Hello lovely people.
Not long ago, my wonderful Samsung Galaxy S2 dropped dead. Before I send it in for service, I would LOVE to get the data on the internal storage back.
The phone does not get hot while charging, and nothing else whatsoever makes it show sings of life.
Is it possible to swap out the internal storage chip from the motherboard, and place it on an another identical phone, and retrieve the data that way?
Any sort of tips for businesses that would do something like this is welcome!
As you can guess, I learned to back up my stuff the hard way. My last clockwork backup was 20 days ago. Precious 20 days ago
probability = 99,99% yes ... a SD-card no matter of where it was before. have good luck
psytr0nic said:
probability = 99,99% yes ... a SD-card no matter of where it was before. have good luck
Click to expand...
Click to collapse
And the deadly .01% is if the damaged part is the internal memory itself.
:good:
While emmc chip got like 20 important pads to solder (out of even hundred, when most are there being N/C) it is still BGA. A ****ass small BGA covered with glue. That would require someone really experienced with reworking such things. I do not know the prices but I would be prepared to pay even 100$ or more for such job, done right.
That from HW level. From SW+HW look: in theory there should be no trouble with properly swapped emmc ic from other phone. But you shall not forget about the said 0.01%, maybe more - reworking such chip might have influence on its content (I might be wrong) + GS2 had the emmc hardbrick bug - how did it die?
Please let us know how did it go.
Oh and btw - there must be companies working on such data recovery with proper HW to wire up to the unsoldered chip with sort of socket or other hackaround - I'd lookup there.
Max specified operating temperature of an eMMC is about 85 °C, there's no telling what happens above that... So whatever way you use to re-connect your eMMC, make sure it is not by soldering!
Of course it is possible but you need highly expensive tools for it to solder of the chip. it is BGA it's not just like a transistor..
It does have hundreds of micro balls under the chip. Did you try adb shell already? Or is it really 99% dead.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
You may find a company that can do it but it will cost A LOT of money. Because you need special tools for it.
Something like this
You best bet would be to try to use a heat gun on the main board. Just heat it up for a few seconds and cool it down to zero as quick as possible. Maybe the bga is cracked because it got hit by the ground when you accidentally dropped it. By heating it up you may temporarily fix this crack(will also cause slightly damage to the chips) in the soldering. So you can back it up and sent it back. I think it will void the warranty, but you have to decide for yourself what to do. Try to get back the data or get a new working main board from Samsung (if you sent the phone back they will just replace it with a new one most likely).
Bga soldering crack
0,1% of chance .. playing with Samsung EMMC chip = bye bye phone . look around forum or elsewhere 100% of bricked is due to it .
Question : what make you confident to say that your internal memory is good ?
to remind : it is also your phone flash chip which manage boot sequence and all . don't forget it .
Max specified operating temperature of an eMMC is about 85 °C, there's no telling what happens above that.
Click to expand...
Click to collapse
Of course it is possible but you need highly expensive tools for it to solder of the chip
Click to expand...
Click to collapse
every time I tried with hot air , I removed chip with missing pads cause of glue under chip which make hard to remove .
why not to give a try ? have good luck
You best bet would be to try to use a heat gun on the main board
Click to expand...
Click to collapse
Those are options you have instead of paying hundreds of euro's to a company that can recover it if it isn't the nand/emmc itself that is the dead part of the phone.
Of course i recommend him to go to a professional company and let them do recover it. Because they will do it the proper way but like i said before it cost you a lot of money.
So your best bet would be to try it yourself or just sent it back to Samsung for warranty.(by trying yourself i don't mean to solder it off because thet will not work out good. It will probably kill the chip, just try to reflow the mainboard and maybe you have luck.)
I know about glue in the corners of bga based chips in HP & Acer and other brands in laptops and such but didn't know that phones had that too.
But glue under the chip, never seen that before. And btw you cannot remove a bga soldered chip with a heatgun you need ir so that the whole surface under the chip gets loose. And you need to cover up all other components or they will get loose too or fry
Acer bga soldered chip -> glue in corners (this is not nand or emmc, its the chipset & cpu/gpu)
http://i.imgur.com/aIHNu.jpg
Irda soldering
http://www.youtube.com/watch?feature=player_detailpage&v=RrA-trDZPNs#t=170s
Recovering data from snapped Galaxy s2 motherboard
Hi everyone, i really need some help
My galaxy s2 motherboard has snapped (around the long thin bit) with all other parts of the motherboard still intact. I really need to recover all of the data. The data has sentimental value and cannot be replaced. Is there any chance of recovering the data either through chip extraction and onto new board? Can the existing motherboard be fixed?
All i keep hearing is that it is too difficult, the motherboard is multi-layered and would be impossible to fix. I am reluctant to take this as an answer. Is there anybody out there that has a solution for recovering all the data? Who would i go to? who do i pay? Ive contacted samsung and they say it is impossible, when questioning them why it is impossible they state tit would cost too much and they cannot do it.
Please help. thank you.
EMMC reball and some other tips
Hey guys,
I know this thread is a little bit old but I'll try to give in my 2 cents maybe someone here may find it helpful
So I come from background where I do around 20 bga reballs per week, so I do know a thing or two I guess about this although my knowledge on Samsung platform is relatively low compared to an iphone logic.
So to begin with replacing the emmc chip alone is not enough as you'll need a programmer box which connects to a jtag interface which is able to rewrite the initial files like bootrom to the emmc. You can find these boxes at any prominent gsm repair shops; boxes named such as RiffBox or Z3X Samsung box are the best I found recently.
Having said that before any repair is attempted by mainly removing the flash chip it is imperative to try to resurrect the phone using these said boxes, to try to find whether or not the NAND chip is actually detected. As one may have simply installed a ROM which is not compatible with the phone and all that is required is to rewrite the bootrom files. If the NAND (basically the same name as a flash chip) fails to be detected then obviously something went wrong and it either could be the NAND is burnt inside, or the NAND has some cracks under its critical ball pins or even may be a problem that the main power management chip inside the phone is failing from supplying usually around 3V to power up the NAND.
The emmc chip at least found in a samsung is a 14 by 14 pins which only about 1/3 of it's pins are critical, the rest are dummy and do not worry if they eventually get removed, while removing the chip or cleaning the board after desoldering prior installing the new chip.
