Reverse-engineering and analysis of SanDisk High Endurance microSDXC card

As seen on Hackaday!

TL;DR – The SanDisk High Endurance cards use SanDisk/Toshiba 3D TLC Flash. It took way, way more work than it should have to figure this out (thanks for nothing, SanDisk!).

In a previous blog post, I took a look at SanDisk’s microSD cards that were aimed for use in write-intensive applications like dash cameras. In that post I took a look at its performance metrics, and speculated about what sort of NAND Flash memory is used inside. SanDisk doesn’t publish any detailed specifications about the cards’ internal workings, so that means I have no choice but to reverse-engineer the can of worms card myself.

The Help Desk That Couldn’t

In the hopes of uncovering more information, I sent an email to SanDisk’s support team asking about what type of NAND Flash they are using in their High Endurance lineup of cards, alongside endurance metrics like P/E (Program/Erase) cycle counts and total terabytes written (TBW). Unfortunately, the SanDisk support rep couldn’t provide a satisfactory answer to my questions, as they’re not able to provide any information that’s not listed in their public spec sheets. They said that all of their cards use MLC Flash, which I guess is correct if you call TLC Flash 3-bit MLC (which Samsung does).

Dear Jason,

Thank you for contacting SanDisk® Global customer care. We really appreciate you being a part of our SanDisk® family.

I understand that you wish to know more about the SanDisk® High Endurance video monitoring card, as such please allow me to inform you that all our SanDisk® memory cards uses Multi level cell technology (MLC) flash. However, the read/write cycles for the flash memory is not published nor documented only the read and write speed in published as such they are 100 MB/S & 40 MB/s. The 64 GB card can record Full HD video up to 10,000 hours. To know more about the card you may refer to the link below:


Best regards,
Allan B.
SanDisk® Global Customer Care

I’ll give them a silver star that says “You Tried” at least.

Anatomy of an SD Card

While (micro)SD cards feel like a solid monolithic piece of technology, they’re made up of multiple different chips, each performing a different role. A basic SD card will have a controller that manages the NAND Flash chips and communicates with the host (PC, camera, etc.), and the NAND Flash itself (made up of 1 or more Flash dies). Bunnie Huang’s blog, Bunnie Studios, has an excellent article on the internals of SD cards, including counterfeits and how they’re made – check it out here.

SD Card Anatomy

Block diagram of a typical SD card.

MicroSD cards often (but not always!) include test pads, used to program/test the NAND Flash during manufacture. These can be exploited in the case of data recovery, or to reuse microSD cards that have a defective controller or firmware by turning the card into a piece of raw NAND Flash – check out Gough Lui’s adventures here. Note that there is no set standard for these test pads (even for the same manufacturer!), but there are common patterns for some manufacturers like SanDisk that make reverse-engineering easier.

Crouching Controller, Hidden Test Pads

microSD cards fall into a category of “monolithic” Flash devices, as they combine a controller and raw NAND Flash memory into a single, inseparable package. Many manufacturers break out the Flash’s data bus onto hidden (and nearly completely undocumented) test pads, which some other memory card and USB drive manufacturers take advantage of to make cheap storage products using failed parts; the controller can simply be electrically disabled and the Flash is then used as if it were a regular chip.

In the case of SanDisk cards, there is very limited information on their cards’ test pad pinouts. Each generation has slight differences, but the layout is mostly the same. These differences can be fatal, as the power and ground connections are sometimes reversed (this spells instant death for a chip if its power polarity is mixed up!).

CORRECTION (July 22, 2020): Upon further review, I might have accidentally created a discrepancy between the leaked pinouts online, versus my own documentation in terms of power polarity; see the “Test Pad Pinout” section.

My card (and many of their higher-end cards – that is, not their Ultra lineup) features test pads that aren’t covered by solder mask, but are instead covered by some sort of screen-printed epoxy with a laser-etched serial number on top. With a bit of heat and some scraping, I was able to remove the (very brittle) coating on top of the test pads; this also removed the serial number which I believe is an anti-tamper measure by SanDisk.

After cleaning off any last traces of the epoxy coating, I was greeted with the familiar SanDisk test pad layout, plus a few extra on the bottom.

Building the Breakout Board

The breakout board is relatively simple in concept: for each test pad, bring out a wire that goes to a bigger test point for easier access, and wire up the normal SD bus to an SD connector to let the controller do its work with twiddling the NAND Flash bus. Given how small each test pad is (and how many), things get a bit… messy.

I started by using double-side foam adhesive tape to secure the SD card to a piece of perfboard. I then tinned all of the pads and soldered a small 1uF ceramic capacitor across the card’s power (Vcc) and ground (GND) test pads. Using 40-gauge (0.1 mm, or 4-thousandths of an inch!) magnet wire, I mapped each test pad to its corresponding machine-pin socket on the perfboard. Including the extra test pads, that’s a total of 28 tiny wires!

For the SD connector side of things, I used a flex cable for the XTC 2 Clip (a tool used to service HTC Android devices), as it acted as a flexible “remote SD card” and broke out the signals to a small ribbon cable. I encased the flex cable with copper tape to act as a shield against electrical noise and to provide physical reinforcement, and soldered the tape to the outer pads on the perfboard for reinforcement. The ribbon cable end was then tinned and each SD card’s pin was wired up with magnet wire. The power lines were then broken out to an LED and resistor to indicate when the card was receiving power.

Bus Analysis

With all of the test pads broken out to an array of test pins, it was time to make sense of what pins are responsible for accessing the NAND Flash inside the card.

Test Pad Pinout

Diagram of the test pads on SanDisk's High Endurance microSD card.

Diagram of the test pads on SanDisk’s High Endurance microSD card. (click to enlarge)

The overall test pad pinout was the same for other microSD cards from SanDisk, but there were some differences, primarily regarding the layout of the power pads; notably, the main power pins are backwards! This can destroy the card if you’re not careful when applying power.

CORRECTION (July 22, 2020): I might actually have just gotten my own documentation mixed up in terms of the power and ground test pads. Regardless, one should always be careful to ensure the correct power polarity is sent to a device.

I used my DSLogic Plus logic analyzer to analyze the signals on all of the pins. Since the data pinout was previously discovered, the hard part of figuring out what each line represented (data bus, control, address, command, write-protect, ready/busy status) was already done for me. However, not all of the lines were immediately evident as the pinouts I found online only included the bare minimum of lines to make the NAND Flash accessible, with one exception being a control line that places the controller into a reset state and releases its control of the data lines (this will be important later on).

