HDD GURU FORUMS
http://forum.hddguru.com/

eMMC BGA153 Pinout
http://forum.hddguru.com/viewtopic.php?f=10&t=37268		 Page 1 of 1
Author:  ddrecovery [ August 16th, 2018, 18:24 ]
Post subject:  eMMC BGA153 Pinout
THGBMFG8C4LBAIR

I have this chip from a phone that will not read in an adapter, so I presume its controller may have failed. I would like to complete a pinout to get access to the NAND but have never done one on an eMMC chip. I have the chip pinout (below) but I presume if we are bypassing the NAND then its not that simple. So I have a couple of noobie questions:-

1. Using either the PC3K or VNR monolith adapter, how do we wire this up to read via the eMMC controller just in case we can access it by changing power settings? There are some pins that we do not usually use such as CMD and CLK.

2. Is there a pinout direct to the NAND, or is that only possible via an analyzer?

Thanks

Attachments:
BGA153 Pinout.PNG
BGA153 Pinout.PNG [ 243.54 KiB | Viewed 22607 times ]
Author:  HaQue [ August 16th, 2018, 19:11 ]
Post subject:  Re: eMMC BGA153 Pinout
you have to find which of the "nc" pads are for the NAND chip. The DAT0 etc are SD/eMMC commands not NAND. You would either need someone to give you the pinout or find it via pinout discovery with an analyzer, or find a device with a chip where they have just used the nand and follow the traces to the controller(which you can find a pinout map for)
Author:  ddrecovery [ August 16th, 2018, 19:18 ]
Post subject:  Re: eMMC BGA153 Pinout
HaQue wrote:
you have to find which of the "nc" pads are for the NAND chip. The DAT0 etc are SD/eMMC commands not NAND. You would either need someone to give you the pinout or find it via pinout discovery with an analyzer, or find a device with a chip where they have just used the nand and follow the traces to the controller(which you can find a pinout map for)

Thanks for that. Do you know which pins to use (and how) to access the eMMC controller?
Author:  fzabkar [ August 16th, 2018, 19:48 ]
Post subject:  Re: eMMC BGA153 Pinout
I have no experience in this area, but I would start by measuring the resistance between ground and each of the NC pins. ISTM that all the I/O lines would have the same resistance. You could also locate any additional ground pins this way.

Next I would test for continuity between the NC pins and each of power rails.
Author:  ddrecovery [ August 16th, 2018, 20:37 ]
Post subject:  Re: eMMC BGA153 Pinout
fzabkar wrote:
I have no experience in this area, but I would start by measuring the resistance between ground and each of the NC pins. ISTM that all the I/O lines would have the same resistance. You could also locate any additional ground pins this way.

Next I would test for continuity between the NC pins and each of power rails.

Many thanks. But before I do that I want to try to access the chip as it would normally be accessed via its own controller. Anyone know which pinouts to use to do this? Ideally I want to try to alter power settings in the hope of getting it to read.
Author:  fzabkar [ August 16th, 2018, 20:54 ]
Post subject:  Re: eMMC BGA153 Pinout
Isn't it just an 8-bit MMC interface?
http://www.hardwarebook.info/MMCplus

Which model phone is it? A service manual may have circuit diagrams and voltage settings.
Author:  HaQue [ August 16th, 2018, 23:23 ]
Post subject:  Re: eMMC BGA153 Pinout
you can try accessing with 4bit mode or 1-bit mode (SD protocol), 8bit MMC as Franc says, or SPI. this should show if controller is dodgy or not. there are plenty of homebrew stuff on the wb for this, and arduino etc have SPI thats easy to work with.

Be warned, these type of jobs take a lot of time mucking about with. Fun, but not really productive apart from the fun of it and learning.
Author:  fzabkar [ August 16th, 2018, 23:36 ]
Post subject:  Re: eMMC BGA153 Pinout
HaQue wrote:
you can try accessing with 4bit mode or 1-bit mode (SD protocol), 8bit MMC as Franc says, or SPI.

ISTR that SPI mode is not supported in the eMMC spec.
Author:  HaQue [ August 17th, 2018, 2:46 ]
Post subject:  Re: eMMC BGA153 Pinout
Maybe, I cant remember. I am guessing a bit of research is in order anyway that should flesh out the possibilities
Author:  Bolo [ August 17th, 2018, 4:42 ]
Post subject:  Re: eMMC BGA153 Pinout
It's possible to read such chips by any NAND reader including VNR, PC3K, FE - pinout is hidden under layer in case of Toshiba chips for example as in your case of THGBMFG8C4LBAIR (its not located on SD protocol pinout so BGA 153 balls)

We got developed NAND pinout for such case so if you are interested contact us for case recovery from such one
Author:  arvika [ August 17th, 2018, 6:34 ]
Post subject:  Re: eMMC BGA153 Pinout
It is your case: http://odzyskiwanie-danych.com.pl/image ... arvika.jpg We have pinout for it. To access data need connect to nand and read as typical flash, then assembly the data.
Author:  Sasha Sheremetov [ August 20th, 2018, 4:51 ]
Post subject:  Re: eMMC BGA153 Pinout
We've made adapters for this and dozens of other ones
https://rusolut.com/techno-security-digital-forensics-conference-2018-myrtle-beach-sc-usa/
Author:  hddguy [ August 20th, 2018, 8:57 ]
Post subject:  Re: eMMC BGA153 Pinout
but these eMMC adapters operating on NAND pinout are not available yet?
Author:  Sasha Sheremetov [ August 20th, 2018, 10:57 ]
Post subject:  Re: eMMC BGA153 Pinout
hddguy wrote:
but these eMMC adapters operating on NAND pinout are not available yet?

Nor for sale yet, were finalizing new software for it.
I believe we will start sales within September.
Author:  ddrecovery [ August 20th, 2018, 13:40 ]
Post subject:  Re: eMMC BGA153 Pinout
Sasha Sheremetov wrote:
hddguy wrote:
but these eMMC adapters operating on NAND pinout are not available yet?

Nor for sale yet, were finalizing new software for it.
I believe we will start sales within September.

Thanks everyone for the help. I will wait for Sasha to develop the NAND pinout adapter.
Author:  Bolo [ September 13th, 2018, 3:55 ]
Post subject:  Re: eMMC BGA153 Pinout
@ddrecovery: viewtopic.php?f=15&t=37381
Author:  Sasha Sheremetov [ September 13th, 2018, 4:41 ]
Post subject:  Re: eMMC BGA153 Pinout
ddrecovery wrote:
I will wait for Sasha to develop the NAND pinout adapter.


Almost done (infact adapters were done 1 year ago, but they are 30% of the whole process), I believe we need 1-2 more weeks to finish software with automatic recovery modes.
Author:  ddrecovery [ September 13th, 2018, 12:52 ]
Post subject:  Re: eMMC BGA153 Pinout
Sasha Sheremetov wrote:
ddrecovery wrote:
I will wait for Sasha to develop the NAND pinout adapter.


Almost done (infact adapters were done 1 year ago, but they are 30% of the whole process), I believe we need 1-2 more weeks to finish software with automatic recovery modes.

Thanks for the update Sasha.
Page 1 of 1 All times are UTC - 5 hours [ DST ]
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
http://www.phpbb.com/