(Surpise) One of the most common drives in the US - Sandisk Ultra 16GB USB 3.0 - has the 2251-03 (2303) controller. Plugged it up today, ran ChipEasy, Phison 2303 chip is present.
The full guide of Best USB flash drive repair software. Of Innostor usb flash drive Silicon Power Formatter Silicon power formatter v 3.7 can repair any silicon flash drive have ps2251 chip vendor Download Silicon power.
Not 100% sure as to whether all batches have the same chip. This particular drive's model is SDCZ48-016G. Sorry to hear about that. You can bring them back to life with: -Phison Mpall (u need to replace the IDBLK_TIMING.dll file with the one called IDBLK_TIMING Dynamic Link Library v1.2.59.0 ) -Firmware PS2251-07 get all of them from here: In Phison Mpall use these files: Burner:BN07V106M.BIN Firmaware: FW07FF01V10053M_20130408.BIN đ I no longer see a point in using this 'exploit'.
Download Phison ST-Tool Rel 9000 with all software versions and repair corruptedPhison Ps2251-07 and Phison Ps2251-67 chip controllers.Learn how to format corrupted Phison flash drives with ST-Tool v3.71 and other versions.
If you are only looking for Rubber Ducky features then get a Digispark or Teensy and program it yourself as a HID keyboard and you are all set. If it says 2303 - than it's 2303. Mine was 2307. It's ok that same pendrives have different controllers. On Fri, Nov 7, 2014 at 5:25 AM, electronicsguy wrote: Hi.
- Jan 22, 2014 Phison PS2251-03 Recovery tool allow you to format Phison PS2251-03,PS2303,UP303 and Toshiba TC58NC2303G5T chip controllers.First you must use Chip Genius software to determine your flash information,and if your flash drive chip controller is Phison PS2251-03, you can use this software.
- Mar 09, 2016 First you must download Phison MPALL v3.72.0B ps2251 flashboot.rar from any download link below. Insert your Phison PS2251 flash disk to your computer. Extract Phison MPALL v3.72.0B ps2251 flashboot.rar and open MPALLF19000v3720B.exe. If your flash drive chip controller supported, you will see your USB flash drive information appears on.
I can verify that the Silicon Power Blaze B30 (128 GB) also possesses a PS2251-03-Q controller. Also Intel memory (Just cant determine which one) One major issue though is MPALL will show the device in red with an error, no matter how much tweaking I can not get it to flash. I was able to get it to show blue in MPALL but even after you hit start it will error red with code 0072.
I believe we would need the latest burner and FW image. This sounds like interesting project to try out but there is a small but.
I have a lot of interest in IT and Computer security and when it comes to hardware based projects like this one, I'm completely green on the topic itself and as I have went through all of the comments I noticed that you guys says something like Rubber Ducky, Teensy so here is my question what is Rubber Ducky and Teensy How and hard is it to compile/write this software to the USB with supported controller? I don't know about Kingston DataTraveler G4 16GB but I have recently bought a 128 GB version and if someone is interested in controller type I will check it in a couple of days and post it here. I just tried 3 different Toshiba Transmemory MX 16 GB 3.0 black and they were all 2307. Patriot Stellar XT 16 gb USB 3.0:( Volume: F: Controller: Phison PS2307 Possible Memory Chip(s): SanDisk SDTNSIAMA-016G Memory Type: TLC Flash ID: 454C98A3 7651 Chip F/W: 01.01.55 Firmware Date: 2015-04-23 ID_BLK Ver.: 1.3.6.0 MP Ver.: MPALL v3.84.0D VID: 13FE PID: 5500 Manufacturer: Product: Patriot Memory Query Vendor ID: Query Product ID: Patriot Memory Query Product Revision: PMAP Physical Disk Capacity: 6 Bytes Windows Disk Capacity: 8 Bytes Internal Tags: 2Q2P-S78J File System: FAT32 Relative Offset: 4032 KB USB Version: 3.00 Declared Power: 504 mA.
Damn I can't find one damn model thumbdrive that has the right version. If anyone finds it you'd be doing yourself good by buying as many as you can and reselling them as I know people would pay a markup for guaranteed versions that work, preferably not the 32-64-128gb but the like 4-8-16gb ones that are cheap and therefor not as big of a deal if you loose one. Even the patriot linked to from the recommended thumb drives section that goes to Amazon here: In the questions section someone posted a couple months ago, so recent, that it comes with: PS2251-07 (2307) v 1.09.10. And by the looks of it all of the thumb drives now come with 2307 not 2303, so that said I'm really hoping someone reverse engineers the 2307 like mentioned by a mod in another post on here it would at least be closer to the 2303 then just reverse engineering a completely different make. Heck I'd even donate some Bitcoin lol. Does ANYBODY know ANYWHERE that sells any thumb drive with the correct versioning for this to work?
Any model on Amazon or eBay or any store that someone found recently still selling the correct version ones for this code to work? Please help a brother out. Yes I already have a Ducky but wanted to try this. Was really looking forward to it and about to order a bunch of those patriots from Amazon since they were even USB 3.0 with great speed reviews but came accross the question/answer posted on the items Amazon page saying its PS2251-07 (2307) v 1.09.10. Thanks in advance to anyone, seriously much appreciated!