Some tips on reworking:
Always cover critical glued components like CPU + POP (package on package) RAM, baseband processor usually XGOLD found in Samsung.
Clean surrounding chip glue before attempting to remove by giving around 250C of heat and with a needle scratching the glue around
Do not exceed more than 350C to remove the actual chip to prevent more damage to the built in tracks inside the motherboard.
Last and not least a schematic for your phone would always be a lot of help to help you detect what voltages are missing on bootup to make sure that the boot up sequence is starting fine and also the relative points of each pin under a chip while knowing which pins are critical and which are dummies, or NC (not connected)
If you need any help you can always message me and I'll try my best to answer your questions.
Regards,
Ryan
solder with care
Solder with care mate, else it will be totally gone
psytr0nic said:
0,1% of chance .. playing with Samsung EMMC chip = bye bye phone . look around forum or elsewhere 100% of bricked is due to it .
Question : what make you confident to say that your internal memory is good ?
to remind : it is also your phone flash chip which manage boot sequence and all . don't forget it .
every time I tried with hot air , I removed chip with missing pads cause of glue under chip which make hard to remove .
why not to give a try ? have good luck
Click to expand...
Click to collapse
The glue in samsung is very easy to remove you just need to heat the board up to 250C and gently scratch the glued area with a needle. Do not worry on the removed pads as 1/3 of the pads under the EMMC are not connected and therefore not needed. Always clean the chip from the glue and use leaded solder for best shiny connections.
If you need any help you can always message me and I'll try my best to answer your questions.
Regards,
Ryan[/QUOTE]
Can you please explain more about JTAG.., types and the connections, how to get files for the different phones, where can we get the software etc. Thank you.:good:
richie16171 said:
If you need any help you can always message me and I'll try my best to answer your questions.
Regards,
Ryan
Click to expand...
Click to collapse
Can you please please explain more about JTAG.., types and the connections, how to get the files from different phones, where can we get the softare etc. Thank you.:good:[/QUOTE]
You will need special programmer boxes like riffbox to be able to rewrite the bootloader. JTAG is a dedicated space on the board where the riffbox will communicate with the phone.
AnArChYm said:
Can you please please explain more about JTAG.., types and the connections, how to get the files from different phones, where can we get the softare etc. Thank you.:good:
Click to expand...
Click to collapse
You will need special programmer boxes like riffbox to be able to rewrite the bootloader. JTAG is a dedicated space on the board where the riffbox will communicate with the phone.[/QUOTE]
Thank you., what about the riffbox connections? Which pin to connect what and is it common to all devices?
richie16171 said:
You will need special programmer boxes like riffbox to be able to rewrite the bootloader. JTAG is a dedicated space on the board where the riffbox will communicate with the phone.
Click to expand...
Click to collapse
Thank you., what about the riffbox connections? Which pin to connect what and is it common to all devices?[/QUOTE]
Edit: I already got the site. And everything is explained in forum there. If anyone wants.. you can find here http://faq.riffbox.org/showcat.html
Would like the learn how to reball
AnArChYm said:
Hey guys,
I know this thread is a little bit old but I'll try to give in my 2 cents maybe someone here may find it helpful
So I come from background where I do around 20 bga reballs per week, so I do know a thing or two I guess about this although my knowledge on Samsung platform is relatively low compared to an iphone logic.
So to begin with replacing the emmc chip alone is not enough as you'll need a programmer box which connects to a jtag interface which is able to rewrite the initial files like bootrom to the emmc. You can find these boxes at any prominent gsm repair shops; boxes named such as RiffBox or Z3X Samsung box are the best I found recently.
Having said that before any repair is attempted by mainly removing the flash chip it is imperative to try to resurrect the phone using these said boxes, to try to find whether or not the NAND chip is actually detected. As one may have simply installed a ROM which is not compatible with the phone and all that is required is to rewrite the bootrom files. If the NAND (basically the same name as a flash chip) fails to be detected then obviously something went wrong and it either could be the NAND is burnt inside, or the NAND has some cracks under its critical ball pins or even may be a problem that the main power management chip inside the phone is failing from supplying usually around 3V to power up the NAND.
The emmc chip at least found in a samsung is a 14 by 14 pins which only about 1/3 of it's pins are critical, the rest are dummy and do not worry if they eventually get removed, while removing the chip or cleaning the board after desoldering prior installing the new chip.
Some tips on reworking:
Always cover critical glued components like CPU + POP (package on package) RAM, baseband processor usually XGOLD found in Samsung.
Clean surrounding chip glue before attempting to remove by giving around 250C of heat and with a needle scratching the glue around
Do not exceed more than 350C to remove the actual chip to prevent more damage to the built in tracks inside the motherboard.
Last and not least a schematic for your phone would always be a lot of help to help you detect what voltages are missing on bootup to make sure that the boot up sequence is starting fine and also the relative points of each pin under a chip while knowing which pins are critical and which are dummies, or NC (not connected)
If you need any help you can always message me and I'll try my best to answer your questions.
Regards,
Ryan
Click to expand...
Click to collapse
Hi Ryan,
My son's galaxy s3 i9300 was inadvertently given a spin in the washing machine. When I realised what had happened I took it apart into its various components and put it in rice for a week. When I switched it on everything worked except the cell phone signal. From what I can gather the eMMC chip has been damaged and no software can fix it. I don't have it with me now but I think IMEI and baseband is unknown. The EFS folder is empty or corrupt.
Stumbling across your post I was interested in the fact that you seem to be an expert in re-balling. My son has since got a new phone and since I am a basic amateur in phone repair (for family and friends) I have been toying with the idea of replacing the eMMC chip on the s3 after watching this video:
http://www.youtube.com/watch?v=s38vQxXv0GE
I don't mind if I buy the chip and it doesn't work I am more intent on gaining the experience and going through the stages. Do you think this is a good idea and do you have any tips or things I can research on the topic?
Yiannos
---------- Post added at 07:30 AM ---------- Previous post was at 07:14 AM ----------
Sorry I meant this video:
http://www.youtube.com/watch?v=ds04BTVL8i0&feature=youtu.be
yiannos50 said:
Hi Ryan,
My son's galaxy s3 i9300 was inadvertently given a spin in the washing machine...
