Hardware Dead eMMC

[redmagejosh]

Hi guys,

So a friend of mine had posted a couple days ago regarding his switch not booting (https://gbatemp.net/threads/how-to-rebuild-nand-from-almost-nothing.571531/)
His switch is currently in a state the can RCM, can boot Hekate, SD Card works however no matter what tool is used the eMMC fails to init. I was dreading the worst and it seems I was right. I swapped the eMMC mini board out with a spare one from an old switch I had laying around. Booted into Hekate and I'm able to see the eMMC info. So my guess is his eMMC, although weird, is dead.
That being said, I'm in search of help for next steps. When I first hacked his switch I gave him his NAND backup but he lost it so there is no NAND backup, no nothing at this point and eMMC is dead so we can't read it.

I have 2 other Switch with that are mostly for spare parts, I was wondering if there is anyway to use the eMMC from one of those and make it functional on his switch? Or is his switch now just a 300$ paper weight?

Thanks in advance for any help you can provide.

 

[ferjero989]

 

[susi91]

When I first hacked his switch I gave him his NAND backup but he lost it so there is no NAND backup, no nothing at this point and eMMC is dead so we can't read it.

In case the eMMC chip itself is fine (and maybe only the board or the soldering of the chip is bad), you may be able to dump a raw-data-backup of the nand with a low voltage eMMC adapter and a bit of soldering, something like this:
https://gbatemp.net/threads/switch-hard-mod-nand-dump-with-low-voltage-emmc-adapter.553032/
but maybe use the 'dead bug' method (desoldered eMMC chip / solder wires directly to the pads).

 

[redmagejosh]

In case the eMMC chip itself is fine (and maybe only the board or the soldering of the chip is bad), you may be able to dump a raw-data-backup of the nand with a low voltage eMMC adapter and a bit of soldering, something like this:
https://gbatemp.net/threads/switch-hard-mod-nand-dump-with-low-voltage-emmc-adapter.553032/
but maybe use the 'dead bug' method (desoldered eMMC chip / solder wires directly to the pads).

Interesting... this is worth a shot. I have a rework station and some soldering skills so maybe this could be an option.

 

[susi91]

Interesting... this is worth a shot. I have a rework station and some soldering skills so maybe this could be an option.

Then, maybe try a reflow first

 

[redmagejosh]

Then, maybe try a reflow first

I thought of doing that, but I don't want to go that route first. Would like to see if there is any way to try and use a new chip on his switch but I fear this might not be possible with the tools we currently have in the community... specially cause we got no nand backup or keys.

 

[redmagejosh]

@mattytrog Do you think there is any hope other that going the hardware route? Sorry to pin you but I know you expertise in the topic could be very valuable.

 

[susi91]

specially cause we got no nand backup or keys.

Yeah, you're right. I don't know if a raw r/w access to the eMMC is useful without keys/boot0 backup, probably pointless.

Just an idea, idk, but whats about an eMMC GPT fix? Maybe only the GPT is messed up? IDK, maybe also encrypted?

Have you checked the SDcard, maybe there is a biskeydump keyfile somewhere?

 

[redmagejosh]

Yeah, you're right. I don't know if a raw r/w access to the eMMC is useful without keys/boot0 backup, probably pointless.

Just an idea, idk, but whats about an eMMC GPT fix? Maybe only the GPT is messed up? IDK, maybe also encrypted?

Have you checked the SDcard, maybe there is a biskeydump keyfile somewhere?

He found a file that is label prod.keys but not sure if it is actually that. I've got to check it.
Still, with only the prod.keys would we be able to recreate his nand into a new emmc chip?

 

[susi91]

He found a file that is label prod.keys but not sure if it is actually that. I've got to check it.
Still, with only the prod.keys would we be able to recreate his nand into a new emmc chip?

Ok, that's good.
Now, take a look here, there are blank boot0/1 variants, for people without backup:
https://gbatemp.net/threads/would-i...post-blank-boot0-1-for-repair-purposes.533830

But you need still a way to read the nand, i.e. with eMMC adapter or reflow or so
in order to get the rawnand backup.

Edit: May be that on the SDcard is another backup in this folder: atmosphere/automatic_backups. On my switch there is a file called biskeys and one file called prodinfo.

 

[LIY2012]

I've seen a failed eMMC module where one of the via corroded causing the 1.8v memory controller voltage to not reach the memory chip. Did you try checking the voltages on the chip to make sure it's getting power. There should be continuity between the yellow points and it should be 1.8v when powered on. If it's not, you could try running a jumper wire to see if you can get the data off it and then replace the module.