TSOP-48 NAND one end covered in black epoxy - Page 1
Forum section: electronics / repair

author: guho
author_rank: Contributor
timestamp: April 27, 2025, 09:51:34 pm
content: My Sony Blu-ray changer BDP-CX7000ES occasionally gives error E-9104. According to the service manual, if it persists after a factory reset, the NAND needs to be replaced. It's 2Gbit Hynix NAND, and I already have the replacement chip (TSOP-48).The issue I am facing is that one end of the chip is covered in black epoxy. See the photo. When I touch this with my hot soldering iron, it does not melt at all. So I know it is not resin.I would like to desolder the chip so I can put it in my MiniPro TL866ii Plus and copy its contents to the new NAND. How do I accomplish this without destroying anything? As you can see this board has NOR (4MBit) right next to the NAND and I am not even sure whether the firmware lives in the NOR or the NAND. The NAND has an 8-bit wide data bus to the controller, the NOR 16 bits. But the NOR seems too small to contain the firmware. So I am not confident the device will start when I remove the current NAND in a destructive fashion and replace it with an empty NAND. Hence my desire to desolder the NAND whole so it can be copied. Thanks for any advice you can give me.

author: tom66
author_rank: Super Contributor
timestamp: April 27, 2025, 10:16:19 pm
content: My guess is the resin is there as some kind of cryptographic information is stored on the flash devices. There is no other good reason I can think of to do this: Blu-Ray relies upon a number of confidential keys for decryption to function (most of which have been leaked since, but nonetheless, manufacturers are still required to keep these secret.) So replacing it with a blank is likely to not work. You would need to try some kind of chemical attack or very carefully dremelling away at the resin to remove it to the point where you can detach the other side of the NAND.When I worked at a certain set-top-box manufacturer, the resin was carefully selected to result in destruction to the board if an attempt to remove it was made. The idea was, you might be able to get the data off, but you couldn't reliably use it to mod units. The companies supplying the DRM were worried that if the boards were easy to modify, a grey/black market of modders would appear offering hacked set top boxes with free access to sports channels, etc.You are almost certainly correct that the NOR will not contain the important info - most likely, it contains only the bootloader(s).

author: aeg
author_rank: Regular Contributor
timestamp: April 27, 2025, 11:40:13 pm
content: You could try using a heat gun with a small nozzle to heat the epoxy and a dental pick to chip away at it. Epoxy gets crumbly when it's hot enough.

author: amyk
author_rank: Super Contributor
timestamp: April 28, 2025, 05:29:03 am
content: Do you happen to have a milling machine? That, or perhaps a dremel held carefully, could remove the bulk of that material really quickly. Then finish the rest with very localised high heat from a hot air gun.

author: voltsandjolts
author_rank: Unknown
timestamp: April 28, 2025, 02:10:52 pm
content: That's a pretty cute anti-rev-eng trick. Not a show stopper but a royal PITA.

author: wraper
author_rank: Unknown
timestamp: April 28, 2025, 02:25:36 pm
content: Quote from: voltsandjolts on April 28, 2025, 02:10:52 pmIt's easily removable by heating it with hot air and prying off. Hardly a problem for reverse engineering or repair.

author: tom66
author_rank: Super Contributor
timestamp: April 28, 2025, 02:40:34 pm
content: Quote from: wraper on April 28, 2025, 02:25:36 pmThe epoxy "we" used was designed to be high temperature stuff: the idea was you'd need a heat gun hot enough that the board would begin to delaminate before you got it off. The NAND traces would be placed on inner layers, such that destruction to the pads rendered recovery impossible. I remember one of the engineers stating that the crypto-key suppliers insisted on the traces from NAND to SoC, and SoC to the card reader IC, be placed only on the inner layers of the board, to provide resistance to attack here.That said, Sony may not have used the same epoxy and the engineers there may have just made the minimum of effort on this knowing it is ultimately pointless.

author: wraper
author_rank: Unknown
timestamp: April 28, 2025, 02:59:54 pm
content: Quote from: tom66 on April 28, 2025, 02:40:34 pmSecurity theater. Even if it was an impossibly good adhesive, easily defeated by having two PCBs and milling components on one PCB and PCB material on another, then putting intact components and PCBs together. Somewhat useful only for preventing very low effort hacking. If you're cloning multilayer PCB, very likely you'll will be CNC milling it by layer anyway.Also if it's not flip chip BGA, you can simply burn the adhesive or IC package with a few k$ laser to get access to the conductors.

