A method and system for detecting fake memory card capacity expansion

Abstract

This invention discloses a method and system for detecting false capacity expansion in memory cards, relating to the field of memory card detection. The method includes: acquiring the nominal capacity information of the memory card under test, and dividing the logical address into multiple test address blocks based on this capacity; performing distributed small data write operations in each test address block, recording the write latency; reading the data and comparing the consistency results, generating a latency behavior curve with the logical address as the horizontal axis and the write latency as the vertical axis, and marking the readback consistency status on the curve; identifying local fluctuation abnormal regions in the curve, and if such regions overlap with readback consistency failure regions, prioritizing their intersection as false capacity expansion regions. This invention effectively solves the problem of falsely advertised memory card capacity without requiring a full disk write.

Description

Technical Field

[0001] This invention relates to the field of memory card testing, and more specifically, to a method and system for detecting fake memory card capacity expansion. Background Technology

[0002] With the widespread application of flash memory technology, memory cards are widely used as portable storage media in devices such as digital cameras, smartphones, and dashcams. In pursuit of higher capacity and lower costs, some unscrupulous manufacturers tamper with the firmware of memory cards, creating "fake expanded capacity cards" with a nominal capacity far exceeding the actual capacity. The capacity information reported by these memory cards in the system is significantly inconsistent with the actual usable physical storage space. Users may not notice the anomaly in the initial stages of data writing, but once the written data exceeds the true capacity limit, problems such as data loss, file corruption, or device crashes may occur, posing serious data security risks to users.

[0003] Existing memory card detection technologies mostly rely on filling the entire disk and then comparing segments to determine the available capacity. However, this type of method usually has the following problems:

[0004] 1. The detection process is time-consuming and causes significant damage to the equipment. Specifically, the traditional "write-full detection" method requires traversing all logical addresses to write and verify a large amount of data, which is time-consuming and may lead to excessive write damage to the memory card, affecting its subsequent normal use;

[0005] 2. Unable to identify firmware-level spoofing behavior. Specifically, some fake expansion cards use circular address mapping, fake data readback, or fake response mechanisms. Even before the physical space is fully used, they may still "disguise" normal writes through caching or repeated response mechanisms.

[0006] 3. Lack of in-depth analysis of behavioral characteristics. Specifically, existing detection methods are mostly based on the direct judgment of whether the capacity write is successful or not, ignoring the latency changes and consistency behavior of the memory card during the write and read-back process. These behaviors often exhibit identifiable abnormal characteristics in pseudo-capacity expansion scenarios.

[0007] Therefore, there is an urgent need for a non-destructive, efficient detection method and system based on access behavior analysis that can accurately identify fake memory cards by modeling the characteristics of their write latency and data consistency behavior without damaging the memory card data, and assist in locating suspicious areas, thereby improving the reliability, practicality and engineering deployability of the detection. Summary of the Invention

[0008] The technical problem to be solved by the present invention is to provide a method and system for detecting false expansion of memory card capacity, so as to solve the problems mentioned in the background art.

[0009] To achieve the above objectives, the present invention adopts the following technical solution:

[0010] A method for detecting fake capacity expansion on memory cards includes the following steps:

[0011] Obtain the nominal capacity information of the memory card under test, and divide the logical address into multiple test address blocks based on the nominal capacity information;

[0012] Perform distributed small data write operations in each test address block and record the write latency of each write operation;

[0013] Perform read operations on the data of each test address block, and compare the read results with the original written data to obtain the readback consistency results;

[0014] Generate a latency behavior curve, with logical address as the horizontal axis and write latency as the vertical axis, and mark the readback consistency result on the horizontal axis;

[0015] Identify local fluctuation anomaly regions in the latency behavior curve. If a readback consistency failure region overlaps with the local fluctuation anomaly region, the intersection region of the local fluctuation anomaly region and the readback consistency failure region is preferentially identified as a pseudo expansion region.