Click to expand...
Click to collapse
Hi,
If the imei is available (null), it could be the case that it needs repairing rather than actually chaging the eMMC chip , however you'll need a special tool to do this, which honestly do not know which exactly is as I'm more into hardware repairs rather than software.
Another possible issue could be that the phone can also have corrosion around critical components, ie around the main baseband supply, which is stopping from the baseband switch on, thus no signal or any radio communication from starting up. It would be best to have a microscope and inspect each part of the board for bad components, rather than rushing to the eMMC replacement.
It's very important to read this post very carefully and understand it as it is not easy to be done, but it is very much possible. And find a lot of youtube videos before even trying so you'll be more familiar with the process and different techniques.
Anyways for the most interesting part
Basically the eMMC chip is a 14 by 14 bga, ball grid array chip which is fairly easy to reball comapred to other complex ones, like baseband processor or the main application processor, You'll also be needing a reballing stencil to put the balls on top of the solder pins, and solder paste to paste the solder onto the holes and a hot air gun to melt that solder into balls. (Basically the solder paste will melt between those holes inside the stencil and will form nice silverish balls.
The chip also has got a lot of not connected pads (aka dummy pads) so do not worry when removing the chip as you'll be more then likely to lift pads from the board especially if this your first reball job.
First of all, you'll need to clean the surrounding glue around the chip by using around 200C and with a needle scrape off the glue, be very gentle not to scrape any tracks or board layers.
Then to remove the chip from the board use around 350C (always ramping up the temp), very important to use kapton tape around the surroundings to reduce heat stress. Personally I use the following temperatures: (do not use any nozzle with the heat gun as the chip is large and you need the heat to dispersed all over the chip)
1st min 180C full air
2nd min 280C full air
4th min 350C full air until the surrounding components turn silverish and are easy to lift, at that time get a very sharp needle and gently (very gently) start to pry up with ease the chip from one side, until it is fully lifted.
Then you'll need to clean the board, basically put flux and with a fine tip soldering iron clean the pads gently until all underfilled glue is no more remaining and the pads are nice and shiny and set the board aside.
If you'll buy a new eMMC chip most probably you'll have it reballed from the supplier. If not pre reballed, you ll need to reball it using a reballing stencil and solder paste.
Finally align back the eMMC chip over the board in the correct way, always note where is pin A1 and solder it back by ramping up heat again, same process as removing the chip.
The last process is all based on software, basically you'll have to copy the bootloader from a good working S3 phone to this one, as the new eMMC chip is empty of data, and obviously without the bootloader so the phone wouldn't be able to switch on.There is a process somewhere on the net how this is exactly done.
Ryan
Ryan,
Thanks a million for setting me on the right path. I'll let you know what happens.
Yiannos
Data recovery - Siemens A31
Hello everyone,
this thread seems to be what I've been looking for. My Siemens A31 got some water from a torrential rain while it was on. When I got to removing the battery, the phone was already off. I dried all accessible parts but I did not have the necessary torx screwdriver, so some water stayed inside. It was Friday evening and I got the screwdriver no earlier than on Monday. There was some corrosion in the phone, of course. It could not be turned on and subsequent cleaning with alcohol and even ultrasound improved only the look of the main board, but not its behavior. The only sign of life was that it seemingly recharged the battery while connected to the charger.
I have asked several repair services and people and I am quite confused whether it is possible to recover the data by soldering the memory chip into another A31, a functioning one of course. Last time, I asked a laptop service and I was told it is impossible, not just because of the difficulty of soldering a BGA chip. They told me it would not work because the phone would get blocked due to IMEI mismatch! This was surprising for me. If it is true, it implies that the IMEI is stored in both the flash memory and some other chip. I was unable to find any evidence for such a claim on the Internet.
Can anyone tell me if the target phone with replaced flash memory will actually work, assuming the memory is functioning? The video referred to by yiannos50 suggests it may really work. Anyone else has tried it? Two people in this discussion were about to do so.
Related
I bought the HTC HD2 when it first came out and i absolutely loved it!! however I had to get rid of it because I needed the money for an emergency. however I just came upon someone who was selling the HTC HD2 for a reasonable price. and I bought it in a rush because I have missed the phone and wanted to get started playing on it right away!!
BUTT
It doesnt work.. im guessing its water damaged because whoever sold it to me took out all the water damage stickers. So.. heres what happens. When i plug it into the charger. The Flash comes on for about 5 seconds and either the buttons light up or the phone vibrates until i take out the battery.
I know I was stupid for buying the phone without checking it. So flame flame flame ALL you want. I just want this fixed!!
btw. The guy i bought it for wont answer his phone so just screw it.
thanks
Oh wow. im noob.. I havent been on here for so long that i forgot the rules of the forum!! could someone help me re-title or just delete post? once again. i apologize.
Ok first just click on the edit button at the bottom of any post of yours to edit it. To edit the title just click edit on your first post and then click advanced and then you can edit the title.
As for your problem can you get to the red, blue, green, and white booloader screen by holding the volume down button down and while you power your HD2 on?
If you can get to bootloader then flashing might help buit it really sounds more like a hardware problem.
Check your battery pins and make sure none of them are slightly bent. Also very very lightly wiggle each pin just a little then try to boot the phone.
If you can not get to the bootloader or even get it to the first splash screen, and by that I pretty much mean get it to even light up the sceen showing it did turn on then it is bricked.
Post back with the results as I can put you in touch with someone to JTAG it if it is bricked.
Thank you so much!!
No.. the screen actually doesnt not light on or anything.
I have noticed the the battery pins were slightly bent and when i wiggled it a little and then put the battery back on Its started vibrating but the screen still doesnt light up
I sent you a PM with info on who to talk to about JTAG. Soprry someone sold you a bricked HD2.
if it's really water damage, then i don't think it's jtag fixable.
jtag is being used when you have a corrupt bootloader that cannot start the phone. The bootloader resides at the beginning of the nand memory, after something called steppingstone (a small - about 4kb portion of memory that is loaded into ram memory and then executes the bootloader program).