Controller: SkyMedi SK6222 Possible Memory Chip(s): Micron MT29F128G08CBCAB Memory Type: MLC Flash ID: 2C84643C A5 Flash CE: 1 VID: 0951 PID: 1666 Manufacturer: Kingston Product: DataTraveler 3.0 Query Vendor ID: KINGSTON Query Product ID: DataTraveler 3.0 Query Product Revision: 1.01 Physical Disk Capacity: 2 Bytes Windows Disk Capacity: 8 Bytes Internal Tags: KL6R-S964 File System: FAT32 Relative Offset: 8 KB USB Version: 3.00 Declared Power: 600 mA ContMeas ID: 5370-01-00 Microsoft Windows 10 x64 Build 10240 Program Version: 8.4.0.588 //bought the usb from Vietnam. Have you success in making that USB? If I have something in coding or flashing hardware, how can I contact you? I also just bought the Corsair Flash Voyager Slider 128GB USB 3.0 drive from Amazon and it's a Phison 2303 (2251-03) controller as well.
I'll be flashing its firmware tonight. UPDATE: I ran into issues with putting the Corsair drive into boot mode. I did the exact same steps that I used to successfully create my BadUSB HID attack device with the Patriot drive and was unable to reproduce the steps on this device.
Just bought a Silicon Power 32GB Blaze B30 (SP032GBUF3B30V1K) from Amazon. Bought a Verbatim Store'n'Go on Amazon. Packaging looks the same on the front, but has a different UPC and chip. Sigh waited a month for it to come from China. I have found a usb with a phison 2251-03 chip in it Patriot 16GB Supersonic Xpress Series Cap-less USB 3.0 Flash Drive - PSF16GXPUSB (on amazon but i saw that it is a different seller now so can't confirm if the others are working. Got this result off a 128gb Sandisk Ultra from Frys.
Silicon Power Blaze B30 no longer uses the Phison 2303 controller. Model number: SP032GBUF3B30V1KBT Volume: F: Controller: Innostor IS917 E1 Possible Memory Chip(s): Not available VID: 1F75 PID: 0917 Manufacturer: UFD 3.0 Product: Silicon Power32G Query Vendor ID: UFD 3.0 Query Product ID: Silicon Power32G Query Product Revision: 1.00 Physical Disk Capacity: 2 Bytes Windows Disk Capacity: 4 Bytes Internal Tags: File System: FAT32 Relative Offset: 64 KB USB Version: 3.10 Declared Power: 304 mA ContMeas ID: Microsoft Windows 10 x64 Build 14393 Program Version: 8.7.0.597. Silicon Power Blaze 30 16gb just came in.
Innostor as well Volume: F: Controller: Innostor IS917 E1 Possible Memory Chip(s): Not available VID: 1F75 PID: 0917 Manufacturer: UFD 3.0 Product: Silicon Power16G Query Vendor ID: UFD 3.0 Query Product ID: Silicon Power16G Query Product Revision: 1.00 Physical Disk Capacity: 0 Bytes Windows Disk Capacity: 0 Bytes Internal Tags: File System: FAT32 Relative Offset: 64 KB USB Version: 3.10 Declared Power: 304 mA ContMeas ID: Microsoft Windows 10 x64 Build 14393 Program Version: 8.7.0.597. Kingston 16 GB DataTraveler DTIG4 is a no go. Volume: F: Controller: SSS 6131 Possible Memory Chip(s): Not available VID: 0951 PID: 1666 Manufacturer: Kingston Product: DataTraveler 3.0 Query Vendor ID: Kingston Query Product ID: DataTraveler 3.0 Query Product Revision: Physical Disk Capacity: 4 Bytes Windows Disk Capacity: 2 Bytes Internal Tags: DU6F-LAE4 File System: FAT32 Relative Offset: 31 KB USB Version: 3.10 Declared Power: 296 mA ContMeas ID: D05A-01-00 Microsoft Windows 10 x64 Build 14393 Program Version: 8.8.0.601. I bought silicon power blaze b30. And Volume: E: Controller: Innostor IS917 E1 Possible Memory Chip(s): Not available Flash ID: 89A46432 AA01 Flash CE: 1 Chip F/W: 41.06.0D.70 VID: 1F75 PID: 0917 Manufacturer: UFD 3.0 Product: Silicon Power32G Query Vendor ID: UFD 3.0 Query Product ID: Silicon Power32G Query Product Revision: 1.00 Physical Disk Capacity: 2 Bytes Windows Disk Capacity: 0 Bytes Internal Tags: CY7H-QCGL File System: NTFS Relative Offset: 64 KB USB Version: 3.00 in 2.00 port Declared Power: 200 mA ContMeas ID: 7796-07-00 Microsoft Windows 10 x64 Build 15063 Program Version: 8.9.0.605 Im sad:-( or is it compatible?
Corsair has been a trusted name in DRAM memory for a long time, which resulted in a brand expansion into peripherals, accessories, power supplies and more. It seems like whatever Corsair puts their brand on is a product you can trust. Iâve always been partial towards Corsair, having owned many memory modules and flash drives from them. For my whole undergraduate career of 5 years, I relied on a Corsair Flash Voyager â a rubberized, ruggedized 4Gb flash drive.
It was no slouch and commanded a premium price. Mine lasted the distance, being in use at least once a day, although the connector did need to be re-soldered in the end. I never lost any data with it. While browsing the, I came across the Corsair CMFLS3-32Gb Flash Voyager LS for AU$17.90. It wasnât a bad price, as it was a USB 3.0 drive and it carried the Corsair badge.
Curiously, this product didnât note any speeds, even on the, despite saying âhigh-performanceâ. I was aware that anything starting with an L likely denotes âlow costâ, just like anything starting with V likely denotes âvalueâ (e.g. VS â value select), but surely Corsair knows whatâs good, right? Unboxing The product, likely many other flash drives, comes in a glossy cardboard and plastic-bubble style packaging. This still features the yellow/black/white/teal colour scheme of the original Flash Voyager series, which is comforting. It advertises âhigh-speed USB 3.0â and âpremium retracting designâ. It comes with a 5-year warranty.
