Tools / technique for boards with eMMC repair?

[CapLeaker]

My question is what kind of tools, programmers, hot air settings, techniques are you guys using to play with eMMC's? Any weird failure modes? These days eMMC is in a lot of devices and I should be getting some these devices on my bench.

I had a RCA smart tv main board in my junk bin that had some Toshiba eMMC FBGA153 on there. So I took it off in order to read it. It seems that these eMMC's aren't only soldered on, but also glued to the board? Anyway, I've probably had the board for 4 years kicking around in the pile, so that probably didn't do any good either. So I put it in the FBGA153 programmer, found the correct eMMC in the settings and? Nothing. The pins got detected correctly, but it is timing out for a read / write in all 3 modes 1bit/4bit/8bit. There was absolutely nothing to save in Boot 1 and 2, User etc. Always get the same error. I've tried to read them individually, no bueno.

Not sure if the eMMC was bad to start with, or i burnt it off (took like 3mins on 400C to get it off the darn board). It wouldn't move off the board easily, so I decided to jam my tweezers between the eMMC and the board and pry it off. That's how I noticed that the eMMC was actually glued on there.

[megaraider]

Re: Tools / technique for boards with eMMC repair?

Those e-MMCs are nothing but NAND Flash Memory, either MLC or TLC, with integrated memory management (much like a uSD card if you like), JEDEC compliant.
They do behave as an e-MMC to the 'outside world' and therefore most read/write adapters include a SD Interface.
The biggest problem being working with FBGA package sucks
If you're unable to read / write anything it's most likely due to poor connection (adapter insertion), missing pads or burned off when removed from circuit.
It's very unlikely to be empty (clean) since it holds the firmware...!

[CapLeaker]

Re: Tools / technique for boards with eMMC repair?

No missing pads, contact is good. Had it under my microscope today. I also tried playing with the voltages, which had the same result.

The biggest problem with eMMC is that they are so god damn thin, small and so many contacts it isn't funny. They bend in heat when you have to pry them off and away from the glue too.

[SMDFlea]

Re: Tools / technique for boards with eMMC repair?

You can get some thin blades to slide under the bga,and some other blades to remove the glue around the outside
https://www.ebay.com/itm/15Pc-A8-A9-...l/253833603869

[CapLeaker]

Re: Tools / technique for boards with eMMC repair?

Well, I think I am better off to leave the IC installed and just go with wires direct to the programmer. Anyone know fast the CLK signal is? I measured something like 48MHz?

[megaraider]

Re: Tools / technique for boards with eMMC repair?

Well, I think I am better off to leave the IC installed and just go with wires direct to the programmer. Anyone know fast the CLK signal is? I measured something like 48MHz?

As long as you know the layout and have access to pads somewhere on the circuit board it's always the best solution because you'll avoid all the mess.
Plus 99% it doesn't have to be replaced, you're just doing it for fun or to perform a firmware corruption recover / downgrade or patch
Don't worry about the clock frequency, just wire connect to an empty SD card holder and insert it to a computer SD card reader/writer or a SD to USB adapter reader/writer. It contents will be ready to full access. If you need a 'low level' access use WinHex or any other alike tool.

[CapLeaker]

Re: Tools / technique for boards with eMMC repair?

the first eMMC I took it a dud. Took another eMMC, known working one out of an old android box and put it into the socket and that one works.

[stj]

Re: Tools / technique for boards with eMMC repair?

As long as you know the layout and have access to pads somewhere on the circuit board it's always the best solution because you'll avoid all the mess.
Plus 99% it doesn't have to be replaced, you're just doing it for fun or to perform a firmware corruption recover / downgrade or patch
Don't worry about the clock frequency, just wire connect to an empty SD card holder and insert it to a computer SD card reader/writer or a SD to USB adapter reader/writer. It contents will be ready to full access. If you need a 'low level' access use WinHex or any other alike tool.

slow down,
some eMMC are 1.8v and SD's are 3.3v

[megaraider]

Re: Tools / technique for boards with eMMC repair?

slow down,
some eMMC are 1.8v and SD's are 3.3v

Yes, thanks for pointing that out!
While not trying do be overall generic, most market manufacturers allow the e-MMC interface to work with 1.7V～1.95V and 2.7V～3.6V.
Nevertheless checking before proceeding never hurts, while the way around might!

[CapLeaker]

Re: Tools / technique for boards with eMMC repair?

That "dud" eMMC can be read and written on with both voltages. I've played around with these voltages, but the chip won't respond at all to any setting. There has to be something wrong with it.

[Spork Schivago]

Re: Tools / technique for boards with eMMC repair?

As long as you know the layout and have access to pads somewhere on the circuit board it's always the best solution because you'll avoid all the mess.
Plus 99% it doesn't have to be replaced, you're just doing it for fun or to perform a firmware corruption recover / downgrade or patch
Don't worry about the clock frequency, just wire connect to an empty SD card holder and insert it to a computer SD card reader/writer or a SD to USB adapter reader/writer. It contents will be ready to full access. If you need a 'low level' access use WinHex or any other alike tool.

This is normally how I read / write to them when the need arises. I check the specs to verify the voltage and just hook it to an SD slot on a PC.

I made an adapter cable that works well. I used a MicroSD to SD card adapter, but instead of putting a MicroSD card in there, that's where I soldered my wires. That way, I can just stick the card into a computer's SD card reader and access the chip directly. It works well, albeit a little slow (I only use one of the data lines I believe). Been a while since I had to use it so my memory is a bit foggy on it.

