Trying to extract data from eMMC device, but need help finding pinouts - Page 1
Forum section: electronics / beginners

author: marcosscriven
author_rank: Contributor
timestamp: May 15, 2023, 01:25:56 pm
content: I have an IoT device that seems quite well locked down - it exposes UART for a short period during boot up, before that being disabled. And while RX is wired up, the TTY seems readonly. I can't do anything with the firmware downloadable from the internet (which I had to sniff with wireshark from a PC-based bit of software). The firmware download is encrypted, and only decrypted by the device itself.So now I have the choice of the desolder or in-place attempt to read, and would like to try the latter first.The chip is this onehttps://datasheet.lcsc.com/lcsc/2008061102_Samsung-KLM4G1FETE-B041_C500273.pdf.Here's the pinout:I also took photos of the top and bottom, and aligned them in GIMP. I've attached those photos, along with one with the bottom flipped and 50% transparent.Top:Bottom:Merged top/bottom:The way the photo is oriented is a bit confusing, but the bottom-right with a dot is A1, then going vertically up the photo is 1 to 14, and going left is A to P.I therefore think the resistors on the bottom right might be DAT signals, and along the bottom power/CMD/CLK signals. There's some relatively large pads, but it's not clear what they route to.However, I'm not sure how to confirm that? I have an el-cheapo 24MHz logic analyser, but as far as this eMMC goes between 26MHz and 200MHz.I can invest in something like a DSLogic Plus, but not even sure that's enough.This guide shows how to identify the pins with an oscilloscope on page 11https://www.blackhat.com/docs/us-17/wednesday/us-17-Etemadieh-Hacking-Hardware-With-A-$10-SD-Card-Reader-wp.pdf. From the screenshot that seems to be 250 MSamples/secIn one sense desoldering seems simpler, as I can simply dead-bug it, but I've never done that.The other thing I'm not sure about, if I've correctly found the resistors attached for DAT, is which side of the resistor to get the data from.Any guidance on the approach here would be handy please - especially the main route/equipment to go with (in-place vs dead-bug)

author: LooseJunkHater
author_rank: Frequent Contributor
timestamp: May 15, 2023, 05:49:21 pm
content: This is probably way above beginners stuff lol

author: DavidAlfa
author_rank: Super Contributor
timestamp: May 15, 2023, 06:23:53 pm
content: https://www.esat.kuleuven.be/cosic/blog/dumping-and-extracting-the-spacex-starlink-user-terminal-firmware/QuoteAlso:https://www.riverloopsecurity.com/blog/2020/03/hw-101-emmc/

author: marcosscriven
author_rank: Contributor
timestamp: May 18, 2023, 06:54:36 pm
content: Quote from: LooseJunkHater on May 15, 2023, 05:49:21 pmHa! Sorry, maybe I should have chosen a different forum. I certainly feel like a beginner.

author: marcosscriven
author_rank: Contributor
timestamp: May 18, 2023, 07:01:00 pm
content: Quote from: DavidAlfa on May 15, 2023, 06:23:53 pmThanks for the links, those look perfect.In both, they seem to be using a logic analyzer (whereas I assumed an oscilloscope would be needed).In the riverloopsecurity blog, I see it's just an 8MHz sample rate, I don't see the rate on the kuleuven one.For some reason I thought you'd need way higher rates to see eMMC data/clock when these eMMC chips can support upwards of 200MHz