[0016] In some embodiments, a region within a sliding window is determined to be a region with abnormal local fluctuations when the following condition exists: the local fluctuation amplitude of the delay curve within the sliding window is greater than a preset allowable range.

[0017] In some embodiments, a template comparison method is used to identify the local fluctuation anomaly region, specifically including the following steps:

[0018] Establish a latency behavior template library, which includes multiple latency template curves generated from normal capacity memory cards;

[0019] The latency behavior curve of the memory card under test is segmented using a sliding window method. Each sliding window corresponds to a local region, and the latency subsequence within the window is extracted as the detection segment.

[0020] Each detected segment is compared with the corresponding template segment in the delayed behavior template library for similarity.

[0021] If the similarity between any detected segment and the template segment is lower than a preset threshold, the area covered by the corresponding sliding window is marked as a local fluctuation abnormality area.

[0022] In some embodiments, the similarity metric includes any of the following: Euclidean distance, cosine similarity, or dynamic time-warped distance.

[0023] In some embodiments, the method further includes: determining the intersection region after deducting the intersection region from the union region of the local fluctuation anomaly region and the consistency failure region as a candidate region for the pseudo expansion segment.

[0024] In some embodiments, the method further includes: performing a write operation on the candidate region, performing a power outage or device restart operation, and reading the original data from the candidate region again. If a consistency failure occurs, the candidate region is determined to be a pseudo expansion segment.

[0025] In some embodiments, the method further includes: performing write and read operations on the candidate region, and comparing the read data with the write data of other address blocks previously. If the matching degree exceeds a preset threshold, the candidate region is determined to be a pseudo expansion segment.

[0026] This invention also discloses a memory card fake capacity expansion detection system, comprising:

[0027] The capacity resolution module is used to obtain the nominal capacity information of the memory card under test, and divide the logical address into multiple test address blocks based on the nominal capacity information.

[0028] The write control module is used to perform distributed small data write operations in each test address block and record the write latency of each write operation.

[0029] The read verification module is used to perform read operations on the data of each test address block, compare the read results with the original written data, and obtain the read back consistency result.

[0030] The curve generation module is used to generate a latency behavior curve, wherein the latency behavior curve is plotted with logical address as the horizontal axis and write latency as the vertical axis, and the readback consistency result is marked on the horizontal axis.

[0031] An anomaly identification module is used to identify local fluctuation anomaly regions in the latency behavior curve and detect whether the anomaly regions overlap with the readback consistency failure regions.

[0032] The pseudo-expansion determination module is used to preferentially determine the intersection area of ​​the local fluctuation abnormal area and the readback consistency failure area as the pseudo-expansion area.

[0033] In some embodiments, the anomaly identification module determines that the region within a sliding window is a local fluctuation anomaly region when the following condition exists: the local fluctuation amplitude of the delay curve within the sliding window is greater than a preset allowable range.

[0034] In some embodiments, the pseudo-expansion determination module also determines the intersection region of the union region of the local fluctuation abnormal region and the consistency failure region as the candidate region of the pseudo-expansion segment.

[0035] The advantages of this invention over the prior art are:

[0036] This invention replaces the full disk writing strategy with distributed small data block writing, avoiding write damage to the memory card and significantly reducing detection time, making it suitable for deployment in consumer-grade application terminals or quality inspection processes.

[0037] Compared to traditional consistency detection methods, this invention innovatively introduces write latency as a behavioral feature dimension. Based on the latency curve, it reveals potential anomalies in the physical write path of the memory card, such as latency mutation, invalid write, or latency drift, which helps to discover hidden firmware-level pseudo-expansion tricks.

[0038] This invention generates a delay behavior curve and combines it with consistency result annotation, so that the pseudo-expansion region presents identifiable structural features in the curve, which has graphical interpretation capabilities, making it easy for technicians to intuitively interpret and assist in locating the true capacity boundary; the accuracy can be further improved by template matching and other methods.