By sniffing the data bus at the DSLogic’s maximum speed (and using its 32 MB onboard buffer RAM), I was able to get a clear snapshot of the commands being sent to the NAND Flash from the controller during initialization.

Bus Sniffing & NAND I/O 101 (writing commands, address, reading data)

In particular, I was looking for two commands: RESET (0xFF), and READ ID (0x90). When looking for a command sequence, it’s important to know how and when the data and control lines change. I will try to explain it step-by-step, but if you’re interested there is an introductory white paper by Micron that explains all of the fundamentals of NAND Flash with much more information about how NAND Flash works.

When a RESET command is sent to the NAND Flash, first the /CE (Chip Select, Active Low) line is pulled low. Then the CLE (Command Latch Enable) line is pulled high; the data bus is set to its intended value of 0xFF (all binary ones); then the /WE (Write Enable, Active Low) line is pulsed from high to low, then back to high again (the data bus’ contents are committed to the chip when the /WE line goes from low to high, known as a “rising edge”); the CLE line is pulled back low to return to its normal state. The Flash chip will then pull its R/B (Ready/Busy Status) line low to indicate it is busy resetting itself, then releases the line back to its high state when it’s finished.

The READ ID command works similarly, except after writing the command with 0x90 (binary 1001 0000) on the data bus, it then pulls the ALE (Address Latch Enable) line high instead of CLE, and writes 0x00 (all binary zeroes) by pulsing the /WE line low. The chip transfers its internally programmed NAND Flash ID into its internal read register, and the data is read out from the device on each rising edge of the /RE (Read Enable, Active Low) line; for most devices this is 4 to 8 bytes of data.


For each NAND Flash device, it has a (mostly) unique ID that identifies the manufacturer, and other functional data that is defined by that manufacturer; in other words, only the manufacturer ID, assigned by the JEDEC Technology Association, is well-defined.

The first byte represents the Flash manufacturer, and the rest (2 to 6 bytes) define the device’s characteristics, as set out by the manufacturer themselves. Most NAND vendors are very tight-lipped when it comes to datasheets, and SanDisk (and by extension, Toshiba/Kioxia) maintain very strict control, save for some slightly outdated leaked Toshiba datasheets. Because the two aforementioned companies share their NAND fabrication facilities, we can reasonably presume the data structures in the vendor-defined bytes can be referenced against each other.

In the case of the SanDisk High Endurance 128GB card, it has a NAND Flash ID of 0x45 48 9A B3 7E 72 0D 0E. Some of these values can be compared against a Toshiba datasheet:

Byte Value (Hex) Description/Interpretation
  • Manufacturer: SanDisk
  • I/O voltage: Presumed 1.8 volts (measured with multimeter)
  • Device capacity: Presumed 128 GB (unable to confirm against datasheet)
  • NAND type: TLC (Triple-Level Cell / 3 bits per cell)
  • Flash dies per /CE: 4 (card uses four 32GB Flash chips internally)
  • Block size: 12 MiB (768 pages per block) excluding spare area (determined outside datasheet)
  • Page size: 16,384 bytes / 16 kiB excluding spare area
  • Planes per /CE: 8 (2 planes per die)
  • Interface type: Asynchronous
  • Process geometry: BiCS3 3D NAND (determined outside datasheet)
  • Unknown (no information listed in datasheet)
  • Unknown (no information listed in datasheet)

Although not all byte values could be conclusively determined, I was able to determine that the SanDisk High Endurance cards use BiCS3 3D TLC NAND Flash, but at least it is 3D NAND which improves endurance dramatically compared to traditional/planar NAND. Unfortunately, from this information alone, I cannot determine whether the card’s controller takes advantage of any SLC caching mechanisms for write operations.

The chip’s process geometry was determined by looking up the first four bytes of the Flash ID, and cross-referencing it to a line from a configuration file in Silicon Motion’s mass production tools for their SM3271 USB Flash drive controller, and their SM2258XT DRAM-less SSD controller. These tools revealed supposed part numbers of SDTNAIAMA-256G and SDUNBIEMM-32G respectively, but I don’t think this is accurate for the specific Flash configuration in this card.

External Control

I wanted to make sure that I was getting the correct ID from the NAND Flash, so I rigged up a Texas Instruments MSP430FR2433 development board and wrote some (very) rudimentary code to send the required RESET and READ ID commands, and attempt to extract any extra data from the chip’s hidden JEDEC Parameter Page along the way.

My first roadblock was that the MSP430 would reset every time it attempted to send the RESET command, suggesting that too much current was being drawn from the MSP430 board’s limited power supply. This can occur during bus contention, where two devices “fight” each other when trying to set a certain digital line both high and low at the same time. I was unsure what was going on, since publicly-available information didn’t mention how to disable the card’s built-in controller (doing so would cause it to tri-state the lines, effectively “letting go” of the NAND bus and allowing another device to take control).

I figured out that the A1 test pad (see diagram) was the controller’s reset line (pulsing this line low while the card was running forced my card reader to power-cycle it), and by holding the line low, the controller would release its control of the NAND Flash bus entirely. After this, my microcontroller code was able to read the Flash ID correctly and consistently.

Reading out the card's Flash ID with my own microcontroller code.

Reading out the card’s Flash ID with my own microcontroller code.

JEDEC Parameter Page… or at least what SanDisk made of it!

The JEDEC Parameter Page, if present, contains detailed information on a Flash chip’s characteristics with far greater detail than the NAND Flash ID – and it’s well-standardized so parsing it would be far easier. However, it turns out that SanDisk decided to ignore the standard format, and decided to use their own proprietary Parameter Page format! Normally the page starts with the ASCII string “JEDEC”, but I got a repeating string of “SNDK” (corresponding with their stock symbol) with other data that didn’t correspond to anything like the JEDEC specification! Oh well, it was worth a try.

