eMMC dumping question
Posted: Wed Aug 07, 2019 5:09 pm
Hello,
I'm trying to dump the eMMC from my car's radio / infotainment system. I've identified an eMMC chip, and believe I have traced out Dat0, CMD, CLK, and RST. I had a second trashed radio of the same model which I removed the eMMC from in order to help me make this pinout.
I don't think I'll be able to deadbug the eMMC from the donor board as I don't have a steady hand, and I probably damaged the IC by brutally removing it with a hot air gun. Instead, I'd like to try dump it from the working board without removing the eMMC. The pads on this board are a little more manageable for soldering than the eMMC itself.
I've looked at this: https://bh2017.exploitee.rs/ and have picked up the passthrough breakout board as well as the voltage regulated breakout board. I will need to figure out if the eMMC is running at 1.8V or 3.3V before deciding which to use.
This is where my question comes in. I'll need to stop the CPU from communicating with the eMMC per the previously linked slides.
One way to do this is to hold the CPU in reset. I understand that the way to do this probably varies from CPU to CPU, but would someone be able to point me in the right direction to figure out how to do this?
Another way is to disconnect the CMD or CLK. The CLK line appears to via to the bottom of the board, then routes to a pad that connects to nothing. I'm guessing some of the middle layers must be involved here, leaving me with no way to disconnect CLK. CMD however, appears to be easy enough to disconnect. Looks like I could just knock off one resistor. I may go this route if I can't figure out how to properly hold the CPU in reset. Does it seem possible that CLK would have some unused bottom layer pad and instead use middle layers?
I'm definitely not an EE / hardware person, so any help is appreciated.
Thanks!
I'm trying to dump the eMMC from my car's radio / infotainment system. I've identified an eMMC chip, and believe I have traced out Dat0, CMD, CLK, and RST. I had a second trashed radio of the same model which I removed the eMMC from in order to help me make this pinout.
I don't think I'll be able to deadbug the eMMC from the donor board as I don't have a steady hand, and I probably damaged the IC by brutally removing it with a hot air gun. Instead, I'd like to try dump it from the working board without removing the eMMC. The pads on this board are a little more manageable for soldering than the eMMC itself.
I've looked at this: https://bh2017.exploitee.rs/ and have picked up the passthrough breakout board as well as the voltage regulated breakout board. I will need to figure out if the eMMC is running at 1.8V or 3.3V before deciding which to use.
This is where my question comes in. I'll need to stop the CPU from communicating with the eMMC per the previously linked slides.
One way to do this is to hold the CPU in reset. I understand that the way to do this probably varies from CPU to CPU, but would someone be able to point me in the right direction to figure out how to do this?
Another way is to disconnect the CMD or CLK. The CLK line appears to via to the bottom of the board, then routes to a pad that connects to nothing. I'm guessing some of the middle layers must be involved here, leaving me with no way to disconnect CLK. CMD however, appears to be easy enough to disconnect. Looks like I could just knock off one resistor. I may go this route if I can't figure out how to properly hold the CPU in reset. Does it seem possible that CLK would have some unused bottom layer pad and instead use middle layers?
I'm definitely not an EE / hardware person, so any help is appreciated.
Thanks!