[CapLeaker]

Re: Tools / technique for boards with eMMC repair?

This is normally how I read / write to them when the need arises. I check the specs to verify the voltage and just hook it to an SD slot on a PC.

I made an adapter cable that works well. I used a MicroSD to SD card adapter, but instead of putting a MicroSD card in there, that's where I soldered my wires. That way, I can just stick the card into a computer's SD card reader and access the chip directly. It works well, albeit a little slow (I only use one of the data lines I believe). Been a while since I had to use it so my memory is a bit foggy on it.

any pictures to go with this?

[CapLeaker]

Re: Tools / technique for boards with eMMC repair?

There are some main boards (for example Vizio's) with an eMMC. They also feature a nice UART and JTAG hookup. Anyone ever tried to gain access or flash that eMMC through that provided JTAG port?

[megaraider]

Re: Tools / technique for boards with eMMC repair?

any pictures to go with this?

There are some main boards (for example Vizio's) with an eMMC. They also feature a nice UART and JTAG hookup. Anyone ever tried to gain access or flash that eMMC through that provided JTAG port?

The JTAG port is connected to the main processor. Therefore to gain access to the flash thru the JTAG port you must first obtain access to the main processor using the JTAG port.
The greatest problem being that’s usually confidential stuff (or must crawl the released code, if any, and figure out how to properly initialize it to successfully hook its JTAG port).
It’s making things harder than they could and should be!


It’s easy to find some nice pictures for an eMMC153/169-SD Adapter FBGA153 BGA169 to a SD Adapter (e.g.: link)


To make things even easier you can hook wires from the circuit board to an empty SD card, see images attached.
[Connect VCC and VCCQ to the correct voltage levels]
.
Notes:
1. In 1 bit mode & SPI mode -» pin 1 (DAT3/CS) is not used.
2. Since SD readers operate at 3.3V, if VCCQ is tied up in circuit to 1.8V then use a low voltage adapter to convert 3.3v signals into 1.8v logic level.
3. Most often the CPU may attempt to communicate with the eMMC while your’re reading / writing it. Here’s where the JTAG port comes handy to quickly identify the RST line and hold the CPU it in reset mode.

[CapLeaker]

Re: Tools / technique for boards with eMMC repair?

I kind of figured that the manufacturers would disable the JTAG port somehow. It just would have been too convenient to download or upload something.
I've seen this SD card reader trick before. Probably it will work all right to UL and DL stuff to and from the eMMC. However, I found this being used as a data recovery measure, not as actually upload new firmware. There isn't a clear step by step guide around what to do or not to do swapping eMMCs. Sure there are vids on youtube, but I haven't seen one that shows how everything is done.

Let's say the eMMC is dead. So one whacks a new eMMC in there. Question is: Should one load it before or after the swap. I remember when things were bricked I put my serial cable to it or flashed chips with a JTAG on a parallel port if there was no RS232 back in the days. Fast forward 20 years later and we are in a total different territory in flash chips.
I wonder if one just replaces the eMMC and stick a factory firmware into the USB slot and it will go from there or preload the eMMC?

[megaraider]

Re: Tools / technique for boards with eMMC repair?

I wonder if one just replaces the eMMC and stick a factory firmware into the USB slot and it will go from there or preload the eMMC?

Far from being a dead recovery.
The eMMC not only holds the firmware, among other things, but also the boot CPU code.
Without the boot CPU code the CPU won't even boot. Therefore it cannot perform a crisis recovery.

And, btw, writing the firmware contents into the eMMC won't work either!

If the eMMC is dead then the easiest solution is to get your hands on a full working eMMC dump.
Load it and program the new eMMC (full dumb clone).

[capwizard]

Re: Tools / technique for boards with eMMC repair?

CapWizard VS CapLeaker


RT809H-EMMC-Nand-FLASH
https://www.youtube.com/watch?v=QnbM7tJj_Y8

RT809H With EMMC Read
https://www.youtube.com/watch?v=DudjyIcumBo

samsung ua40f5500ar 50f550ar emmc
https://www.youtube.com/watch?v=ym1JwFKCvTE

tp.r68 ps66a qt572hp v3.1
https://www.youtube.com/watch?v=dqkqhTce6f4

i bought A RT809H and emmc adapter then i forgot about it.

The tendency is Emmc will replace Nand flash in 8k TV.

[CapLeaker]

Re: Tools / technique for boards with eMMC repair?

I did manage to take out two fbga153 eMMC's. One is junk (4GB) I can't read nothing off of it. The software just sez, that the eMMC is bad. It won't recognize squat, everything is zeroed out, no matter what I try for settings. That was my first one.
The second one was a 128GB one and I was able to copy, erase and program it. That's as far as I got with the eMMC's. Soon I supposed to get another candidate with a bad or corrupt eMMC. But for that, I have a second working box. So the plan is to take a working one, clone it to the 128GB (a little step up from 8GB) and put it on to the broken box that won't boot.

The reason that I am not so sure on how things are going to work out is, because copy all info from the other box, incl. the MAC, PW, etc. So I am not sure if that is going to work as I'd like to.

[capwizard]

Re: Tools / technique for boards with eMMC repair?

Excuse me. I have a question. Where can I find such a big one 128Gb emmc ?

[CapLeaker]

Re: Tools / technique for boards with eMMC repair?

There are bigger eMMC's than that, which you can buy at mouser, digi etc. I took it out of my android box.