I collected the data with the same Arduino sketch as shown above, and pulled 1,536 bytes’ worth of data; I wrote a quick program on Ideone to provide a nicely-formatted hex dump of the first 512 bytes of the Parameter Page data:

Offset 00:01:02:03:04:05:06:07:08:09:0A:0B:0C:0D:0E:0F 0123456789ABCDEF
------ --+--+--+--+--+--+--+--+--+--+--+--+--+--+--+-- ----------------
0x0000 53 4E 44 4B 53 4E 44 4B 53 4E 44 4B 53 4E 44 4B SNDKSNDKSNDKSNDK
0x0010 53 4E 44 4B 53 4E 44 4B 53 4E 44 4B 53 4E 44 4B SNDKSNDKSNDKSNDK
0x0020 08 08 00 08 06 20 00 02 01 48 9A B3 00 05 08 41 ..... ...H.....A
0x0030 48 63 6A 08 08 00 08 06 20 00 02 01 48 9A B3 00 Hcj..... ...H...
0x0040 05 08 41 48 63 6A 08 08 00 08 06 20 00 02 01 48 ..AHcj..... ...H
0x0050 9A B3 00 05 08 41 48 63 6A 08 08 00 08 06 20 00 .....AHcj..... .
0x0060 02 01 48 9A B3 00 05 08 41 48 63 6A 08 08 00 08 ..H.....AHcj....
0x0070 06 20 00 02 01 48 9A B3 00 05 08 41 48 63 6A 08 . ...H.....AHcj.
0x0080 08 00 08 06 20 00 02 01 48 9A B3 00 05 08 41 48 .... ...H.....AH
0x0090 63 6A 08 08 00 08 06 20 00 02 01 48 9A B3 00 05 cj..... ...H....
0x00A0 08 41 48 63 6A 08 08 00 08 06 20 00 02 01 48 9A .AHcj..... ...H.
0x00B0 B3 00 05 08 41 48 63 6A 08 08 00 08 06 20 00 02 ....AHcj..... ..
0x00C0 01 48 9A B3 00 05 08 41 48 63 6A 08 08 00 08 06 .H.....AHcj.....
0x00D0 20 00 02 01 48 9A B3 00 05 08 41 48 63 6A 08 08  ...H.....AHcj..
0x00E0 00 08 06 20 00 02 01 48 9A B3 00 05 08 41 48 63 ... ...H.....AHc
0x00F0 6A 08 08 00 08 06 20 00 02 01 48 9A B3 00 05 08 j..... ...H.....
0x0100 41 48 63 6A 08 08 00 08 06 20 00 02 01 48 9A B3 AHcj..... ...H..
0x0110 00 05 08 41 48 63 6A 08 08 00 08 06 20 00 02 01 ...AHcj..... ...
0x0120 48 9A B3 00 05 08 41 48 63 6A 08 08 00 08 06 20 H.....AHcj..... 
0x0130 00 02 01 48 9A B3 00 05 08 41 48 63 6A 08 08 00 ...H.....AHcj...
0x0140 08 06 20 00 02 01 48 9A B3 00 05 08 41 48 63 6A .. ...H.....AHcj
0x0150 08 08 00 08 06 20 00 02 01 48 9A B3 00 05 08 41 ..... ...H.....A
0x0160 48 63 6A 08 08 00 08 06 20 00 02 01 48 9A B3 00 Hcj..... ...H...
0x0170 05 08 41 48 63 6A 08 08 00 08 06 20 00 02 01 48 ..AHcj..... ...H
0x0180 9A B3 00 05 08 41 48 63 6A 08 08 00 08 06 20 00 .....AHcj..... .
0x0190 02 01 48 9A B3 00 05 08 41 48 63 6A 08 08 00 08 ..H.....AHcj....
0x01A0 06 20 00 02 01 48 9A B3 00 05 08 41 48 63 6A 08 . ...H.....AHcj.
0x01B0 08 00 08 06 20 00 02 01 48 9A B3 00 05 08 41 48 .... ...H.....AH
0x01C0 63 6A 08 08 00 08 06 20 00 02 01 48 9A B3 00 05 cj..... ...H....
0x01D0 08 41 48 63 6A 08 08 00 08 06 20 00 02 01 48 9A .AHcj..... ...H.
0x01E0 B3 00 05 08 41 48 63 6A 08 08 00 08 06 20 00 02 ....AHcj..... ..
0x01F0 01 48 9A B3 00 05 08 41 48 63 6A 08 08 00 08 06 .H.....AHcj.....

Further analysis with my DSLogic showed that the controller itself requests a total of 4,128 bytes (4 kiB + 32 bytes) of Parameter Page data, which is filled with the same repeating data as shown above.

Reset Quirks

When looking at the logic analyzer data, I noticed that the controller sends the READ ID command twice, but the first time it does so without resetting the Flash (which should normally be done as soon as the chip is powered up!). The data that the Flash returned was… strange to say the least.

Byte Value (Hex) Interpreted Value
  • Manufacturer: Toshiba
  • I/O voltage: Unknown (no data)
  • Device capacity: Unknown (no data)
  • NAND type: SLC (Single-Level Cell / 1 bit per cell)
  • Flash dies per /CE: 1
  • Block size: 4 MB excluding spare area
  • Page size: 16,384 bytes / 16 kiB excluding spare area
  • Planes per /CE: 2
  • Interface type: Asynchronous
  • Process geometry: 70 nm planar

This confused me initially when I was trying to find the ID from the logic capture alone; after talking to a contact who has experience in NAND Flash data recovery, they said this is expected for SanDisk devices, which make liberal use of vendor-proprietary commands and data structures. If the fourth byte is to be believed, it says the block size is 4 megabytes, which I think is plausible for a modern Flash device. The rest of the information doesn’t really make any sense to me apart from the first byte indicating the chip is made by Toshiba.


I shouldn’t have to go this far in hardware reverse-engineering to just ask a simple question of what Flash SanDisk used in their high-endurance card. You’d think they would be proud to say they use 3D NAND for higher endurance and reliability, but I guess not!


