Replacing a flash chip on the firewall

[OldFox]

Hi all!
I've two Zyxel USG110 firewalls. One of them has recently died after the firmware upgrade - it doesn't boot anymore, so I attached the console cable to see what's going on. From the logs I can see that it has problems with mounting the partition and it reboots after the "kernel panic" error. Reloading the firmware didn't help. My prediction was that the flash chip was bad, so I took the thing apart.
I've located the flash chip, which is soldered to a seperate PCB module together with the flash controller. The module can be easily removed so I tried to replace it with the one from my other firewall device, which still works and it worked without problems!



I've easily removed old flash chip from the PCB module using the hot air gun and ordered a replacement flash chip Samsung K9F4G08U0D-SCB0.

I don't have much experiences with Flash chips, so my question here is:
will it work if I just simply replace old flash chip with the new one (assuming that flash controller is ok)? Will the flash controller self-initialize the new flash chip or do I have to program it before I solder it on the flash PCB board?
If I need to program it, then I probably need a NAND Flash programmer and read the content of the flash from the working module and write it to the new flash chip. Would that work?

p.s. The device is out of warranty, so I have nothing to lose. I've tried my luck with Zyxel support and they don't offer a spare flash PCB or repair.

TODO LIST
Current status:

- DONE: waiting for new flash chip to arrive
- DONE: desolder bad flash chip from PCB module
- IN PROGRESS: solder a new flash chip to PCB module (out of solder wire, waiting for new one to arrive )
- DONE: try to attach an USB-Connector from the PC-ATX mainboard to the firewall and use an usb flash drive instead of PCB flash module: boot is stuck at "Recovering partition" (tried ext2, ext3 partition type)
- DONE: prepare a USB A to duPont pin adaptor cable
- DONE: try to read image from the working PCB module using USB A to duPont cable (determine partition type, ...): Successfully cloned image from working eUSB flash module
- IN PROGRESS: try to boot from an usb flash drive with cloned image. Try to fake(clone) the Vendor ID (VID) and Product ID (PID) of the USB stick

- TBD: try to add power switch to the PCB module, then boot firewall with the good module and hot-swap module with the bad one
- TBD: if fixing old module fails, try to use a replacement eUSB module (e.g. https://www.swissbit.com/de/usb-produkte/).

[Ian.M]

The Phison PS2251-50-F appears to be a USB interface flash controller., usually used in USB thumb drives.  There's a little bit of data here: http://www.rflashdata.com/uploadfile/2011/1117/UP19-PS2251%20datasheet.pdf which should be sufficient for you to trace the pinout to the female header so you can butcher a USB cable to make a USB A to duPont pin adaptor cable.

It may be sufficient to image the good drive with a raw disk imaging utility, but you may need a Phison OEM utility to initialise and defect map the new FLASH chip.  There's a page of Phison utilites here: http://usb-fix.blogspot.com/p/phison.html
I haven't used any oif them so YMMV.

[OldFox]

...which should be sufficient for you to trace the pinout to the female header so you can butcher a USB cable to make a USB A to duPont pin adaptor cable.

It may be sufficient to image the good drive with a raw disk imaging utility, but you may need a Phison OEM utility to initialise and defect map the new FLASH chip.  There's a page of Phison utilites here: http://usb-fix.blogspot.com/p/phison.html
I haven't used any oif them so YMMV.

Great, thanks for the info! So basically I could connect that PCB module to USB and use it like a USB Flash drive?
I'll definitely try my luck with a USB A to duPont pin adaptor cable.
Does that also mean that I could simply connect the USB flash drive to that firewall flash connector (with the USB to duPont cable) and use it instead of the original flash PCB?
Flash is probably only used for storing firewall logs and firmware.

[Twoflower]

Aren't the USB 2.0 connectors of a normal PC ATX mainbaoard using a 2x5pin 2mm pitch connector? Maybe you don't even need a adapter.

Edit: But you should first check if the pinout match!