author: guho
author_rank: Contributor
timestamp: April 28, 2025, 08:23:33 pm
content: Many thanks for all responses so far.It is interesting that the 8 data lines of the 2Gbit NAND are on the end not covered by epoxy, so in theory one could connect a logic analyzer to read all the data coming through. Only NAND pins 1-24 are covered by the epoxy. The 16 data lines of the 4Mbit NOR are covered by the epoxy (Pins 25-48 of the NOR are covered, the package is turned 180 degrees). Not sure what to make of this. I am confused about error message E9104. Shouldn't there be bad block management in place for the NAND? Even if some blocks go bad, perhaps some disc information will be lost but nothing crucial I would think. The small NOR is more reliable than the large NAND so perhaps all the critical Blu-ray keys are in there.The 8 NAND data lines go through two 0 ohm resistor blocks (4 resistors each). The spare IC503 area has pads for resistor blocks as well. Makes me think it is possible to solder a new NAND in the IC503 space and moving the resistor blocks over to bypass IC502. Pure speculation on my part. See attached PCB layout from the service manual. Looks like the control lines are connected between IC502 and the empty area IC503.The epoxy is really tough and does not melt or deform at all when touching it with a 380 Celsius soldering iron.

author: wraper
author_rank: Unknown
timestamp: April 29, 2025, 01:11:02 pm
content: Quote from: guho on April 28, 2025, 08:23:33 pmBecause it's not how you do it. You should heat it with hot air and peel off with dental pick or something similar. Touching with soldering iron will barely heat it. And it obviously won't melt because it's not thermoplastic.

author: tooki
author_rank: Super Contributor
timestamp: April 29, 2025, 02:14:45 pm
content: Quote from: guho on April 27, 2025, 09:51:34 pmNo, all you know is that it is asynthetic resinthat resists contact with a soldering iron.It could be epoxy, silicone, polyurethane, or any number of other polymer systems.In any case, since heating it to the point it softens or decomposes would also destroy the board, you’ll just have to resort to removing it mechanically, e.g. by scraping it away or very carefully milling it with a Dremel. Just don’t use your best tools, in case it’s a resin filled with highly abrasive filler. (I found one that uses silicon carbide for abrasion resistance!!)Quote from: wraper on April 29, 2025, 01:11:02 pmWell, if itisa resin designed for tamper-resistance, then it’s very unlikely to just peel off with hot air.

author: wraper
author_rank: Unknown
timestamp: April 29, 2025, 02:19:59 pm
content: Most likely it has nothing to do with tampering in was done for the same reason that corners or whole BGA chips are glued/underfilled in laptops and smartphones. Not to say most of those pins are exposed through uncovered resistor networks anyway.

author: tom66
author_rank: Super Contributor
timestamp: April 29, 2025, 10:24:46 pm
content: Quote from: wraper on April 28, 2025, 02:59:54 pmMaybe true. But I know they had these requirements and that we had to demonstrate quite a lot of processes were taken to protect the very important crypto keys... not that it really stopped anyone copying live TV given HDCP was totally broken after the first few years on the market, but them's the rules.I can't see why there would be adhesive in this location if it wasn't some kind of attempt to prevent data being read from these devices, and the presence in a Blu-Ray player all but confirms it for me. That said, the keys for Blu-Ray were ultimately leaked from buggy software on Windows and -not- player firmware, but I'm sure if the Windows tool didn't leak it then it wouldn't be long before someone got it out of a player anyway. There is really nothing to stop someone determined enough.I do remember that 'we' accidentally shipped thousands of set top boxes where the kernel UART was not turned off and the default password was 'root'... with that you could -very easily- get access to the decrypted MP2TS stream if you wanted to.

author: u666sa
author_rank: Frequent Contributor
timestamp: April 30, 2025, 01:26:34 am
content: You'd need MaAnt CPU glue pick or other CPU pick.https://www.aliexpress.us/item/3256805594784637.htmlNot the scalpel, because you'd cut traces. Tweezers won't do a good job either, plus you'd break your tweezers.Then you'd need a chip grinder, for example QIANLI DM360-Khttps://www.aliexpress.com/item/1005007053093793.htmlApply heat, 250C, first around the chip, you want to heat up the board, then directly onto epoxy, and dig it out. If it fails, if@tom66is correct and there is some special stuff there, just grind it off with chip grinder. But I have my doubts about needed the chip grinder, 250C and glue pick should do the job.