So when you use jtag, you invoke another thing, called watchdog, a CPU function, that once invoked, will halt loading the steppingstone into ram memory. Once this is done, the phone will remain in "service mode" until the next restart. With jtag, you can load the bootloader back into nand memory at it's corresponding address and then normally flash the phone.
But, jtag requires you have a working cpu, ram and nand memory because basically jtag does at a more "lower level" what you do when you flash the phone. If your hd2 suffered some water damage, i doubt (based on what you say it's been doing since you tried to start it) that it can simply be restored by jtag.
The phone should first be disassembled and it's motherboard be cleaned by a powerful solvent in a ultrasonic cleaner. If the phone was dropped in a salty or sugary kind of liquid, although the water in it will evaporate, the salt/sugar will dry up and remain in crystal state among the pins or connectors of the motherboard. Both salt/sugar are electrically conductors so the phone's normal operations will be affected by various short circuits between pins or such stuff. If you're lucky, cleaning will solve the problem, if not.. the motherboard could be damaged physically because of those short circuits.
facdemol said:
if it's really water damage, then i don't think it's jtag fixable.
jtag is being used when you have a corrupt bootloader that cannot start the phone. The bootloader resides at the beginning of the nand memory, after something called steppingstone (a small - about 4kb portion of memory that is loaded into ram memory and then executes the bootloader program).
So when you use jtag, you invoke another thing, called watchdog, a CPU function, that once invoked, will halt loading the steppingstone into ram memory. Once this is done, the phone will remain in "service mode" until the next restart. With jtag, you can load the bootloader back into nand memory at it's corresponding address and then normally flash the phone.
But, jtag requires you have a working cpu, ram and nand memory because basically jtag does at a more "lower level" what you do when you flash the phone. If your hd2 suffered some water damage, i doubt (based on what you say it's been doing since you tried to start it) that it can simply be restored by jtag.
The phone should first be disassembled and it's motherboard be cleaned by a powerful solvent in a ultrasonic cleaner. If the phone was dropped in a salty or sugary kind of liquid, although the water in it will evaporate, the salt/sugar will dry up and remain in crystal state among the pins or connectors of the motherboard. Both salt/sugar are electrically conductors so the phone's normal operations will be affected by various short circuits between pins or such stuff. If you're lucky, cleaning will solve the problem, if not.. the motherboard could be damaged physically because of those short circuits.
Click to expand...
Click to collapse
Thanks for that great explanation facdemol! I have never JTAGed a device before so I did not know about the Watchdog fuction. I also did not know about the Steppingstone I thought the IPL loaded the SPL which is pretty much the what bootloader is, I know it is more to it then that but that is just to generalize it. Or is the IPL what you are callin g Steppingstone?
Anywqay you are probably right about if it is truly from water or some other liquid damage. But since the OP is not 100% sure that is the cause I would suggest trying JTAG first and if that does not work then just replace the the main board cause not everybody is as good at DIY as you are man.
Before you start on actually modifying your hardware, you must know what it is you're after. Don't just go using your finely tuned soldering iron without doing some research first... http://twitpic.com/75maxq
I wanted to share some tricks I use when locating UnBrickable Mod on various devices because it has been requested many times. Overall, the methods I'm going to talk about can be called "reverse engineering", "hacking", or "circuit bending".
Each device is different so different methods may be used. I'll start with what I feel is the best method to use and move my way on through less accurate and more destructive/difficult methods. The methods I'm using here can be used on nearly ANY device for nearly ANY purpose, not just locating boot modes. Using the techniques I'm laying out here, you can locate any physical memory register on any chip.
For the purposes of this familiarization guide, we will be locating the xOM5 resistor which changes the S5PC110 boot mode from "boot from OneNAND" to "Boot from USB, then OneNAND". Other modes are available such as booting from SDCard or MMC but these modes do not allow dual booting into the standard OneNAND boot so they are not practical unless you have a NAND failure.
By reading the S5PC110 processor manual, we can see on page 6-8, this is achieved by setting the xOM bits to 101001 (hex value 29). These binary values correspond to pins on the processor. These pins can be set high or low, and they ARE set high and low on the development board for the S5PC110 development boards. On other processors like OMAP4460, or Exynos, different pins are used but the functionality is the same.
All binaries and reading materials used are availabe in the GalaxyS hack pack: http://forum.xda-developers.com/showthread.php?t=1111866
For installation of binaries, you can use the market app "mount rw/ro" and drop the binaries in your /system/bin folder. See here for more information on direct access to Linux and installing binaries: http://forum.xda-developers.com/showthread.php?t=1030107
For the purposes of this thread we will be using a S5PC110 chip which is what the entire GalaxyS series of device is based upon.
With this knolwedge in hand, lets continue into HOW we can locate these pins.
how to locate the xOM resistor cluster
If you orient the S5PC110 processor with the PIN-0 dot at the lower left corner, you will find the xOM cluster at the lower right corner. These resistors will always be near this location because the pins on the board are near this location. It's never a good idea to have "runs" on a board longer than necessary. Therefore, these resistors will always be near this corner.
NOTE: You need not remove the processor. This is only for illustration.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
For other devices, see the pinouts on the processor manual.
Methods for locating modificaton
Monitoring memory locations in real-time
You will need:
viewmem installed in /system/bin
bash installed in /system/bin
Market App: QuickSSHD allows you to terminal into the device.
1. we locate the xOM registers on the device. According to the processor manual
OM_STAT 0xE010_E100 R OM status register 0x0000_0000
Click to expand...
Click to collapse
the OM registers are at 0xE010E100. So we know where to look in memory to monitor changes.
2. ssh into your device. See QuickSSHD for more information. Once you are in, assume super-user, get into a bash terminal, and use the viewmem utility.
Code:
$ su
# bash
bash-4.1#viewmem 0xE010E100 0x4|hexdump
[INFO] Reading 4 bytes at 0xe010e100...
0000000 0009 0000
0000004
3. Short and test. While shorting the high value to the active side, NOT THE VISIBLY GROUNDED SIDE, monitor output from the terminal.
The PullUp resistors are 10Kohm and the Pulldown resistors are 100Kohm. This means there's 10x more force behind a digital high than a digital low, in other words, you can short any low value high without a problem...