[aqibi2000]

Use a programmer

[Ian.M]

Great, thanks for the info! So basically I could connect that PCB module to USB and use it like a USB Flash drive?
I'll definitely try my luck with a USB A to duPont pin adaptor cable.
Does that also mean that I could simply connect the USB flash drive to that firewall flash connector (with the USB to duPont cable) and use it instead of the original flash PCB?
Flash is probably only used for storing firewall logs and firmware.

Once you've got the replacement FLASH chip, there's little risk in hooking up the rebuilt module to a PC.  Once you are satisfied it works as a mass storage device, you can risk imaging the good module, preferably under Linux to avoid Windows' unpleasant tendency to write stuff to filesystems it doesn't really understand.

Re: Thumbdrive substitution in the router: Maybe, maybe not.  It very much depends on if the host firmware is looking for a specific mass storage device, or if those extra pins on the connector are anything except power, ground and n/c. 

[OldFox]

Aren't the USB 2.0 connectors of a normal PC ATX mainbaoard using a 2x5pin 2mm pitch connector? Maybe you don't even need a adapter.

Edit: But you should first check if the pinout match!

No idea. I'll check the pinout.

Use a programmer

I'll try with the USB to duPont cable first. If that fails, which programmer do you suggest?

Great, thanks for the info! So basically I could connect that PCB module to USB and use it like a USB Flash drive?
I'll definitely try my luck with a USB A to duPont pin adaptor cable.
Does that also mean that I could simply connect the USB flash drive to that firewall flash connector (with the USB to duPont cable) and use it instead of the original flash PCB?
Flash is probably only used for storing firewall logs and firmware.

Once you've got the replacement FLASH chip, there's little risk in hooking up the rebuilt module to a PC.  Once you are satisfied it works as a mass storage device, you can risk imaging the good module, preferably under Linux to avoid Windows' unpleasant tendency to write stuff to filesystems it doesn't really understand.

Re: Thumbdrive substitution in the router: Maybe, maybe not.  It very much depends on if the host firmware is looking for a specific mass storage device, or if those extra pins on the connector are anything except power, ground and n/c.

New flash chips (I bought more than 1, just in case something goes wrong) are on the way - will probably get them tomorrow.
I'll be back to you once I prepare everything I need (solder new flash chip on the PCB, prepare USB to duPont cable, study that pinout). Thanks a lot for your help guys

[Twoflower]

That memory module really looks like an USB flash module (e.g. https://www.swissbit.com/de/usb-produkte/). So there's a good chance that this will be compatible to access via a normal PC.

[OldFox]

That memory module really looks like an USB flash module (e.g. https://www.swissbit.com/de/usb-produkte/). So there's a good chance that this will be compatible to access via a normal PC.

Woow, great find! I tought that the PCB module with flash and controller is custom PCB from Zyxel. But that U-110 module from the link you provided looks just like the one on my photo.

[OldFox]

Ok little update:
I've traced the pinout. It looks like only 4 pins are connected to the controller chip.


Next step is to solder a new flash chip and try to connect module to the computer USB

[Twoflower]

That only 4 pins are assigned is normal as the 10-pin header provide 2x USB 2.0: (https://doc.xdevs.com/doc/_PC_HW/Form_factors/fpio_design_guideline.pdf ; Page 21).

I would say: That module is compatible to the USB-Connectors you'll find on a normal PC-ATX mainboard.

[fzabkar]

I would have thought that the next step would be to try a regular USB flash drive, with a suitable cable.

[OldFox]

That only 4 pins are assigned is normal as the 10-pin header provide 2x USB 2.0: (https://doc.xdevs.com/doc/_PC_HW/Form_factors/fpio_design_guideline.pdf ; Page 21).

I would say: That module is compatible to the USB-Connectors you'll find on a normal PC-ATX mainboard.

So I could simply attach it to the mainboard connector. I'll check my old PC to see if I've one of those connectors available.
Otherwise I already have a USB A to duPont pin adaptor cable prepared.

