Dumping flash from HTC Desire 510

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • Spork Schivago
    Badcaps Legend
    • Mar 2012
    • 4734
    • United States of America

    #1

    Dumping flash from HTC Desire 510

    Hello,

    So I need to dump the flash from an HTC Desire 510 cell phone. I did something similar with a 3DS a while back. I used a MicroSD to SD adapter, tore it apart, soldered some wires onto it, put it back together, and then soldered the wires to the 3DS.

    I've attached a picture of the MicroSD pinout.

    My memory is a bit messed up, so I'm having some trouble remembering stuff and wanted to make sure I'm doing this right. For the phone, I believe I know where CMD, CLK, DAT0, 1.8V and 2.8V are located. With the 3DS, I remember there being more DAT#'s.

    In the picture, do I just hook 4 (VDD) to the voltage source (1.8V or 2.8V), then pin 7 to DAT0, pin 5 to CLK, and pin 3 to CMD?

    There's a tin cover over all the chips that I have to unsolder later today, then I can post pictures. I found the pin outs of the eMMC stuff using the internet.

    I think the card reader in my computer provides the power to the eMMC on the phone. I think this voltage is 2.7V, so I should be able to hook pin 4 right up to the 2.8V point on the phone and be good, right?

    Here's a pic I found on the net of the pinouts for the eMMC for the Desire 510. Like I said, later, I'll take my own pictures and verify it's the same and everything.
    Attached Files
    -- Law of Expanding Memory: Applications Will Also Expand Until RAM Is Full
  • stj
    Great Sage 齊天大聖
    • Dec 2009
    • 31007
    • Albion

    #2
    Re: Dumping flash from HTC Desire 510

    sd cards are 3.3v - dont blow your flash up

    why do you need to dump it?
    fastboot can dump the partitions over usb.

    Comment

    • stj
      Great Sage 齊天大聖
      • Dec 2009
      • 31007
      • Albion

      #3
      Re: Dumping flash from HTC Desire 510

      http://www.ebay.co.uk/itm/191899183629

      Comment

      • Spork Schivago
        Badcaps Legend
        • Mar 2012
        • 4734
        • United States of America

        #4
        Re: Dumping flash from HTC Desire 510

        Originally posted by stj
        sd cards are 3.3v - dont blow your flash up

        why do you need to dump it?
        fastboot can dump the partitions over usb.
        This adapter I used worked with the 3DS without me needing to modify anything. It's an MicroSD-to-SD adapter.

        The phone has a PIN that we're trying to recover. If I used a resistor to drop it down to 2.8V, we should be good though, right?

        I could just plug the adapter into my card reader and use DD to dump it, right? I cannot remember how I did it with the 3DS. I remember soldering stuff, but I don't remember if there were special drivers or modules that I needed to install or what. I can't remember if I did it in Windows or Linux. It was a while ago.
        -- Law of Expanding Memory: Applications Will Also Expand Until RAM Is Full

        Comment

        • Spork Schivago
          Badcaps Legend
          • Mar 2012
          • 4734
          • United States of America

          #5
          Re: Dumping flash from HTC Desire 510

          Originally posted by stj
          I don't think that will work. This is a BGA type chip. I have the pinouts for the eMMC stuff, I don't see why I just can't do it the way I did with the 3DS. Essentially, the same thing, right?
          -- Law of Expanding Memory: Applications Will Also Expand Until RAM Is Full

          Comment

          • Spork Schivago
            Badcaps Legend
            • Mar 2012
            • 4734
            • United States of America

            #6
            Re: Dumping flash from HTC Desire 510

            That picture of the PCB isn't the right one. This has a Hynix BGA type flash chip in it. The phone on the back says:
            Code:
             HTC0PCV1   FCC ID: NM80PCV100
            0PCV100 5VDC == 1A
            I'll start searching for the eMMC pinouts for the 0PCV100.
            -- Law of Expanding Memory: Applications Will Also Expand Until RAM Is Full

            Comment

            • stj
              Great Sage 齊天大聖
              • Dec 2009
              • 31007
              • Albion

              #7
              Re: Dumping flash from HTC Desire 510

              the ebay unit is a level translator, you use it between your reader & the chip.

              can you boot into fastboot?
              (volume down + power)

              Comment

              • Spork Schivago
                Badcaps Legend
                • Mar 2012
                • 4734
                • United States of America

                #8
                Re: Dumping flash from HTC Desire 510

                We can reset the phone. We just cannot physically get into the phone. I have it torn apart right now, but I believe we'd be able to get into fast mode. Why, is there away to recover the pin or dump the flash without resetting the phone using fastboot?

                The flash is a Sk Hynix h26m31001hpr, if that helps.