[0039] This invention proposes to prioritize the intersection of "local fluctuation anomaly region" and "consistency failure region" as pseudo expansion segment, and to form candidate region by subtracting the intersection part from the union. Combined with further verification mechanisms (such as power failure retesting and address rollback analysis) for dynamic determination, it can effectively reduce the false alarm rate and enhance the stability and flexibility of the detection system. Attached Figure Description

[0040] Figure 1 This is an overall flowchart of the memory card pseudo-capacity expansion detection method of the present invention;

[0041] Figure 2 This is a flowchart of the test address block division and small data writing sampling in this invention;

[0042] Figure 3 This is a flowchart of the present invention for generating delayed behavior curves and identifying local fluctuation anomaly regions;

[0043] Figure 4 This is a flowchart of the processing of pseudo-expansion candidate regions in this invention. Detailed Implementation

[0044] The specific embodiments of the present invention will now be described with reference to the accompanying drawings.

[0045] This invention proposes an efficient and accurate method and system for detecting false expansion in memory cards, aiming to identify hidden false expansion areas in memory cards through distributed small data block writing, write latency behavior analysis, and data consistency verification.

[0046] As shown in Figure 1, the method of the present invention includes the following steps:

[0047] Obtain the nominal capacity information of the memory card under test, and divide the logical address into multiple test address blocks based on the nominal capacity information;

[0048] Perform distributed small data write operations in each test address block and record the write latency of each write operation;

[0049] Perform read operations on the data of each test address block, and compare the read results with the original written data to obtain the readback consistency results;

[0050] Generate a latency behavior curve, with logical address as the horizontal axis and write latency as the vertical axis, and mark the readback consistency result on the horizontal axis;

[0051] Identify local fluctuation anomaly regions in the latency behavior curve. If a readback consistency failure region overlaps with the local fluctuation anomaly region, the intersection region of the local fluctuation anomaly region and the readback consistency failure region is preferentially identified as a pseudo expansion region.

[0052] In specific embodiments, the nominal capacity is typically provided by the memory card manufacturer through firmware or device interface, in bytes. For example, a memory card nominally rated at 32GB has a nominal capacity of approximately 32 × 1024 × 1024 × 1024 bytes, or 34,359,738,368 bytes. After obtaining this information, the logical address space of the memory card needs to be divided into multiple test address blocks. The purpose of this division is to ensure that subsequent distributed write operations can cover the entire address space, while ensuring that the size of each test address block is small enough to reduce the burden on the memory card in a single operation.

[0053] As shown in Figure 2, when dividing the test address blocks, the number and size of the blocks can be dynamically adjusted according to the nominal capacity. Let the nominal capacity be... C Bytes divide the logical address space into N If there are 1 test address block, then the size of each test address block is... S It can be represented as:

[0054] ;

[0055] Here, N is an adjustable parameter whose value needs to balance detection accuracy and efficiency. If N is too small, each test address block will be too large, potentially leading to insufficient detection granularity and difficulty in detecting local anomalies; if N is too large, the number of test address blocks will be excessive, increasing computational and storage overhead. Typically, the value of N can be set between 100 and 10000. For example, for a 32GB memory card, if... N = 1024, then the size of each test address block is:

[0056] ;

[0057] This partitioning method ensures that the test address block can cover the entire logical address space while facilitating subsequent distributed small data write operations.

[0058] Within each test address block, distributed small data write operations need to be performed. Specifically, several logical addresses are randomly selected within each test address block, and small blocks of data are written to these addresses. The amount of data written each time should be controlled within a small range, such as 4KB (4096 bytes) or 8KB (8192 bytes). There are two reasons for this design: first, to avoid excessive write wear on the memory card; and second, to amplify potential latency differences through the writing of small data blocks, making it easier to expose abnormal behavior in pseudo-expansion areas.