I would have thought that the next step would be to try a regular USB flash drive, with a suitable cable.

Did you mean that I should try to attach an USB flash drive directly to that usb connector of firewall (instead of that flash module)?

[Twoflower]

Yes, I would think so. The 10-Pin or sometimes 9-Pin as one is used for preventing to plug it in the wrong way is standarized. Otherwise you can't connect the mainboard** to the front-side USB connectors most of the PC-Cases have. So if you have a reasonable modern PC you might find at least one of the USB connectors. Depending on the board often two or three connectors. And if you don't have many USB-Ports and memory card readers in your Desktop PC you might even find one unused.

**Some mainboards from Dell, Lenovo, Fujitsu... might be an exception as they sometimes use non standard connectors.

[fzabkar]

Use something like this:

https://ae01.alicdn.com/kf/HTB1APEKSpXXXXbhXpXXq6xXFXXXy/6-pcs-PCI-C-bles-9pin-USB2-0-Connecteur-Carte-M-re-USB-Extension-C-ble.jpg

https://ae01.alicdn.com/kf/HTB14QP_SpXXXXakapXXq6xXFXXXR/6-pcs-PCI-C-bles-9pin-USB2-0-Connecteur-Carte-M-re-USB-Extension-C-ble.jpg

Then plug a regular USB flash drive into it.

[OldFox]

Use something like this:

https://ae01.alicdn.com/kf/HTB1APEKSpXXXXbhXpXXq6xXFXXXy/6-pcs-PCI-C-bles-9pin-USB2-0-Connecteur-Carte-M-re-USB-Extension-C-ble.jpg

https://ae01.alicdn.com/kf/HTB14QP_SpXXXXakapXXq6xXFXXXR/6-pcs-PCI-C-bles-9pin-USB2-0-Connecteur-Carte-M-re-USB-Extension-C-ble.jpg

Then plug a regular USB flash drive into it.

I didn't find time to solder a new flash chip on the module yet, BUT...
I've tried with the cable and USB flash drive, like you suggested, and it actually detects the USB drive - usb drive blinks and the console message on the firewall is different:


But I'm not sure which partition type should I use.
Startup process is stuck at "Recovering partition ...".

Maybe I should remove that flash module from the working Firewall and try to attach it to the computer using USB A to duPont pin adaptor cable to check the partition type, and maybe clone the contents of that flash?

I'll have probably the same situation when I try to boot using that original module with replaced flash.

[perieanuo]

well, you have much simplier solution
identify your VCC for your module and add a switch (cut some track or whatever get this done) on both modules
start the router with the good module, cut power to the module, insert the other one (the bad one), switch this one 'on' (with his new attached power switch) and start updating or play in terminal with the bad flash
costs you 2 switches or just lumpers or just some wires
it's kinda risky ...

that's in case you avoid the correct way, reading the good one and reprogramming the bad one with a serious flash programmer

[Ian.M]

That's high risk compared to simply cloning the USB mass storage device the module presents as.  Also it quite likely that the router only mounts USB devices at boot as its expecting it to be non-removable.

[Syntax Error]

One thought. Looking at those messages, I suspect the Kernel is checking for an EXT2/3/4 partition.

As in https://linux.die.net/man/8/mke2fs

Create an EXT2 or 3 partition on a blank USB drive and see if the boot sequence likes that.

 I suspect the kernel does not need a 'sexy' NAND partition type (like UBI), as the NAND chip is hidden away on the USB bus.

Do you have a copy of the boot log, as this may give clues as to what is being loaded?

[OldFox]

One thought. Looking at those messages, I suspect the Kernel is checking for an EXT2/3/4 partition.

As in https://linux.die.net/man/8/mke2fs

Create an EXT2 or 3 partition on a blank USB drive and see if the boot sequence likes that.

 I suspect the kernel does not need a 'sexy' NAND partition type (like UBI), as the NAND chip is hidden away on the USB bus.