There is a picture at the back illustrating the retracting design. The drive itself is a swivel-type drive with a brushed stainless âclipâ. Both sides are laser engraved with the Corsair logo, and a small slot is provided through the clip to see the activity light. A short keyring attachment is provided. The drive swivels as described, to reveal a real USB 3.0 connector with laser markings â no plastic here.
The body of the drive has CE and FCC markings and is finished in a soft-touch plastic finish. The retracting design seems like a rather unnecessary gimmick given the connector retracts when it is protected by the metal swing-arm, and thus, there must be space inside the casing to house the connector. No further protection for the open end of the port is provided. A non-retracting port would have the drive at exactly the same size.
The unit has a customized VID and PID combination. It seems the drive is formatted with a CORSAIR volume label, but is otherwise free of included software or bloatware â which is just the way I like it. Teardown I can already hear the people asking â hey, why didnât you tear down the other USB drives? Lg Vs810pp Driver And Firmware Downloads Iphone. Well, as it turns out, some of them are more obvious as to how to break them apart without damaging them, and for those, I will risk a teardown. This belongs to the category of easily disassembled â without tools in fact. To open it up, itâs a simple as spreading the clip apart and sliding the âmiddleâ out, being careful not to lose the round disc with two chevrons.
The disc itself falls away from the drive, and acts as a simple rotational-to-linear gearing to âpushâ the centre of the drive out of the body. The little protruding knob on the disc rides along in the slot of the heart of the flash drive. The main body can be split into two halves to reveal some of the insides.
Several observations can be made. The first and most shocking is that this is not a Corsair developed product at all. The moulding has a very light printing that says UDF303.
This is tracked down to being the OEM. Is it of enough quality?
The second is that of the retracting design â no space is saved. Instead the flash drive is inside a plastic housing with bumps so it can slide around the inside of the outer case without damage. Lets examine the PCB for further details. It can be released from its carrier with light pressure around the corners of the plastic frame. The top of the PCB reveals a controller. It seems Phison controllers are generally quite popular with value drives, although I have experienced poor small-block performance with many of them back in the USB 2.0 days.
The PCB itself has spaces for inductor filters over the USB data leads, which are not fitted, as well as space for what appears to be an external crystal reference, which is not fitted at all. This is rather surprising, as the crystal âcanâ is often something which affected the size of flash drives, and it may have been integrated in the IC now, or relying on the USB 3.0 host clock instead. The underside houses a single chip of flash, and some spaces for other components as well.
The flash is not marked in a way I recognize, and could be lower-quality flash from one of the more minor manufacturers. It is marked TT58G2JAJA K1327 DP0534521.00C. A shows other people looking for information, and that this flash âchipâ is often used in conjunction with a Phison controller. Without knowing what it is, itâs not possible to determine what arrangement it is, and if itâs MLC or TLC. This did lead me to a realization that this marking can also be seen on the Patriot Blaze SSD.
In this review, also using a Phison controller, the flash is marked in a similar font and format (IP79G5SAPH K14.001) â note the K in the second line and. Followed by 3 digits on the last line, but are BGA packages. States that it is 16nm from Intel Micron Flash Technologies, which would not be a bad thing at all. That being said, all of the IMFT chips Iâve seen are marked either with the Intel âiâ or the Micron MT symbols, so I canât be certain. Performance Testing Lets see how this unit performs. Iâve got some high hopes!
HDTune Pro On a clean drive, it manages to average 35.4Mb/s read, which makes it just worthy of USB 3.0. The best USB 2.0 drives can manage about 32Mb/s on a âclean busâ, so having USB 3.0 would benefit the end user especially when other peripherals are clogging the bus. After a full write, the performance is held for the dirty state as well. No lies going on here, maybe itâs indicative the factory had done a full-surface format rather than a quick format. CrystalDiskMark The read speed performance is similarly echoed here, although the write performance is disappointing. A 14.30Mb/s write performance can be surpassed by better USB 2.0 flash drives, but also stands behind the value end pack. For reference, the managed 49.79Mb/s sequential read and 31.92Mb/s sequential write, which improves on the read by 34% and doubles the LS on the write!
Even a super-capacity managed 84.01Mb/s sequential read and 28.74Mb/s sequential write and was likely impacted by the need to deploy denser flash. These figures have the most bearing when it comes to bulk file transfers (e.g. Large ZIP/RAR, ISOs). The LS lags behind on the read speed compared to other USB 3.0 âvalueâ series drives, but its medium and small block write performance is sort of in the ball park. It seems that 512kb and 4kb writes do slow down the process dramatically, with the Kingston DataTraveler G4 being about half the speed of the LS on 4kb accesses, and the Kingston DataTraveler 100 G3 being about three times faster on 4kb accesses. The 512kb accesses are roughly similar across the board. The lack of branding about the performance of this drive seems to be deliberate as it has nothing really distinctive to advertise when it comes to speeds.
UPDATE: Well, I just decided to give it a go in my Windows 8.1 laptop with an Intel USB 3.0 controller as opposed to the Renasas/NEC in my main workstation running Windows 7 and it turns out much better read speed results which make it almost entirely different. The write speeds are a little improved but not by much. Alas, it seems there is probably a controller compatibility issue at stake here too.
To be fair, all other results were obtained using the Renesas/NEC chipset, so I wonât compare this with the others. H2testw The drive completed the H2testw sequence with no failure, although the write speed for the whole drive was a measily 12.8Mb/s. High performance is relative, I suppose it could have been.