                From what I've been reading, the programming voltage for this chip is 3.3VDC. So perhaps if I find the pinouts, it'd work? A Sk Hynix model number decoder lists it as an MMC.

                https://www.elnec.com/en/device/SK+H...%5BFBGA153%5D/
                Last edited by Spork Schivago; 06-27-2017, 12:06 PM.
                -- Law of Expanding Memory: Applications Will Also Expand Until RAM Is Full

                Comment

                • Spork Schivago
                  Badcaps Legend
                  • Mar 2012
                  • 4734
                  • United States of America

                  #9
                  Re: Dumping flash from HTC Desire 510

                  I believe I've found the JTAG pins and I believe I know what the pinouts for the JTAG pins are (they're not a standard). Other people that are smarter than me figured them out.

                  I'm not good with JTAG. I have an Olimex ARM-USB-OCD-H jtag device. I wonder if I soldered the 5 or 6 wires onto the pads, if I could use that device and OpenOCD to dump the flash content?
                  -- Law of Expanding Memory: Applications Will Also Expand Until RAM Is Full

                  Comment

                  • stj
                    Great Sage 齊天大聖
                    • Dec 2009
                    • 31007
                    • Albion

                    #10
                    Re: Dumping flash from HTC Desire 510

                    before it was locked, was ADB / developer-mode enabled?

                    if it was - you can open a terminal connection to it.

                    Comment

                    • Spork Schivago
                      Badcaps Legend
                      • Mar 2012
                      • 4734
                      • United States of America

                      #11
                      Re: Dumping flash from HTC Desire 510

                      Originally posted by stj
                      before it was locked, was ADB / developer-mode enabled?

                      if it was - you can open a terminal connection to it.
                      No, I already tried that Stj, it wasn't not enabled. That was the first thing I tried.

                      Then I tried a few known exploits, but they don't seem to work. One was typing a very long pin number and then tapping the camera button on the screen, but the camera button on the screen has been removed.

                      I really think this is the Desire 510, just a earlier board. I think in the first post of mine, that board is the 0PCV200, whereas this one is the 0PCV100.

                      Any ideas about the JTAG and OpenOCD? Think I can dump the firmware that way? Thanks.
                      -- Law of Expanding Memory: Applications Will Also Expand Until RAM Is Full

                      Comment

                      • stj
                        Great Sage 齊天大聖
                        • Dec 2009
                        • 31007
                        • Albion

                        #12
                        Re: Dumping flash from HTC Desire 510

                        no idea.

                        Comment

                        • Spork Schivago
                          Badcaps Legend
                          • Mar 2012
                          • 4734
                          • United States of America

                          #13
                          Re: Dumping flash from HTC Desire 510

                          If I could find a datasheet for the h26m31001hpr, I could just purchase a used version of this board, remove the chip, and figure out the pinouts for certain. I've searched the entire net though and couldn't find a datasheet for it.

                          I think JTAG is the only option left.
                          -- Law of Expanding Memory: Applications Will Also Expand Until RAM Is Full

                          Comment

                          • Spork Schivago
                            Badcaps Legend
                            • Mar 2012
                            • 4734
                            • United States of America

                            #14
                            Re: Dumping flash from HTC Desire 510

                            I wonder if that h26m31001hpr FBGA153 uses the same pinout as other FBGA153 eMMC NAND flash chips. What do you think? If so, then I don't need the datasheet, I can just pull up the pinouts for the FBGA153 and find the various pins I need.
                            -- Law of Expanding Memory: Applications Will Also Expand Until RAM Is Full

                            Comment

                            • goontron
                              5000!
                              • Dec 2011
                              • 4108
                              • US

                              #15
                              Re: Dumping flash from HTC Desire 510

                              If you are just after the data: https://www.amazon.com/ALLSOCKET-eMM...s=eMMC+adapter
                              Things I've fixed: anything from semis to crappy Chinese $2 radios, and now an IoT Dildo....

                              "Dude, this is Wyoming, i hopped on and sent 'er. No fucking around." -- Me

                              Excuse me while i do something dangerous


                              You must have a sad, sad boring life if you hate on people harmlessly enjoying life with an animal costume.

                              Sometimes you need to break shit to fix it.... Thats why my lawnmower doesn't have a deadman switch or engine brake anymore

                              Follow the white rabbit.

