuję kopię pliku Szukam tablicy partycji Znaleziono tablicę partycji. Blok:2046 Liczba partycji:5 1. Start block:0 Length:214 2. Start block:214 Length:256 3. Start block:470 Length:214 4. Start block:684 Length:1040 5. Start block:1724 Length:200 Zakończono szukanie tablicy partycji Szukam tablicy uszkodzonych bloków Znaleziono tablicę uszkodzonych bloków. Blok:2045 Liczba uszkodzonych bloków w tablicy:1 1. Block:1131 Replace to:2043 Zakończono szukanie tablicy uszkodzonych bloków Koryguję bloki danych Move block. From: 2043 To: 1131 Zakończono korygowanie bloków danych Aktualizuję tablicę uszkodzonych bloków Zakończono aktualizację tablicy uszkodzonych bloków Tworze tablice uszkodzonych blokow Uszkodzony blok: 411 Uszkodzony blok: 1172 Uszkodzony blok: 2040 Uszkodzony blok: 2073 Move block. From: 411 To: 2043 Move block. From: 1172 To: 2042 Move block. From: 2040 To: 2041 Zakończono tworzenie tablicy uszkodzonych blokow Aktualizuję tablicę uszkodzonych bloków Zakończono aktualizację tablicy uszkodzonych bloków Plik gotowy do zaprogramowania pamięci: M:\tmp\15_K9GAG08U0E-SCB0_20170818_170742.bin

Memory verification here:
weryfika..a.txt Download (60.48 kB)

Based on the verification, it can be concluded that the memory has been correctly programmed and verified. Occurring differences max. 2 bits are within the norm, where the norm here is at least 24 bits.

This is the first version of this functionality, so I apologize in advance for the overload of information. I will sort out the chaos as time goes on.

Meanwhile, I invite you to test and see if it really works.

Please also send me the batches as there are generally two versions circulating on the net, the first one with one BBT table and the other one with two BBT tables.
The version with two BBT tables I had only one and, in addition, in my opinion it was probably wrong, because I did not agree with the logical and structure.
#48 16653609 20 Aug 2017 23:05

waldix waldix

Company Account
Level 18

» | Helpful post? (+1)

Post #48
16653609 20 Aug 2017 23:05

Hello

Tomorrow, when I have time, I will let you know how it went because I have two such TV sets on the table to be done.

Regards Waldek

#49 16653839 21 Aug 2017 17:24

funak funak

Level 27

Post #49

16653839 21 Aug 2017 17:24

waldix wrote:
Tomorrow, when I have time, I will let you know how it went because I have two such TV sets on the table to be done.

Revelation, please attach the LOG from the preparation of the file, and possibly send me the source batch.

Added after 6 [minutes]:

Analysis of the transferred batches:

ue32d5500-1023.bin

Spoiler:


Rozpoczęto przytowanie pliku do zapisu
Ustawiam parametry kodera BCH
Generuję tablicę BCH
Obliczam GF
Postęp GF:520
Postęp GF:658
Postęp GF:748
Postęp GF:820
Postęp GF:873
Postęp GF:924
Postęp GF:971
Postęp GF:1012
Postęp GF:1047
Postęp GF:1079
Postęp GF:1106
Postęp GF:1129
Postęp GF:1145
Postęp GF:1160
Postęp GF:1172
Postęp GF:1180
Zakończono obliczanie GF
Wykonuję kopię pliku
Szukam tablicy partycji
Znaleziono tablicę partycji. Blok:2046
Liczba partycji:5
1. Start block:0 Length:214
2. Start block:214 Length:256
3. Start block:470 Length:214
4. Start block:684 Length:1040
5. Start block:1724 Length:200
Zakończono szukanie tablicy partycji
Szukam tablicy uszkodzonych bloków
Znaleziono tablicę uszkodzonych bloków. Blok:2045
Liczba uszkodzonych bloków w tablicy:2
1. Block:594 Replace to:2043
2. Block:944 Replace to:2042
Znaleziono tablicę uszkodzonych bloków. Blok:2044
Liczba uszkodzonych bloków w tablicy:3
1. Block:594 Replace to:2043
2. Block:944 Replace to:2042
3. Block:1483 Replace to:2041
Zakończono szukanie tablicy uszkodzonych bloków
Koryguję bloki danych
Move block. From: 2043 To: 594
Move block. From: 2042 To: 944
Zakończono korygowanie bloków danych
Aktualizuję tablicę uszkodzonych bloków
Biorę pod uwagę tablicę nr 1
Zakończono aktualizację tablicy uszkodzonych bloków
Tworze tablice uszkodzonych blokow
Uszkodzony blok: 411
Uszkodzony blok: 1172
Uszkodzony blok: 2040
Uszkodzony blok: 2073
Move block. From: 411 To: 2043
Move block. From: 1172 To: 2042
Move block. From: 2040 To: 2041
Zakończono tworzenie tablicy uszkodzonych blokow
Aktualizuję tablicę uszkodzonych bloków
Biorę pod uwagę tablicę nr 1
Zakończono aktualizację tablicy uszkodzonych bloków
Plik gotowy do zaprogramowania pamięci:
A:\DUMP-NAND\ue32d5500-1023_K9GAG08U0E-SCB0_20170821_171946.bin