Code:
viewmem 0xE010E100 0x4|hexdump
[INFO] Reading 4 bytes at 0xe010e100...
0000000 0029 0000
0000004
the 29 signifies that the device is modded properly. A value of 0x9 is a standard production device. When you see 0029, you've located the proper resistor for the modification.
Using overlays
Take a picture of the board, then use an annotated pinout to locate the proper pins on the processor. This allows for a visual of the device as though the processor were removed.
here's a picture of my own annotated overlay. Use this and we'll walk through overlay logic.
Now, with a xOM value of 0x9, that's a binary value of 001001, use your calculator in "programmer" or "scientiffic" mode if you don't believe me.
Broken Down:
xOM5=0
xOM4=0
xOM3=1
xOM2=0
xOM1=0
xOM0=1
xOM 3 and 1 are both high values, all the rest are low. We can use this to our advantage. We can see that 4 resistors are connected to ground on one side and 2 are not. Those two are obviously xOM3 and xOM1.
If we look at the processor pinout, we can see that if xOM3 and xOM1 resistors were swapped, one would be very much longer than the other so there's only one logical solution.
Moving on to the shortest ones, xOM4 and xOM2 would obviously be closest to the top of the resistor cluster, and it's also obvious wich one would be which.
Now that leaves two resistors in the middle. One is high and one is low. by drawing it out you can see that if xOM5 were on the right, then xOM1 would be very much longer than xOM5, so xOM5 must be on the left.
So, we've located all xOM values with this method.
Using relative positioning
This method is not nearly as scientiffic... Since there are now 10 guides made for modifying xOM5 on different boards, a resistor may be picked and chosen as though it were from anothe board. See here for various modifications: http://forum.xda-developers.com/showthread.php?t=1236273
Verification from this method may be made using UART. you would be expecting an output like this over the UART on your device.
See here for info on UART: http://forum.xda-developers.com/showthread.php?t=1235219
If the modification was sucessful, UART will output a line which states OM=0x29.
Using a multimeter
You can remove the processor from a device and trace out the pins manually. This method is only appropriate for a broken device.
conclusion
So, these are my methods for hacking hardware and making it do what I want. I'd like to hear others. Lets hack up some hardware and talk about it here.
+1
Good that every chip component is configureable on lowest level by set of external passive elements - opens big possibilities to change any hardware into something different.
Worth to add - always think twice, or even once more before short circuiting anything. If between some V line and another there is positive voltage, like +1V, it still doesn't mean that second one is GND. First one can be +2V and second one +1V. READ carefully all datasheets and documentation. Don't connect any power line straight to another without resistor - this will cause high current go through some component and probably damage it.
Example of bad test - there are some capacitors on the left of Adam's needle when testing resistor. It's highly possible that these capacitors are ARM_CORE stabilisers, which is 1.2V and can handle up to about 1.4V. Adam is operating with 1.8 or 2.8V from other V line - accidentally touching the capacitor with needle can damage CPU core.
If you never been doing any hardware mods but feels like you want to start - prepare for some victims in your electronic devices. That's all of my experiences for now.
//Damn me and my bad habit of reserving posts in Adam's thread. Sorry. :d
very informative
Excellent and authoritative article! Though I'm personally too scared to do anything like this on my phone!
I've gotten replies from people that removing a BGA chip is almost impossible. A tutorial on how to unsolder one would be helpful for aspiring hardware hackers.
Master Melab said:
I've gotten replies from people that removing a BGA chip is almost impossible. A tutorial on how to unsolder one would be helpful for aspiring hardware hackers.
Click to expand...
Click to collapse
It IS almost impossible. It's rediculously difficult. You'll end up pulling a pad or two off the board. You must heat up the entire chip with a heat gun or a hot air station, then pull it off... Meaning you're heating up the entire chip to the point where the solder melts. It takes a multi-thousand dollar professional setup in order to make sure no damage is done. I use a digital temperature controlled heat gun. It works, but it's not accurate.
If you could replace the pads with a socket or something like that you'll be set to go.
we need to get you a better camera
elmanortega said:
we need to get you a better camera
Click to expand...
Click to collapse
HAHHAHHAHHA. funny story about that...
You see, my 6 year old tried to do unbrickable mod on that today..
I no longer have a dedicated camera
I wish i could try it, but i am sure i wont be able to, lol
Thank you very much for this guide.
Could you also describe what tools (soldering iron etc) do you use?
I use a Radio Shack digital soldering iron. It's nothing special but it's temperature controlled and has a fine point.
I made some more overlays
here is Exynos4210
This is from OMAP 4460, but I'm pretty sure it applies to OMAP 4430 as well
verry intresting, soon i try
Seriously this guys work is awsome, learnt quite abit from your work, thank you very much!
Sent from my Desire HD using XDA App
cdesai said:
I wish i could try it, but i am sure i wont be able to, lol
Click to expand...
Click to collapse
Same here but why dont giveit a try... just encourage
AdamOutler said:
... It takes a multi-thousand dollar professional setup in order to make sure no damage is done. I use a digital temperature controlled heat gun. It works, but it's not accurate.
Click to expand...
Click to collapse
Sorry Adam, you have a great writeup, but this is really a BS statement!
-- You can easily unsolder a BGA chip with a $5 micro-blow-torch! You just have to make sure you shield the surrounding components from the excessive heat. Put a small piece of copper (a penny?) on top of the chip, then put a piece of low-temperature (lead-free) solder on top of the coin, so you can get an idea when you have enough heat. Continue 10-20 seconds. Very carefully try to jam a few sharp toothpicks under any space between chip and PCB. Never bend!
This technique is well known and well demonstrated on YouTube, ever since the HP/Nvidia scandal of video chips falling of the MOBO after dust blocking the fan intake with (purposely) under-dimensioned and faulty heat-sink design.
The problem is getting it back ON! Then you need to invest in a professional heat plate and re-balling grid.
excuse me mister, i have done it, n my tab turn back on, now i have another problem, the screen is black and the bottom light is on, could you help me?
^^ good idea! I've always used a high power and small heat gun. It works for 99% of the pads, but I always lose 1 or 2. I never intend to put them back on.
apram75 said:
excuse me mister, i have done it, n my tab turn back on, now i have another problem, the screen is black and the bottom light is on, could you help me?
