eMMC BGA153 Pinout

[ddrecovery]

THGBMFG8C4LBAIR

I have this chip from a phone that will not read in an adapter, so I presume its controller may have failed. I would like to complete a pinout to get access to the NAND but have never done one on an eMMC chip. I have the chip pinout (below) but I presume if we are bypassing the NAND then its not that simple. So I have a couple of noobie questions:-

1. Using either the PC3K or VNR monolith adapter, how do we wire this up to read via the eMMC controller just in case we can access it by changing power settings? There are some pins that we do not usually use such as CMD and CLK.

2. Is there a pinout direct to the NAND, or is that only possible via an analyzer?

Thanks

Attachments

[HaQue]

you have to find which of the "nc" pads are for the NAND chip. The DAT0 etc are SD/eMMC commands not NAND. You would either need someone to give you the pinout or find it via pinout discovery with an analyzer, or find a device with a chip where they have just used the nand and follow the traces to the controller(which you can find a pinout map for)

[ddrecovery]

you have to find which of the "nc" pads are for the NAND chip. The DAT0 etc are SD/eMMC commands not NAND. You would either need someone to give you the pinout or find it via pinout discovery with an analyzer, or find a device with a chip where they have just used the nand and follow the traces to the controller(which you can find a pinout map for)

Thanks for that. Do you know which pins to use (and how) to access the eMMC controller?

[fzabkar]

I have no experience in this area, but I would start by measuring the resistance between ground and each of the NC pins. ISTM that all the I/O lines would have the same resistance. You could also locate any additional ground pins this way.

Next I would test for continuity between the NC pins and each of power rails.

[ddrecovery]

I have no experience in this area, but I would start by measuring the resistance between ground and each of the NC pins. ISTM that all the I/O lines would have the same resistance. You could also locate any additional ground pins this way.

Next I would test for continuity between the NC pins and each of power rails.

Many thanks. But before I do that I want to try to access the chip as it would normally be accessed via its own controller. Anyone know which pinouts to use to do this? Ideally I want to try to alter power settings in the hope of getting it to read.

[fzabkar]

Isn't it just an 8-bit MMC interface?
http://www.hardwarebook.info/MMCplus

Which model phone is it? A service manual may have circuit diagrams and voltage settings.

[HaQue]

you can try accessing with 4bit mode or 1-bit mode (SD protocol), 8bit MMC as Franc says, or SPI. this should show if controller is dodgy or not. there are plenty of homebrew stuff on the wb for this, and arduino etc have SPI thats easy to work with.

Be warned, these type of jobs take a lot of time mucking about with. Fun, but not really productive apart from the fun of it and learning.

[fzabkar]

you can try accessing with 4bit mode or 1-bit mode (SD protocol), 8bit MMC as Franc says, or SPI.

ISTR that SPI mode is not supported in the eMMC spec.

[HaQue]

Maybe, I cant remember. I am guessing a bit of research is in order anyway that should flesh out the possibilities

[Bolo]

It's possible to read such chips by any NAND reader including VNR, PC3K, FE - pinout is hidden under layer in case of Toshiba chips for example as in your case of THGBMFG8C4LBAIR (its not located on SD protocol pinout so BGA 153 balls)

We got developed NAND pinout for such case so if you are interested contact us for case recovery from such one

[arvika]

It is your case: http://odzyskiwanie-danych.com.pl/image ... arvika.jpg We have pinout for it. To access data need connect to nand and read as typical flash, then assembly the data.

[Sasha Sheremetov]

We've made adapters for this and dozens of other ones
https://rusolut.com/techno-security-digital-forensics-conference-2018-myrtle-beach-sc-usa/

[hddguy]

but these eMMC adapters operating on NAND pinout are not available yet?

[Sasha Sheremetov]

but these eMMC adapters operating on NAND pinout are not available yet?

Nor for sale yet, were finalizing new software for it.
I believe we will start sales within September.

[ddrecovery]

but these eMMC adapters operating on NAND pinout are not available yet?

Nor for sale yet, were finalizing new software for it.
I believe we will start sales within September.

Thanks everyone for the help. I will wait for Sasha to develop the NAND pinout adapter.

[Bolo]

@ddrecovery: viewtopic.php?f=15&t=37381

[Sasha Sheremetov]

I will wait for Sasha to develop the NAND pinout adapter.

Almost done (infact adapters were done 1 year ago, but they are 30% of the whole process), I believe we need 1-2 more weeks to finish software with automatic recovery modes.

[ddrecovery]

I will wait for Sasha to develop the NAND pinout adapter.

Almost done (infact adapters were done 1 year ago, but they are 30% of the whole process), I believe we need 1-2 more weeks to finish software with automatic recovery modes.

Thanks for the update Sasha.