NANDLite_D5500_K9GAG08U0E-SCB0_2_OK.bin
Also two BBT tables

Spoiler:


Rozpoczęto przytowanie pliku do zapisu
Wykonuję kopię pliku
Szukam tablicy partycji
Znaleziono tablicę partycji. Blok:2046
Liczba partycji:5
1. Start block:0 Length:214
2. Start block:214 Length:256
3. Start block:470 Length:214
4. Start block:684 Length:1040
5. Start block:1724 Length:200
Zakończono szukanie tablicy partycji
Szukam tablicy uszkodzonych bloków
Znaleziono tablicę uszkodzonych bloków. Blok:2045
Liczba uszkodzonych bloków w tablicy:1
1. Block:531 Replace to:2043
Znaleziono tablicę uszkodzonych bloków. Blok:2038
Liczba uszkodzonych bloków w tablicy:6
1. Block:0 Replace to:2042
2. Block:531 Replace to:2043
3. Block:2039 Replace to:2038
4. Block:2040 Replace to:2039
5. Block:2041 Replace to:2040
6. Block:2044 Replace to:2038
Zakończono szukanie tablicy uszkodzonych bloków
Koryguję bloki danych
Move block. From: 2043 To: 531
Zakończono korygowanie bloków danych
Aktualizuję tablicę uszkodzonych bloków
Biorę pod uwagę tablicę nr 1
Zakończono aktualizację tablicy uszkodzonych bloków
Tworze tablice uszkodzonych blokow
Uszkodzony blok: 411
Uszkodzony blok: 1172
Uszkodzony blok: 2040
Move block. From: 411 To: 2043
Move block. From: 1172 To: 2042
Move block. From: 2040 To: 2041
Zakończono tworzenie tablicy uszkodzonych blokow
Aktualizuję tablicę uszkodzonych bloków
Biorę pod uwagę tablicę nr 1
Zakończono aktualizację tablicy uszkodzonych bloków
Plik gotowy do zaprogramowania pamięci:
A:\DUMP-NAND\NANDLite_D5500_K9GAG08U0E-SCB0_2_OK_K9GAG08U0E-SCB0_20170821_172427.bin

#50 16655893 22 Aug 2017 00:27

waldix waldix

Company Account
Level 18

» | Helpful post? (0)

Post #50
16655893 22 Aug 2017 00:27

Hello

Two batches, one of which is ripped with NandLit from a working new memory, which, when mounted to the TV, works normally.
Two different televisions and two different old (original ones that were installed in the TV) memories and restarts as they were as they are.
Either bad copy or bad programming. I have access to a working TV and if nothing is explained, I can still make copies and program again, but it's only after Wednesday.
I sent the batches and logs with NandLit to the server.
One is with a batch 100% copied from working memory because I look at this TV every day, I did the other one purely for the experiment and I don't remember where I got it from.

Regards Waldek
#51 16655979 22 Aug 2017 06:41

Lensmen Lensmen

Level 11

» | Helpful post? (0)

Post #51
16655979 22 Aug 2017 06:41

The TV will work, but if you update the software and connect the Smart function? The presence of bad blocks affects the functionality of the TV after upgrading and connecting the internet.