Click to expand...
Click to collapse
This is the wrong place to post that. And it does not really make sense that you did this in context.
Unsoldering a BGA is easy.
Doing it without causing unrecoverable damage is a different story. Same for resoldering it back on.
However it is getting easier nowadays - temp-controlled hot air rework stations have dropped drastically in price - http://www.amazon.com/Updated-Aoyue-Digital-Soldering-absorber/dp/B006FA481G/ref=pd_cp_hi_3
Also, reflowing a BGA without removing it (such as for Xbox360 RRoD fixes) is a LOT easier than remove-and-replace.
Also - my personal favorite deal in terms of soldering irons is http://www.amazon.com/Aoyue-937-Dig...ref=sr_1_1?s=hi&ie=UTF8&qid=1331244730&sr=1-1 - The Aoyue 937 is amazing considering it is <$50.
Hi guys!I'm not sure that I'm posting this threat in the right section, but i didn't find any other related to hardware.
I have a little problem with my galaxy s2....it overheats - a lot.After trying all official roms from 2.3.5 to 4.1.2 i know that it's a hardware issue.I gave it to a local service repair centre and they told me that the "power managment chip" has bursted and the damage is beyond rapair,but the phone charges up normally and I am able to use it.....probably they are wrong;
So I have a second galaxy which I can use as a donor, could you tell me where is this "power managment chip" located?Also, is the CPU built into the motherboard or it is just "plugged into" and can be "plugged out" ?Perhaps i should try changing the cpu first and see if the heating stops..........or directly replace the whole motherboard...?
I am attaching a pic of my phone with detailed explanation of my problem; PLS post your opinions!
umex said:
...I gave it to a local service repair centre and they told me that the "power managment chip" has bursted and the damage is beyond rapair,but the phone charges up normally and I am able to use it.....probably they are wrong;
So I have a second galaxy which I can use as a donor, could you tell me where is this "power managment chip" located?Also, is the CPU built into the motherboard or it is just "plugged into" and can be "plugged out" ?Perhaps i should try changing the cpu first and see if the heating stops..........or directly replace the whole motherboard...?
I am attaching a pic of my phone with detailed explanation of my problem; PLS post your opinions!
Click to expand...
Click to collapse
My opinions. Power management chips typically control charging and voltage regulation for other components and the system. The CPU (and I'd suppose most integrated circuits (ICs) on the board seem to be SMD (surface mounted device) type components, they look like BGAs (ball grid arrays). They are flow soldered on the board and the solder joints are located underneath the chips. So, manually resoldering them is .. well ... impossible? The solder bumps are between the chip's underside and board top side You can imagine that for manual re-solder, taking into consideration the scale of the components.
When service shops fix phones, if they need to, I suppose mostly they just replace the whole phone as it is easier. If they indeed do repair, the change whole modules, like mother board as one part. Even then it is difficult to find all the small connectors and loose them and re-insert the new mb.
My take on this would depend on the scale of heating. If you feel like wanting to try a repair, first identify exactly which IC is heating up too much. Then proceed from there. Due to small scale of things, even such analysis is total PITA But you wanted to, I understood.
Finally, I would simply buy a new phone or put up with heating. In latter case, take care when charging and otherwise, never to leave your phone unattended as it may in the worst case catch fire.
tapiov said:
My opinions. Power management chips typically control charging and voltage regulation for other components and the system. The CPU (and I'd suppose most integrated circuits (ICs) on the board seem to be SMD (surface mounted device) type components, they look like BGAs (ball grid arrays). They are flow soldered on the board and the solder joints are located underneath the chips. So, manually resoldering them is .. well ... impossible? The solder bumps are between the chip's underside and board top side You can imagine that for manual re-solder, taking into consideration the scale of the components.
When service shops fix phones, if they need to, I suppose mostly they just replace the whole phone as it is easier. If they indeed do repair, the change whole modules, like mother board as one part. Even then it is difficult to find all the small connectors and loose them and re-insert the new mb.
My take on this would depend on the scale of heating. If you feel like wanting to try a repair, first identify exactly which IC is heating up too much. Then proceed from there. Due to small scale of things, even such analysis is total PITA But you wanted to, I understood.
Finally, I would simply buy a new phone or put up with heating. In latter case, take care when charging and otherwise, never to leave your phone unattended as it may in the worst case catch fire.
Click to expand...
Click to collapse
Right.....so if I replace the whole motheboard with the one from the other device, it should boot up, right?It's exactly the same phone, but with broken screen
umex said:
Right.....so if I replace the whole motheboard with the one from the other device, it should boot up, right?It's exactly the same phone, but with broken screen
Click to expand...
Click to collapse
You can test it, yes, and I suppose there's good possibility that it will boot. But there's bigger possibility that you fail to change it correctly, missing a connector, breaking a fragile part etc. But sure, go ahead and try. Tell us how you managed, possibly take close-up photos of the process so that others can follow it. Or at least make a example how not to do things
Ok so ive had this acer iconia a500 (stock no root) and one day it borked itself, now i have read every guide on here and tried everything from EUU to Apxflash tool to barbedsector to tdv4 and realized I had a bad nand after getting an error from barbedsector, now most of you know nvidia is forever releasing **** with bad/cold solder joints so, I said what the hell! why not reflow this ****er and give it a try its already trash.
So this is what I did to fix the bad nand, first off take mainboard out of the unit, pop off the cover on the gpu and nand chip off, now wrap everything else in foil except the area I said to pop the can cover off of, preheat your oven to 400 F, once oven is preheated use a baking sheet pan with 4 foil balls to keep MB off the tray. now place your baking sheet pan with MB in the oven and set your timer for 5min exactly (no more than 5min) when timer goes off pull pan out the oven and with a flat head screw driver (or something not plastic) gently press down the gpu, memory and nand chips and then set it off to the side for about 10min or until the whole board is cold, now once cold put it all back together and attempt your recoveries (I myself just turned it on and it booted past the dreaded acer screen instantly (your time may differ)
This should work for most that have had their tablet drop dead out of nowhere, and for the record if the nands were totally bad they would never have passed the testing stage at acer before hitting the shelves which is what led me to believe it was a cold solder prob, thanks NVIDIA I love fixing your ****! ALSO BTW I use this procedure to fix Laptops, Ps3s, Xbox 360s and multiple electronics that have heating issues!