Conclusion The drive has a Corsair branding on it, but does that mean itâs one of the true Flash Voyagers? Iâd have to go with no. It seems Corsair has âdilutedâ the value of the Flash Voyager branding â this drive does not epitomize the original values of ruggedness, and high performance. The LS âappendageâ changes the equation drastically, and it seems this drive is carrying the name, but targeting the value segment. Has Corsair done a good job with optimising value? Maybe, but on the whole, the products competitors seem to have done a better job. The product is not a Corsair design, instead, OEMed from Topdisk.
The drive itself is as âhigh performanceâ as a Toyota Camry is to a Porsche. Their main competitors in the value segment are anywhere from on-par to three times faster. The price may be cheap, but this product isnât the gold that the Corsair name usually implies.
If youâre after an average USB 3.0 flash drive, go ahead, but donât expect something special. A few years ago, while shopping around at a local Jaycar, I got a bit distracted and did something bad.
I made an impulse buy. I saw a nice LED torch sitting on the shelf, on special, with a very nice number of lumens and I thought I could do with one of those. It wasnât really cheap, when compared to eBay or direct importers. It didnât have a proper branding, it was just inscribed with X-Glow, CREE XLamp. I should know better than to take a chance on a product with questionable credentials, but surely a torch isnât that hard to make right and CREE is a reputable LED manufacturer. Sadly, it was pretty much bad news since after the first month of ownership, the first one had a current driver issue which resulted in a very unstable, flickering output that was more like a candle than a torch.
I didnât want to be out of pocket, so I took it back, and they gave me another. It seemed to work fine, although my family did make fun of me for buying it in the first place.
They said âwho needs a torch anyway?â Then one night, looking to do some work on his car at night, my brother did and so he borrowed it almost-permanently. I didnât see it again for another year, at least.
Then it came back to me â he was done with it. But it wasnât quite the same Bright, but not quite right? Interestingly, when I powered it up, I immediately realized the colour temperature was off and the torch wasnât as bright as it should be.
It was more of a rosy white, rather than the cool white it started off. It wasnât really bright enough to make it worth using anymore. A quick examination of the LED gives us an idea of whatâs wrong. Instead of a nice light-yellow phosphor surface on the LED chip, itâs a toasted black.
Thatâs not right! The LED seems to have burnt â but why? Did it overheat?
It never really felt warm. Did the current driver over-drive the LED? Intrigued, I decided to take it apart and analyze it on its way to the bin.
Teardown and Test Unscrewing the front reflector lets us see the LED itself up close. The LED looks like a Cree or series LED, mounted on some thin, but regular fiberglass PCB. The board itself is riveted onto the aluminium plate.
This doesnât bode well for thermal management at all, as metal-core printed circuit boards (MCPCB) is preferred for LEDs to reduce the thermal resistance from the LED to the heatsink, in this case, the body of the torch. The XR-C is rated for a drive current of 0.5A maximum, with the XR-E rated for 0.7A for Neutral White and 1A for Cool White, provided the LED is kept cool enough. A close up of the LED chip shows the rough edges from sawing the LED wafer into dies, and the mounting of the die on the package with gold bond wires. Itâs lovely, except for the toasty brown center. This is how it looks when it is running â the loss of light and alteration in colour temperature from the brown area is very visible.
Just visible is the grid pattern shadow of the front contact on the LED chip. In order to investigate mode of failure, the first thing I wanted to measure was the LED waveform and current. In order to do that, I needed to desolder the LED connection to open the circuit and add a wire to allow me to insert a non-inductive resistor set just like how I did with the.
Screwing it into circuit, and then clipping my oscilloscope leads over the resistor lets me observe the current through the LED. So what does the waveforms look like? While the LED torch is on the maximum brightness mode, the output duty cycle isnât 100% as you would expect. Instead, every 8.754ms, there is a short dip in the current, resulting in a very short flicker at a rate of 114.2Hz. The forward current averaged 892.2mA which is a high value to run this LED. The RMS ripple averages 55.93mA, so nothing too disasterous to the LEDâs longevity. A close-up of the dip shows a fairly clean curve with no strong overshoots which could harm the LED.
So, aside from a slightly high output current, the current driver doesnât seem to be lethal to the LED on its own. According to the XR-E datasheet, the forward voltage drop at 900mA is about 3.8v.
The most efficient royal blue LEDs which underlie white LEDs are generally about 50% efficient, thus the LED would be putting out 1.71W of heat at the least. In reality, itâs likely to be about 2W. An easily managed amount provided sensible design procedures are followed.
Lets take a look at some of the other modes of this controller â the low-brightness mode for example: The low-brightness mode has an average forward current of 184mA in the LED and a duty cycle of about 25%. In fact, this is likely to be safe for most LED packages even with questionable thermal management, as it should result in about 0.25W of heat. The frequency of the flicker is 112.7Hz, so it seems like it corresponds with the periodic dipping in the above measurements. This implies it might be a microcontroller which runs a loop every ~1/100s.
Not particularly expected. Finally, thereâs a bike-light-like flash mode: The flash cycles every 567ms, and the on periods feature dips similar to the above. Average current over a cycle is 195.6mA, although the on-time current is about 726.3mA, which is close to my expected 700mA value. To find out the problem, we must dig deeper.
As you might have realized, the LED is mounted to a PCB which is riveted to an aluminium plate thatâs part of the torch. The torch barrel doesnât unscrew any further from the outside so how can one access the current driver circuit and the LED PCB itself? Thatâs where a watch wrench comes in handy â as the unit is internally secured by a ring with holes for a tool to fasten/unfasten it.
The rear of the plate already shows cause for concern â there doesnât seem to be much there in terms of thermal management at all. Drilling through the rivets and some prying with a flat-head screwdriver released the PCB from the plate itself.
