Xored Bad Columns in SM2685 and Some SM Monolithic Devices
In most cases, Silicon Motion (SM) controllers with NAND memory and bad columns are relatively simple to handle.
The typical steps - dividing planes, removing bad columns for each plane, and generating a custom XOR - are the same and are described in detail in this article:
How to Handle bad columns and XOR in SM Controllers – Rusolut Knowledge Base
However, in flash data recovery, one rule is certain: there are always exceptions.
One exception occurs with devices using the SM2685 controller, commonly found in monolithic designs.
In these devices, the problem is bad columns, but unlike standard cases, the XOR is adjusted on bad columns — it is generated bit by bit on each bad column, making it extremely difficult to identify their exact locations.
How to Deal with XORed Bad Columns
However, in flash data recovery, one rule is certain: there are always exceptions.
One exception occurs with devices using the SM2685 controller, commonly found in monolithic designs.
In these devices, the problem is bad columns, but unlike standard cases, the XOR is adjusted on bad columns — it is generated bit by bit on each bad column, making it extremely difficult to identify their exact locations.
How to Deal with XORed Bad Columns
1.Initial Diagnosis - Are Bad Columns Present?
First, you need to determine if bad columns are present. Look for these indicators:
Low ECC (Error Correction Code) search results
Shifted blocks at the end of the page
The entire page looks like noise, and bad columns are not visible.
If these symptoms are present, XORed bad columns are likely involved.
2. Plane Division and Initial Setup
As described in the linked article above, divide the dump into planes and set up the BCR (Bad Column Remover) for a single plane.
This article focuses specifically on locating and handling bad columns.
3. Extracting a Data Block
After plane division and before running the bad column remover:
Find one block containing user data.
Use the XOR Analyzer — not to find the XOR pattern, but to quickly extract a data block.
After plane division and before running the bad column remover:
Find one block containing user data.
Use the XOR Analyzer — not to find the XOR pattern, but to quickly extract a data block.
You don't need to complete a full XOR analysis — simply cancel at the beginning and find the data block manually.
4. Using the Block as a Temporary XOR
Use the extracted block as a temporary XOR — not to de-XOR the full data, but to make XORed bad columns visible.
5. Finding Bad Columns
With the temporary XOR loaded:
First, locate a bitmap containing user data.
Then, apply the Alcor Micro controller algorithm, which searches for repeating bytes.
With the temporary XOR loaded:
First, locate a bitmap containing user data.
Then, apply the Alcor Micro controller algorithm, which searches for repeating bytes.
This method makes bad columns easier to spot because they typically appear as areas of repeating bytes after XORing two data blocks together. This behaviour is typical for this specific type of SM device.
6. Eliminating False Positives
As with any algorithm, it is not perfect.
At the end of each page, you may find false positives — vertical stripes that are actually part of the ECC (Service Area correction).
To remove false positives:
Hold down the Ctrl key and left-click with the mouse to unselect them.
As with any algorithm, it is not perfect.
At the end of each page, you may find false positives — vertical stripes that are actually part of the ECC (Service Area correction).
To remove false positives:
Hold down the Ctrl key and left-click with the mouse to unselect them.
7. Finalizing the BCR Setup
Once all bad columns have been correctly marked:
Disconnect the BCR element from the temporary XOR.
Connect it to the Plane Offsets.
If the ECC search still returns a low result:
Double-check the bad column positions and adjust them if necessary.
Once ECC results are sufficiently high, select the correct ECC correction code and proceed to the next plane.
8.Final Steps
After successfully handling bad columns, all remaining recovery steps are standard — the same as for any SM device with bad columns.
Conclusion
Recovering data from devices using the SM2685 controller with bitwise XORed bad columns is more complex than in typical cases.
However, by extracting a data block, using it as a temporary XOR, and applying repeating byte detection algorithms, it is possible to efficiently locate and correct bad columns.
Patience and careful validation at each step are key.
Following this method carefully, even complicated cases can result in a successful and complete data recovery.
Recovering data from devices using the SM2685 controller with bitwise XORed bad columns is more complex than in typical cases.
However, by extracting a data block, using it as a temporary XOR, and applying repeating byte detection algorithms, it is possible to efficiently locate and correct bad columns.
Patience and careful validation at each step are key.
Following this method carefully, even complicated cases can result in a successful and complete data recovery.
Related Articles
NAND Bad Columns. Bad Column Remover
Each time during the chip-off data recovery, after the physical image extraction, and before any further step, it's necessary to check the quality of the dump. Due that memory chips are being read physically, the extracted dump may contain defects. ...Silicon Motion(SM) controllers - Data recovery
We can find plenty of NAND controllers on the market and without any doubt one of the most popular is SiliconMotion. These controllers found their use in all kinds of flash devices, starting from USB flash drives, SD cards, monolithic devices, and ...AU Monolith Devices with Bad Pages
In the market for USB flash drives, many monolithic devices can be found. Often, these devices contain Alcor Micro (AU) controllers. While most of them function in a standard way, some exhibit unique characteristics. It is possible applied XOR, bit ...VNR Silicon Motion AI XOR
When you work with devices based on modern Silicon Motion controllers, it is essential to separate a dump by planes. Before separating the planes, it's necessary to determine how many planes exist per crystal/dump. There are two methods to verify the ...NAND Bad Columns analysis and removal
Every crystal of modern NAND chip consists of several planes. Typically, it consists of 2 or 4 planes. The plane consists of an array of memory cells grouped into pages and blocks. Planes are connected so that Plane 0 is composed of even physical ...