EMMC programmer questions

[EazyBone]

Looking to up my game a little bit, but these programmers seem a bit daunting.

Trying to get a device for EMMC repair, and it's very difficult to lookup all the words to find if I'm on the right track lol.

Trying to reprogram EMMC on Sony/Hisense mainly but would like to hit a few other brands.

My question is would either of these work? And is there a specific card reader I need for TV emmc? There is like 10-40 additional pieces that I can get but not sure what I actually need for my application only.

I may do eeprom as well. Can someone point me in direction of what attachment I need or something they use in order to handle these Sony/Hisense emmcs, thanks 😊 😊 😊

https://www.amazon.com/XGecu-TL866-3.../dp/B0B59959PR

https://www.amazon.com/Filican-Progr...s%2C374&sr=8-3

[CapLeaker]

I suggest using the search function up top and search for “EMMC repair”. This should get you going and what programmer was used. Pay attention to the posting dates too. Some programmers are getting a bit older and there are sometimes newer ones.

[EazyBone]

I suggest using the search function up top and search for “EMMC repair”. This should get you going and what programmer was used. Pay attention to the posting dates too. Some programmers are getting a bit older and there are sometimes newer ones.

Yes I saw Nick's tvs selling t56 but figured someone would respond. Search function is junk now, it used to be alright, now it doesn't work for me well. But I'll look at that

[CapLeaker]

I find with programmers everyone needs to look for their own. Some programmers are easier, others are way to expensive or too cheap and doesn't do everything you want. That's why I say look at some threads that had dealt with EMMC's. You may need extra gear too. I've got a DreamLink thread, and there are a few others threads too where there is stuff and info to learn from.

[lotas]

Here in the video Nick's we use a programmer for eMMC - Z3X easy jtag plus.
https://www.youtube.com/watch?v=qq3t_Z2tUvQ

[mon2]

Just followed this thread and watched Nick's video. Can the same process be used to replace the worn out EMMC on Hisense units? From where can we access a known good EMMC dump to program a blank?

[EazyBone]

Just followed this thread and watched Nick's video. Can the same process be used to replace the worn out EMMC on Hisense units? From where can we access a known good EMMC dump to program a blank?

A question I have as well. At least where the dump is,but yes emmc on Google Hisense is possible

[mon2]

Interesting. Review the post from Nick in the YT video linked in post # 5 from earlier this morning. He is of the opinion that we can dump it from a known good unit. Searching for donor Hisense units now for these experiments. Then will consider to purchase the above referenced JTAG tool. We have a Seamark BGA work station already. In the end, this is JTAG driven but the packaged socket and s/w is gold to get an early start. There are far too many of these Hisense units being tossed out due to a defective EMMC.

[EazyBone]

Nick sells t56 programmer with 153/169 socket. One of his recent videos he's uses this since jtag is so expensive. They also have em on Amazon. I chose the t48 just because of cost and, well if it works it works

[mon2]

Can the T56 with the EMMC socket R/W the required target EMMC for these models? Just concerned about the depth of the support of the EMMC devices if using T56 vs. another brand / model. In the end, the issue is about the software and vendor support for the target EMMC devices. JTAG programmers can be built with $10 worth of hardware but right now, interested in the fastest and stable solution for a tool to get started.

[EazyBone]

I asked him that question and yes, he does Hisense in the video and sonys etc said was what works. He specifically made mention about using it, being cheaper but same effectiveness. If you are going to do one every once in awhile it's perfect. If you are going to program chips all day non stop then no, but even he doesn't do that

[Diah]

start first to have good archive of good working content of eMMC... when you reached this buy programmer.... i prefer always using SoC tools as it write firmware in block at it

[mon2]

I have thought that the issue that is stopping us from replacing the EMMC with a fresh one are the hidden encryption keys. Are these keys extractable from the EMMC using the jtag tools? One user on reddit has stated that he did replace the EMMC with success on his Hisense and it is working.

Hisense H8G failure. Run away from this brand and never look back. : r/Hisense (reddit.com)

Just found a (paid) website that claims to have EMMC dumps for Hisense (and others) but still not clear if the dump is complete enough to transfer onto a blank EMMC. So far, do not see the 55Q9G dump that we are after but plenty others appear to be posted.

We are developing some FPGA based hardware and have studied the JTAG communication. Have made some progress to create a JTAG state machine to extract the IDs. Moving forward, R/W should be possible as well with anything that is JTAG driven. As noted earlier, the commercial tools are about proven hardware and software with ideally some factory support for these target devices. Personally have no experience yet with EMMC but it appears to be SDIO based. See a number of vendors offering the zero force sockets for the EMMC devices. The show stopper will be if we cannot fully replicate the original EMMC's contents.

[EazyBone]

I have no idea what your talking about.

[mon2]

There are 2 methods by which the EMMC device can be programmed. One is the method in Nick's video above where you desolder the whole BGA chip and place inside of the dedicated programming tool. This method uses the SDIO interface to R/W the contents.

The other method is using the JTAG interface where the device remains soldered on the target PCB and you will use a mix of interface lines to send out commands and expect a response. Using this mode, you can do the same - erase / read / write the contents. Being that the Hisense TVs have worn out EMMC memory - the old EMMC must be desoldered and a blank one placed onboard - just like Nick did in the video(s). Sometimes, you can purchase the EMMC pre-flashed and ready to solder and use OR often, you must do this externally with the programming tool.

I do believe that it is possible to fix these boards but still confirming the final details before throwing more effort into this nasty project. Locally, Hisense owners are giving away their defective TVs. So sad.

[lotas]

This is not called JTAG, but an ISP connection, ISP connection points (Pinout) to eMMC, example in the photo.

[mon2]

Thanks for the clarification. Are there software tools available to R/W/E the eMMC using this ISP method? Are they in the public domain or commercial?

Alternatively, need to consider the RT809H or another that can R/W/E the eMMC with a zero force socket. This project is now getting interesting. We still have access to a Hisense 55Q9G main board that is 99% ok but is boot looping. That is, if we read out the contents of that eMMC and apply onto a blank eMMC, we should be able to fix this main board. Would you agree?

From reading, the contents we need to dump and apply onto a fresh eMMC are: boot1, boot2 and userfile.

[Diah]

wait... ISP are just the tool for SoC to handle the eMMC... this is only on MT SoC the interface communication are still the only one is JTAG,by SoC

[mon2]

Hardware Hacking 101: Identifying and Dumping eMMC Flash (riverloopsecurity.com)

[Diah]

latest isp tool