#52 16656035 22 Aug 2017 08:04

funak funak

Level 27

Post #52

16656035 22 Aug 2017 08:04

I received such dumps and their LOGs:


Kasowanie pamięci
ID                	: EC D5 84 72 50 42 EC D5
Manufacturer      	: SAMSUNG
Model             	: K9GAG08U0E-SCB0
Konfiguracja: 
Target count      	: 1
LUN count         	: 1
Block per LUN     	: 2076
Page per Block    	: 128
Page size         	: 8192+436
Rozmiar całkowity 	: 2 292 701 184 bajtów
Error erase block: T:1 L:0 B:3 P:0
Error erase block: T:1 L:0 B:297 P:0
Error erase block: T:1 L:0 B:388 P:0
Error erase block: T:1 L:0 B:757 P:0
Error erase block: T:1 L:0 B:865 P:0
Error erase block: T:1 L:0 B:923 P:0
Error erase block: T:1 L:0 B:999 P:0
Error erase block: T:1 L:0 B:2073 P:0
Kasowanie zakończone
Czas rozpoczęcia  	: 2017-08-21 14:29:29
Czas zakończenia  	: 2017-08-21 14:29:33
Szybkość          	: 528661,959 kB/s

The memory has 8 bad blocks.

Analysis:


Rozpoczęto przytowanie pliku do zapisu
Ustawiam parametry kodera BCH
Generuję tablicę BCH
Obliczam GF
Postęp GF:506
Postęp GF:628
Postęp GF:710
Postęp GF:778
Postęp GF:833
Postęp GF:873
Postęp GF:900
Postęp GF:937
Postęp GF:970
Postęp GF:1000
Postęp GF:1027
Postęp GF:1052
Postęp GF:1075
Postęp GF:1096
Postęp GF:1116
Postęp GF:1130
Postęp GF:1143
Postęp GF:1155
Postęp GF:1167
Postęp GF:1177
Zakończono obliczanie GF
Wykonuję kopię pliku
Szukam tablicy partycji
Znaleziono tablicę partycji. Blok:2046
Liczba partycji:5
1. Start block:0 Length:214
2. Start block:214 Length:256
3. Start block:470 Length:214
4. Start block:684 Length:1040
5. Start block:1724 Length:200
Zakończono szukanie tablicy partycji
Szukam tablicy uszkodzonych bloków
Znaleziono tablicę uszkodzonych bloków. Blok:2045
Liczba uszkodzonych bloków w tablicy:1
1. Block:531 Replace to:2043
Znaleziono tablicę uszkodzonych bloków. Blok:2044
Liczba uszkodzonych bloków w tablicy:2
1. Block:531 Replace to:2043
2. Block:944 Replace to:2042
Zakończono szukanie tablicy uszkodzonych bloków
Koryguję bloki danych
Move block. From: 2043 To: 531
Zakończono korygowanie bloków danych
Aktualizuję tablicę uszkodzonych bloków
Biorę pod uwagę tablicę nr 1
Zakończono aktualizację tablicy uszkodzonych bloków
Tworze tablice uszkodzonych blokow
Uszkodzony blok: 3
Uszkodzony blok: 297
Uszkodzony blok: 388
Uszkodzony blok: 757
Uszkodzony blok: 865
Uszkodzony blok: 923
Uszkodzony blok: 999
Uszkodzony blok: 2073
Move block. From: 3 To: 2043
Move block. From: 297 To: 2042
Move block. From: 388 To: 2041
Move block. From: 757 To: 2040
Move block. From: 865 To: 2039
Move block. From: 923 To: 2038
Move block. From: 999 To: 2037
Zakończono tworzenie tablicy uszkodzonych blokow
Aktualizuję tablicę uszkodzonych bloków
Biorę pod uwagę tablicę nr 1
Zakończono aktualizację tablicy uszkodzonych bloków
Plik gotowy do zaprogramowania pamięci:
D:\internet\samsung_40D5500RX_K9GAG08U0E-SCB0_20170821_143105.bin

After the initial inspection, you can see that this memory has two BBT tables. I only included one in the processing. Thus, block 944 is still not repaired.

Second load:


Kasowanie pamięci
ID                	: EC D5 84 72 50 42 EC D5
Manufacturer      	: SAMSUNG
Model             	: K9GAG08U0E-SCB0
Konfiguracja: 
Target count      	: 1
LUN count         	: 1
Block per LUN     	: 2076
Page per Block    	: 128
Page size         	: 8192+436
Rozmiar całkowity 	: 2 292 701 184 bajtów
Error erase block: T:1 L:0 B:854 P:0
Error erase block: T:1 L:0 B:937 P:0
Error erase block: T:1 L:0 B:2073 P:0
Kasowanie zakończone
Czas rozpoczęcia  	: 2017-08-21 13:53:48
Czas zakończenia  	: 2017-08-21 13:53:52
Szybkość          	: 501597,354 kB/s

