SanDisk Sansa Clip+ Recovery nand

[ansewy789123]

 Hello! Tell me please how to restore nand ? Removed nand from the player restored with

ru.aliexpress.com/item/TSOP48-Flash-Eraser-Support-TSOP48-pin-AU6989SNHL-GT-UFD-Controller-NAND-Flash-Sorting-Erasing-Burn-in/32766446082.html?spm=a2g0v.10010108.1000016.1.Qxkw3H&isOrigTitle=true

Nand working 100% but the player does not see it. As it should be stitched nand, so that the player sees it?
Thank you so much! With me a gift 

[saratoga]

What did you flash to the NAND? 

[ansewy789123]

Nand I have formatted (not a player) and installed there the firmware (also not in the player)
I have 4 GB is defined as follows:

[Mihail Zenkov]

Are you have some reaction from player (message on screen or usb drive)?

[ansewy789123]

Player is detected only 32 mb.

[Mihail Zenkov]

Did you do dump of nand before writing on it? Maybe firmware should be written with some offset or should have some special formatting.

We still don't know how internal drive work: from software (driver) point it looks like ordinary SD card. So player should have sd to nand controller and probably some configuration bits for it.

Dongs at IRC (https://www.rockbox.org/irc/log-20170101) try replace nand. You can try to ask him.

[ansewy789123]

I formatted NAND, and then put in the firmware. And, perhaps, the size of the flash drive is different, because of this does not work in the player? (The working NAND in Figure 1 of the player, and the second is not a robotic NAND in the player, see Figure 2)

[saratoga]

There is some information on the AMS SD formatting on the wiki, but it is complex because so many different players and two hardware revisions exist, so not all of it may be exactly right on the clip+.  My memory is that the stock firmware is stored as an image at the start of the SD which is hidden by the firmware.  The rockbox SD driver can read/write this area, but we hide it to keep the user from damaging the stock firmware.  When you short out the NAND and get the player to boot up in the "recovery" mode, you see the entire SD up to the first few GB, including the firmware.  Below the level of the SD (and unaccessible to rockbox) is the raw NAND, which probably includes some additional space used to store the SD to NAND cell mapping. 

I think ideally you would need an image from a desoldered NAND chip to flash to a new NAND.  This should set up the NAND with all the SD translation tables.  If you don't have that, the SD controller may be smart enough to recreate it, or it may refuse to boot.  I don't think anyone beyond Dongs ever looked at it, and he did not get it working. 

[ansewy789123]

thanks for answers! Tell me please, is this JTAG correct for the firmware of the player?

https://ru.aliexpress.com/item/USB-Blaster-Rev-C-Universal-Edition-FPGA-CPLD-Download-line-download-cable/32433221548.html?spm=a2g0v.10010108.1000016.1.38f7f731m9KgbM&isOrigTitle=true

[vitt13]

Similar story to me. 
NAND is died, I had all of the symptoms was not able to boot rockbox or OF. I tried many of recovery manuals but had no luck. I tried so many times that resulted shorting 29-30 pins gives only 32MB storage and never 3.9GB.
Then I tried to replace NAND with well known Samsung 2GB one - no success, since bootloader has no support other nand ID than SANDISK.
I tried to find any new or used SANDISK NAND ICs with known IDs on e-stores but have no luck. Probably few years ago I'd find some USB stick with Sandisk NAND TSOP48 but not this year - only have found Samsung or Hynix NAND on sale.
Then I found USB stick based on PHISON PS2251-61-5. I replaced NAND form that USB stick with my Sansa's NAND.
Then I used UPTool_Ver2094 software for low level scaning NAND, found out that there were 234 Bad D3 Blocks that actually not so much and the tool can do sorting, low and high level format. I made the USB stick operate with Sansa's NAND, only 3.7GB remains, but it was promising... I wrote on it full RAW data from recovery image that it found here https://forums.rockbox.org/index.php?topic=52014.0
Then I moved NAND back into my SANSA, but it had nothing to work... It still have only 32MB visible and no visible NAND. I give up, but there is only thing I didn't do, is JTAG recovery.

[vitt13]

I found and ordered a cheap SanDisk SATA SSD 'SDSA5BK-008G' on Aliexpress (also available on eBay) which has TSOP48 NAND IC marked as SDTNPMAHEM-008G. Memory Type: MLC Flash ID: 45DEA482 7656

So, my idea is try to restore RAW image "SansaClip+8G_RECOVERY.imgc" from this message https://forums.rockbox.org/index.php/topic,52014.msg244198.html#msg244198 to SSD while it connected to PC though SATA to USB adapter. Then replace IC from the SSD board and solder it to the player's board.