Do you have a copy of the boot log, as this may give clues as to what is being loaded?

Thanks, I'll try.
Well I've access to the working firewall. Will try to find the boot log location, maybe it will reveal some clues.

[perieanuo]

That's high risk compared to simply cloning the USB mass storage device the module presents as.  Also it quite likely that the router only mounts USB devices at boot as its expecting it to be non-removable.

yes, it's a little risk, but the router won't see device as removable if you cut power and restore it to flash controller. I tested once on some device
the only risk is on interface comm signals, but those things are well made, I never saw one fried by taking it off with voltages applied, but I saw some with dead firmwares from toying with him, took me 1/2 day to restore one
[edit]
after looking at module ( http://www.rflashdata.com/uploadfile/2011/1117/UP19-PS2251%20datasheet.pdf) , if you cut power is similar to ejecting a usb stick from computer, where power is cut first cause the power pad V+ is shorter, so there's almost zero risk. in fact, zero
[edit 2]
in fact, if on comm lines you add 2x100ohm resistors, my sugestion is bulletproof

[OldFox]

One thought. Looking at those messages, I suspect the Kernel is checking for an EXT2/3/4 partition.

As in https://linux.die.net/man/8/mke2fs

Create an EXT2 or 3 partition on a blank USB drive and see if the boot sequence likes that.

 I suspect the kernel does not need a 'sexy' NAND partition type (like UBI), as the NAND chip is hidden away on the USB bus.

Do you have a copy of the boot log, as this may give clues as to what is being loaded?

Thanks, I'll try.
Well I've access to the working firewall. Will try to find the boot log location, maybe it will reveal some clues.

Actually if I log into the firewall using SSH I don’t get the linux shell, but some kind of Zyxel console which has its own list of commands.
Anyway, I checked the system log in web interface and found some traces about EXT3, example:
“EXT3-fs (sda10): mounted filesystem with writeback data mode”
So filesystem is probably EXT3. I’ve formatted the usb drive to EXT3, but it didn’t help. It’s stuck at “recovering partition …”.

That's high risk compared to simply cloning the USB mass storage device the module presents as.  Also it quite likely that the router only mounts USB devices at boot as its expecting it to be non-removable.

yes, it's a little risk, but the router won't see device as removable if you cut power and restore it to flash controller. I tested once on some device
the only risk is on interface comm signals, but those things are well made, I never saw one fried by taking it off with voltages applied, but I saw some with dead firmwares from toying with him, took me 1/2 day to restore one
[edit]
after looking at module ( http://www.rflashdata.com/uploadfile/2011/1117/UP19-PS2251%20datasheet.pdf) , if you cut power is similar to ejecting a usb stick from computer, where power is cut first cause the power pad V+ is shorter, so there's almost zero risk. in fact, zero

Will try this, if the “USB A to duPont pin adaptor cable” method fails.

Currently I’m in process of soldering that new flash module to the controller PCB.
But guess what, I ran out of solder wire. Actually I have another solder wire (left on the pic) which is a real nightmare compared to the old one (right on the pic).
 


Any suggestions which solder wire is the best for this job (soldering flash chip) ?

[perieanuo]

see my latest edit if you want you can also add on data lines 100R resistor, the risc becomes zero even if you extract the module 'live'

[Ian.M]

Anything with 'Water Washable' flux is setting yourself up for failure unless you have the correct equipment to clean thoroughly under ICs etc.  The residue is typically hygroscopic and highly corrosive, and it only takes one droplet remaining sitting over a via within the footprint to result in failure months pr even years later.  At the very least you want a medium pressure jet of hot water + an appropriate surfactant, to get enough flow *UNDER* chips to remove the residue effectively.

[Haenk]

You could check the partition structure with most Linux install discs; starting the partition manager (parted or similar) should show the the partition table; note it down (! don't write to disk !), create the same partitions on the replacement...