For those that are interested, I’ve included the logic captures of the card’s activity shortly after power-up. I’ve also included the (very crude) Arduino sketch that I used to read the NAND ID and Parameter Page data manually:

WordAds Adventures, Episode 5: 2019 in review (January to September)

Time sure flies by – it’s already been almost two years since I first joined the WordAds program, and over a year since my last WordAds update. Let’s see how we’ve done…

Results from July 2018 to September 2019

Earnings Data

Payout Period Revenue Ads Views Visitors CPM Ads/View Ads/Visitor
1 Jul 2018  $     8.19     18,581       6,861       3,191  $   0.441 2.708 5.823
Aug 2018  $   11.64     21,633       8,103       3,931  $   0.538 2.670 5.503
Sep 2018  $   10.66     21,082       8,251       3,721  $   0.506 2.555 5.666
Oct 2018  $   16.66     34,896     11,976       6,044  $   0.477 2.914 5.774
Nov 2018  $   26.20     40,856     15,520       6,709  $   0.641 2.632 6.090
Dec 2018  $   23.31     38,538     11,786       6,119  $   0.605 3.270 6.298
2 Jan 2019  $   12.71     40,856     13,028       5,791  $   0.311 3.136 7.055
Feb 2019  $     9.91     42,626     11,334       5,773  $   0.232 3.761 7.384
Mar 2019  $     7.45     32,798       9,230       4,427  $   0.227 3.553 7.409
Apr 2019  $     4.20     20,456       6,320       2,870  $   0.205 3.237 7.128
May 2019  $     5.79     26,557       6,414       2,910  $   0.218 4.140 9.126
Jun 2019  $   14.36     48,428       9,821       3,977  $   0.297 4.931 12.177
Jul 2019  $   21.19     87,689     16,222       8,819  $   0.242 5.406 9.943
Aug 2019  $   10.17     44,227       8,376       4,083  $   0.230 5.280 10.832
Sep 2019  $   11.78     54,143     10,155       5,264  $   0.218 5.332 10.286

July 2018 to December 2018

Since the last update, things were actually doing pretty nicely until the end of 2018. My CPM rose from the 40-cent mark up to 64 cents on November 2018. My last payout came to me after the end of the year, netting $194.42 for 2018 overall, and $96.66 for this specific time period. The CPM (earnings per 1000 ad views) was an average 55 cents for the entire year, and 53.5 cents for this specific time period.

January 2019 to September 2019

After ending 2018 on a high note, I had good feelings about how well 2019 was going to pay out. I was wrong – it’s worse than it’s ever been before. My CPM has fallen to less than 30 cents, even despite a few popular posts like adding PCIe to the Atomic Pi, or fixing a liquid-damaged MacBook Pro.

This year to date I’ve earned $97.56, with a total ad view count of 397,780. If I multiplied this by last year’s average CPM, I should have earned $218.78 – talk about a massive cutback! This is coupled with the fact that the majority of the ads that do get served are the low-quality chumbox kind, like the infamous “gut doctor” ad that would repeat itself over a dozen times within a few pages’ worth of blog posts.

At the same time, I guess I shouldn’t complain too much about my earnings. Another WordPress blogger earned 18 cents in March 2019. Even if I’m not breaking even on my hosting fees, it still helps.


Simply put, 2019 has not been a particularly prosperous year for WordAds revenue – or at least in my case it isn’t. Hopefully the rest of 2019 turns out better, and likewise for 2020…


Unboxing and review of SanDisk 64GB microSDXC High Endurance Card

UPDATE (July 19, 2020): I’ve analyzed a 128GB version of the High Endurance card, and it appears that SanDisk is using 3D TLC Flash.

Dashcams: they can be a crucial tool when reconstructing events in a vehicular incident, or a source of entertainment when watching compilations on YouTube. Like any modern device, they generally use SD or microSD cards as their storage medium. However, not all cards are created equal.

Cheaper cards, like SanDisk’s Ultra lineup, use cheaper TLC (triple-level cell) NAND Flash that is ill-suited to the harsh working conditions of a dashcam. Not only does the card have to endure temperature extremes, the constant writes can burn through the Flash’s write cycles in short order. In fact, SanDisk specifically denounces this line of cards for use in continuous-recording applications.

The solution: high-endurance memory cards! These cards (at least in theory) use more durable MLC or even SLC NAND Flash, which can take many more write cycles. I purchased the 64-gigabyte model, the SDSQQNR-064G-G46A.


The card’s packaging isn’t much different than SanDisk’s typical microSD card offerings. The paper-and-plastic package includes a small blister pack that holds the microSD card itself and the full-size SD card adapter, without a carrying case (granted, the memory card is expected to stay inside the dashcam for most of its working life).

The packaging also includes a license key for a 1-year subscription to the RescuePRO data recovery software (although in all honesty, you’d be better off using the free PhotoRec software instead).

Endurance Rating

SanDisk’s lineup of high-endurance memory cards are designed for use in very write-intensive workloads, such as constant video recording.

Unfortunately, the endurance specifications for these cards are (probably intentionally) vague, only providing a set number of hours of video recording. However, we can infer a rating with a little bit of math.

SanDisk’s card packaging defines Full HD video to be 26 Mbps, which is equivalent to 3.25 (binary) megabytes per second. This equates to 11,700 megabytes per hour, or 11.426 gigabytes per hour. With a rating of 5,000 hours at this data rate, we get a specified endurance of 57,128.91 gigabytes written, or 55.79 terabytes written (TBW).

Memory cards, like other block-based storage media, often define capacities with decimal prefixes, whereas computers usually binary. A “64-gigabyte” card is really 59.605 binary gigabytes (“gibibytes“) in capacity, but in this blog post I’m using the Windows notation of gigabytes; that is, calculating in binary but displaying as decimal. 😛

Therefore, we get a final calculated P/E (program-erase) cycle count of… 936 cycles. This is more in line with traditional 2D TLC NAND Flash, so I suspect that this rating is either based on different bitrates, or SanDisk is being really, really conservative in their estimates – or heck, maybe this really is just TLC NAND Flash that’s being configured and/or warrantied differently by SanDisk. As much as I am tempted to remove the epoxy coating that covers the manufacturing test pads in order to get a NAND Flash signature directly, I like having a warranty for at least a few years. Maybe I’ll buy another card to try this on…

UPDATE (July 19, 2020): I got my paws on another card (the 128GB variant), and did some reverse-engineering work on it to determine what Flash SanDisk used. It turns out they used 3D TLC NAND, which is still quite durable and reliable due to the use of larger process geometries. The Flash should easily withstand thousands of write cycles without much issue.

Card Information

Using an older laptop with a true SD-compliant slot (most newer ones are just USB card readers internally), I was able to grab the card’s metadata from Linux. These information files are found in /sys/block/mmcblkX/device, where X is usually 0 depending on your host machine. Android used to be able to do this as well, but nowadays it’s not possible without a rooted operating system.

