FiiO X1 FTL reversed: the map was in the OOB bytes I never dumped

Sun, 31 May 2026 00:00:00 +0000

Rockbox's hwstub tools have a Lua function for NAND flash called read_page, and it does exactly what it says. You give it a page and a length, it gives you that many bytes of the page. I gave it 2,048, the size of a page's data area, 65,536 times, and it never once complained. Good tool. The complaint is about the length.

The flash belongs to a FiiO X1, a second-hand music player whose 128 MB NAND chip I copied in full over USB in Part 6, using hwstub, Rockbox's debug stub, and that function. Each page on this chip is 2,112 bytes: 2,048 of data and 64 of spare area, the OOB ("out of band") bytes where flash keeps error-correction codes and bookkeeping. Part 16 carved a SQLite database out of that copy, found pages from different versions of the file side by side in it, and blamed the flash translation layer (FTL), the firmware code that decides which physical block holds which logical one. "The FTL did it" is the flash-storage version of "works on my machine". This part reads the X1's FTL in the firmware to see what it actually does, and finds out where it keeps its map.

Nand on tsvinc

FiiO X1 FTL reversed: the map was in the OOB bytes I never dumped