Cree LEDs come with a feature â an electrically neutral thermal bonding pad which is circular and in the centre of the LED. This is designed to be soldered to a printed pad area (at the least) so as to take the heat away from the small LED chip and spread it to a larger area (making it easier to move to a heatsink). As you can see above, the PCB itself was glued to the aluminium plate (Iâm not sure if itâs even thermal adhesive), but the thermal bonding pad was unconnected. There was no contact of the thermal bonding pad with any adhesive (a poor thermal conductor, but better than air). Even worse, the power connection pads copper area isnât particularly big either, and would have been the last âhopeâ as a heatsink. If they wanted to cheap out on an MCPCB, they should have at least gone with a double sided PCB with no solder resist on the rear, and vias from the thermal pad to the copper on the back to spread the heat.
Proper thermal adhesive would then move this heat to the body of the torch, acting as a heatsink, thus keeping the LED cool. There is no way the 2W of heat would have made it from the small chip to anywhere decent â the torch never heated up in your hand and thatâs exactly the problem â the heat was stuck in the LED chip, killing it. For completeness, lets take a look at the current driver board as well. The main controller is an IC which is bonded to the board in gob-top fashion, thus remaining anonymous. There is a regular ST opamp package on the board as well. The board is marked ALC-0713D-1 V1.
Searching the reveals the OEM as Dongguan Lumingear Lighting Co. Lets hope they arenât still building their units like this nowadays. Post Mortem It seems likely that the torch might have been accidentally left on for an extended period of time, until the batteries drained.
The lack of thermal path from the thermal pad on the back of the LED to any form of heatsinking would have allowed the LED to overheat after a minute or two of operation. Further compounding the problem is the LED driver which drives the LED at (likely) excessive current even for an ideal thermal arrangement. Once the LED overheated, it might have cooked the phosphor layer, or caused a chemical reaction with the packaging materials causing it to go dark. Surprisingly the LED chip itself didnât get hot enough to fail entirely.
Conclusion A LED torch isnât as simple as one might think. In this product, the lack of proper thermal management set the LED on a course of failure from the day it was manufactured. Users which didnât use the torch for long periods may not observe the failure as quickly, although it is not a recommended way of incorporating an LED into a product. Regardless, the current driver also ran the LED at a high, likely slightly excessive current depending on the LED unit, which exacerbated the issue. Even if it is imported, branded and sold by a local electronics shop for a sizeable mark-up is no guarantee the product is of any quality or the shop knows what theyâre doing. I never thought I would meet an LED product with such a fundamental flaw.
Too bad, they have my money already and Iâm not going to see it again. What does somebody do when theyâre in a room and want to relax for a bit? They watch television, of course! Having lived the majority of my life in Australia, it also provides the double-benefit of allowing me to soak up a little of the language and culture of Hong Kong.
Flicking the TV on in the Harbourview Hotel room wasnât particularly inspiring â everythingâs analog and fuzzy hmm. Thatâs not right! Of course, with me, the situation is never quite that simple. Television is, for all intents and purposes, just another radio signal which begs to be captured, decoded and analyzed. Television Signals in Hong Kong Hong Kong is in a state of transition in respect to, similar to where we were a few years back. In Hong Kong, a analog system remains in use until the end of this year, when it will be switched off, officially marking the completion of the transition to digital TV. This will mean that many viewers will need to upgrade to a TV with an integrated digital tuner, or utilize an external digital set top box.
Due to the complications of highrise buildings and shared master antenna systems, some users may have problems even after purchasing the necessary equipment, especially those using analog modulators and closed-circuit TV systems. While not required to do so, Hong Kong adopted the China-backed (DTMB, formerly known as DMB-T or CMMB) standard for broadcasting using 8Mhz wide channels, making it incompatible with receivers based on the European DVB-T standard (such as used in Australia) as well as the Japanese ISDB-T standard, and the US ATSC standard. This makes its reception rather interesting to me, but also requires acquiring some equipment to make it happen. While the DTMB standard, the standard itself is very recent and incorporates many physical layer coding techniques which are superior to those employed by virtually all competing standards. Features such as LDPC error correction coding only are beginning to be implemented by 2nd-generation standards are standard in DTMB. Also, rather interestingly, DTMB also uses time and frequency domain techniques to improve synchronization speed and channel estimation which makes mobile and handheld reception more likely. At the moment, the free-to-air television broadcasts are run by three main companies, Television Broadcasts Limited or better known as, Asia Television or better known as, and Radio Television Hong Kong, better known as.
The first two are commercial broadcasters, with the latter being an independent government department, sort of like how the ABC operates in Australia. Surprisingly, despite there being these free to air broadcasters, the amount of people actually tuning into free to air broadcasts is rather limited, as the programming (at least, according to the locals) is rather thin and poor and the vast majority of serious TV watchers have. The signal frequencies themselves from Office of the Communications Authority, which I stumbled on in a Google search. The terrain in Hong Kong is very hilly and full of urban canyons formed by skyscrapers, which makes it a very difficult and demanding setting for reliable television broadcast. As a result, they have many transmitters scattered everywhere, with a mixture of polarizations and powers, some down to 0.25w â walkie talkie power!
The digital broadcasts are less confusing, with three of the four multiplexes opting to go for a Single Frequency Network arrangement, where all transmitters are sending the same signal at the same point in time, using the same frequency. This has a lot of technical challenges, especially when signals overlap, as they can do so destructively and cause a loss of reception â it is something we have avoided here, although not entirely. The excerpt for the first page of digital frequencies is shown below. At our very central location, our signal was primarily coming from the Temple Hill transmitter, which is the first row, very conveniently. You might have noticed that the RTHK column has a lot of shaded cells â at the moment, RTHK is still in the process of and is in a trial of digital broadcasting. Their covers the approximate area in the diagram (excerpted from ): Of course, I didnât actually know all of this at the time, and instead had to spend time with a tuner and doing some investigation online to find it all out.
