yashsingh1/xdaforums huggingface dataset:
[Fire TV General] sammy98:
I still read here but i also still think the pin out is not complete from the gtv hackers...

Sammy98

Gesendet von meinem Nexus 7 mit Tapatalk
[Fire TV General] tonyv2:
Hi

Thanks derpeter for taking photo soon i will summon courage to have a go myself.

Been reading the toshiba chip datasheet it is JEDEC/MMCA Version 4.41 compliant. This standard doesn't have a spi mode (older versions do) even though it has a 1 bit mode which the chip supports see http://www.linkedin.com/groups/SPI-mode-in-eMMC-Devices-37565.S.77338175.The Sandisk seems to support v 4.51 and backward compatible to 4.41 see

http://www.reactivedata.com/Product...73 eMMC 2GB and 4GB 24nm to eMMC 19nm 4GB.pdf.

Are we sure 1 bit mode of a sdcard /mmc reader is same as 1 bit mode of emmc v 4.41.

Maybe different sdcard readers have diff implimentations of 1bit mode assuming gtv hackers actually pulled off this hack. I am inclined to think they have, maximus64 who was supposed of have been involved is sparing in details.

update

Forum thread about eMMC reader VERIFIED MicroSD adapters (in 4 bit mode) http://forum.odroid.com/viewtopic.php?f=53&t=2725 these are the readers http://www.hardkernel.com/main/products/prdt_info.php?g_code=G135393511084

This sandisk datasheet http://pdf.datasheetarchive.com/indexerfiles/Datasheets-EC1/DSAQ00203957.pdf ( this datasheet is of emmc replaced by model in other firetv see first pdf this post) states 1 bit mode is default so assume starts in 1 bit and negotiates to more.

So presumably the above readers work in 1 bit mode .

Tonyv2
[Fire TV General] sammy98:
I got one of the readers for the odroid and it didnt work with the emmc of the atv

Gesendet von meinem Nexus 7 mit Tapatalk
[Fire TV General] tonyv2:
Hi

This guys sdcard reader detected the card by detecting power drawn. He successfully read emmc on vita http://yifan.lu/tag/hacking/ also he has link to jedec specs http://rere.qmqm.pl/~mirq/JESD84-A44.pdf

However this site http://www.psdevwiki.com/ps3/KLMAG2GE4A-A001#Connecting_to_reader states card detection is achieved by 50kohm resistor between vcc and dat3 of reader.

Tonyv2
[Fire TV General] derpeter:
I think we should be able to ignore the different flash chips as long as thex all support one wire emmc if we use a raspberry pi with the spi_emmc module loaded.

That should rule out problems with the sd card reader and will be my next try.

Are you argree or do i miss something?
[Fire TV General] Wa||acE:
The section below was taken from the vita blog posted above, it looks like a good theory to test and prove that the sd readers being used can switch to 1bit mode.
[Fire TV General] derpeter:
Yes i (and some other people here) did that. I have 3 reader that read a taped card just fine but not the firetv.
[Fire TV General] tonyv2:
Hi

"I think we should be able to ignore the different flash chips as long as thex all support one wire emmc "

I reckons so.

"if we use a raspberry pi with the spi_emmc module loaded"

I reckon not .No spi in emmc spec jedec 4.41 see http://www.linkedin.com/groups/SPI-mode-in-eMMC-Devices-37565.S.77338175

Raspberry PI Compute Module has 4Gbyte eMMC Flash on-board

which i think is controlled through the same circuitry as sdcard controller. Doesn't seem straight forward i could be wrong.

Could be card detect problem see below

Could try one of the sdcard adapters mentioned in odroid forum thread http://forum.odroid.com/viewtopic.php?f=53&t=2725 though sammy98 reports no success with one of them maybe its a card detect problem:-

Could try one the two ways of fooling card detect ie

1/ 50k between vcc and dat3 of adapter {1} this whoever states that a combined sd mmc reader uses only physical card detect.

2/ This guy (http://yifan.lu/tag/hacking/) inserted a sdcard with all pins except vdd and gnd taped up and wired other appropriate pins (of adapter) to emmc . When it was not working without the modded sdcard .He concluded that the sdcard was detected by the power drawn ,though actually it could have been a physical card detect this seems more likely as it is backed up by {1} page 11. ie just stick something in adapter to fool card detect .

The card detect could be tested by soldering wires from sdcard rather than inserting it. It shouldn't work but should if another card completely taped up is inserted at same time. Unless you have led showing card detect then should be easy to test as he did with taped up sdcard.

1. www.nxp.com/documents/application_note/AN10911.pdf

Tonyv2
[Fire TV General] nhumber:
This is all way above me but has anyone tried a USB stick? Open it up, break the lines to the memory and connect the ftv mmc to that.. Maybe that little circuit board in a USB key could talk better than an SD card reader? Just a thought.
[Fire TV General] androidyeah:
I don't think that this will work.. The mmc expects to have a reader before the memory chip itself. You can't just connect some random memory part onto a device. Something has to interpret the stuff that is on the memory. A USB stick usually has a memory chip and some other parts that will manage this memory chip. And that will be a different one compared to sd card readers.

