Hacking Has anyone with a brick been able to recover?

[Cyberdrive]

http://3dbrew.org/wiki/Hardware only lists Toshiba THGBM2G3P1FBAI8 chip; Samsung one is KLM2G1HE3F-B001 and I think it's eMMC 4.4.1
Chip itself goes for ~$10 with shipping on aliexpress, but if no software unbricking solution is found, let's hope that 3DS' 4-wire SD/MMC interface can be used to flash NAND backup to another chip, otherwise repair costs can become quite high if we include the price of a donor motherboard, let alone price of eMMC programmer.

 

[justinkb]

Well. It seems to be extremely unlikely that the eMMC registers can't be reconfigured by interfacing via the CMD line. It is were, Nintendo probably wouldn't have allowed the eMMC driver to reconfigure itself, but this is speculation.

Could still be they intentionally allowed relatively simple bricking via software to discourage homebrew. Kind of nefarious actually.

I'm sure we'll have someone who is interested enough in this issue writing a tool for it within the coming week. I haven't been bricked, but I'm looking to get into some homebrew, so I may take a look myself.

 

[krisztian1997]

anyone tried dumping their NAND after it got bricked ? if gateway only set the write protection register, then it would be still posible to read from the nand.

 

[obcd]

There is a command to disable the eMMC untill the correct passkey is entered. Why use the write protect?

 

[bkifft]

http://3dbrew.org/wiki/Hardware only lists Toshiba THGBM2G3P1FBAI8 chip; Samsung one is KLM2G1HE3F-B001 and I think it's eMMC 4.4.1
Chip itself goes for ~$10 with shipping on aliexpress, but if no software unbricking solution is found, let's hope that 3DS' 4-wire SD/MMC interface can be used to flash NAND backup to another chip, otherwise repair costs can become quite high if we include the price of a donor motherboard, let alone price of eMMC programmer.

thing is, those bga packages are a bitch to solder (cant use your trusty iron, need to use a reflow oven or a similar indirect heat source).

 

[obcd]

Gateway seems to be able to fix the brick. if all they did was just lock the device, it can be undone using the normal 6 - 8 connections that are also used to dump the nand using a sd 2 usb cardreader. The problem is that with such a device you can't control the eMMC on it's command level. The controller in the cardreader does all the low level work and makes the eMMC nand appear to it's usb host as a USB block memory device. If the device was locked, this won't happen anymore.
So, to unlock it, you need a device that communicate with the eMMC on it's CMD level. You also need the option to check the various control registers from the eMMC controller. Obviously, to unlock the device again, you will need the passkey that was used to lock the device. That secret could be hidden somewhere in the gateway code.
So, there is no need to desolder the eMMC.
If you had a previous backup of the eMMC, you could desolder the device, solder a new one in place and reprogram that new one with the backup. This would indeed be an expert job. Even with a reflow oven it's hard, as the components on the other side of the pcb might desolder as well if you start heating up. Usually an infra red heat source is used for such tasks, and all surrounding components need to be covered from the heat source. This requires some preparation. Next you need to be able to correctly position the new chip and you need to heat it up properly to resolder it. Even the cooling speed afterwards is important to prevent the corners of the chip to start to bend causing some solder balls to give a bad connection. Luckily there aren't that much balls used on the eMMC chip, but still...

 

[temp1312]

I know it might be funny but don't blame me because I am a noob.
If we can connect the NAND to a card reader and access it as a SD card, why can't we just put a real SD card to replace the NAND?
I heard that SD card also has register inside like eMMc, can a sd card just work as eMMc controller + NAND ?

 

[Cyberdrive]

God forbid, I didn't imply de- and re-soldering FBGA153 by hand or even reballing at home. I implied taking 3DS and spare parts to the nearest local repair service that works with consoles and handhelds -- every more or less populated city has at least one.
The problem, I think, is flashing NAND backup to a new chip: either you
1) buy a new motherboard, solder 4 wires, flash your backup to new mobo and ask servicemen to switch chips or
2) buy a new blank chip, ask servicemen to switch chips, solder 4 wires and flash backup to a blank chip
That's assuming that neither you nor servicemen have suitable eMMC programmer AND Gateway bricked eMMC for good.

If we can connect the NAND to a card reader and access it as a SD card, why can't we just put a real SD card to replace the NAND?

I'm no pro myself, but I'd think that in eMMC NAND is bundled with flash controller in one inseparable package and all communications with NAND must go through (now bricked) controller which is incompatible with SD card's controller.

 

[krisztian1997]

I know it might be funny but don't blame me because I am a noob.
If we can connect the NAND to a card reader and access it as a SD card, why can't we just put a real SD card to replace the NAND?
I heard that SD card also has register inside like eMMc, can a sd card just work as eMMc controller + NAND ?

