VNR Silicon Motion AI XOR
When you work with devices based on modern Silicon Motion controllers, it is essential to separate a dump by planes. Before separating the planes, it's necessary to determine how many planes exist per crystal/dump.
There are two methods to verify the number of planes:
1. Using LBN (Logical Block Number) Values.
To check the boundaries of the planes, it's helpful to use the "Highlight Blocks" option in the Bitmap View tab. This allows you to pinpoint the start of each block.
Next, locate the Service Area (SA). In older devices, the LBN is stored in the second and third bytes of the SA, while in modern devices, it’s found in the third and fourth bytes.
If the LBN is the same across two neighboring blocks, the NAND has two planes. However, if the LBN is the same across four blocks, the NAND has four planes.
Example:
There are two methods to verify the number of planes:
1. Using LBN (Logical Block Number) Values.
To check the boundaries of the planes, it's helpful to use the "Highlight Blocks" option in the Bitmap View tab. This allows you to pinpoint the start of each block.
Next, locate the Service Area (SA). In older devices, the LBN is stored in the second and third bytes of the SA, while in modern devices, it’s found in the third and fourth bytes.
If the LBN is the same across two neighboring blocks, the NAND has two planes. However, if the LBN is the same across four blocks, the NAND has four planes.
Example:
Four blocks with the same LBN indicate four planes.
2. For devices with bad columns, the position of the bad column and the shift at the end of the page remain the same within one plane. This pattern can be used to detect the number of planes.
Example:
At the end of the page, blocks between planes may appear misaligned. If the bad column and page-ending line match every second block, the NAND has two planes. In the case of four planes, the position of the bad column and page boundary will match every fourth block.
Once the number of planes is known, proceed with separation. Use the "Divide" option and input the number of planes. This operation generates Offset elements for each plane, with the number of elements equal to the number of planes.
If the dump does not contain bad columns, it's necessary to determine the ECC correction code and adjust the page layout. However, if bad columns are present, use the "Bad Byte Columns Remover" tool and set it to 1 plane. This step is crucial, as bad columns will shift positions in the XOR sequence, and this information is necessary for SM AI XOR element.
After removing bad columns for each page, you can generate the XOR for each plane. However, AI XOR only functions correctly when the page layout is properly defined, so verify this before starting the XOR analysis.
Most controllers handle bad columns by skipping them initially and then generating the XOR key. Therefore, the XOR remains static, regardless of the bad column location. However, SM controllers work differently—XOR generation happens before removing bad columns. As a result, the XOR shifts to where the bad columns were, producing a unique XOR for each plane. Because of this, it was necessary to divide the dump and process each plane individually.
After generate the XOR for all planes, the next step is to determine the page allocation between them. To do this, compare both images at the same addresses in several locations.
For SM controllers, two conditions must be checked:
LBN values at the same addresses.
Data patterns at the same addresses.
If either the patterns or LBN values differ, the elements need to be merged according to the dump size.
Example:
Different LBN values at the same addresses across planes, so unite bitmaps is by dump size.
If the LBN values are the same (like it is on the first picture in this article) and the data patterns match, unite the elements by page size.
In modern SM controllers, page allocation is often divided between planes. However, it's better to avoid merging areas by pages after XOR, as 2-10% of blocks might have asymmetric Multi plane page allocation (You can read more about asymmetric page allocation here). To resolve this, sort and select only the necessary blocks for each plane using the block manager. Ensure all elements have the same block sets and sizes before uniting them.
In modern SM controllers, page allocation is often divided between planes. However, it's better to avoid merging areas by pages after XOR, as 2-10% of blocks might have asymmetric Multi plane page allocation (You can read more about asymmetric page allocation here). To resolve this, sort and select only the necessary blocks for each plane using the block manager. Ensure all elements have the same block sets and sizes before uniting them.
Finally, connect all elements using the "Unite" function—8192 bytes for ~9KB pages, or 16384 bytes for ~17-18KB pages.
Example:
Example:
Four planes with modern SM devices, where the physical page size is 18,432 bytes, and blocks are sorted within the planes. All data areas are connected using 16384 bytes.
Related Articles
Silicon Motion(SM) controllers - Data recovery
We can find plenty of NAND controllers on the market and without any doubt one of the most popular is SiliconMotion. These controllers found their use in all kinds of flash devices, starting from USB flash drives, SD cards, monolithic devices, and ...Phison dynamic XOR
Majority of NAND memory devices that use scrambling algorithms generate their XOR keys statically. When a user writes new data to the NAND chip, the controller transforms this data with the XOR key that is generated every time with the same binary. ...Xored Bad Columns in SM2685 and Some SM Monolithic Devices
In most cases, Silicon Motion (SM) controllers with NAND memory and bad columns are relatively simple to handle. The typical steps - dividing planes, removing bad columns for each plane, and generating a custom XOR - are the same and are described in ...VNR File Assembler
NAND controllers write data to memory chips by logical blocks in mixed order. Therefore, recovering files from such mixed dumps would fail as files may begin in one block and continue in another that is located somewhere else, not necessarily after. ...XOR transformation
Scrambling (XOR) Modern Flash controllers utilize scrambling algorithms when recording data into flash memory. A typical scrambler implementation is based on the method where the special scrambling (XOR) key is generated by a controller and mixed ...