And processing:


Rozpoczęto przytowanie pliku do zapisu
Ustawiam parametry kodera BCH
Generuję tablicę BCH
Obliczam GF
Postęp GF:512
Postęp GF:636
Postęp GF:722
Postęp GF:789
Postęp GF:842
Postęp GF:885
Postęp GF:923
Postęp GF:958
Postęp GF:990
Postęp GF:1017
Postęp GF:1041
Postęp GF:1064
Postęp GF:1085
Postęp GF:1105
Postęp GF:1122
Postęp GF:1135
Postęp GF:1147
Postęp GF:1159
Postęp GF:1169
Postęp GF:1178
Zakończono obliczanie GF
Wykonuję kopię pliku
Szukam tablicy partycji
Znaleziono tablicę partycji. Blok:2046
Liczba partycji:5
1. Start block:0 Length:214
2. Start block:214 Length:256
3. Start block:470 Length:214
4. Start block:684 Length:1040
5. Start block:1724 Length:200
Zakończono szukanie tablicy partycji
Szukam tablicy uszkodzonych bloków
Znaleziono tablicę uszkodzonych bloków. Blok:2045
Liczba uszkodzonych bloków w tablicy:1
1. Block:531 Replace to:2043
Znaleziono tablicę uszkodzonych bloków. Blok:2040
Liczba uszkodzonych bloków w tablicy:4
1. Block:214 Replace to:2042
2. Block:531 Replace to:2043
3. Block:2041 Replace to:2040
4. Block:2044 Replace to:2040
Zakończono szukanie tablicy uszkodzonych bloków
Koryguję bloki danych
Move block. From: 2043 To: 531
Zakończono korygowanie bloków danych
Aktualizuję tablicę uszkodzonych bloków
Biorę pod uwagę tablicę nr 1
Zakończono aktualizację tablicy uszkodzonych bloków
Tworze tablice uszkodzonych blokow
Uszkodzony blok: 854
Uszkodzony blok: 937
Uszkodzony blok: 2073
Move block. From: 854 To: 2043
Move block. From: 937 To: 2042
Zakończono tworzenie tablicy uszkodzonych blokow
Aktualizuję tablicę uszkodzonych bloków
Biorę pod uwagę tablicę nr 1
Zakończono aktualizację tablicy uszkodzonych bloków
Plik gotowy do zaprogramowania pamięci:
D:\internet\K9GAG08U0E\odczyt1_nowa_pamiec_K9GAG08U0E-SCB0_20170821_135413.bin

From the processing it appears that the batch also has 2 BBT tables, but unfortunately a second table with strange entries.

In summary, both processing may not work properly.
In the first one, both BBT tables should be taken into account, while the second batch looks like it is wrong. Correctly read but logically incorrect.

ADVERTISEMENT
#53 16656356 22 Aug 2017 12:01

waldix waldix

Company Account
Level 18

» | Helpful post? (0)

Post #53
16656356 22 Aug 2017 12:01

Hello

I do not know if it matters, but when I sent files to the server, I included the batch in one of them before processing and in the other after processing, just to let you know.
We have to master the subject because the third TV set is on its way to me.

In summary, it turns out that if we even assumed at this point that both batches are 100% well copied and functional, they may not work anyway due to poor processing? I understand well?

If so, as I said before, I can make a copy of a working TV and there will be 3 pieces for testing, but only after Wednesday. And, like a colleague funak, he will of course have time to improve the algorithm.

Regards Waldek
#54 16656402 22 Aug 2017 12:26

funak funak

Level 27

» | Topic author Helpful post? (0)

Post #54
16656402 22 Aug 2017 12:26

After careful analysis, it looks like the batch: samsung_40D5500RX.bin is a good batch.
Only during processing I did not take into account the entries in the second BBT table, as a result of which the actual contents of block 944 are overwritten with the contents of block 297, i.e. the batch destroyed.

I will make the amendment taking into account the second table this afternoon based on the samsung_40D5500RX.bin batch.

I conclude that the two BBT tables differ only in one BBT block entry that occurred later in time. I assume that the processor (on the TV) has to:

1. Delete BBT1
2. Copy the contents of BBT2 to BBT1
3. Delete BBT2
4. And just add a new block to the BBT2 list.

As the K9GAG08U0E memory is nominally programmable only once. So the parameter NOP = 1. To save again, first delete the block.

