All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 18 posts ] 
Author Message
 Post subject: eMMC BGA153 Pinout
PostPosted: August 16th, 2018, 18:24 
Offline
User avatar

Joined: June 11th, 2013, 17:01
Posts: 1022
Location: USA
THGBMFG8C4LBAIR

I have this chip from a phone that will not read in an adapter, so I presume its controller may have failed. I would like to complete a pinout to get access to the NAND but have never done one on an eMMC chip. I have the chip pinout (below) but I presume if we are bypassing the NAND then its not that simple. So I have a couple of noobie questions:-

1. Using either the PC3K or VNR monolith adapter, how do we wire this up to read via the eMMC controller just in case we can access it by changing power settings? There are some pins that we do not usually use such as CMD and CLK.

2. Is there a pinout direct to the NAND, or is that only possible via an analyzer?

Thanks


Attachments:
BGA153 Pinout.PNG
BGA153 Pinout.PNG [ 243.54 KiB | Viewed 1619 times ]

_________________
HDD, SSD, Flash and RAID Data Recovery
Top
 Profile  
 
 Post subject: Re: eMMC BGA153 Pinout
PostPosted: August 16th, 2018, 19:11 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3161
Location: Adelaide, Australia
you have to find which of the "nc" pads are for the NAND chip. The DAT0 etc are SD/eMMC commands not NAND. You would either need someone to give you the pinout or find it via pinout discovery with an analyzer, or find a device with a chip where they have just used the nand and follow the traces to the controller(which you can find a pinout map for)


Top
 Profile  
 
 Post subject: Re: eMMC BGA153 Pinout
PostPosted: August 16th, 2018, 19:18 
Offline
User avatar

Joined: June 11th, 2013, 17:01
Posts: 1022
Location: USA
HaQue wrote:
you have to find which of the "nc" pads are for the NAND chip. The DAT0 etc are SD/eMMC commands not NAND. You would either need someone to give you the pinout or find it via pinout discovery with an analyzer, or find a device with a chip where they have just used the nand and follow the traces to the controller(which you can find a pinout map for)

Thanks for that. Do you know which pins to use (and how) to access the eMMC controller?

_________________
HDD, SSD, Flash and RAID Data Recovery


Top
 Profile  
 
 Post subject: Re: eMMC BGA153 Pinout
PostPosted: August 16th, 2018, 19:48 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 10868
Location: Australia
I have no experience in this area, but I would start by measuring the resistance between ground and each of the NC pins. ISTM that all the I/O lines would have the same resistance. You could also locate any additional ground pins this way.

Next I would test for continuity between the NC pins and each of power rails.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: eMMC BGA153 Pinout
PostPosted: August 16th, 2018, 20:37 
Offline
User avatar

Joined: June 11th, 2013, 17:01
Posts: 1022
Location: USA
fzabkar wrote:
I have no experience in this area, but I would start by measuring the resistance between ground and each of the NC pins. ISTM that all the I/O lines would have the same resistance. You could also locate any additional ground pins this way.

Next I would test for continuity between the NC pins and each of power rails.

Many thanks. But before I do that I want to try to access the chip as it would normally be accessed via its own controller. Anyone know which pinouts to use to do this? Ideally I want to try to alter power settings in the hope of getting it to read.

_________________
HDD, SSD, Flash and RAID Data Recovery


Top
 Profile  
 
 Post subject: Re: eMMC BGA153 Pinout
PostPosted: August 16th, 2018, 20:54 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 10868
Location: Australia
Isn't it just an 8-bit MMC interface?
http://www.hardwarebook.info/MMCplus

Which model phone is it? A service manual may have circuit diagrams and voltage settings.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: eMMC BGA153 Pinout
PostPosted: August 16th, 2018, 23:23 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3161
Location: Adelaide, Australia
you can try accessing with 4bit mode or 1-bit mode (SD protocol), 8bit MMC as Franc says, or SPI. this should show if controller is dodgy or not. there are plenty of homebrew stuff on the wb for this, and arduino etc have SPI thats easy to work with.

Be warned, these type of jobs take a lot of time mucking about with. Fun, but not really productive apart from the fun of it and learning.


Top
 Profile  
 
 Post subject: Re: eMMC BGA153 Pinout
PostPosted: August 16th, 2018, 23:36 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 10868
Location: Australia
HaQue wrote:
you can try accessing with 4bit mode or 1-bit mode (SD protocol), 8bit MMC as Franc says, or SPI.