[Bilgus]

Sounds like an interesting idea

Let us know how it goes

[vitt13]

Unfortunately (but expectably) I have no good results with such simple replacement.
As I understand there is some service information stored to NAND from specific NAND controller so that is why it cannot be easy replaced from SSD board to player board without rewriting that service information.
Anyway I guess that NAND IC can be generally used for replacement if player's firmware has support the NAND ID.

My next step would be to try uploading and starting the original firmware via JTAG. I've never worked with JTAG. I'm looking for the information what hardware and software I potentially can use. I have EZ-USB FX2LP board and the device with FT2232D IC onboard, and both cases require more time to make the working JTAG device.

[vitt13]

Found the link https://jacobncalvert.com/2020/02/04/jtag-on-the-cheap-with-the-ftdi-ft232r/ how to use FT232RL adapter as JTAG with OpenOCD.
I use referenced config https://www.rockbox.org/wiki/pub/Main/SansaAMSJTAG/openocd_clipplus.cfg and xPack OpenOCD https://github.com/xpack-dev-tools/openocd-xpack

I spent four hours and did not understand why it does not work as expected.

Code: [Select]

xPack OpenOCD x86_64 Open On-Chip Debugger 0.11.0+dev (2022-09-01-17:58)
Licensed under GNU GPL v2
For bug reports, read
        http://openocd.org/doc/doxygen/bugs.html
Info : only one transport option; autoselect 'jtag'
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : clock speed 3000 kHz
Info : JTAG tap: as3525plus.cpu tap/device found: 0x3838170f (mfg: 0x387 (Unifosa Corporation), part: 0x8381, ver: 0x3)
Warn : JTAG tap: as3525plus.cpu       UNEXPECTED: 0x3838170f (mfg: 0x387 (Unifosa Corporation), part: 0x8381, ver: 0x3)
Error: JTAG tap: as3525plus.cpu  expected 1 of 1: 0x07926f0f (mfg: 0x787 (<unknown>), part: 0x7926, ver: 0x0)
Info : TAP as3525plus.etb does not have valid IDCODE (idcode=0xffc5801c)
Info : TAP auto0.tap does not have valid IDCODE (idcode=0xffe2c00e)
Info : JTAG tap: auto1.tap tap/device found: 0xfff16007 (mfg: 0x003 (Fairchild), part: 0xff16, ver: 0xf)
Error: Trying to use configured scan chain anyway...
Error: as3525plus.etb: IR capture error; saw 0x08 not 0x01
Warn : Bypassing JTAG setup events due to errors
Info : Embedded ICE version 0
Error: unknown EmbeddedICE version (comms ctrl: 0x0038170f)
Info : as3525plus.cpu: hardware has 2 breakpoint/watchpoint units
Info : ETM v1.0
Error: etm_reg_add is requested to add non-existing registers, ETM config might be bogus
Info : starting gdb server for as3525plus.cpu on 3333
Info : Listening on port 3333 for gdb connections
Warn : WARNING: mystery debug reason MOE = 0xc. Try issuing a resume + halt.
Error: invalid mode value encountered 15
Error: cpsr contains invalid mode value - communication failure
Polling target as3525plus.cpu failed, trying to reexamine
Info : Embedded ICE version 0
Error: unknown EmbeddedICE version (comms ctrl: 0x0038170f)
Info : as3525plus.cpu: hardware has 2 breakpoint/watchpoint units
Info : ETM v1.0
Error: etm_reg_add is requested to add non-existing registers, ETM config might be bogus
Warn : WARNING: mystery debug reason MOE = 0xc. Try issuing a resume + halt.
Error: invalid mode value encountered 15
Error: cpsr contains invalid mode value - communication failure
Polling target as3525plus.cpu failed, trying to reexamine
Info : Embedded ICE version 0
Error: unknown EmbeddedICE version (comms ctrl: 0x0038170f)
Info : as3525plus.cpu: hardware has 2 breakpoint/watchpoint units
Info : ETM v1.0
Error: etm_reg_add is requested to add non-existing registers, ETM config might be bogus
Warn : WARNING: mystery debug reason MOE = 0xc. Try issuing a resume + halt.
Error: invalid mode value encountered 15
Error: cpsr contains invalid mode value - communication failure
Polling target as3525plus.cpu failed, trying to reexamine
...
and so on... repeating polling and trying

[vitt13]

I tried same JTAG connection with FT232RL under Linux and got similar output. Even with recompiled OpenOCD from sources.
And even with FX2LP board with firmware 'usbjtag-nanodla.hex' compiled from https://github.com/mithro/ixo-usb-jtag project.
I think my player is still alive at least it appeared as M200plus device and 32MB disk. So it definitely JTAG connection and OpenOCD issues.