Added after 1 [minutes]:

waldix wrote:
Hello
If so, as I said before, I can make a copy of a working TV and there will be 3 pieces for testing, but only after Wednesday. And, like a colleague funak, he will of course have time to improve the algorithm.

I would very much like to ask you to make a copy from a working TV.
Overall, it is best to take two readings of the same bone.
I will compare the content bit by the way to check. whether the content is also read correctly.
#55 16656432 22 Aug 2017 12:35

Lensmen Lensmen

Level 11

» | Helpful post? (0)

Post #55
16656432 22 Aug 2017 12:35

Now there are 2 TVs with K9GAG08U0E on the table, there is also an excellent dump, but there is no your prog.
It is not necessary to remove broken blocks, they need to be shifted
#56 16656535 22 Aug 2017 13:21

funak funak

Level 27

» | Topic author Helpful post? (+1)

Post #56
16656535 22 Aug 2017 13:21

I would also like to inform you that the batches sent to me are anonymous. Due to the protection of personal data, etc.
The only thing that distinguishes them is the file name and the MD5 checksum.
So please let me know what the analysis is about.
#57 16657709 22 Aug 2017 21:44

waldix waldix

Company Account
Level 18

» | Helpful post? (0)

Post #57
16657709 22 Aug 2017 21:44

Hello

"samsung_40D5500RX.bin is a good batch." - I think so too, I made the drop with NandLit from a working bone.
On Thursday, when I have time, I will take two readings from a working bone and upload NandLit to the server.

Regards Waldek
#58 16661966 25 Aug 2017 07:21

Lensmen Lensmen

Level 11

» | Helpful post? (0)

Post #58
16661966 25 Aug 2017 07:21

We discuss in Ukraine http://www.tele-servis.ru/forum/viewtopic.php?t=8478
#59 16664609 26 Aug 2017 15:55

funak funak

Level 27
» | Topic author Helpful post? (+3)

Post #59
16664609 26 Aug 2017 15:55

New version of the application: 1.0b1014.84

In the new version:
- a large number of signatures for new layouts have been added
- K9GAG08U0E (D5500) programming algorithm improved to test
- anonymous sending of statistical data on the use of the application has been added, above all sending the LOG from the Read / Write / Erase functions

I also include an offline version

Attachments:

NANDLite_1.0b1014.84.zip Download (2.34 MB)
#60 16664631 26 Aug 2017 16:08

Lensmen Lensmen

Level 11

» | Helpful post? (+1)

Post #60
16664631 26 Aug 2017 16:08

In the new version, the window size is incorrect, too large. Only producent, symbol, id should be left
The language doesn't change either.
Create an account, log in and become active in a forum and ads will not appear. You will receive points by participating in discussions.
Join this discussion.

Install the application

Reply Cool? Ranking DIY | New topic

Notify about new articles

Report a violation of the law

Topic summary

The discussion centers on the development and use of a low-cost Flash NAND memory programmer designed specifically for TSOP48 packaged NAND Flash chips. The programmer targets applications such as reading and programming NAND Flash from devices like flash drives, TVs, routers, and modems, offering an affordable alternative to expensive professional tools. The design includes a permanently soldered TSOP48 socket and uses an FT245 USB interface combined with an Atmel XMEGA microcontroller for flexible control and hardware timing measurements. Software development focuses on supporting various NAND Flash memory types, including multi-die ("4 die") memories, and implementing error correction algorithms such as BCH capable of correcting multiple bit errors per 512-byte sector. The NANDLite application supports reading, writing, erasing, and batch uploading of NAND dumps for analysis and algorithm improvement, including handling bad block tables (BBT) and ECC data correction. Specific NAND Flash models like Samsung K9GAG08U0E and Toshiba TC58NVG6T2FTA00 are extensively tested, especially in relation to Samsung D5500 series TVs. Challenges discussed include addressing discontinuous memory spaces, bad block management, different addressing schemes (e.g., Toshiba's additional page addressing commands), and the complexity of NAND file systems like UBIFS. The project is evolving with plans for faster data transfer rates (up to 50MB/s in future versions), improved software interface, multilingual support, and expanded memory support including eMMC in the future. Comparisons with commercial programmers such as RT809H and Lens-Men highlight differences in speed, functionality, and openness of software. The community contributes NAND dumps for analysis to enhance error correction and bad block handling algorithms. The discussion also touches on hardware considerations like the quality of Chinese TSOP48 sockets, USB driver compatibility (including Windows XP support), and the limitations of TSOP48 packaging as industry shifts toward BGA and FBGA packages, suggesting ISP programming as a future direction.
Summary generated by the language model.