Hope this helps you guys out! if it does hit my thank you button cause not one person replied to my first threat about the tablet being borked!
i´d like to bake the errors away, too
Hello
thanks for your guide, it would be very facinating to solve my problem in a similar way.
in this thread, i described my error incl. two pics.
is one of the errors a similar to yours?
i would like to be sure its really broken hardware before having mainboard-cake on sunday afternoon.
thx for a reply
kreike
i cant believe it, but it worked
i couldn´t wait as it was trash in any other way, as you already explained.
many thanks again and again and once more... for this idea.
after the operation, i had no error flashing, babsector created new partitions without any remarks (see attched pic).
to your guide, i would like to add following / explain how i did it:
- better remove camera from the board
- the area to take away the can is on the lower side after opening
- i pushed - gently as adviced - with the big and of a pencil, just to get resistance
- i put the oven on 210 Celsius, a little more tha adviced,
- the lower side, the left an right part were packed into 2 layers of foil
- make sure, you can insert the sd-card properly again...
worked on my second device, too
I am going to try this this weekend! Might as well since my tablet is already bricked. I've figured the memory chip just got corrupted somehow, but if it's just the solder and a nice toasty bake can fix it, I will be super stoked!
I'll let you know how it turns out next week.
Thank you, finally something that worx!
After having tried, (like many others with me) almost anything i could find on google and forums about the fixing of this A500-headache machine, Finally this one worked for me!!! But after 1 day of full functioning A500 I guess the solder-joint got cold again though, and it stopped functioning again. tried it 2 more times and and now fully functional device again!!! Same as with the older xbox360...Thanx again.
Kinda Worked
I tried this technique and it allowed me to boot into APX, run babsector and get it to pass!! I was so excited. It then actually rebooted into recovery. I then tried to flash A ROM back onto the device, and ended up right where I had started. Stuck on the Android logo.
Tried to run babsector again and it just failed like it used to. I tried baking the MB again, with no luck. Not sure if I should just try it again and again until it does work, or if this MB is just shot.
Photos?
Anyone have any photos of the foiled up motherboard? It would help a lot in knowing what's where. I'm going to try this as soon as I can. Thanks!
I appreciate if you could attach some photos or video. I would like to try this one as soon as i have some pics to teach me how to do it.
Thanks.
---------- Post added at 04:40 PM ---------- Previous post was at 04:27 PM ----------
darkeskye said:
Ok so ive had this acer iconia a500 (stock no root) and one day it borked itself, now i have read every guide on here and tried everything from EUU to Apxflash tool to barbedsector to tdv4 and realized I had a bad nand after getting an error from barbedsector, now most of you know nvidia is forever releasing **** with bad/cold solder joints so, I said what the hell! why not reflow this ****er and give it a try its already trash.
So this is what I did to fix the bad nand, first off take mainboard out of the unit, pop off the cover on the gpu and nand chip off, now wrap everything else in foil except the area I said to pop the can cover off of, preheat your oven to 400 F, once oven is preheated use a baking sheet pan with 4 foil balls to keep MB off the tray. now place your baking sheet pan with MB in the oven and set your timer for 5min exactly (no more than 5min) when timer goes off pull pan out the oven and with a flat head screw driver (or something not plastic) gently press down the gpu, memory and nand chips and then set it off to the side for about 10min or until the whole board is cold, now once cold put it all back together and attempt your recoveries (I myself just turned it on and it booted past the dreaded acer screen instantly (your time may differ)
This should work for most that have had their tablet drop dead out of nowhere, and for the record if the nands were totally bad they would never have passed the testing stage at acer before hitting the shelves which is what led me to believe it was a cold solder prob, thanks NVIDIA I love fixing your ****! ALSO BTW I use this procedure to fix Laptops, Ps3s, Xbox 360s and multiple electronics that have heating issues!
Hope this helps you guys out! if it does hit my thank you button cause not one person replied to my first threat about the tablet being borked!
Click to expand...
Click to collapse
Hi,
If you don't mind can you please send me a video or photos that which parts need to be wrap in foil and place in oven? I appreciate if you could send me as soon as possible. I am now frustrated after using all tricks and none of them worked out.
Thanks.
Tried this...sadly didn't work. Tried it again for 10 minutes, again, no luck. I have always liked Acer, but after this, and seeing how many people have this issue, and other issues related to Acer products, you can bet they'll go on my 'do not buy' list.
Glad I only paid $20 for the tablet (had a charging issue that I repaired)
Well, after my bootloader "Blob Update Failed", and no other method of unbricking it, I used this as a last resort.
It worked!!!
For Europeans, set the oven to about 200/205 C. Used a pencil eraser to press down immediately after removing from oven. Not quite sure which exact chips to press down on, so I did all available!
Only bad thing, I broke the rear facing camera (not important anyhow).
it worked for me
I took out my MB to a nearby repair man. he blew heat gun over the NAND chip and it worked!! everything is back to normal without any data loss. thanks a lot
Where is the NAND chip located on the motherboard?
farhanalisyed said:
I took out my MB to a nearby repair man. he blew heat gun over the NAND chip and it worked!! everything is back to normal without any data loss. thanks a lot
Click to expand...
Click to collapse
but which is the nand chip ? PHOTO?
Where is the NAND chip?
Bump, where is the NAND chip?
Can someone take a photo or just explain where it is?
I'm having the usual problem, stuck on Acer logo, drivers wont install, no cpuid, update.zip doesn't work (android guy on its back with every ROM i've tried)
And here's a photo of the motherboard
search google for "gorbachev teardowns acer" for the disassembly process with more photos (can't post links yet)
can someone who knows just put a dot on this image where the NAND chip is?
Thank you for your time
loicloicloicloic said:
Bump, where is the NAND chip?
Can someone take a photo or just explain where it is?
I'm having the usual problem, stuck on Acer logo, drivers wont install, no cpuid, update.zip doesn't work (android guy on its back with every ROM i've tried)
And here's a photo of the motherboard
search google for "gorbachev teardowns acer" for the disassembly process with more photos (can't post links yet)
can someone who knows just put a dot on this image where the NAND chip is?
