| Author |
Message |
pcimage
Joined: 03 Mar 2008
Posts: 1768
Location: UK
|
 Posted: Tue Mar 11, 2008 17:09 Post subject: Sandisk Memory Stick
|
|
Hi, please help with this.
Sandisk Memory Stick.
Controller Chip "Sandisk 20-99-00056-4"
Found FAT, block size appears to be 0x21000.
Which utility to use and with which parameters?
Thank you!!
300K sample attached[/img]
|
|
|
pcimage
Joined: 03 Mar 2008
Posts: 1768
Location: UK
|
|
Posted: Tue Mar 11, 2008 17:42 Post subject:
|
|
Pic of stick, if it helps.
Flash chip is Samsung K9K4G08UON
I think maybe I should be using the 8080_0101 utility?
But I think the markers are at the beginning ("80 C0" etc)
|
|
|
Сергей
Joined: 26 Aug 2005
Posts: 20281
Flash-Extractor developer
|
|
Posted: Tue Mar 11, 2008 18:11 Post subject:
|
|
Dump_Search / Listing
Block_Size 0x4200
Sector 0/7/512/8
rar & attach
|
|
|
pcimage
Joined: 03 Mar 2008
Posts: 1768
Location: UK
|
|
Posted: Tue Mar 11, 2008 18:30 Post subject:
|
|
Lising (using Virtual Translator I presume)
Block Size 0x4200
0/7/512/8
All I get is...
Canceled.
Data Corrupt: Sector Size must be 528 * 2
|
|
|
Сергей
Joined: 26 Aug 2005
Posts: 20281
Flash-Extractor developer
|
|
Posted: Tue Mar 11, 2008 18:56 Post subject:
|
|
ups :)
Dump_Search / Listing
Block_Size 0x4200
Sector 0/7/512/9
|
|
|
pcimage
Joined: 03 Mar 2008
Posts: 1768
Location: UK
|
|
Posted: Tue Mar 11, 2008 19:59 Post subject:
|
|
Ok, that's better.
RAR text file attached (part 1)
|
|
|
pcimage
Joined: 03 Mar 2008
Posts: 1768
Location: UK
|
|
Posted: Tue Mar 11, 2008 20:00 Post subject:
|
|
Part 2...
This shows groups of 8, so I presume this mean block size IS 0x21000, right?
(8* 0x4200)
|
|
|
Сергей
Joined: 26 Aug 2005
Posts: 20281
Flash-Extractor developer
|
|
Posted: Tue Mar 11, 2008 20:36 Post subject:
|
|
Try use
Dump_Search / Virtual_Translator
Block_Size 0x21000
Sector 0/7/512/9
find 1-3 blocks
show results
|
|
|
pcimage
Joined: 03 Mar 2008
Posts: 1768
Location: UK
|
|
Posted: Tue Mar 11, 2008 21:02 Post subject:
|
|
| Сергей wrote: | Try use
Dump_Search / Virtual_Translator
Block_Size 0x21000
Sector 0/7/512/9
find 1-3 blocks
show results |
You mean?...
Right click on VT.........block size 0x21000......Sector 0/7/512/9
Then put...
1/0x3DE000
2/0x3FF000
3/0x420000
4/0x441000.... in the box?
(0X3DE000 is the first block i can see, after the uniform data of FAT, correct?)
The right click on each of the blocks, and "show"??
If I am correct, it gives.....
| Code: | Sector 00 80 00 08 14 bd 85 ff 6f 90 dd 83 73 1c 2a ff c0
Sector 01 80 00 08 14 bd 85 ff 68 dd 79 49 e8 81 b5 d9 00
Sector 02 80 00 08 14 bd 85 ff 16 df 51 91 a6 e9 40 65 c0
Sector 03 80 00 08 14 bd 85 ff 81 87 81 f2 e1 35 e2 bc c0
Sector 04 80 00 08 14 bd 85 ff 8e b5 ed 2e 21 b9 ea d0 80
...
|
|
|
|
Сергей
Joined: 26 Aug 2005
Posts: 20281
Flash-Extractor developer
|
|
Posted: Tue Mar 11, 2008 21:52 Post subject:
|
|
tage "Code" is more readable :)
We can see that first byte is sector number.
You need put blocks in this box by order in image (not in dump).
How to do it read in Block_Number / Example_1 / Virtual_Translator
We need this to determine where is marker.
I can do it myself, if you put full dump.
|
|
|
pcimage
Joined: 03 Mar 2008
Posts: 1768
Location: UK
|
|
Posted: Wed Mar 12, 2008 0:50 Post subject:
|
|
Not sure what you mean by "first byte is sector number"?
All the first bytes are "80"
Sorry for being stupid! 
I'm putting full dump up now ("1.rar" in pcimage folder).
|
|
|
Сергей
Joined: 26 Aug 2005
Posts: 20281
Flash-Extractor developer
|
|
Posted: Wed Mar 12, 2008 0:57 Post subject:
|
|
| pcimage wrote: | | Not sure what you mean by "first byte is sector number"? |
Sorry, may be i look other way...
Waiting dump
|
|
|
pcimage
Joined: 03 Mar 2008
Posts: 1768
Location: UK
|
|
Posted: Wed Mar 12, 2008 1:03 Post subject:
|
|
Hey!!
Too quick for me! My connecton is slow!! 
Still uploading.
Do you mean I have to make virtual translator by putting blocks in order?
i.e.
80 00 01
80 00 02
80 00 03
80 00 04
...
...
...
That would take for ever!!
|
|
|
Сергей
Joined: 26 Aug 2005
Posts: 20281
Flash-Extractor developer
|
|
Posted: Wed Mar 12, 2008 1:11 Post subject:
|
|
I wan't you to put blocks in order they go in disk image.
We need only 3-4 block to determine where is block number in system area (SA).
When you save image in Virtual_Translator, you can see SA of first sectors of each block.
Blocks already sorted by you.
|
|
|
pcimage
Joined: 03 Mar 2008
Posts: 1768
Location: UK
|
|
Posted: Wed Mar 12, 2008 2:01 Post subject:
|
|
| Сергей wrote: | I wan't you to put blocks in order they go in disk image.
We need only 3-4 block to determine where is block number in system area (SA).
When you save image in Virtual_Translator, you can see SA of first sectors of each block.
Blocks already sorted by you. |
OK, I think I have done as you asked..
Into the box I put...
0/0x3ba8d0/boot
1/0xa0bf000
2/0xa122000
3/0xa1a6000
4/0xa28d000
5/0xa2ae000
and file attached is the "show" from these blocks.
Is this what we need?
This is quite different to the example!!
In fact when I raw-file search this "disk.image" with Winhex I can see half a photo.
Cheers
Sean
|
|
|
|
