The Nand on cellular iPad is dead. Is it doomed?

Question

iPad Air 3

Apple's March 2019 refresh of its iPad Air tablet, sporting an A12 Bionic processor and a 10.5" screen.

crwdns2934591:020crwdne2934591:0 crwdns2934593:0crwdne2934593:0 | crwdns2947278:08crwdne2947278:0 crwdns2947270:0crwdne2947270:0

wellbinnn @wellbinn

crwdns2934065:0crwdne2934065:0: 67

2

1

crwdns2931729:0crwdne2931729:0: Mud 19, 2024

crwdns2933897:0crwdne2933897:0

The Nand on cellular iPad is dead. Is it doomed?

It is an iPad Air3 Cellular model.

After replacing the nand chip, the ipad works normally. However, since the existing nand chip is completely dead, there is no way to extract the serial, Wi-Fi, and Bluetooth Mac addresses. (I tried the nand programmer, but I couldn't query any Mac addresses. The chip is completely dead.) Sadly, I don't even have a Mac address written down before, so there is no way to know it.

+For devices A12 and above, I understand that Mac Address is also stored in AP, and I was wondering if there is a way to extract it.

crwdns2934089:0crwdne2934089:0 crwdns2934093:0crwdne2934093:0

crwdns2934109:0crwdne2934109:0

crwdns2853045:0crwdne2853045:0 crwdns2853046:0crwdne2853046:0

crwdns2889612:0crwdne2889612:0 2

crwdns2944067:06crwdne2944067:0

Why is the nand chip dead?

crwdns2934271:0Mud 20, 2024crwdnd2934271:0 Hampter crwdne2934271:0

@hampter idk...

crwdns2934271:0Mud 20, 2024crwdnd2934271:0 wellbinnn crwdne2934271:0

@wellbinn ok thats fine, why did you replace the last one?

crwdns2934271:0Mud 20, 2024crwdnd2934271:0 Hampter crwdne2934271:0

@hampter probably because it died?

crwdns2934271:0Mud 20, 2024crwdnd2934271:0 Duck crwdne2934271:0

@hampter It was someone else's device, so I don't know its history. It was already broken when I got it. DFU recovery failed, so I tried various things to repair it, and after replacing the NAND, I succeeded in recovering iPadOS.

When I put the original NAND I extracted into the v1s pro programmer, it says it needs to be formatted. However, even after formatting, it outputs a message asking me to format it again.

When I try syscfg queries, they all fail. The only output is the NAND capacity and model name. Of course, I also tried NAND reball, but that didn't work either.

crwdns2934271:0Mud 20, 2024crwdnd2934271:0 wellbinnn crwdne2934271:0

crwdns2934273:01crwdne2934273:0

crwdns2934285:0crwdne2934285:0

crwdns2933315:03crwdne2933315:0

@hampter It was someone else's device, so I don't know its history. It was already broken when I got it. DFU recovery failed, so I tried various things to repair it, and after replacing the NAND, I succeeded in recovering iPadOS.

When I put the original NAND I extracted into the v1s pro programmer, it says it needs to be formatted. However, even after formatting, it outputs a message asking me to format it again.

When I try syscfg queries, they all fail. The only output is the NAND capacity and model name. Of course, I also tried NAND reball, but that didn't work either. — wellbinnn

score 3 · Answer 1 · 2024-05-21T20:10:51-07:00

crwdns2934057:0crwdne2934057:0

DanielAdvancedDeviceRepair @adr_daniel

crwdns2934065:0crwdne2934065:0: 394

8

1

crwdns2931729:0crwdne2931729:0: Mud 21, 2024

crwdns2933897:0crwdne2933897:0

In theory there are decryption keys to these adresses stored in apples "secure enclave" there could be a way to exploit and read some of this information

You could also see if your home wifi router logs the devices Mac adresses that have been formerly connected to to.

If you have any previously paired Bluetooth devices they may also have unencypted Mac adresses cashed internally. I don't know enough about the Bluetooth protocol to be certain but from what I understand it's not very secure and there are certainly plenty of tools to diagnose and dedug Bluetooth communication.

See what a memory dump of any previously paired device yields.

In theory to the best of my knowledge it possible to find the information you need.

A custom solution and a lot of research and hardware hacking would be in order to fix this in practice.

So it's probably doomed unless you are really really good at hardware hacking.

You may be able to jailbreak the ipad, there is some 0day unpatchable hardware level exploits on a lot of apple devices. There are entire companies dedicated to breaking into and extracting information from smartphones to extract data for law enforcement and courts of law.

crwdns2934105:0crwdne2934105:0

crwdns2853045:0crwdne2853045:0 crwdns2853046:0crwdne2853046:0

crwdns2889612:0crwdne2889612:0 3

crwdns2947414:01crwdne2947414:0:

Thank you for your answer.

