[jeremyb]

I'm guessing there is Software BB or "something" obfuscating the layout.. My eyes are not as well trained as yours..

See if you can work your magic..

I'm guessing the TT is stored in DA, if you can remove the obfuscation I can probably find the TT and reassemble the image.

Uploading Dumps..

Thanks

[jeremyb]

Upload Complete

[Сергей]

First of all you make Find Xor:

0x19884000   -> 0x16800000    ca 7e d5 20 a3 ea 38 3a d0 ..
0xd82c4000   -> 0xbe800000    9f 35 d7 24 4b 58 3e 3a 9a ..
0x4c470c000  -> 0x433800000   9f 35 d7 24 4b 58 3e 3a 9a ..
0x4c7d84000  -> 0x436800000   cf 7e d4 20 5f 58 38 3a 92 ..
0x11058000   -> 0xf000000     cf 7e d4 20 5f 58 38 3a 92 ..

Select layout SM3254 1066 without invert
Look at 0x436800000
Select this place on ECC map
Search for layout and found famaly CBM2199 1152
Now you see that xor starts from cf7e in Find Xor log
So need select CBM2199 1152 Xor cf7e_64
Now at 0x436800000 you see zeros and green ECC
You start go down sector by sector
And found at 0x436800e00 red ECC and at some place zeros stop and start random data
You add Software bad bytes step
Start Bad Bytes Editor
Select place where start random data
And see that bb is ff
When you double click, you see that random data become zeros, and ECC = OK
So bb removed
Now you can continue manualy
Or press Auto_FF

[Сергей]

Job.txt attached

[jeremyb]

Told you you had better eyes than me..

[Сергей]