[0059] During a write operation, the latency of each write operation is recorded. Write latency refers to the time elapsed from issuing a write command to the completion of the write operation, usually measured in milliseconds (ms). This time can be measured using the system clock or a high-precision timer. For example, on a real 32GB memory card, the latency for writing 4KB of data normally might be around 1ms, while in a pseudo-expansion area, due to firmware tampering or address rollback, the latency may increase significantly or fluctuate.

[0060] To ensure comprehensive testing, the number of writes within each test address block can be set to 5 to 20. For example, if each test address block is written 10 times, with each write being 4KB, then for a 33.55MB address block, the total amount of data written is 40KB, far less than the address block capacity. This distributed write strategy ensures coverage while avoiding the inefficiency and high overhead of writing the entire disk.

[0061] After the write operation is complete, a read operation is performed on the written data in each test address block, and the read result is compared with the original written data to evaluate data consistency. If the read data is exactly the same as the written data, the readback consistency result of that address block is considered "consistent"; if there is a difference, it is marked as "failed". This consistency check is an important basis for judging false expansion, because false expansion areas often cannot store data correctly, leading to errors during reading.

[0062] For example, suppose that in a certain write to a test address block, a logical address is written... A If the data "0x1234" is written and the data returned upon reading is also "0x1234", then the consistency result is "consistent". If "0x0000" or a random value is returned, then it is "invalid". By performing multiple writes and reads on each test address block, the overall consistency performance of that block can be statistically analyzed.

[0063] As shown in Figure 3, next, a latency behavior curve is generated based on the write latency and consistency results. The horizontal axis of this curve represents the logical address, and the vertical axis represents the write latency, typically in milliseconds (ms). For ease of analysis, the write latency of each test address block can be the average of multiple writes. For example, if 10 writes are performed within an address block, with latencies of 1.2ms, 1.3ms, 1.1ms, etc., then the average latency of that block is:

[0064] ;

[0065] When plotting the curve, the horizontal axis arranges all test address blocks in logical address order, and the vertical axis marks the corresponding average latency value. Simultaneously, the readback consistency result for each address block is marked on the horizontal axis, for example, with green dots representing "consistent" and red crosses representing "failure." This visualization method allows technicians to intuitively observe the relationship between latency and consistency.

[0066] The significance of latency behavior curves lies in their ability to transform the write behavior of a memory card into identifiable structural features. Latency in normal capacity areas is typically relatively stable, while pseudo-expansion areas may exhibit sudden latency spikes or fluctuations. Combining these with consistency results allows for more accurate localization of abnormal areas.

[0067] After generating the latency behavior curve, it is necessary to identify localized abnormal fluctuation regions. These regions refer to areas where the latency curve exhibits significantly increased fluctuation amplitudes within certain local segments, potentially indicating abnormal write behavior of the memory card at the corresponding logical address. Identification methods can be divided into two types:

[0068] Method 1: Fluctuation amplitude detection based on sliding window.

[0069] The delay curve is segmented using a sliding window approach. The size of the sliding window... W The number of address blocks included (i.e., the number of address blocks) can be set according to the actual situation, for example, 5 to 20 address blocks. For each window, the fluctuation range of the latency curve is calculated; common indicators include standard deviation or range. Taking standard deviation as an example, let the range within the window be... W The delay value of each address block is The average delay is Then the standard deviation The calculation formula is:

[0070] ;

[0071] If a certain window Greater than the preset allowable range T If so, the area within the window is considered a local fluctuation anomaly area. T The value of this parameter is related to the performance of the memory card and the required detection accuracy, and can typically be set between 3ms and 10ms. For example, if... T = 5ms, for a certain window If so, the area is marked as abnormal.

[0072] The advantage of this method lies in its computational simplicity and ability to quickly locate regions with significant fluctuations. The standard deviation in the formula reflects the dispersion of delay, making it suitable for capturing abrupt delay changes in pseudo-expansion regions.

[0073] Method 2: Anomaly detection based on template comparison.