Thank you for your time
Click to expand...
Click to collapse
It's on the other side, you should search for the "Sandisk" logo on the chip...
Great info...!!!
Thanks a million, darkeskye.
May using a heat-gun would be safer than the oven...
Done it !!!
Hi, just wanted to let everyone know that I fixed my A500 aswell using the NAND reflow.
I had occasional bugs with Civato's Re-Flexx ROM, so decided to start with a fresh install and when i entered the recovery had a fatal breakdown.
After many unsuccessful APX flashes, I decided to try the memory chip and found a fix described on http baheyeldin com.
He describes the same aluminum foil method, but a comment made by "IT-Betreuung" is even better:
"With a soldering iron and a 1 EURO Cent piece it is also possible.
I had no heat gun to hand,so I have been thinking about alternatives and it is even easier without the aluminum foil packaging.
Simply put the Cent on the chip and a small piece of solder on it, then heat the Cent with a "strong" soldering iron, until the solder melted
and further heat for approximately 20 - 30 seconds.
Regards IT-Betreuung"
No foil, no oven, no risk, no mess.
Thanks.
Heating the owen !
hello guys!
:silly: as I said ,.. heating the owen right now. Have made photos ,.. i will upload them later ... wish me luck! ( this is crazy !)
,.. i am thinking now,.. maybe some bread for tommorow morning ? :lol:
Hello Everybody,.. finally my owen could not reach sufficient temperature to melt joints ( i have made test with a piece of joint in the owen )
so i ve borrowed a hot air gun,.. IT WORKS!
My beloved a500 works,.. and you know what ? no new rom needed, no partitions formatting ,.. nothing.
Everything works like nothing happened to it
-----
I have used all the information placed on this thread,.. location of the memory chip ,.. ( on the bottom side ) in my case it is samsung 16gb
Take of back camera from the mainboard to protect it. I have protected all the manboard with aluminium ( for the owen ) leaving only and the only memory chip visible ( for the heat gun ) and i have shoot from like 20cm above the board directly on the chip with a small piece of stain on it.
As the piece started to melt and it gets a ball shape,..I have pressed the chip with a knife and i have maintained it pressioned a second or two and took the gun offside ( becarefull as all the mainboard gets very hot )
Firstly I have asembled without camera, without mainboard cans , no mic no nothing only the essentianls.
Now i have to disassemble it one more time and put all together!
truely ,... it was very emotive experience :LOL
it seems that i am not allowed to put images yet...so
pixel2_es/download/a500_jpg (_=.)
,... thank you all for helping in this thread!
bvmerang said:
Hello Everybody,.. finally my owen could not reach sufficient temperature to melt joints ( i have made test with a piece of joint in the owen )
so i ve borrowed a hot air gun,.. IT WORKS!
My beloved a500 works,.. and you know what ? no new rom needed, no partitions formatting ,.. nothing.
Everything works like nothing happened to it
-----
I have used all the information placed on this thread,.. location of the memory chip ,.. ( on the bottom side ) in my case it is samsung 16gb
Take of back camera from the mainboard to protect it. I have protected all the manboard with aluminium ( for the owen ) leaving only and the only memory chip visible ( for the heat gun ) and i have shoot from like 20cm above the board directly on the chip with a small piece of stain on it.
As the piece started to melt and it gets a ball shape,..I have pressed the chip with a knife and i have maintained it pressioned a second or two and took the gun offside ( becarefull as all the mainboard gets very hot )
Firstly I have asembled without camera, without mainboard cans , no mic no nothing only the essentianls.
Now i have to disassemble it one more time and put all together!
truely ,... it was very emotive experience :LOL
it seems that i am not allowed to put images yet...so
pixel2_es/download/a500_jpg (_=.)
,... thank you all for helping in this thread!
Click to expand...
Click to collapse
I just got the hot air gun from amazon. I have disassembled the TAB but wondering how did you remove the metal cover which is on top of the Chip. Can i Heat it over the metal cover and press the cover itself.
My phone display came off with that golden bus like wire slightly attached to the port board( half of it is disconnected). What are all things now I have to replace to make my phone up and running properly? should i replace entire display or is there a way to replace that bus like wire alone and get it running... pls suggest if u have any idea on this.. hate to spend more as i already spent a bit much on this phone. pls lemme know the repair cost too
What is damaged, the micro connector on the display or just the ribbon cable and/or it's connector?
blackhawk said:
What is damaged, the micro connector on the display or just the ribbon cable and/or it's connector?
Click to expand...
Click to collapse
think microconnector is intact. ribbon cable is broken in the nearby charging port board
Replace all damaged components.
Understand the mobo may be damaged as well.
High G loads and direct impact can damage chipsets, solder bonds and external/internal PCB traces. Batteries are also intolerant of physical insults.
Best to always use a good case.
blackhawk said:
Replace all damaged components.
Understand the mobo may be damaged as well.
High G loads and direct impact can damage chipsets, solder bonds and external/internal PCB traces. Batteries are also intolerant of physical insults.
Best to always use a good case.
Click to expand...
Click to collapse
is there a way to backup all my data safely? as my display is not functioning i am finding it difficult to switch to recovery mode. i have set fingerprint and it asks for password after reboot
There may be but I don't know it well enough to be of help.
Setting passwords on bios, devices and encrypting data always ends up causing trouble, I don't. You end up getting locked out many times because of a hardware failure causing corruption.
I redundantly backup all critical data... I learned that the hard way. I may lose a small fraction of data but never all. I archive data on hdds like a squirrel does nuts.
blackhawk said:
There may be but I don't know it well enough to be of help.
Setting passwords on bios, devices and encrypting data always ends up causing trouble, I don't. You end up getting locked out many times because of a hardware failure causing corruption.
I redundantly backup all critical data... I learned that the hard way. I may lose a small fraction of data but never all. I archive data on hdds like a squirrel does nuts.
Click to expand...
Click to collapse
luckily i just replaced with a duplicate display and other mobile parts are intact and now my phone is running just fine.have to backup..first thing .thanks
Yay! Well done.