16GB iPod Nano 3G Upgrade

A maker set out to upgrade a 3rd‑generation iPod Nano to 16GB, teaching themselves soldering and reverse engineering along the way. The board-level swap of a NAND chip produced a Red X error: the firmware refused to recognize the new chip. To fix that, low‑level access was required, so the maker used the Rockbox bootloader and the Pwnage 2.0 BootROM exploit (an ASN.1/DER certificate parsing stack overflow that overwrites the saved LR) to run unsigned code, dump firmware, and locate the EFI NAND driver and its device identification table. Simple edits to the NAND table didn't solve the problem, so a deeper investigation of the boot flow and driver initialization followed.

The maker developed two effective introspection tools: a conditional spin (bisecting code paths by forcing freezes) and data exfiltration through diagnostic mode by smuggling values into the System Information Table’s NAND LBA field to observe internal state. Using those techniques they traced the failure to production formatting: a verification memcmp read back all 0xFF, indicating writes weren’t taking. That led into reverse engineering a NAND coprocessor layer (FMISS/bytecode sequencer) that actually handles flash operations. The project documents the manual patching workflow, the specifics of EFI/NAND interaction, and how firmware checks and low‑level microcode prevented an out‑of‑the‑box NAND swap until those layers were understood and patched.