Getting a Tuner Given that I couldnât really walk much, or if at all, I had to send the family friend on a mission to buy me a tuner. I made it clear that I was after a DTMB digital USB TV tuner, to use with my laptop. I didnât really need to think about analog â it features less channels, is on the way out, and is much more difficult to capture, store and process. Surprisingly, it wasnât as easy as expected, and in the end there was only a very limited number of stores stocking only two models. Thatâs what happens when you have a unique standard, and few people actually tuning in. I ended up with a. The device is worth HK$270, or about AU$45, but the shop would only negotiate down to HK$320, or about AU$53.
Not too bad, given the receipt states the discount was from HK$750. The tuner itself was taken out of the box at the time I took the shot. It was only now that I regretted bringing my laptop where I had removed the optical drive to save on wasted power and weight Yep. The drivers still come on a CD. I had to do some furious digging before I found and got the software downloaded over the hotel Wi-Fi. The dongle itself was a medium sized unit, with no cap.
Interestingly the printing on the bottom references DMB-T/H which means that it also supports the handheld-variant of the DTMB standard, although it is the old name for it. The tuner itself has a belling-lee PAL aerial socket, which was all good for me, because I had carried along F-to-PAL adapters in case I needed to plug it into a wall socket somewhere. As is the case for most tuners, they come standard with an IR remote and included batteries, not that anyone really uses them anyway.
It did come with a short USB extension (not pictured), which I thought was very thoughtful, as that solves the perpetual problem of port-hogging due to the tunerâs size It also came with a simple dipole antenna which is actually much smaller than it might appear â when folded, it would only be about 10cm tall. This was the antenna I used to receive most of my recordings, and I was surprised that it even got a signal at all due to the vast amount of local noise (e.g.
LED light bulbs, multipath from buildings, water). Teardown Even before I began using it, the first instinct of mine was to take it apart and see whatâs inside. And so I did, although, I didnât have a good camera to take a picture of it at the time. So, when I got it home, I took it apart again Well, would you look at that. RTL-SDR users would already see a breath of familiarity, as this is based on an U which is a cousin of our very familiar RTL2832U. This is paired up to a Fitipower FC0013 front-end (not our favourite) just underneath the IR receiver which is bent up and out of the way. Interestingly, the design of this tuner uses two crystals, both 27Mhz units.
In most of the lower cost tuners, only one crystal is used with the RTL chip feeding out the clock to the front-end. Maybe thereâs a limitation in the RTL2836BU or some stability requirements that couldnât be met using that arrangement, hence the need for two crystals of the same frequency.
The marking on the PCB is HU772 Rev D. A quick search for the code suggests that the OEM may be. The underside doesnât have much to offer, but it suggests the tuner was made week 38 of 2014. It seems there might be some power regulation circuitry on the underside, and possibly an EEPROM for the vendor information. Watching and Collecting TV Getting the tuner up and running wasnât very difficult, with the Arcsoft TotalMedia viewer working out of the box. With some very careful antenna alignments, I was able to get all four multiplexes tuned and watchable but with some level of picture and audio break-up.
This was actually quite variable, as the TVB and ATV SFN multiplex was nice and clear scoring above 90% decode quality, whereas the RTHK service and the TVB+ATV regular analog-replacement multiplex was variable, at times below 20% for quality and totally unwatchable. If I was to catalogue and analyze the television in Hong Kong, using the TotalMedia viewer software was the wrong way to do it. It could only do one logical channel at a time, and it hid all the details about the tuning away from me.
I had to dig a little deeper. It was then, I realized, I still had my Twinhan TS Recorder application for BDA tuners with me. This little handy utility (which isnât available anywhere else anymore) basically provides a crude front end to pass tuning commands to a DVB-T or DVB-S BDA compliant tuner and dump the resulting transport stream.
But hold on a sec, this tuner isnât a DVB-T or DVB-S tuner Youâd be right. But then I discovered something interesting â instead of making a whole new subset of a standard and cause the need for rewriting tuner applications to support DTMB, all DTMB tuners known to date exploit the DVB-T standard and. The capture application worked, as long as I plugged in the right frequency, and 8Mhz reception bandwidth. Over a period of about a week, I managed to capture and carry home over 1.4Tb of TV data off the air for later viewing and analysis â everything including the null packets and TEI flagged reception errors.
After all, I had no time to watch it live, and I didnât have the time or tools to analyze it live either. Channels on the Air and Proof of Reception Although I was technically in the target reception area, the fact that I travelled all the way to Hong Kong to receive the signals makes it feel like a DXpedition to me. As a result, I wanted to collect something memorable and structured as proof of the reception. Of course, there was no time and it was unlikely they would issue QSL cards (itâs a bygone era), so I took to taking down the station watermark logos and recording their station promos and compiling them into a video. Not all clips were received without transmission error, but the majority were. Stations in the TVB Network Jade High Definition Jade J2 iNews Pearl Stations in (or provided by) the ATV Network Home Asia World Classic CCTV-1 SZTV Stations in (or provided by) the RTHK Network RTHK 31 RTHK 32 RTHK 33 (CCTV-9) More interesting is to watch the station introductions and promotional clips which I have compiled into two videos.