[0074] Another identification method utilizes template comparison. First, a latency behavior template library is established, containing multiple latency template curves generated from memory cards of normal capacity. These template curves are generated by performing the same write operation on memory cards of known actual capacity, representing normal latency behavior. For example, the latency behavior template library might include latency curves from memory cards of different capacities such as 32GB and 64GB.

[0075] The latency curve of the memory card under test is also segmented using a sliding window approach, with each window extracting a latency subsequence as a detection segment. Then, the detection segment is compared with the corresponding template segment in the template library for similarity. The similarity metric can be Euclidean distance, cosine similarity, or dynamic time warped distance (DTW). Taking cosine similarity as an example, let the detection segment be a vector... The template fragment is These represent the delay values ​​within the sliding window, and their cosine similarity is:

[0076] ;

[0077] like If the value is less than a preset threshold (e.g., 0.9), the detected fragment is considered to differ significantly from the template, and the corresponding window is marked as a region of local fluctuation anomaly. The preset threshold can range from 0.85 to 0.95, depending on the diversity of the template library and the required detection sensitivity.

[0078] This method can more accurately identify anomalies by comparing them with normal behavior, and is especially suitable for scenarios with complex firmware camouflage.

[0079] After identifying the local fluctuation anomaly regions, it is necessary to further determine which regions are pseudo-expansion regions. First, check whether these anomaly regions overlap with readback consistency failure regions. A readback consistency failure region refers to the logical address range where the consistency result is "failed". If a local fluctuation anomaly region intersects with a consistency failure region, this intersection is preferentially identified as a pseudo-expansion region. This preferential identification is based on the fact that pseudo-expansion regions typically exhibit both latency anomalies and data storage failures simultaneously.

[0080] To improve the comprehensiveness of the detection, it is also necessary to analyze the union of local fluctuation anomaly regions and consistency failure regions. After subtracting the intersection region from the union region, the remaining part is used as a candidate region for pseudo-expansion segments. These candidate regions may contain anomalies that have not been fully confirmed and require additional verification operations.

[0081] like Figure 4 The diagram shows a combined use of the two methods. Specifically:

[0082] Verification Method 1: Power off or restart the device for testing.

[0083] A write operation is performed on the candidate region, then a power outage or device restart is simulated, and the data is read again and compared with the original written data. If the read data is inconsistent, the candidate region is determined to be a pseudo-expansion segment.

[0084] This is because when specific data is written to a candidate area of ​​the memory card, and a power-off or restart operation is immediately performed, and the data in that area is read again after the device is powered on, if the read result is all 0s, all FFs, a random value, or is still the old data instead of the data just written, it means that the data in that area has not actually been written to the flash memory medium, but is only temporarily stored in the controller cache or returned as "write successful" through a firmware pseudo-response. Essentially, this is a kind of "temporary cache pseudo-write" behavior. This behavior usually occurs in the logical mapping area of ​​pseudo-expansion cards, because there is no real physical space behind it, and it cannot support effective storage.

[0085] Verification Method 2: Address Rewind Analysis.

[0086] Another verification method is to perform write and read operations on the candidate region and compare the read data with the write data of other address blocks previously written. If the read data highly matches the write data of another address block (e.g., the match rate exceeds 90%), address rollback may exist, meaning that the pseudo-expansion region is cyclically writing data to the real capacity portion. The threshold for the match rate can be set between 85% and 95%, depending on the stringency requirements of the detection.

[0087] Based on the above method, the present invention also designs a detection system, comprising the following modules:

[0088] The capacity resolution module is used to obtain the nominal capacity information of the memory card under test, and divide the logical address into multiple test address blocks based on the nominal capacity information.

[0089] The write control module is used to perform distributed small data write operations in each test address block and record the write latency of each write operation.

[0090] The read verification module is used to perform read operations on the data of each test address block, compare the read results with the original written data, and obtain the read back consistency result.

