Disk On Chip Firmware

[2PAC Mafia]

Hi guys,

looking for somebody with experience reading and programming firmware from a Disk On Chip device. We have done some attemps via JTAG and also removing the chip to read it through ISA bus not successful, only read boot section by JTAG. I attach datasheet.

Device is MD4832-d512-V3Q18-X-P-JP (BGA). Thanks in advance.

 

[sagor1]

I suspect the chip is read protected, as mentioned on page 2 of the datasheet:

"Two configurable hardware-protected
partitions for data and code:"

They have separate protection for the boot code, which in your case seem to not be enabled...
You may need a "security key" or code to be able to read the rest of the chip. See section 3.4.1 of the datasheet:

"A protected partition may be protected by either/both of these hardware mechanisms:
• 64-bit protection key
• Hard-wired LOCK# signal"
If they used a 64 bit key, no way you can read that chip without that key.

That said, have you tried toggling the "LOCK#" pin when trying to read the chip?

 

[2PAC Mafia]

Thank you for reading and helping.

I already checked for LOCK pin and it is hardwired directly to High state.

About 64 bit protection key I don´t know how to confirm if it is protected or not. I was thinking about special software "driver" TrueFFS which is used at this device. It seems it is like a bridge to the flash data content and may be JTAG is not able to get access due to that. I read all the possible address and possible extension and as I said I saw boot section and in other sections full of 0, but in a small section I saw MSWin4.1 and also TFAT12 hidden (right side alphanumeric section). I don´t know if that is giving some information.

We also tried to get access with XP PC with ISA bus, we took the flash out and solder in an adapter connected to an ISA interface made by us, but as you can read in datasheet this device is very special so I think to get access you have follow some main steps, if you don´t accomplish the device can become inaccessible. The PC didn´t recognize the device at any moment.

I tried to contact to companies to get original reader called FlashPak from M-Systems but we don´t have the adapter for that anyway...