                              Comment

                              • Spork Schivago
                                Badcaps Legend
                                • Mar 2012
                                • 4734
                                • United States of America

                                #16
                                Re: Dumping flash from HTC Desire 510

                                Originally posted by goontron
                                That's perfect! That would mean that all the eMMC FBGA153's use the same pinouts. That's awesome though and might be well worth the buy. I'm going to try JTAGging it first and see where that goes. Then I'll see what's cheaper, a replacement used board or that adapter. Right now, until we get the electrical updated, I don't think I can remove the chip without damaging the board. I don't think I'd ever be able to properly re-attach the chip. We're just a few dollars shy of the price we need to get the electrical panels in the house upgraded though.
                                -- Law of Expanding Memory: Applications Will Also Expand Until RAM Is Full

                                Comment

                                • goontron
                                  5000!
                                  • Dec 2011
                                  • 4108
                                  • US

                                  #17
                                  Re: Dumping flash from HTC Desire 510

                                  Let me know how it works if you get one, i have an eMMC i need to read myself.
                                  Things I've fixed: anything from semis to crappy Chinese $2 radios, and now an IoT Dildo....

                                  "Dude, this is Wyoming, i hopped on and sent 'er. No fucking around." -- Me

                                  Excuse me while i do something dangerous


                                  You must have a sad, sad boring life if you hate on people harmlessly enjoying life with an animal costume.

                                  Sometimes you need to break shit to fix it.... Thats why my lawnmower doesn't have a deadman switch or engine brake anymore

                                  Follow the white rabbit.

                                  Comment

                                  • Spork Schivago
                                    Badcaps Legend
                                    • Mar 2012
                                    • 4734
                                    • United States of America

                                    #18
                                    Re: Dumping flash from HTC Desire 510

                                    So I went and put the phone back together real quick and did the Power-DOWN. There's an option to boot into fastboot, but instead, I selected the RAM Dump option and am dumping the RAM to a microSD card. I doubt the RAM will contain the PIN because I'm in the Recovery mode or whatever you want to call it, but it's worth a shot. Then I'll try the fastboot.

                                    Once I JTAG this, I'm not sure how I'm going to power the phone on. The JTAG taps are on the wrong side. Some people said they couldn't get the VCC to stay, it kept going low, but I think that was the 200 model board. Not sure about the 100 model board.

                                    Thanks for all the help guys.
                                    -- Law of Expanding Memory: Applications Will Also Expand Until RAM Is Full

                                    Comment

                                    • Spork Schivago
                                      Badcaps Legend
                                      • Mar 2012
                                      • 4734
                                      • United States of America

                                      #19
                                      Re: Dumping flash from HTC Desire 510

                                      Originally posted by goontron
                                      Let me know how it works if you get one, i have an eMMC i need to read myself.
                                      Is yours a cell phone too? No way to find the eMMC pinouts? I have a bunch of pictures that list the various locations on various phones.

                                      Also, I just ran across this when I was researching to see if the passcode would be stored in the RAM dump and if so, how to recover it.

                                      https://www.extremetech.com/computin...in-the-freezer

                                      Some smart people made an open-source program, FROST. I read the article but didn't look into it too much. Not sure if I'd just have to hook a USB cable to phone and use FROST or if FROST would have to be installed, much like that ClockWorkMod or whatever it's called (the mention that in the post as well).

                                      This is what the FROST website says:
                                      Code:
                                      At the end of 2011, Google released version 4.0 of its Android operating system for smartphones. For the first time, Android smartphone owners were supplied with a disk encryption feature that transparently scrambles user partitions, thus protecting sensitive user information against targeted attacks that bypass screen locks. On the downside, scrambled telephones are a a nightmare for IT forensics and law enforcement, because once the power of a scrambled device is cut any chance other than bruteforce is lost to recover data.
                                      
                                      We present FROST, a tool set that supports the forensic recovery of scrambled telephones. To this end we perform cold boot attacks against Android smartphones and retrieve disk encryption keys from RAM. We show that cold boot attacks against Android phones are generally possible for the first time, and we perform our attacks practically against Galaxy Nexus devices from Samsung. To break disk encryption, the bootloader must be unlocked before the attack because scrambled user partitions are wiped during unlocking. However, we show that cold boot attacks are more generic and allow to retrieve sensitive information, such as contact lists, visited web sites, and photos, directly from RAM, even though the bootloader is locked.
                                      (source) https://www1.cs.fau.de/frost

                                      To me, I think this means even if we can dump the contents of the flash, because this Desire 510 is running a version of Android higher than 4.0, without something like FROST installed, there won't be much we can do with our recovery attempts.