Item Value
CID (Card ID) 035744534836344780ed1bbb9e013100
CSD (Card Specific Data) 400e0032db790001dbd37f800a404000
Manufacturer ID 0x03 (SanDisk)
Manufacture Date January 2019
Device Name SH64G
Firmware Version 0x0
Hardware Revision 0x8

Initial Formatting

The card is formatted as exFAT, with a 16 MB offset (that is, the first 16 MB of the card is unallocated), with an allocation unit size of 128 kilobytes. It uses a very basic MBR (Master Boot Record) partition structure, with the first sector being the bare minimum to be recognized as a valid structure.


Now that I’ve probably irked some of my readers with my usage of decimal and binary prefixes, it’s time to see how fast this card can go. SanDisk’s own ratings for the card are very brief, citing a sequential read/write speed of 100 and 40 MB/s respectively. It is rated for the V30 Video speed classification, which guarantees a minimum of 30 MB/s sequential writes continuously.

All the tests below were performed on my desktop computer using a FCR-HS4 USB 3.0 reader from Kingston, which is based on the Realtek RTS5321 chipset.


CrystalDiskMark is the de-facto standard for storage benchmarks. I’m using the 64-bit edition of CDM, version 5.2.0.

I/O Type Read Write
Sequential QD32 91.80 MB/s 60.56 MB/s
Sequential 93.33 MB/s 61.66 MB/s
4K Random QD32 8.319 MB/s
2129.7 IOPS
4.004 MB/s
1025.0 IOPS
4K Random 8.121 MB/s
2079.0 IOPS
3.971 MB/s
1016.6 IOPS

The sequential I/O speeds are on par with a modern microSDXC card, and the IOPS aren’t too shabby either; they exceed the IOPS requirements for the A1 performance class which requires R/W IOPS of 1500 and 500 respectively. This could make this type of card a viable option for other write-heavy environments – this includes single-board computers (SBCs) like the Raspberry Pi, where memory card failures due to excessive writes are common.

ATTO Disk Benchmark

The card’s read/write performance levels off at around the 64-kilobyte mark during testing, showing that operations smaller than this incur a significant performance penalty. This may also be indicative of the internal page and block sizes of the NAND Flash itself.

Hard Disk Sentinel

Hard Disk Sentinel comes with a bunch of disk benchmarking tools, including some to test the entire “surface” of a drive. I used the software’s Surface Test tool to measure the card’s performance before and after filling the drive with data – first with random data, then with all zeroes.

Random Seek Test

The Random Seek Test measures the card’s latency when performing random “seeks”, although more accurately it reads a single sector from a random location.

State Average Latency Minimum Latency Maximum Latency
Empty/Initial (0x00) 360 µs 350 µs 420 µs
Random Fill 600 µs 590 µs 670 µs
Zero Fill 600 µs 590 µs 690 µs

The card initially had about 420 microseconds of latency, but after filling the card with random data, this increased to 670 microseconds. Filling the card with all zeroes again did not improve performance, and his isn’t helped by the fact that SD cards generally lack the ability to “TRIM” unused sectors like SSDs or eMMC chips.

Full Surface Read (or at least an attempt)

This is where things get a bit… interesting. It was around this time that I noticed some performance inconsistencies that didn’t show up on other benchmarks. Although the I/O speeds largely matched what my other benchmarks revealed, I noticed frequent dips below normal, often down to the mid-20 MB/s range! I wasn’t sure that this was necessarily the card’s fault (pauses in read/writes could result in performance degradation on a device if it can’t buffer the writes well enough), or if my card reader/operating system/etc. was responsible.

I decided to hold off on publishing the sequential write test until I get this issue figured out – perhaps it’s worthy of a blog post all on its own…

Discreet Quality: Review of the sketchiest-looking 512GB Lexar SDXC card

It’s amazing how much Flash-based storage technology has advanced in the last few years, especially considering how much prices have dropped.

Naturally, when it comes to speed, capacity and price, consumers tend to look for the lowest price; as manufacturers race towards the bottom line, many will take the low road and sell counterfeit goods. This is especially prevalent in the NAND Flash market, and online marketplaces like eBay, AliExpress and even Amazon are fraught with countless fake storage devices that claim high capacities at too-good-to-be-true prices. It’s not uncommon to see unrealistic capacities sold for a few tens of dollars, but what the customer ends up receiving is a storage device with a falsified capacity that will pass a simple copy-paste test but will corrupt itself with extended use.

While browsing eBay for some deals on some Flash storage, I happened upon a very strange-looking 512GB SDXC card. It was listed as an OEM Lexar card but had no labels, selling for an unprecedentedly low price of $60 USD (the card would cost several times more at normal retail outlets). On the outside, everything about the card’s exterior seems to raise a red flag that the card is not to be trusted.

Lexar OEM 512GB Listing

eBay listing of the Lexar OEM 512GB SDXC card

Upon closer inspection, there are some hints that one shouldn’t always judge a book – er, card – by its cover. The laser-etched markings might look like cryptic gibberish to the layperson, but the markings “SM2702BAC” and “L95B” have actual meanings; the SM2702 is an SD card controller by Silicon Motion, and L95B refers to the 16nm generation of MLC NAND Flash by Micron, which owns the Lexar brand (but unfortunately is being discontinued). The seller also says that the cards have been tested, which is reassuring.

I decided to take the plunge and plunk down about $80 USD including shipping (or $105 CAD at the time) and buy a card for myself.

A Closer Look

After waiting a few weeks, the card showed up in my mailbox. The seller did a very good job packaging it, even placing the card in an ESD shielding bag before wrapping it with foam and placing it in a bubble mailer (it’s much better than the plastic wrap I’ve had some used i7 CPUs by a huge amount).


The card looks very plain, with the top label area lacking any labeling, and the same laser-etched markings on the back. The card’s contacts indicate that it has been placed in a card reader a few times before (presumably for testing).

Card Identification

I used my old Gateway M-7305u laptop with Kali Linux to see what information the card reports. These older laptops have true SDA (SD Association) compliant card slots, so they will identify as an actual SD card instead of a USB drive like with many modern laptops; in Linux these show up as devices like /dev/mmcblk0 instead of /dev/sda. By using the “dmesg -wH” command I can read the kernel logs once the card is connected to the computer.