[0091] The curve generation module is used to generate a latency behavior curve, wherein the latency behavior curve is plotted with logical address as the horizontal axis and write latency as the vertical axis, and the readback consistency result is marked on the horizontal axis.

[0092] An anomaly identification module is used to identify local fluctuation anomaly regions in the latency behavior curve and detect whether the anomaly regions overlap with the readback consistency failure regions.

[0093] The pseudo-expansion determination module is used to preferentially determine the intersection area of ​​the local fluctuation abnormal area and the readback consistency failure area as the pseudo-expansion area.

[0094] These modules work together to achieve a complete process from data acquisition to anomaly detection.

[0095] To illustrate the invention more intuitively, consider the following case: Assume the memory card under test has a nominal capacity of 64GB. Divide the logical address space into 1024 test address blocks, each approximately 64MB in size. Randomly select 10 logical addresses within each block, write 4KB of data, record the latency, and verify consistency. After generating a latency behavior curve, calculate the standard deviation using a sliding window (10 address blocks wide). If the standard deviation exceeds 5ms, it is marked as an abnormal region. Further examine the overlap between abnormal regions and consistency failure regions, and perform power-off tests on candidate regions to ultimately confirm pseudo-expansion regions.

[0096] In summary, the core advantage of the pseudo-expansion detection method proposed in this invention lies in its combination of two types of indicators: write latency behavior and readback consistency. Starting from the underlying storage response characteristics, it reveals the differential characteristics of pseudo-expansion cards that are difficult to disguise at the physical layer. Among these, latency behavior analysis plays a crucial role in this invention.

[0097] Specifically, when a normal memory card completes data writing, the write latency typically exhibits a stable, continuous, and predictable trend. Even if there are local differences, there will not be significant abrupt changes. However, fake memory cards, because their logical addresses exceeding the actual capacity do not have corresponding physical storage resources, often use methods such as firmware spoofing, address rollback, or temporary caching to fake successful writes.

[0098] Compared to a real physical write, this spoofing process typically introduces a series of additional intermediate processing steps, such as address remapping within the firmware, data rollback, pseudo responses to write results, or temporary cached responses. These processes differ significantly from the actual write operation at the execution level and cannot fully replicate the timing and circuit overhead required for a real flash memory write. Consequently, they are prone to exhibiting abnormal write latency, such as sudden increases in latency (e.g., internal firmware redirection or erase / write conflicts), drastic latency fluctuations (e.g., switching triggered by different strategies), or even abnormally low latency (e.g., only returning a pseudo success signal without actually writing).

[0099] Latency anomalies and data consistency failures often occur together because the pseudo-expansion area does not actually have real physical storage space. Therefore, a true storage loop cannot be completed when performing write and read operations. When data is written to the pseudo-expansion area, the controller may adopt a "pseudo-write" strategy, that is, directly caching the write command to disguise it as a successful response, or writing the data back to the front space of the real capacity. Since this process is not a regular flash write process, it may omit low-level operations such as write preparation, page programming, and block erasure, so the write latency will be abnormal: either abnormally high (such as due to rollback deduplication, error handling, or firmware intervention), or unreasonably low (such as directly returning a "write successful" signal without actually writing to disk). Subsequently, during the read process, the controller attempts to extract data from a non-existent physical address. At this time, it often returns the default value (such as all 0s, all FFs) or the contents of other previous data blocks, making it impossible to restore the original written data, causing consistency failure.

[0100] This invention jointly models the write latency and consistency comparison results to generate behavior curves, making latency mutations and consistency failures exhibit highly overlapping patterns in the logical address space, thereby achieving high-confidence identification of pseudo-expansion regions.