                                      I love the signature btw.
                                      Last edited by Spork Schivago; 06-28-2017, 07:03 PM. Reason: Added more info about FROST.
                                      -- Law of Expanding Memory: Applications Will Also Expand Until RAM Is Full

                                      Comment

                                      • goontron
                                        5000!
                                        • Dec 2011
                                        • 4108
                                        • US

                                        #20
                                        Re: Dumping flash from HTC Desire 510

                                        Originally posted by Spork Schivago
                                        Is yours a cell phone too? No way to find the eMMC pinouts? I have a bunch of pictures that list the various locations on various phones..
                                        An early Verizon Motorola Droid...Just the eMMC chip, though. The rest had an unfortunate accident with the serpentine belt of a Ford Triton... To be fair, it did a number on the Triton as well. New cooling fan, belt, and radiator hose were needed after... Along with the original failing idler pulley...
                                        Last edited by goontron; 06-28-2017, 09:38 PM.
                                        Things I've fixed: anything from semis to crappy Chinese $2 radios, and now an IoT Dildo....

                                        "Dude, this is Wyoming, i hopped on and sent 'er. No fucking around." -- Me

                                        Excuse me while i do something dangerous


                                        You must have a sad, sad boring life if you hate on people harmlessly enjoying life with an animal costume.

                                        Sometimes you need to break shit to fix it.... Thats why my lawnmower doesn't have a deadman switch or engine brake anymore

                                        Follow the white rabbit.

                                        Comment

                                        Related Topics

                                        Collapse

                                        • SluggerB
                                          Help with trying to fix phone that is not charging (Pics inside)
                                          by SluggerB
                                          I have two TCL A30 phones.

                                          Old Phone: This phone worked fine for years, then stopped charging If you plugged a charger into it, the phone would make the charging sound, the phone would tell you it is charging, but the battery icon would not have the charging symbol in it and the battery would not charge.I tried new battery, same behavior.

                                          New Phone: Works fine, bought as a donor board to try and repair Old Phone

                                          My interest here is to repair Old Phone, using components parts off New Phone if needed. I am not interested in replacing Old Phone with New Phone....
                                          08-12-2024, 08:11 AM
                                        • ekozeko333
                                          [Help] Lenovo Yoga Slim 7-14ARE05 (DA0LS3MBAF0) – 25Q80DVN1G Flash Is All FF, USB-C PD Stuck at 5V
                                          by ekozeko333
                                          Hi all,
                                          I’m trying to recover a Lenovo Yoga Slim 7-14ARE05 with board DA0LS3MBAF0 Rev:F. I’ve run into an unusual issue where USB-C PD is stuck at 4.7–5V and the system won’t boot (keyboard lights flash briefly, then nothing).
                                          🔥 The Problem Started After Suspected ESD/PD Fault
                                          I experienced a power issue or ESD event through a USB-C charger
                                          After that, the NX20P5090 power switch was visibly burned and was replaced
                                          Now the PD controller always negotiates 5V @ 2A, even with known-good chargers
                                          🧠 What I’ve Done So Far
                                          Flashed...
                                          06-21-2025, 02:48 AM
                                        • corrize
                                          Nikon D800 camera - flash don’t work and capacitor don’t charge
                                          by corrize
                                          Hello, I'm stuck in troubleshooting…
                                          The flash system works like that : when the (mechanic) flash button is pressed, the flash mecanically pop up, and a circuit buck boost elevate 7v (batt) to 200-300v (?) for charging the big capacitor. And when the photo shoot button is pressed, the capacitor is discharged in the xeon light.

                                          In the D800, there is a first « power board » close to the battery. 2 wires (batt 7v) goes to another little « flash board ». I measured 7v, so ok.
                                          When I press the flash button, it's detected by the system, flash icon appear on LDC display....
                                          10-01-2022, 10:02 AM
                                        • keeney123
                                          new OS on a Sonim XP5s phone
                                          by keeney123
                                          To you programmers out there I want to know if it is possible to put a new OS on the Sonim XP5s phone? I only need this phone to make calls, receive calls, have a list of contacts and be able to call voice mail.
                                          I bought this phone new Sep.2021 as an unlock phone from a third-party seller. The phone worked fine until Jan 2022. I then had intermittent problems with the sound setting resetting itself. One of the settings, outdoor, would go to silent all by itself. When in silent mode it does not indicate a call has come in. I missed very important phone calls. All the other setting in sound...
                                          05-13-2022, 07:19 PM
                                        • abajor
                                          Canon VIXIA HF S10 A read data from inernal flash memory.
                                          by abajor
                                          Hello I've had somebody bring in one of these charming little cameras to attempt retrieving data from the internal 32GB flash.
                                          Something is damaged inside the cameras lens assembly I can hear it clunking around and it has probably dislodged the sensor, powering up the camera gives a blank screen and the focus motor sounds like it's having a fit.
                                          The camera will not connect to a computer via USB in this state, I have no options no navigation, just power up and focus/zoom motor noises.

                                          I think my best shot is to figure out a way to read the internal flash memory outside...
                                          07-20-2024, 12:04 AM
                                        • Loading...
                                        • No more items.
                                        Working...