The first video is for Hong Kong Free to Air stations which are locally sourced. The second video is for China TV provided via Hong Kong Free-to-Air stations. Analyzing Hong Kong Free-to-Air DTMB Multiplexes A nice thing about having transport stream captures is that you can take them home and analyze them at your leisure, using tools such as TSReader.
Using this, you can read the system data from the transport stream and uncover streams which you didnât realize were in the multiplex. One of the first things I like to check out is the Network Information Table (NIT).
The NIT usually provides information about the multiplex provider name, and modulation parameters. Unfortunately, due to the non-DVB nature of the system, the modulation parameters shown were completely wrong. ⢠402Mhz â Network name [blank], Network ID 32765 ⢠586Mhz â Network name SFN_TVB, Network ID 32766 ⢠602Mhz â Network name aTV-SFN, Network ID 32767 ⢠802Mhz â Network name [blank], Network ID 32764 The frequencies used span the whole band from lower UHF to upper UHF, which seems like a rather strange arrangement especially if they want to refarm blocks of spectrum for resale. I do like the systematic nature of the Network ID allocations. It was interesting to catalog the PID numbers, LCN numbers, encodings and bitrates of each channel in each multiplex.
Phison Ps2251-03
Again, the PIDs (in decimal) seem to be allocated almost systematically based on the LCN, rather than in the usual ad-hoc fashion. The results are summarized in the below table. From the table, we can see that all channels except those owned by ATV are already running in 1080i. There are no MPEG-2 services on the air, and no MPEG-2 Audio anywhere to be seen. ATV broadcasts all their channels in standard definition except Asia, but theyâre all in H.264 as well. Asia and High Definition Jade also provide 5.1 audio, whereas Jade and High Definition Jade provide triple-language subtitle streams. Itâs important to note that Jade and High Definition Jade are not simulcast stations and often have different content despite the similarities in name.
Jade itself is in High Definition. On the 586Mhz channel, it seems there is a special available on PID1001. This stream carries 399kbit/s of data consistently, and its purpose seems to be related to the MHEG-5 TVB Interactive service. Unfortunately, never having used an MHEG-5 based service, I really wonder just how often used it might be. To better understand the bitrate allocation, we need to know the encoding mode.
Unfortunately, the data in the NIT wasnât helpful, so lets take a look at the indicated air bitrate. TSReader reported a stream bitrate around 21.730 â 21.982Mbit/s when reading out from the file. This was true for all four multiplexes! I had to look hard to find the DTMB modulation mode and bitrate tables, but I managed to find one courtesy of the. I have reproduced the relevant tables below: Given the bitrate is around 21 to 22Mbit/s, the most likely candidate modes are: ⢠4200 symbols, 16QAM, 4/5 FEC ⢠4725 symbols, 64QAM, 3/5 FEC Either mode results in the same net bitrate of 21.658Mbit/s, which we will use as the total stream bitrate. Iâve tallied up the streams and their bitrates, as well as that of the null packets â whatever remains belongs to the overheads of sending the PMT, NIT, SDT, and subtitles. The channel utilization is slightly below-optimal on the first transponder, but is pretty packed for everything else.
Compared to DVB-T, their multiplex bitrates are actually lower than the rates most commercial channels (see below). Differences to Australian Television Hong Kong TV does have quite a few notable differences to that in Australia. That includes: ⢠The use of DTMB modulation schemes which are superior for signal robustness, and 8Mhz channel width instead of 7Mhz in Australia due to bandplan differences. ⢠The widespread use of H.264 encoding, despite what the, MPEG-2 is no longer on the air. Likewise, 720p is not on the air either, and 576i is only restricted to ATV properties. ⢠1080i almost everywhere, and bitrates that are quite reasonable, exceeding 10Mbit/s in some cases (Youtube 1080p only averages 4Mbit/s).
Using the H.264 encoding produces much better pictures for the same bitrate, compared to MPEG-2. ⢠A lot of public service announcement ads â this includes anything from checking your mobile contract before you sign, being aware of high roaming mobile phone charges, to escalator safety, to keeping out of the way of emergency services when you drive, to competition watchdog messages, job scam alerts, election warnings, to blood transfusions, computer literacy, bird flu and AIDS warnings. They generally are pretty informative sometimes a little on the overdone dramatic/cute side, kind of like an infomercial.
Itâs not all about commercial ads! ⢠They have sponsored time-check announcements of the time. ⢠The watermark is on the top right hand corner, instead of the bottom right hand corner. ⢠They make extensive use of multiple-audio technology to deliver programs in Cantonese and Manderin, or Cantonese and English simultaneously, and some have triple-subtitles as well, and not of the nasty blocky âteletextâ type either!
They look DVD quality. ⢠The stations donât always produce 24/7 programming. RTHK32 is mostly scrolling text most days, and RTHK31 is the same bar 3-6 hours a day of programs. TVB stations tend to repeat every popular program once to give viewers a chance to catch it in the evening if they missed out in the morning.
⢠Syndication of content â stations seem to be happy to get content from elsewhere and air it on their channels. ATV, for example, carries CCTV-1 and SZTV from China, and RTHK carries CCTV-9 from China. ATV has ATV World, and TVB has Pearl which are 24/7 English language stations in a Cantonese speaking world. ⢠CCTV-1 and SZTV via ATV is presented inside coloured pillarboxes because theyâre native 4:3 content.
We just use black pillarboxes or a half-way crop. ⢠They have lots of station promos compared to us. ⢠They donât seem to use the EPG feature, or if they do, they donât send them as MPEG-TS EIT events. However, I think the biggest difference lies in the state of free-to-air in Hong Kong. While free-to-air here is considered viable and sometimes turns out decent programming, many viewers in Hong Kong have completely turned off free-to-air, and their locally produced content has never rated very well. This has combined into a slow death-spiral, which was consuming ATV while I was there.