Because you will have to desolder the NAND from the 3ds and solder a card instead of it. You can buy a new NAND exactly like the one from the 3ds from the internet, but desoldering it and resoldering it (reballing) takes too much work and professional reballing is not cheap.

 

[kublai]

Gateway need to change the title on their page from "Clone Blue Screen" to "All Blue Screen"

 

[temp1312]

Because you will have to desolder the NAND from the 3ds and solder a card instead of it. You can buy a new NAND exactly like the one from the 3ds from the internet, but desoldering it and resoldering it (reballing) takes too much work and professional reballing is not cheap.

Thanks , now I get it.
It would be cool if we could mount a sd card slot outside the console and switch among OS versions by changing sd card inserted.

 

[obcd]

You only need reballing if you intend to resolder the same desoldered bga chip.

A newly bought chip should have it's solder balls already attached to the chip surface.

Isn't the eMMC having it's edges sealed with some sort of glue that might make desoldering even more difficult?

While you can read an eMMC like a SD, it's specification has more commands if I remember well. The method to read and write from the device is pretty much identical and that's why you can use an sd card reader to read and write the eMMC as well.

 

[krisztian1997]

You only need reballing if you intend to resolder the same desoldered bga chip.

A newly bought chip should have it's solder balls already attached to the chip surface.

Isn't the eMMC having it's edges sealed with some sort of glue that might make desoldering even more difficult?

While you can read an eMMC like a SD, it's specification has more commands if I remember well. The method to read and write from the device is pretty much identical and that's why you can use an sd card reader to read and write the eMMC as well.

But you still have to solder those balls to the mobo, and you are right, the NAND is sealed with some sort of white glue (epoxy maybe). Also cant we use something like an arduino or raspberry to do some low level comunication with the eMMC controller ?

 

[bkifft]

Gateway seems to be able to fix the brick. if all they did was just lock the device, it can be undone using the normal 6 - 8 connections that are also used to dump the nand using a sd 2 usb cardreader. The problem is that with such a device you can't control the eMMC on it's command level. The controller in the cardreader does all the low level work and makes the eMMC nand appear to it's usb host as a USB block memory device. If the device was locked, this won't happen anymore.

thing is, ninty seems only to use those six lines (cmd, clck and the four data lines), see http://3dbrew.org/w/images/2/22/CTR_NAND_pinout_XL.jpg (which was really slow loading right now -.-), the other pins are all ground, 3.3v and 5v. (at least i saw another picture claiming that which i can't find again at the moment).

Gateway need to change the title on their page from "Clone Blue Screen" to "All Blue Screen"

50 posts till we got offtopic and the bitching started. i'm impressed.

 

[obcd]

Yes, arduino or raspberry are possible options, but you still have to create some software to emulate the protocol the eMMC is expecting.
I think the eMMC io lines are 3V3, but thinking is never wise in such case. Arduino has 5V io lines if I remeber well. Raspberry has 3V3
As I said before, A lot can be tested with a simple SD card. You can connect the eMMC if all goes well.

 

[krisztian1997]

Yes, arduino or raspberry are possible options, but you still have to create some software to emulate the protocol the eMMC is expecting.
I think the eMMC io lines are 3V3, but thinking is never wise in such case. Arduino has 5V io lines if I remeber well. Raspberry has 3V3
As I said before, A lot can be tested with a simple SD card. You can connect the eMMC if all goes well.

I dont have a bricked 3ds because mine is on 7.0 so I cant get a flash card. There are some libraries made for comunicating with the mmc using an arduino, but not sure if those also work with low-level communication (this is about what I am talking http://www.roland-riegel.de/sd-reader/index.html and theres a nice thread about setting up an arduino to communicate with an sd/mmc http://forum.arduino.cc/index.php?PHPSESSID=f72jg5pvgl7tnejseb77plhuf6&topic=8314.0 )

 

[obcd]

I don't have one either. So unless someone is willing to donate (or sell for a decent price) a bricked 3ds, I have no intention to examine this to the bone.
Even with a device I would expect to need at least a week to 14 days before any result would come out of this.

 

[olfa]

if emmc controller supports SPI mode, then you will have to connect 3DS DAT3 port to SDCARD pin 1
and try with lower level SPI communication

 

[obcd]

It supports SPI mode, but not all eMMC commands are available in that mode.

 

[Deleted User]

I don't have one either. So unless someone is willing to donate (or sell for a decent price) a bricked wiiu, I have no intention to examine this to the bone.
Even with a device I would expect to need at least a week to 14 days before any result would come out of this.

Why are you talking about wiiu in a 3ds topic?