both eMMC and SD are extensions upon original Multimediacard standard.While you can read an eMMC like a SD, it's specification has more commands if I remember well. The method to read and write from the device is pretty much identical and that's why you can use an sd card reader to read and write the eMMC as well.
I'm sure the government could crack it in less than a minute if they wanted to.
I dont think that its posible to do that using an sd card adapter. Maybe it would be posible to comunicate with the controller directly using a serial port (or lpt one, IIRC that can do the same as an serial one)if emmc controller supports SPI mode, then you will have to connect 3DS DAT3 port to SDCARD pin 1
and try with lower level SPI communication
If the flash memory isn't detected, how do you know that the eMMC Master Controller's firmware is gone?
Did anyone ran some low level eMMC communication on it to confirm this?
I agree upon the fact that Samsung has manufacturer specific commands to update the eMMC firmware, but it's the firmware that controls the communication with the chip.
If you fubar that, it's game over. There is no such thing as a JTAG or serial console port to establish communication and restore the firmware.
Some 3ds have a Toshiba eMMC instead of a Samsung. It would really suprise me if it would use the same manufacturer commands to manipulate the firmware, unless it would contain the same samsung controller inside the housing.
Let's just say that my asumption that they might have password locked the eMMC is still an option until proven wrong.
If the flash memory isn't detected, how do you know that the eMMC Master Controller's firmware is gone?
Did anyone ran some low level eMMC communication on it to confirm this?
I agree upon the fact that Samsung has manufacturer specific commands to update the eMMC firmware, but it's the firmware that controls the communication with the chip.
If you fubar that, it's game over. There is no such thing as a JTAG or serial console port to establish communication and restore the firmware.
Some 3ds have a Toshiba eMMC instead of a Samsung. It would really suprise me if it would use the same manufacturer commands to manipulate the firmware, unless it would contain the same samsung controller inside the housing.
Let's just say that my asumption that they might have password locked the eMMC is still an option until proven wrong.
We have to reset the eMMC's pasword, but so far we dont have any ways to talk with the controller directly (some ideas would be to try with an arduino and an already made library to communicate with the controller) so we can send the erase command to itprofi2000
If you already know the aswer, why don't you help instead of playing the guessing game?
If someone here has an arduino, then we could test some stuffs on a test eMMC and maybe even unbrick a console. I talked with someone who had an arduino and if he still has it, then I can get one to test some stuffsCode:http://gbatemp.net/threads/has-anyone-with-a-brick-been-able-to-recover.360647/page-2#post-4889629
This describes the locking options of the eMMC 4.4 standard protocol.
If someone here has an arduino, then we could test some stuffs on a test eMMC and maybe even unbrick a console. I talked with someone who had an arduino and if he still has it, then I can get one to test some stuffs
I already looked into tinyFAT and its pretty ok, there are some other libraries which can send low level commands and are much smaller than tinyfatjust take care: arduinos operate on 5V logic, while the eMMC only can handle 3.3ishV -> logic level converter (or at least resistor based voltage dividers). raspberry pis use 3.3V by default.
also for anyone interested check out the tinyFAT lib, written for arduino but seems easily portable to all microcontrollers (you only need to change the GPIO handling code), got nice functions for the whole handshake stuff ("hello card, are you ok?" blablabla) and can then be used to send arbitrary commands (here its command 0x2A (always with those 42s...) with an argument 0x8, see already posted jedec standard, page 63 ff.).
edit: found an even smaller implementation that only does the force erase, written for avr: http://pastebin.com/jLXknkNk
edit the second: nice short writeup on CMD42 http://www.seanet.com/~karllunt/sdlocker2.html=
If there is people who feel confident enough and have the resources for testing this out but not a bricked 3DS to test it on.....maybe they could just try setting the lock status on a working 3DS and see if you get the same BSOD error code
Also I'm pretty sure on the old symbian Nokia phones you could lock the mmc card so you had to put the password in to unlock....but I think you could format without it if I remember correctly...maybe wiring the nand up to an old phone you could use the format option to remove the password and lock code idk tbh but just an idea but you would still need to restore the original dump afterwards this is assuming Nokia was using the same locking method on the card
Could this be of any help?
http://forum.dailymobile.net/index.php?PHPSESSID=0l6sfckmnd0576lit8rbpe5ks3&/topic,1220.0.html