[0101] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for detecting fake capacity expansion on a memory card, characterized in that, Includes the following steps: Obtain the nominal capacity information of the memory card under test, and divide the logical address into multiple test address blocks based on the nominal capacity information; Perform distributed small data write operations in each test address block and record the write latency of each write operation; Perform read operations on the data of each test address block, and compare the read results with the original written data to obtain the readback consistency results; Generate a latency behavior curve, with logical address as the horizontal axis and write latency as the vertical axis, and mark the readback consistency result on the horizontal axis; Identify local fluctuation anomaly regions in the latency behavior curve. If a readback consistency failure region overlaps with the local fluctuation anomaly region, the intersection region of the local fluctuation anomaly region and the readback consistency failure region is preferentially determined as a pseudo expansion region.

2. The method for detecting false capacity expansion of memory cards according to claim 1, characterized in that, A region within a sliding window is considered to be a region of abnormal local fluctuations when the following condition exists: the local fluctuation amplitude of the delay curve within the sliding window exceeds a preset allowable range.

3. The method for detecting false capacity expansion of a memory card according to claim 1, characterized in that, The template comparison method is used to identify the local fluctuation anomaly region, specifically including the following steps: Establish a latency behavior template library, which includes multiple latency template curves generated from normal capacity memory cards; The latency behavior curve of the memory card under test is segmented using a sliding window method. Each sliding window corresponds to a local region, and the latency subsequence within the window is extracted as the detection segment. Each detected segment is compared with the corresponding template segment in the delayed behavior template library for similarity. If the similarity between any detected segment and the template segment is lower than a preset threshold, the area covered by the corresponding sliding window is marked as a local fluctuation abnormality area.

4. The method for detecting false capacity expansion of a memory card according to claim 3, characterized in that, The similarity measurement method includes any of the following: Euclidean distance, cosine similarity, or dynamic time-warped distance.

5. The method for detecting false capacity expansion of a memory card according to claim 1, characterized in that, The method further includes: determining the intersection region after deducting the intersection region from the union region of the local fluctuation anomaly region and the consistency failure region as a candidate region for the pseudo expansion segment.

6. The method for detecting false capacity expansion of a memory card according to claim 5, characterized in that, The method further includes: performing a write operation on the candidate region, performing a power outage or device restart operation, and reading the original data from the candidate region again. If a consistency failure occurs, the candidate region is determined to be a pseudo expansion segment.

7. The method for detecting false capacity expansion of a memory card according to claim 5, characterized in that, The method further includes: performing write and read operations on the candidate region, and comparing the read data with the write data of other address blocks previously. If the matching degree exceeds a preset threshold, the candidate region is determined to be a pseudo expansion segment.

8. A memory card fake capacity expansion detection system, characterized in that, include: The capacity resolution module is used to obtain the nominal capacity information of the memory card under test, and divide the logical address into multiple test address blocks based on the nominal capacity information. The write control module is used to perform distributed small data write operations in each test address block and record the write latency of each write operation. The read verification module is used to perform read operations on the data of each test address block, compare the read results with the original written data, and obtain the read back consistency result. The curve generation module is used to generate a latency behavior curve, wherein the latency behavior curve is plotted with logical address as the horizontal axis and write latency as the vertical axis, and the readback consistency result is marked on the horizontal axis. An anomaly identification module is used to identify local fluctuation anomaly regions in the latency behavior curve and detect whether the anomaly regions overlap with the readback consistency failure regions. The pseudo-expansion determination module is used to preferentially determine the intersection area of ​​the local fluctuation abnormal area and the readback consistency failure area as the pseudo-expansion area.

9. The memory card fake capacity expansion detection system according to claim 8, characterized in that, The anomaly identification module determines that the region within a sliding window is a local fluctuation anomaly region when the following condition exists: the local fluctuation amplitude of the delay curve within the sliding window is greater than a preset allowable range.

10. The memory card fake capacity expansion detection system according to claim 8, characterized in that, The pseudo-expansion determination module also determines the intersection region of the union region of the local fluctuation abnormal region and the consistency failure region as the candidate region of the pseudo-expansion segment.

Images