[Jan24 10:52] mmc0: new high speed SDXC card at address 59b4
[ +0.094917] mmcblk0: mmc0:59b4       483 GiB 
[ +0.001111] mmcblk0: p1

The card reports a capacity of 483 GiB (that’s binary gigabytes, or 519.6 decimal – a.k.a. “weasel” – gigabytes), but the SD card name is ”     ” – five ASCII spaces. Everything about the card superficially rings alarm bells! However, I wasn’t phased, and decided to try the card in my Kingston FCR-HS4 USB 3.0 card reader, which uses the Realtek RTS5321 chipset.

Lexar OEM 512GB Partition

OEM Lexar 512GB SDXC card in Disk Management

Examining the card in Windows shows that the card was formatted as exFAT with a drive name of “SDXC”, suggesting it may have been formatted by the seller with the SD Formatter tool. Looking at the raw sector data in Hard Disk Sentinel suggests that the seller indeed do a full capacity test, as the data patterns match that of the program H2testw, an excellent tool for detecting fake Flash memory. This is a good sign – the seller did their due diligence and by this point I already had a good feeling that the card is genuine.

However, I wanted to test this for myself, so I ran the H2testw utility myself and let it run on the card. The write speed remained consistent throughout, which is a good indication that the card is not overwriting memory locations like in fake Flash storage (the card did get uncomfortably hot during the process, however). It took four hours to complete the write and read test, but everything came out clean – the card is genuine, even when every other sign says otherwise!

Lexar 512GB OEM H2testw

H2testw verifying that the OEM Lexar card’s 512GB capacity is genuine


With the card verified, it was time to put it to the test.


The card showed sequential read speeds of 92.03 MB/s and sequential write speeds of 60.45 MB/s; the sequential write speed coincides with the seller’s rating of 400x (400 * 150 kB/s = 60 MB/s).

The random 4K I/O performance isn’t great, especially with writes, but it isn’t bad either. The card managed 4K random read speeds of 6.644 MB/s (1700.9 IOPS) and 4K random write speeds of 0.671 MB/s (171.8 IOPS).

Lexar 512GB OEM Benchmark

Benchmark of the 512GB Lexar OEM SDXC card in CrystalDiskMark 3.0.4


In the end, I was satisfied – I got a 512GB SDXC memory card at a fraction of the cost from a normal retail outlet. It’s not exactly a speed demon, but it’s not a slowpoke either. The looks may be deterring for most folks (and rightly so), but with the right tools and knowledge, one can pick up one of these less aesthetically-pleasing memory cards and save some serious coin in the process.

WordAds Adventures, Episode 4

Oh my, it has been a while since the last update, hasn’t it?

Results for February to June 2018

Since my last report, I managed to earn $45 in one month after getting my blog post featured on the r/hardware subreddit, which then made its way to Hacker News (a news aggregation site), bringing the most traffic to my site in many years; March 2018’s view count was the second highest on record, bested only by June 2014’s 25,051 views which were not monetized. I even received my first payout on May 29th.

However, the rest of the months have been less fruitful, especially as of late. Since May, my monthly ad revenue has dropped below $10 USD/month. I thought that the boost in traffic from March would result in more views after the fact – I could not have been more wrong.

Let’s look at the data (note that am now also tracking statistics for ads per viewer and visitor):

Payout Period Earnings Ads Served Views Visitors $ Per
Ads Per
Ads Per
0 Nov 2017  $     5.03           4,648     8,533      3,833  $  0.00108219 0.545 1.213
Dec 2017  $   15.18         17,369     9,734      4,344  $  0.00087397 1.784 3.998
Jan 2018  $   11.96         17,887     9,428      4,359  $  0.00066864 1.897 4.103
Feb 2018  $   11.20         18,532     7,980      3,595  $  0.00060436 2.322 5.155
Mar 2018  $   45.89         74,754   23,933    14,537  $  0.00061388 3.123 5.142
Apr 2018  $   10.99         20,100     8,017      3,595  $  0.00054677 2.507 5.591
1 May 2018  $     9.88         20,046     7,700      3,522  $  0.00049287 2.603 5.692
Jun 2018  $     7.78         16,699     6,704      2,967  $  0.00046590 2.491 5.628
WordAds Earnings Nov 2017 to Jun 2018

WordAds monthly earnings (November 2017 to June 2018)

WordAds Rate Nov 2017 to Jun 2018

WordAds monthly pay-per-impression rate (November 2017 to June 2018)

Since my last update, I noticed that my pay-per-impression rate was steadily decreasing, and that has not changed since; although it has leveled off mostly, it is still decreasing.


The data sends a clear message: in order to continue receiving an appreciable amount of ad revenue, I need to keep posting and getting my blog posts published on various outlets; additionally, returns from existing content is not steady but instead continuously declines even if viewership does not appreciably fluctuate from month to month. (Granted, that’s probably common sense and I just need to get back in gear and make more posts – many of which are still in draft form.)

WordAds Adventures, Episode 3

Another month has passed and that means another round of ad revenue trickling in.

Results for January 2018

This is rather interesting – despite getting more views than December 2017, the pay rate was lower than before!

Curious to see what the dollar-per-impression rate was for each month, I tabulated the results and graphed them:

Period Earnings Visitors Views Ads Served $/Impression
Nov 2017  $     5.03 3833 8538 4648  $ 0.00108219
Dec 2017  $   15.18 4344 9732 17369  $ 0.00087397
Jan 2018  $   11.96 4359 9458 17887  $ 0.00066864

WordAds Rate Nov 2017 to Jan 2018

That is a pretty linear drop in dollar-per-impression rate. Perhaps this is due to ad market fluctuations, or maybe WordPress is “incentivizing” increased viewership to maintain ad revenue. Who knows? Either way, it will be interesting to track this trend as time goes on.

Mini-Ramble: WordAds – I think it’s working!

Over a month has passed since my first post about seeing where the WordAds train will take me and my blog, and the first (meaningful) payout numbers have rolled out.

Current Earnings

ss (2018-01-05 at 12.42.57)

WordAds earnings for 1/3 of November 2017, and all of December 2017.

Not too bad – in 1 1/3 months, I’ve earned $20.20 USD in ad revenue. In December alone I earned $15.18 from 17,369 attempted ad impressions; with 9,732 views in December this equates to an impression-to-view ratio of 1.785.

Assuming that I receive the same number of views per month, $15/month * 12 months = $180 USD/year. With this amount of revenue, my blog can finally run itself!

Blog Budget Breakdown (yay, alliteration!)

