16GB iPod Nano 3G Upgrade
A hacker upgrades an iPod Nano 3G's NAND flash to 16GB by reverse-engineering its bootloader, an undocumented NAND instruction set, and overcoming storage limitations.
read it A deeply technical write-up detailing hardware modification, reverse engineering an undocumented NAND coprocessor instruction set, and solving low-level firmware limitations.
summary
The author chronicles a multi-year project to upgrade an iPod Nano 3rd Generation with a 16GB NAND flash chip. Facing boot failures, they reverse-engineered the iPod's EFI bootloader, uncovered an undocumented bytecode engine for the NAND controller, and diagnosed hardware-level write protection and MLC NAND cell pairing issues. After bypassing these via an SLC chip and fixing SCSI sector-size math in disk mode, the project finally succeeded.
key points
- The iPod Nano 3G uses an EFI-based bootloader with a hardcoded NAND geometry table that triggers a fatal 'Red X' on unrecognized chips.
- The author reverse-engineered an undocumented 64-bit bytecode instruction set used by the device's dedicated NAND hardware coprocessor.
- Initial tests with MLC NAND failed at page six due to tight voltage margins from multi-level bit pairing, requiring a switch to an SLC chip.
- Disk mode required low-level code patches to fix SCSI capacity math that faulted when dividing by non-standard page sizes.
who should read it
Embedded systems engineers, hardware hackers, and retro-tech enthusiasts.
discussion warm
consensus
Commenters widely celebrate the post as quintessential Hacker News material, combining nostalgic affection for vintage Apple hardware with genuine awe for the deep reverse engineering involved.
Now this is HACKER news! Kudos to the author! Well done.
The NOP thing was predictable. Qemu is not great at limiting itself to actual requested emulated hardware, often allowing supersets of instruction sets and abilities.
And NAND....is always unnecessarily exciting.
It validates the technical difficulty of low-level NAND hacking and the quirks of rehosting in QEMU.
Generated by an LLM from the article and thread. Check the sources before relying on it.