1-855-374-6263 info@recovermyflashdrive.com

Silicon Motion (SM) Controller Off-Chip Data Structures

Most silicon motion controllers use the same spare area data structure. I ran into a 32GB Lexar Professional 1000x using a different data structure. The value in block function ranged from 0x90 to 0x9F. Unknown contained 0xEF. LBN (Logical Block Number) and LPN (Logical Page Number) contained the normal inverted values. The memory card uses a SM3257 1150_27 geometry however the spare area couldn’t be decoded by Flash Extractor. I used Flash Extractor to fix bit errors and VNR to reassemble the data.

Lexar Professional 32GB SD card with 150 MB/s speed, V30/U3 markings.
Row of four labeled blocks: Block function (1 Byte) in blue, Unknown (0xEF) (1 Byte) in gray, LBN (2 Bytes) in tan, and LPN (2 Bytes) in light green.
#pragma pack(push, 1)
struct SpareArea {
    uint8_t  block_function; //
    uint8_t  unknown;        // always 0xEF
    uint16_t lbn;            // logical block number, inverted, little endian
    uint16_t lpn;            // logical page number, inverted, little endian
};
#pragma pack(pop)