Item  Value 
Yearly Ad Revenue ($15 USD * 12 months)  $ 180.00
Domain Name Registration (1 year for 3 domains, assuming CAD-to-USD conversion rate of 0.8x)  $  (76.80)
G Suite (1 year, assuming CAD-to-USD conversion rate of 0.8x)  $  (48.00)
Final Balance (USD)  $   55.20

If I assume that my current view count doesn’t change, this would leave me with a little over $50 USD in pocket change by the end of the year. Perhaps this money could be put to use to buy some more things to make blog posts with – maybe some iPhone batteries or an eMMC module or two…

Once again, thanks to all of my readers – I couldn’t have done any of this without you! 😀

Review of SanDisk Extreme CompactFlash 32GB (SDCFXS-032G)

After my previous review of a Silicon Power 8GB CompactFlash memory card, I was looking around for more CF cards to review, in the hopes of finding a higher-performing card with S.M.A.R.T. health reporting and the ability of acting as a “fixed disk” (that is, identifying to the system as a hard drive rather than a removable disk), and decided to purchase this memory card from Amazon.

Advertised specifications

The card’s specifications indicate that the CompactFlash card is capable of 120MB/s sequential read and 60MB/s sequential write speeds, has a lifetime warranty and comes with a license key for a 1-year subscription to their RescuePRO data recovery software. It is advertised to have internal RTV (room-temperature vulcanization) silicone potting, has an operational temperature range of -25 to 85 degrees Celsius (-13 to 185 Fahrenheit), and uses their “ESP (Enhanced Super-Parallel) Technology” which I presume is some sort of proprietary multi-channel controller, and is UDMA 7 (167 MB/s maximum interface speed) capable.

Benchmark – Setup

To connect the card to my computer, I used a CompactFlash-to-IDE converter and a Marvell 88SE9128-based SATA/PATA host bus adapter. This allows me to use up to UDMA 6 (133 MB/s maximum interface speed) as UDMA 7 is basically restricted to cameras as it’s only part of the CompactFlash official specifications.

Benchmark – CrystalDiskMark

For this test, I manually zero-filled the card using Hard Disk Sentinel, formatted it with exFAT, then ran CrystalDiskMark, set to 3 runs with a 500MB file size using random data, all zeros (0x00), and all ones (0xFF).

Data Type Test Read (MB/s) Write (MB/s) IOPS Read IOPS Write
Random Sequential 103.2 52.45
512K Random 99.55 29.57
4K Random (QD1) 11.37 0.916 2775.2 223.6
4K Random (QD32) 17.24 1.413 4208.2 344.9
All 0 (0x00) Sequential 104.3 54.25
512K Random 98.27 31.22
4K Random (QD1) 11.36 1.1 2773.3 268.5
4K Random (QD32) 17.39 1.263 4244.5 308.4
All 1 (0xFF) Sequential 104.5 53.95
512K Random 98.05 25.84
4K Random (QD1) 11.19 1.112 2733 271.4
4K Random (QD32) 17.32 1.437 4229.3 351

It appears that there is no significant difference between the tests depending on what data was used for the benchmark.

Benchmark – AS SSD

As with CrystalDiskMark, I zeroed out the card and formatted it as exFAT before running the test.

Test Read Write
Sequential 99.70 MB/s 46.13 MB/s
4K 11.40 MB/s 0.74 MB/s
4K 64 Thread 12.80 MB/s 1.03 MB/s
Access Time 0.389 ms 5.504 ms
Score 34 6

Benchmark – Hard Disk Sentinel

I ran three separate benchmarks with Hard Disk Sentinel’s Surface Test feature, using the read and write (both empty and random data) tests, and used the Random Seek Test to measure the card’s responsiveness after filling it with empty and random data.

Test Speed
Read 0x00 95.20 MB/s
Read Random 97.30 MB/s
Write 0x00 49.81 MB/s
Write Random 49.04 MB/s
Seek Time 0x00 0.35 ms
Seek Time Random 0.37 ms

Once again, there does not appear to be any appreciable difference between an empty (zeroed-out) or full card.

Analysis – HWiNFO64

Now that the benchmarks are out of the way, let’s take a look at the card and what it can (and can’t) do. Let’s take a look at the details of the drive…

The card shows up as a regular IDE drive in HWiNFO, and has information about its CHS (Cylinder-Head-Sector) geometries and supported I/O interface speeds. Here we can see the card supports up to UDMA 7 but is running at UDMA 6 as because it is connected to a PC IDE bus.

Now for the kicker: Does the drive identify itself as a fixed or removable disk? Cross your fingers…

NOPE! The SanDisk Extreme CompactFlash card does NOT identify as a fixed disk, but instead as a removable drive. This means that the hopes of using this as a bootable Windows disk are now out the window. [ba-dum-tssh!]

Analysis – Hard Disk Sentinel

Looking at the Overview tab in HDS, something weird is happening. It states that “the hard disk status is PERFECT” yet it has no health or performance percentages available. If I open the Information tab, I can see that the SanDisk Extreme CompactFlash card does NOT support S.M.A.R.T. health reporting. Bummer. Additionally, it appears that Windows does not like removable IDE drives that lack S.M.A.R.T. and instead report garbage data (or data mirrored from another drive in the system).

Looking further inside the Information tab, we can see the features that the memory card does support. It supports DMA, Ultra DMA, APM (advanced power management), write caching, 48-bit LBA (logical block address) addressing, IORDY (flow control), a NOP (no-operation) command, and has the CFA (CompactFlash Association) feature set.

Since the card reported that it supported APM, I tried to enable it but the card refused to accept the command.


Overall, I like this card quite a bit. It has fast sequential I/O and a respectable random read speed. However, this is soiled by the fact that the card is configured to show up as a removable disk, which renders the card unusable as a Windows boot drive, and the lack of S.M.A.R.T. health and temperature reporting makes me a bit uneasy as I cannot track the card’s program-erase cycle count during use.

Oh well. Looks like the hunt for a fast, fixed-disk CompactFlash card continues…

Review, teardown and analysis of Charging Essentials USB wall outlet

(UPDATE: March 2, 2015 – I’ve picked up a pair of the newer tamper-resistant versions of this wall outlet. A review and teardown on that unit is coming up; stay tuned!)
(UPDATE 2: May 29, 2016 – Scratch that on the first tamper-resistant model; it had the same performance as the one mentioned here. Also, Costco has released a 3.1A version of this outlet, and is currently under review.)