It's been broken since I first received the device, so this ipad only has a history of wired to itunes in recovery mode. Sad.

crwdns2934271:0Mud 22, 2024crwdnd2934271:0 wellbinnn crwdne2934271:0

crwdns2934285:0crwdne2934285:0

Emil Ludvigsson @emilludvigsson crwdns2934065:0crwdne2934065:0: 25 2 · Answer 2 · 2024-05-23T06:32:40-07:00

Emil Ludvigsson @emilludvigsson

crwdns2934065:0crwdne2934065:0: 25

2

crwdns2931729:0crwdne2931729:0: Mud 23, 2024

crwdns2933897:0crwdne2933897:0

You can use a nand programmer p13 from JC for example and put a compatible nand in the programmer and format nand for a ipad air 3 and write/unbind wifi. Then solder Nand back on to Ipad and update firmware in dfu mode.

Try to activate the device over wifi and you will not bypass activation.

Remove nand from ipad and put it in nand programmer again and QueryCode//Unbind and choose fast mode. Wait untill process is done and you have the old serial wifi and bluetooth.

crwdns2934105:0crwdne2934105:0

crwdns2853045:0crwdne2853045:0 crwdns2853046:0crwdne2853046:0

crwdns2889612:0crwdne2889612:0 1

crwdns2944067:03crwdne2944067:0:

I already own JC's NAND programmer. However, iPad Air 3 is an A12 chip, and starting with A12, AP also has a WIFI MAC address registered, so if you inject another MAC address into the NAND, activation is not possible. (Actually, I've already tested it with a different MAC address. I get an activation error.)

And as far as I know, even if the chip is less than A11, the cellular model cannot be activated only by WIFI/BT MAC change.

crwdns2934271:0Mud 23, 2024crwdnd2934271:0 wellbinnn crwdne2934271:0

yes bur you are not supposed to pass activate with wrong serial and bt/wifi rather Get the original serial and Mac adresses by connecting to the act. server with the wrong serial/bt/wifi. After you try activate the a12+ iPad it will send information from and back to iPad. With that info you can obtain the original serial, bt and wifi from p13 reader with quary option on the new nand.

crwdns2934271:0Kho 13, 2024crwdnd2934271:0 Emil Ludvigsson crwdne2934271:0

Does it mean that the Apple activation server has a serial address and a bt/wifi address?

But how can I read it? I'm trying to activate it but nothing shows up except an error message...You told me to query NAND after the activation attempt, but will the server's mac address data come into NAND if I try to activate it with the wrong serial?

crwdns2934271:0Kho 14, 2024crwdnd2934271:0 wellbinnn crwdne2934271:0

crwdns2934285:0crwdne2934285:0

score 0 · Answer 3 · 2024-06-15T04:09:22-07:00

Dan @danj

crwdns2934065:0crwdne2934065:0: 490.1crwdns2936485:0crwdne2936485:0

Self employed contract worker

35

338

973

crwdns2931729:0crwdne2931729:0: Kho 15, 2024

crwdns2933897:0crwdne2933897:0

While I’m no expert on iPad NAND programming, I think your best bet is finding a junker to swap out the NAND. Basically, the chip is to far gone to salvage the needed data, a still good NAND from a compatible system even if it’s addresses are different should work.

crwdns2934105:0crwdne2934105:0

crwdns2853045:0crwdne2853045:0 crwdns2853046:0crwdne2853046:0

crwdns2889612:0crwdne2889612:0 0

crwdns2944067:010crwdne2944067:0:

It is my understanding that Apple devices A12~A13 have the Wi-Fi/BT mac address hardcoded into the AP. Even when replacing the nand, it cannot be activated unless the original mac address is written to the nand. Rather, starting with A14, MAC addresses are stored only in APs, so it doesn't matter if existing NANDs are damaged.

crwdns2934271:0Kho 15, 2024crwdnd2934271:0 wellbinnn crwdne2934271:0

@wellbinn - That doesn’t make sense, it would either be programmed within the Apple/Universal Scientific Industrial USI 339S00551 Wi-Fi/Bluetooth Module or held within the NAND. If it was programmed then the chips markings should give you a clue. The more elegant way is to use the NAND in a protected cell area.

crwdns2934271:0Kho 15, 2024crwdnd2934271:0 Dan crwdne2934271:0

@danj But there's no way to read syscfg in this broken nand. I've tried several ways, but the programmer still hasn't been able to query syscfg in nand.

crwdns2934271:0Kho 15, 2024crwdnd2934271:0 wellbinnn crwdne2934271:0

@wellbinn - Yes, I figured that, which is why you need a preprogrammed NAND from another system using its MAC address. Cloning the chip might work but you would then need a fresh MAC address to replace the duplicate.

crwdns2934271:0Kho 15, 2024crwdnd2934271:0 Dan crwdne2934271:0

@danj In the case of the A14, it is certain that the AP and the WIFI IC are serialized. In fact, the iPhone 12 and MacBook Air M1 (=A14X) cannot be repaired if the WIFI IC module fails. Hardcoding parts' serials on the AP seems to be technically possible. I am not sure exactly about the A12.

crwdns2934271:0Kho 15, 2024crwdnd2934271:0 wellbinnn crwdne2934271:0

crwdns2934275:05crwdne2934275:0

crwdns2934285:0crwdne2934285:0

iPad Air 3

The Nand on cellular iPad is dead. Is it doomed?

crwdns2933315:03crwdne2933315:0

crwdns2934229:0crwdne2934229:0