ISTR that SPI mode is not supported in the eMMC spec.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: eMMC BGA153 Pinout
PostPosted: August 17th, 2018, 2:46 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3161
Location: Adelaide, Australia
Maybe, I cant remember. I am guessing a bit of research is in order anyway that should flesh out the possibilities


Top
 Profile  
 
 Post subject: Re: eMMC BGA153 Pinout
PostPosted: August 17th, 2018, 4:42 
Offline
User avatar

Joined: December 29th, 2016, 18:13
Posts: 45
Location: Poland
It's possible to read such chips by any NAND reader including VNR, PC3K, FE - pinout is hidden under layer in case of Toshiba chips for example as in your case of THGBMFG8C4LBAIR (its not located on SD protocol pinout so BGA 153 balls)

We got developed NAND pinout for such case so if you are interested contact us for case recovery from such one

_________________
Best regards,
Boguslaw Rzepka,
Multi-COM Ltd., Poland


Top
 Profile  
 
 Post subject: Re: eMMC BGA153 Pinout
PostPosted: August 17th, 2018, 6:34 
Offline

Joined: October 24th, 2009, 15:22
Posts: 580
Location: Poland
It is your case: http://odzyskiwanie-danych.com.pl/image ... arvika.jpg We have pinout for it. To access data need connect to nand and read as typical flash, then assembly the data.

_________________
Odzyskiwanie danych


Top
 Profile  
 
 Post subject: Re: eMMC BGA153 Pinout
PostPosted: August 20th, 2018, 4:51 
Offline

Joined: July 2nd, 2014, 8:05
Posts: 169
We've made adapters for this and dozens of other ones
https://rusolut.com/techno-security-digital-forensics-conference-2018-myrtle-beach-sc-usa/

_________________
VISUAL NAND RECONSTRUCTOR. A big revolution in chip-off data recovery


Top
 Profile  
 
 Post subject: Re: eMMC BGA153 Pinout
PostPosted: August 20th, 2018, 8:57 
Offline

Joined: November 9th, 2006, 15:15
Posts: 2981
but these eMMC adapters operating on NAND pinout are not available yet?


Top
 Profile  
 
 Post subject: Re: eMMC BGA153 Pinout
PostPosted: August 20th, 2018, 10:57 
Offline

Joined: July 2nd, 2014, 8:05
Posts: 169
hddguy wrote:
but these eMMC adapters operating on NAND pinout are not available yet?

Nor for sale yet, were finalizing new software for it.
I believe we will start sales within September.

_________________
VISUAL NAND RECONSTRUCTOR. A big revolution in chip-off data recovery


Top
 Profile  
 
 Post subject: Re: eMMC BGA153 Pinout
PostPosted: August 20th, 2018, 13:40 
Offline
User avatar

Joined: June 11th, 2013, 17:01
Posts: 1022
Location: USA
Sasha Sheremetov wrote:
hddguy wrote:
but these eMMC adapters operating on NAND pinout are not available yet?

Nor for sale yet, were finalizing new software for it.
I believe we will start sales within September.

Thanks everyone for the help. I will wait for Sasha to develop the NAND pinout adapter.

_________________
HDD, SSD, Flash and RAID Data Recovery


Top
 Profile  
 
 Post subject: Re: eMMC BGA153 Pinout
PostPosted: September 13th, 2018, 3:55 
Offline
User avatar

Joined: December 29th, 2016, 18:13
Posts: 45
Location: Poland
@ddrecovery: viewtopic.php?f=15&t=37381

_________________
Best regards,
Boguslaw Rzepka,
Multi-COM Ltd., Poland


Top
 Profile  
 
 Post subject: Re: eMMC BGA153 Pinout
PostPosted: September 13th, 2018, 4:41 
Offline

Joined: July 2nd, 2014, 8:05
Posts: 169
ddrecovery wrote:
I will wait for Sasha to develop the NAND pinout adapter.


Almost done (infact adapters were done 1 year ago, but they are 30% of the whole process), I believe we need 1-2 more weeks to finish software with automatic recovery modes.

_________________
VISUAL NAND RECONSTRUCTOR. A big revolution in chip-off data recovery


Top
 Profile  
 
 Post subject: Re: eMMC BGA153 Pinout
PostPosted: September 13th, 2018, 12:52 
Offline
User avatar

Joined: June 11th, 2013, 17:01
Posts: 1022
Location: USA
Sasha Sheremetov wrote:
ddrecovery wrote:
I will wait for Sasha to develop the NAND pinout adapter.


Almost done (infact adapters were done 1 year ago, but they are 30% of the whole process), I believe we need 1-2 more weeks to finish software with automatic recovery modes.

Thanks for the update Sasha.

_________________
HDD, SSD, Flash and RAID Data Recovery


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 18 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 9 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group