Fake Usb Sticks?

[dpoarch]

my friend bought one of those cheap memory sticks off ebay. It says its a 16gig chip but it only lets him write about 4 gigs before it crashes. I was wondering if anyone knows how they make the chips show 16gigs of memory even though its only 4 gigs. We know no one would waste the money to do this unless it could be done without much effort.

 

[nubie]

my friend bought one of those cheap memory sticks off ebay. It says its a 16gig chip but it only lets him write about 4 gigs before it crashes. I was wondering if anyone knows how they make the chips show 16gigs of memory even though its only 4 gigs. We know no one would waste the money to do this unless it could be done without much effort.

If you are at the factory where they write the flash params that is.

I would much rather get one that can emulate a real CD drive (I know my Sandisk Cruzer can do this for some "flash utils" it came with, I deleted them.)

Maybe if you can get the TOC from a 16GB flash and dd it onto the root of the drive? Can't be too hard with a little knowledge of file system TOC and a hex editor.

 

[Javacat]

They probably just flash it with a dodgy firmware, which reports the wrong size. There are a few programs around for fixing USB drives with faked sizes. I can't remember the names of the programs now, but there is some info on fixing the drives @ http://www.myblog.bloggybloggy.com/fixing-...128-16-04-2008/ and http://www.myblog.bloggybloggy.com/fixing-...ick-08-04-2008/.

 

[Iorgy77]

Rule No 1 of internets.

If something is too good to be true, it probably is.

I had to re convert some 16gb sticks back to 4gb for some friends of mine who got duped.

 

[dpoarch]

Ya that is what he is trying to do is figure out how to fix it because right now every time its formated it shows 16 gigs. After he transfers around 4 gigs it crashes. So the consensus is that it can be flashed? Sweet I'll let him know, I think he was getting a little more into it. On the chip apparently is a micro and he was thinking there was some kind of bootloader that he needed to find out how to get inside. Oh and he kinda thought it was a shady purchase he just went for it because he was intrigued and hes not really out much money. Thanks everyone.

 

[craigix]

I always assumed they were using faulty 16GB chips which would be very cheap to buy.

I guess it depends on if it's a faulty chip or just a fake label.

 

[Username]

Maybe he should order from somewhere like Newegg. How much did he pay for it?

 

[dpoarch]

He spent around 15 bucks on it. He bought because he wanted to see what he was getting for that price since he knew it wasn't really going to be 16 gigs. Now its more a of a project and he is trying to see if he can make it work. I didn't think about it being a broken 16 gig chip but that makes sense too. The only thing that makes me doubt it is that it dies right around 4 gigs, but its still a possibility.

 

[Prometheus]

Ya that is what he is trying to do is figure out how to fix it because right now every time its formated it shows 16 gigs.

It's because the controller has been reprogrammed to report a false capacity. I think some of these links might be of help;

CODE
http://sosfakeflash.wordpress.com/2008/09/02/h2testw-14-gold-standard-in-detecting-usb-counterfeit-drives/


CODE
http://sosfakeflash.wordpress.com/2008/10/23/did-you-manage-to-reprogrammed-a-fake-flash-drive-bought-on-ebay/


Both from the rather excellent SOSFakeFlash (which carries a lot of information on this, as they rather accurately describe it, "plague"). Some of the comments attached to that second one have some other pointers on fixing at least some of these little gits, so hopefully something there will help.

I always assumed they were using faulty 16GB chips which would be very cheap to buy.

I guess it depends on if it's a faulty chip or just a fake label.

They usually tend to be smaller chips, with the controllers reprogrammed (often using low-level tools similar to those that legitimate manufacturers use to pre-format things). Almost never are they faulty.

EDIT: Whoops, forgot about the messed-up links...