I am working for a few months on dumping the content of a certain NAND Flash. This is the first time that I am doing this so I needed some time to get a good idea of how this works.

The NAND Flash that I am working with is this one: https://datasheetspdf.com/pdf-file/1226904/GigaDevice/GD5F1GQ4UCYIG/1

Unfortunately I can't desolder the Flash so it's still attached to the board. I set a connection to all 8 pins of the Flash and I keep the chip at reset so that it doesn't interfere when I power up the NAND Flash.

I use a Bus Pirate v4 to communicate with it and the connection between the BP and the Flash looks like this one here: https://www.flashrom.org/Bus_Pirate

My idea was to communicate with the Bus Pirate via SPI with my NAND Flash, since the datasheet provides the commands for a page read. The problem is when I try to read the same page I get every time a different output.

In the datasheet is written at page 5: " The device will automatically read first page of first block to cache after power on, then host can directly read data from cache for easy boot. Also the data is promised correctly by internal ECC."

So I tried to use the following command in BPs SPI Mode right after the power up: [0x03 0x00 0x00 0x00 r:2048]

If I understand it correctly the 0x03 command should be read from Cache (which should contain the first page at this point). When I reset the board and try it again I get a different result and most of the output are zero bytes which looks kind of wrong to me. Does anyone have an idea why this is not working or if I do something wrong?

  • \$\begingroup\$ "I keep the chip at reset" -- presumably that's another chip on the same board as the flash. How do you know that keeping it in reset prevents it from interfering with the Bus Pirate? Perhaps you should instead let the chip boot normally, and capture the activity using the BP as a logic analyzer. \$\endgroup\$ – Dave Tweed Sep 18 at 11:46
  • \$\begingroup\$ Let's assume I would do that. Would I still be able to dump the entire flash? If I let the chip boot normally am I still able to send my flash commands to perform a page read? I was keeping the chip at reset because I thought this could be a potential troublemaker. \$\endgroup\$ – Ramazuri Sep 18 at 12:04
  • \$\begingroup\$ It would at least allow you to verify that you're using the correct command and what the correct contents of page 0 are, and that the chip isn't driving some of the signal even when held in reset. And if you capture the entire boot process, you'll have all of the contents of the flash that the chip is using. \$\endgroup\$ – Dave Tweed Sep 18 at 12:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.