Phison 2251 03 2303 Usb

/ Comments off

PS2303 is a low cost USB3.0 NAND controller used in many modern USB flash drives. Description at Phison's site.

First try to get the chip genius report for your corrupted usb flash disk.Download Chip Genius V4 Software and insert your corrupted Phison USB disk.The Chip vendor must be Phison and Chip part number should be PS2251-02(PS2302).The USB repair software used in this article will be only for Phison. Phison 2251-03 (2303) Custom Firmware & Existing Firmware Patches. This repository contains the following items: DriveCom- PC C# application to communicate with Phison drives. EmbedPayload- PC C# application to embed Rubber Ducky inject.bin key scripts into custom firmware for execution on the drive. Jan 22, 2014  Hello My friends, we will explain how to repair Phison PS2251-03,PS2303,UP303 and Toshiba TC58NC2303G5T USB flash drives.If you have a corrupted Phison PS2251-03 and you need it's firmware to fix it, here is the solution.I gather to you all possible Phison PS2251-03. Phison ps2251 03 firmware mediafire I had a usb stick fail. It froze while copying, had no option but to just pull it out. Since then the computer only picks it up as a Removable Disk, which opens with Please insert disc. Assuming i corrupted something, I'v been playing around with Phison MPALL, which apparently can help.

Two packages available:

  • LQFP64 (PS2251-03-Q) - dual channel version
  • LQFP48 (PS2251-03-V) - single channel version

Chip architecture

PS2303 consists of:

  • 8051-compatible 250MHz (yes, 250 !) core with 256 bytes of IRAM (DesignWare DW8051 ?), two timers
  • 256KiB (?) RAM used for code/data/USB buffers/NAND buffers
  • USB 3.0 function core (Synopsys ?)
  • Two NAND flash interface cores
  • NAND data processor (ECC, descrambler)
  • DMA core (moves data between RAM/NAND/USB at high speed)

Memory map

  • CODE 0000-7FFF(?) - program RAM, mapped to PA (physical address) 0 of RAM. Size can be changed ?
  • XDATA 0000-EFFF - data RAM, consists of several independently mapped areas
  • XDATA F000-F3FF - USB 3.0 function core
  • XDATA F400-F4FF - NFC0 (NAND flash channel 0)
  • XDATA F500-F5FF - NFC1 (NAND flash channel 1)
  • XDATA F600-F6FF - NDP (NAND data processor)
  • XDATA F700-F7FF - NFC0/1 interleaved port
  • XDATA F800-F8FF - ?
  • XDATA F900-F9FF - DMA
  • XDATA FA00-FAFF - SYSTEM (RAM mapping, clocks, GPIO, ..)
  • XDATA FB00-FBFF - ?
  • XDATA FC00-FCFF - ?
  • XDATA FD00-FDFF - ?
  • XDATA FE00-FEFF - ?
  • XDATA FF00-FFFF - ?

Interrupts

  • INT0 - USB control interrupt (bus states, EP0 requests)
  • INT1 - Timer 0 overflow interrupt (standard 8051 feature)
  • INT2 - USB endpoints interrupt (bulk data available)
  • INT3 - Timer 1 overflow interrupt (standard 8051 feature)

USB flash drives based on PS2303:

  • Patriot SuperSonic Xpress USB 3.0 - full LQFP64 version for 10EUR price (8GB model)
  • Kingston DataTraveller 111 - LQFP48 version
  • many others

Updated Jay z blueprint 2 zippyshare.

This repository contains the following items:

  • DriveCom -- PC C# application to communicate with Phison drives.
  • EmbedPayload -- PC C# application to embed Rubber Ducky inject.bin key scripts into custom firmware for execution on the drive.
  • Injector -- PC C# application to extract addresses/equates from firmware as well as embed patching code into the firmware.
  • firmware -- this is 8051 custom firmware written in C.
  • patch -- this is a collection of 8051 patch code written in C.

Releases have the following items:

  • patch -- this is a collection of 8051 patch code written in C.
  • tools -- these are the compiled binaries of all the tools.
  • CFW.bin -- this is custom firmware set up to send an embedded HID payload.

Take note that the firmware patches have only been tested against PS2251-03 firmware version 1.03.53 (which is for an 8K eD3 NAND flash chip). They may work for others, but be careful.

As long as you are using the correct firmware image for your controller version and NAND chip, there is no harm in downgrading to an earlier version (such as from 1.10.53).

WARNING: This is experimental software. Use on unsupported devices, or even on supported devices, may cause loss of data, or even permananent damage to devices. Use at your own risk.

Getting Started

Phison 2251 03 2303 Usb Cable

See Known Supported Devices for information on supported devices; use on an unsupported device may cause permanent damage to the device.

To get started, you'll need to obtain a burner image, which is the 8051 executable responsible for flashing firmware to the drive.

See Obtaining a Burner Image on the wiki for more information.

Build Environment

To patch or modify existing firmware, you must first set up a build environment. See Setting Up the Environment on the wiki for more information.

At a minimum, SDCC needs to be installed to C:Program FilesSDCC.

Dumping Firmware

Run DriveCom, passing in the drive letter representing the drive you want to flash, the path of the burner image you obtained, and the destination path for the firmware image:

where E is the drive letter, BN03V104M.BIN is the path to the burner image, and fw.bin is the resulting firmware dump.

