Here is one:

http://www.users.on.net/~fzabkar/temp/photo_188_TSOP48_ONFI.jpg

_________________
A backup a day keeps DR away.

bottom pictured chip is TSOP-56

but anyway, doesn't really matter what the chip is, just need the pinout. I would heavily lean towards standard TSOP48 pinout.

I don't like to disagree with JB but in this case I haven't seen that device referred to a BGA149. But if it is then possibly someone wanted some to fit on eMMC pinout but didn't want eMMC insides, so (theorising here) they just made some raw nand ones up. I would like to see the Toshiba data JB is talking about though.

But yes, as discussed, usually the eMMC chip fails, so get sold and NAND is tested. if this works they just use the chip on a flash drive.
BTW, if nand fails the test, they test it yet again and see if it is only a crystal that is failed and use the other half making a chip 1/2 the original capacity. . If all crystals fail full tests they then see if they can cut blocks out of the translator and still use it but at even lower capacity.


Franc I don't believe the controller can use any part of the eMMC side of it.

That hacked TSOP-56 chip appeared in a thread where the OP connected it to a standard ONFI TSOP-48 jig. Incredibly, the chip was not damaged. Since the example in the current thread is non-standard, it would seem prudent to at least locate the power rails and determine the respective supply voltages before proceeding.

Moreover, I see that the MMC interface balls have traces which appear to be wired to the TSOP pads, although I can't be certain of this. If true, then I can't see how one could access the NAND via this path. This is what led me to speculate that the controller may have an alternate function, possibly a USB-eMMC bridge.

_________________
A backup a day keeps DR away.

@fzabkar and @Arvika you are absolutely right. Someone else (in my office) initially worked on this case and saw the hole burnt through the the controller so removed the chip presuming it was a chip off recovery without noticing the chip type (eMMC). So either way we complete a pinout to the board or a pinout to the chip. This is why I was initially after the controller pinout. I have not had chance to test if the TSOP connections are as ONFI, its been very busy couple of weeks and this is not an urgent job. I will update you soon.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group

I added what the data sheet wont show you:



I often see pads on the PCB that make no sense, and I assume it is because a board could support a few different chips, capacities, or the developers revise the PCB and don't bother to erase the original, just do the minimum to add support for what they need at the time.

BTW, maybe I am having a blank mind day, but I cant remember when I last saw an external eMMC controller chip.

I traced the pinout as best as I could. There are 3 sets of 3 balls at 3 corners of the BGA. These are wired to the NAND control pins (R/B, CE, ALE, WP, etc) at the TSOP-48 pads.

The eMMC Data_0 - Data_7 balls are wired to TSOP pads IO_0 - IO_7. There must be something going on inside the chip that isn't shown in the block diagram.

I can't see where the CMD and CLK pins go, but there appear to be pullup resistors in the vicinity.

_________________
A backup a day keeps DR away.

Sometimes..

PS2251 models comes in many flavours. Each also can be in different packages.

Here is a PS2251-33 that is 48 pins from FE site. Also PS2251-33-BB-F is 48pins.


edit - realised you were talking about the pinout pictured on first post - sorry!

I still have the pin-out, take a picture of the eMMC chip so I can make sure it's the same one.
I sniffed the signals and found out it was a stock NAND chip in an eMMC package..
Like flash drives using SanDisk or Kingson SD/MicroSD's pinouts for NAND.

_________________
Recover My Flash Drive

Here you go JB. I will be working on this today hopefully.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group

http://odzyskiwanie-danych.com.pl/image ... arvika.jpg - same.

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices

AISI, pinout discovery is just a matter of tracing the connectivity between the balls and the pads with a multimeter. I can find most of them by sight. Surely this can't take more than 10 minutes?

I'd be interested in finding out what the PCB does with the CMD and CLK balls. I'm wondering whether these signals are used to determine the configuration of the flash chip at power-on. Could it be that they determine whether the chip powers up as an eMMC or as a regular NAND (MMC controller disabled)?

There are also 3 balls labelled VSF (Vendor Specific Function) which should normally be left floating.

_________________
A backup a day keeps DR away.

When eMMC chip is refurbished and used in flash with external controller, they use only NAND module from eMMC chip (controller is cut off/damaged/not working).

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices

Sorry to necrobump this thread, but this thread ranks highly on Google and it seems there is still no public pinout for the BGA149 package.

Did this ever come to anything?

well.. how HDD's are going, most of these will be necrothreads soon

I don't know, but maybe contact Rusolut. They are working on a lot of similar:

This shows the NAND pads may be the square pads that don't have the coating removed yet in the picture above. Also is some interesting reading : https://rusolut.com/wp-content/uploads/2018/10/damagedEMMC.pdf

https://rusolut.com/emmc-nand-reconstructor/#adapters