Home page
/
Forum
/
DIY Projects
/
Flash NAND Lite Memory Programmer! TSOP48

FAQ

TL;DR: NANDLite v1 erases 512-MBit chips at 4.8 MB/s, “the TV came to life” after one flash [Elektroda, funak, post #16067358][#16667571]. First-time users need <3 min setup. Why it matters: hobbyists get pro-level NAND support without €900 lab gear.

Quick Facts

• Firmware: NANDLite! _R1.0v1.0b1024a [Elektroda, funak, post #18353353]
• Max measured write speed: 2.7 MB/s NAND→XMEGA, 980 kB/s PC link [Elektroda, funak, post #15973950]
• Auto-erase rate: 4.8 MB/s on 69 MB ST NAND512W3A [Elektroda, funak, post #16067358]
• Supported IC signatures: 70 + (SLC, MLC, ONFI) [Elektroda, funak, post #16449394]
• Kit price: approx. PLN 450; worldwide shipping PLN 21 [Elektroda, mailo, post #17314701][#17949208]

Which Windows versions run the current NANDLite software?

The online release 1.0.1014.89 runs on Windows XP, 7, 8, 10 (32 / 64-bit). SmartScreen blocks can be bypassed via “More info → Run anyway” [Elektroda, funak, post #18359665]

How fast can I dump a 2 GB K9GAG08U0E?

With v1 hardware set to 750 kB/s link speed, a full 2 GB read finishes in about 45 minutes; v2.0 (USB 3.0 + FPGA) targets 40 MB/s, cutting time to ≈55 s [Elektroda, funak, post #18250769]

What error level is acceptable during verify?

SLC devices allow 1-4 bit errors per 2 kB page; MLC K9GAG08U0E tolerates up to 24 bit flips—verify will flag but ECC corrects them in-device [Elektroda, funak, post #17878605][#16649962].

Can I add an unsupported NAND ID myself?

Yes. Pick a chip with matching geometry from the list, edit LUN-, block- and page-sizes, then save as a custom XML entry. Example: TC58BVG0S3HTA00 added by user in 5 min [Elektroda, bolvan, post #18061891]

Edge-case: app closes on erase under Windows XP. Fix?

Upgrade to Win 7 or newer; the crash is XP-specific to .NET 3.5 threading [Elektroda, tomasz w., #18170875][fachura, #18171637].

How do I prepare a Samsung D5500 dump?

Detect K9GAG08U0E.
Press “Prepare file D5500”; select source dump and output file.
Click “Erase”, then “Write”. The wizard remaps all bad blocks and recreates the BBT automatically [Elektroda, funak, post #16649962]

Does NANDLite handle eMMC or SPI NOR?

v1.0: only parallel NAND. v1.2 will add SPI/I²C via EXT header; v2.0 will add eMMC and NOR through USB 3.0/FPGA adapter [Elektroda, funak, post #18223831]

What is the largest page size validated?

16 384 + 1 280 B pages (Hynix H27UCG8T2BTR-BC, 64 Gbit). Verify reports <130 flipped bits per page—well within the 640-bit ECC budget [Elektroda, funak, post #16876251]

How do I flash chips that need 1.8 V I/O?

Use NANDLite v2.0 or v1.0 with the dual-voltage adapter; set supply to 1.8 V and leave VCC at 3.0 V as per ONFI [Elektroda, funak, post #17298560]

Where can I buy genuine TSOP48 sockets?

Original Yamaichi TSOP48 cost ≈PLN 180 at Semicon; tested Chinese clones work but lose spring tension after ~100 insertions [Elektroda, tplewa, post #15976786][funak, #15979863].

Statistic: how many bad blocks are typical on a blank 8 GB MLC?

Four bad blocks (0.2 %) per die is typical; sample K9GAG08U0E showed 8 bad blocks right after erase [Elektroda, funak, post #16656035]

Can I program OneNAND or BGA eMMC today?

No. They need different command sets; support is planned for NANDLite 2.0 only [Elektroda, funak, post #17659451][#18223831].

Failure fact: what causes endless verify loops?

If geometry is unset (page = 0), the app enters an infinite verify loop—select a matching chip definition first [Elektroda, funak, post #18400138]

Quote from the author about future-proofing?

“Three versions will coexist and all will keep product support” [Elektroda, funak, post #18226506]