Phison 2251 03 2303 Usb Port

Currently, only 200KB firmware images can be dumped (which is what the Patriot 8GB Supersonic Xpress drive uses).

Flashing Custom Firmware

Run DriveCom, passing in the drive letter representing the drive you want to flash, the path of the burner image you obtained, and the path of the firmware image you want to flash:

where E is the drive letter, BN03V104M.BIN is the path to the burner image, and fw.bin is the path to the firmware image.

Running Demo 1 (HID Payload)

Create a key script in Rubber Ducky format, then use Duckencoder to create an inject.bin version of it:

where keys.txt is the path to your key script.

You may notice the delays are not quite the same between the Rubber Ducky and the drive -- you may need to adjust your scripts to compensate.

(These tools are available from https://code.google.com/p/ducky-decode/.)

Once you have an inject.bin file, embed it into the custom firmware with:

where inject.bin is the path to your inject.bin file, and hid.bin is the path to the HID payload custom firmware.

(Notice that the firmware image is copied, and the payload is embedded into the copy -- this is because the payload can only be embedded once, so the original CFW.bin must remain intact.)

You can now flash the firmware to your drive with:

where E is the drive letter representing your drive, BN03V104M.BIN is the path to your burner image, and hid.bin is the path to the HID payload custom firmware.

Huge thanks to the Hak5 team for their work on the excellent USB Rubber Ducky!

Running Demo 2 (Hidden Partition Patch)

First, determine the number of logical blocks (sectors) your drive has with the following command:

Go into the patch directory and modify base.c to disable all other patches, and enable the hidden partition patch:

Then modify the NUM_LBAS define to the number of logical blocks on your drive:

Make sure you round down to an even number, and it couldn't hurt to subtract a few first, in case a few blocks go bad over time. (For example, if the number of LBAs was 0xE6C981, you might reduce it to 0xE6C940.)

Place the firmware image you want to patch into the patch directory and name it fw.bin.

Go to the patch directory and run build.bat. It will produce a file at patchbinfw.bin -- this is the modified firmware image.

You can now flash this file to your drive.

The prosperity game is a simple and fun way to activate your ability to attract money. In order to get money flowing freely in your life, you first have to understand the law of attraction because that’s what’s behind it all. The Law of Attraction, simply stated, says, “Like. Glamour. Jul 21, 2012  In the Prosperity Game, you begin by establishing an imaginary checking account. In other words, there will be no actual bank involved, but you will make deposit entries and check withdrawals just as if it were an actual account. You could use an old checkbook system that is no longer in use, an accounting program in your computer, or you could even manufacture a complete. The Prosperity Game The Prosperity Game is a lavish and playful game by Abraham Hicks. If you’re not familiar with the Law of Attraction teachings of Abraham-Hicks, they are a group of non-physical teachers channeled by Esther Hicks filled with Universal wisdom and witty repartee. Jun 15, 2010  If anyone is curious, the Prosperity Game is a process originally described in the book “Ask and it is Given” by Esther and Jerry Hicks (Abraham-Hicks). The best book ever written, in my opinion, with 21 other processes in there to boot. I love this game, and I too found that after a certain amount of money I started feeling very generous!

After flashing, Windows may be confused, as it now only sees half of the partition it once did -- it may ask you to format the first time you view either the public or hidden halves of the drive. This is normal.

Phison 2251 03 2303 Usb Charger

Running Demo 3 (Password Patch)

Go into the patch directory and modify base.c to disable all other patches, and enable the password patch:

Place the firmware image you want to patch into the patch directory and name it fw.bin.

Go to the patch directory and run build.bat. It will produce a file at patchbinfw.bin -- this is the modified firmware image.

You can now flash this file to your drive.

Running No Boot Mode Patch

Go into the patch directory and modify base.c to disable all other patches, and enable the no boot patch:

Place the firmware image you want to patch into the patch directory and name it fw.bin.

Go to the patch directory and run build.bat. It will produce a file at patchbinfw.bin -- this is the modified firmware image.

Phison 2251 03 2303 Usb File

You can now flash this file to your drive. Once flashed to your device, it will no longer act on the command to jump to boot mode. To update the firmware again will require shorting pins on the controller. To make it impossible* to update, after flashing this patch coat the device with epoxy.

  • Within reason; it may be possible to get to boot mode via an exploit or other non-standard method.

Converting to Mode 7

You can run the ModeConverterFF01.exe application (see Useful Links) to split the drive into public and secure partitions, or restore the original (mode 3) functionality.

After converting to mode 7, you should be able to set, change, or disable the secure partition password with the USB DISK Pro LOCK utility.

Building From Source

Modify the C files in the firmware directory for custom firmware, or the patch directory for the firmware patches, then run the build.bat file in the appropriate directory.

Phison 2251 03 2303 Usb

Once it has built successfully, use DriveCom to flash the resulting file (binfw.bin) to your drive:

..or..

Questions? Comments? Complaints?

Phison 2251 03 2303 Usb Download

Unfortunately this isn't the most straightforward process at the moment, so if you have questions, open an issue and we'll do our best to help (and update the readme/wiki).