That was why they were running so many ânew lifeâ campaign promos, as they had run out of money and were unable to pay their employees on time, leading to a walk-out. The future of ATV is under question, given that they have started advertising extremely highly discounted advertising packages which are unlikely to turn a real profit.
Itâs a sad situation, as ATV has been important in the history of Hong Kong television. So maybe I shouldnât be so jealous of their high quality picture Conclusion I can definitely tick the box and say that Iâve received DTMB-standard digital TV broadcasts and I know I have equipment that works. Analyzing the Hong Kong TV broadcasts has shown me the superiority of the DTMB standard, and the high quality delivered by the 1080i (on most channels) in H.264. Itâs a shame that our local TV looks nothing like the quality of Hong Kongâs. Unfortunately, a quality picture doesnât save the free to air networks from declining ratings and viewership, and ATVâs future is currently under a shadow.
December 2017 M T W T F S S 1 2 4 5 6 7 8 9 10 11 13 14 15 17 18 19 20 24 25 26 27 28 29 30 31 ⢠Archives ⢠(12) ⢠(19) ⢠(1) ⢠(4) ⢠(16) ⢠(6) ⢠(11) ⢠(30) ⢠(13) ⢠(15) ⢠(19) ⢠(16) ⢠(8) ⢠(31) ⢠(14) ⢠(21) ⢠(13) ⢠(17) ⢠(19) ⢠(20) ⢠(12) ⢠(15) ⢠(4) ⢠(12) ⢠(22) ⢠(14) ⢠(21) ⢠(25) ⢠(14) ⢠(16) ⢠(6) ⢠(11) ⢠(12) ⢠(19) ⢠(11) ⢠(21) ⢠(18) ⢠(20) ⢠(12) ⢠(7) ⢠(23) ⢠(18) ⢠(16) ⢠(15) ⢠(14) ⢠(21) ⢠(13) ⢠(17) ⢠(26) ⢠(26) ⢠(11) ⢠(17) ⢠(31) ⢠(27) ⢠(36) ⢠(31) ⢠(39) ⢠(3) ⢠(18) ⢠(1) ⢠Tags.
C01 and C02 are in the signal lines. These would not be fused. In any case you could eliminate any concerns with USB 3.0 by using a USB 2.0 cable. Instead I would test zero-ohm resistor R03. I would also confirm that the two switchmode DC-DC converters are working, and that the controller and flash ICs are not overheating. The output voltages of the two converters would appear across C41 and C42.
Code: Pin Number Name Description 1 VBus +5V Power 2 USB D- USB 2.0 data 3 USB D+ 4 GND Ground for power return 5 StdA_SSRX- SuperSpeed receiver 6 StdA_SSRX+ SuperSpeed receiver 7 GND_DRAIN Ground for signal return 8 StdA_SSTX- SuperSpeed transmitter 9 StdA_SSTX+ SuperSpeed transmitter Could you tell us the markings on U02 and U03? I would have thought that typical NAND VDD/VDDQ voltages would be 1.8V and 3.3V, so yours would appear to be of the right order. Perhaps Kingston has tweaked the 3.3V supply? I would also measure the voltages across the remaining capacitors. This would help to identify any other voltages such as the internal (?) Vcore and Vio supplies for the flash controller. I would avoid probing C13/R14/R15 and C14 or either of its associated resistors (whose circuit references I cannot identify). I believe that these capacitors and resistors form the feedback networks of each of the buck regulators.
Typically these resistors have high values, so your multimeter may disturb the output voltage. You might try to locate a datasheet or reference circuit for the flash controller (is it a Phison?). There would normally be a reset pin, and this pin is often connected to an RC combination. I suspect that the junction of R12 and C04 could be the reset test point. It should go high in order for the controller to start up. So, turns out the flsh controller is a PHISON PS2251-13-Q.
I'm having trouble finding datasheets for this chip. As suggested, I have measured the voltage for all the other capacitors on the PCB. I have done the same thing with an identical working USB key.
(see attached file) Aside from C01 and C02, the voltages for all capacitors are pretty close from one device to the other. For C01 and C02, I don't get any voltage on the defect key, but I get 0.63V on the working one. Is there something else that I could test/try?
Attachments Voltages for all capacitors. Defect key vs working key (9.79 KiB) Downloaded 70 times. The BCnn components would be bypass capacitors. These provide local supply filtering at the various ICs. It would appear that the flash controller has an internal 1.1V Vcore linear LDO regulator and possibly an internal 3.3V linear Vio LDO regulator. The external 1.9V and 3.5V supplies would be for the NANDs. Code: BC02 1.12 1.11 BC03 1.12 1.09 BC05 1.12 1.11 BC07 1.12 1.09 Flash Controller internal Vcore LDO reg = 1.1V?
Phison Mpall
BC08 1.12 1.11 BC10 1.12 1.09 BC11 1.12 1.09 BC01 1.86 1.88 BC04 1.88 1.86 BC06 1.88 1.86 Vio/NAND = 1.9V? BC13 1.88 1.86 BC15 1.88 1.86 BC09 3.3 3.24 Flash Controller internal Vio LDO reg = 3.3V? BC12 3.47 3.45 BC14 3.47 3.45 Vio/NAND = 3.5V? The capacitor which I suspected was the reset cap (C04) is sitting at +3.5V, so this means that the controller should have woken up. However, the 0V readings at C01 and C02 (USB 3.0 pins) would suggest that the controller may be brain dead.
Phison Ps2251 03 V Datasheets360 1
My next step would be to confirm whether Y01 is oscillating. Other than that, I wouldn't be able to do anything.