About a week ago I bought a set of wall outlets from Costco that integrate two USB charging ports into a standard Decora-type receptacle. It’s marketed to replace your traditional AC adapter, allowing other appliances to be plugged in while charging your portable electronics.

The outlet is made by Omee Electrical Company, but curiously enough this particular model, the OM-USBII, wasn’t listed on their site. The packaging itself bears the name Charging Essentials, with a logo that looks like a USB icon that’s had one Viagra too many. The packaging states that the outlet has:

  • “Two 5VDC 2.1A ports for more efficient charging in less time”
  • “Smarter USB charging with special chip designed to recognize and optimize the charging requirements of your device”
  • “Screw-free wall plate snaps into place for a more clean, modern appearance”

The second note is of particular importance to me. If it’s true, that means it might be using some USB charge port controller like TI’s TPS251x-series chips. But I’m not one to have blind faith in what’s written on the packaging. Let’s rip this sucker apart!

The outlet has a snap-on coverplate which may look sleek but could hamper removal of this outlet later on if needed. I was curious as to why one couldn’t just use a regular screw-on coverplate, and it turns out it’s because the mounting flange doesn’t have any tapped screw holes; you physically can’t use screws on this because the manufacturer didn’t want to go to the effort to make holes that can accept screws!

The casing is held together with four triangle-head screws in a weak attempt to prevent opening of the device. I had a security bit set on hand so this posed no hindrance to me. Upon removing the cover, the outlet seems rather well built. However, after removing the main outlet portion to reveal the AC-DC adapter inside, I quickly rescinded that thought.

The converter seems relatively well-built (at least relative to some crap Chinese power supplies out there). Some thought was put into the safe operation of this device, but there’s almost no isolation between the high and low voltage sides, and the DC side of this adapter is not grounded; the “ground” for the USB ports floats at 60 volts AC with respect to the mains earth pin. The Samxon brand caps are also pretty disappointing.

As for the USB portion of this device, I had to remove some hot glue holding the panel in place. After a few minutes of picking away at the rubbery blob, I was able to pull out the USB ports.

… and I found LIES! DIRTY LIES! There is no USB charge port controller, contrary to what the packaging claims. It just uses a set of voltage dividers to emulate the Apple charger standard, which could break compatibility with some smartphones. Ugh, well let’s put it back together and take a look at it from the performance side of things. At least the USB ports feel pretty solid…

To measure the voltage-current characteristic of the outlet, I rebuilt my bq27510-G3 Li-Ion gas gauge board so it had better handling of high current without affecting my current and voltage measurements. The reason I used this is because the gauge combines a voltmeter and ammeter in one chip, and by using the GaugeStudio software, I could create easy, breezy, beautiful V-I graphs.

Using a Re:load 2 constant-current load, I slowly ramped up the load current while logging the voltage and current data to a CSV file for analysis in Excel.

overall vi graphThis charger’s… okay. It has surprisingly good regulation up to 2.3 amps, but after that point the AC-DC converter basically brickwalls and the voltage plummets to 3 volts. That said, this also means that this outlet is not a set of “two 2.1A USB ports”. You can charge one tablet but you won’t be able to charge a tablet along with another device simultaneously.

Bah, I’ve had it with this wall outlet. Looks like this one’s gonna be returned to Costco in the next few days. This outlet may be adequate for some people, but for me it’s a disappointment.


  • Solid USB ports
  • Good voltage stability (up to 2.3 amps, enough to charge ONE tablet)
  • Apple device compatibility


  • Annoying coverplate design
  • Does not meet rated current output, will not charge 2 tablets or 1 tablet + another device
  • Does NOT have a “smart charging chip” despite being stated on packaging, some devices (eg. BlackBerry) will refuse to charge from these ports
  • Power supply for USB seems cheap
  • USB port is not grounded – if a short-circuit happens inside the power supply it can be a shock hazard to you

Tearing down and analyzing a cheap-ass “Xtreme” $3.50 external phone battery

I was shopping around at this electronics liquidation store and stumbled upon a couple cheap buys: A “1900 mAh” external phone battery and another 4400 mAh pack (which will be the subject of another post and teardown). The batteries were originally priced at $7 and $38 respectively, but they were on sale at half price. For $3.50, I was curious enough about the 1900 mAh battery’s real capacity that I bought it anyway, expecting to be disappointed.

The pack itself is roughly half the size of a typical smartphone and about 1.5 times thicker. The casing itself has no screws; the manufacturer decided it was too expensive to use screws so they simply ultrasonic-welded the case shut. After about half an hour with a plastic spudger tool, I was able to crack the case open.

2014-01-05 00.11.26The soldering quality, surprisingly, is pretty good for a sub-$10 device, save for a bunch of hand-soldered components with flux residue left behind. The circuit board is made up of a battery protection circuit (yes, they actually put one in!), an ME2108A-50 boost converter,  something I’d assume to be a charging circuit, and an LM324 op-amp as a “gas gauge” (if you could even call it that!).

2014-01-05 00.11.36The cell appears to be a thicker version of a typical cell phone battery. It’s similar in size to something like a Nokia BL-5C which is a 1020 mAh cell, and is 5.6 mm thick. The cell in the charger is 7.7 mm thick. The charger’s cell is only 37.5% thicker but should have 190% of the capacity… yeah, no. This is not going to be very promising, given how the spot-welded nickel strips literally fell off the cell when I tried to desolder it from the PCB.

After soldering some 20-gauge solid wire to the terminals and hooking it up to a bq27425-G2A fuel gauge chip, I noticed that it reported that the fully-charged voltage is 4.25 volts. This charger tries to squeeze the most out of the cell by overcharging it! Granted, a Li-Ion cell’s maximum terminal voltage is 4.25 volts but it shouldn’t settle down to this voltage after charging!

1900 mah charger overvoltageAfter performing a few learning cycles to determine capacity and resistance, the cell holds merely 1370 mAh. The internal resistance is about 85 milliohms, which tells me that at least they used a relatively fresh cell in this charger and not just some recycled cell (*cough* UltraFire *cough*).

1900 mah charger graphI knew from the get-go that this battery was going to be a let-down, and I was right. But hey, for $3.50 I get a half-decent 1370 mAh cell and a few scrap chips (no way I’m reusing that battery’s PCB as-is!). But my verdict: Avoid this battery pack if you intend to use it to, I dunno, charge your phone. 😛