I don't know if thats true, but It's just my little thought process behind your theory.

greetings
[Fire TV General] jmp:
Any news on this topic?

Any news or update about the reader or D0 ?
[Fire TV General] ThaRaat:
I would also like to know..
[Fire TV General] sammy98:
Read #47. We already tried that some time ago

Gesendet von meinem Nexus 7 mit Tapatalk
[Fire TV General] YourNameInHere:
tried the whole weekend to get this working - but without luck :(

Reading was not possible with the provided pinout from gtvhacker.

I also checked every pin (labeled with R89-R97) as DAT0.

So for me it looks like CLK is correct (logic analyzer looks fine), but DAT0 and CMD are wrong (or we just miss some logic from pinout to sd-reader).

Next days i will test all combinations of the pins (labeled with R89-R97) as DAT0 and CMD (already have the pins wired).

I'm not sure if there was a test with a raspberry pi as a reader - doesn't work for me too :crying:

BUT .... AFTV ist still working :)

YourNameInHere

P.S. if i brick the device i will try to solder out the emmc and check the pinout (atm i have two AFTVs).
[Fire TV General] YourNameInHere:
sorry to late today for further testing ....

i have captured all the lines with a logic analyzer (saleae china clone) during bootup (60seconds):

h t t p s://enigma2.qc.to/aftv.logicdata.zip

ignore the cert warning - self signed :p

In this zip-file you will find two files because i could only capture 8 lines at one time (note to myself: buy a bigger one of this cheap china clones :cool:)

R89-R96.logicdata

(bottem) pin labled with R89 - R96 (on AFTV-PCB)

R89-R97b-CLK.logicdata

(bottem) pin labeld with R89 - R97 (R97a is the latest pin at the bottem and R97b is the pin above which is labeld with DAT7 at the gtvhacker-pinout) + CLK, "NC!" means "not connected".

Software from h t t p ://support.saleae.com/hc/en-us/articles/201589175 is needed for opening (used newest BETA 1.1.30).

So .... maybe someone can look into the files and give some hints :)

thx
[Fire TV General] rbox:
So when my box bricked, it was taking me to qualcomm download mode. Someone had mentioned that it might be possible to get there if you ground the clock pin. Basically if you have a USB A to A cable plugged in, and you get it in to download mode, it'll show in dmesg as QHSUSB_DLOAD. When it happened for me, I had full access to the emmc.

I'm not an electrical engineer so I don't know as to the safety of grounding it, but it would probably be okay...
[Fire TV General] YourNameInHere:
thx - i didn't even know this mode exists.

I killed the box yesterday and yes it is in that mode now:

[42908.971993] usb 2-2: new high-speed USB device number 38 using xhci_hcd
[42909.136679] usb 2-2: New USB device found, idVendor=05c6, idProduct=9008
[42909.136682] usb 2-2: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[42909.136684] usb 2-2: Product: QHSUSB_DLOAD
[42909.136685] usb 2-2: Manufacturer: Qualcomm CDMA Technologies MSM

Bus 002 Device 038: ID 05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)

after loading the qcserial driver i can see a tty device:

[43289.797257] usbcore: registered new interface driver qcserial
[43289.797296] usbserial: USB Serial support registered for Qualcomm USB modem
[43289.797365] qcserial 2-2:1.0: Qualcomm USB modem converter detected
[43289.797553] usb 2-2: Qualcomm USB modem converter now attached to ttyUSB0

did you saw a /dev/sd[X] afterwards?

thx
[Fire TV General] OskarW:
I did already seen this download mode on a HP Touchpad - take a look at his link:

http://rootzwiki.com/topic/38786-tpdebrick-v004/

If I rember right it is possible to read and write in this mode to the emmc!!! Maybe this is the way to root the FireTV again :laugh:
[Fire TV General] YourNameInHere:
just tested this on the not (yet) broken one.

I grounded the possible CMD-pin und the device will fallback to the "QHSUSB_DLOAD"-mode. Aftwards i disconnected the pin from ground.

But as the broken one - i can only see the serial(?)-tty-device.

I think we have to tell the qualcomm-chip to re-read the emmc ....
[Fire TV General] rbox:
Unfortunately, modem mode isn't the one we need. I think it's possible to write the mmc from modem mode, but I'm not sure. I was in 'download mode' when it happened to me and the device just showed up as usb mass storage. Maybe with QPST you can switch it to download mode somehow. [MENTION=4240355]mastafunk[/MENTION] was messing around with modem mode... maybe i'll see this and check in. I know he found a bunch of instructions for using modem mode, but download mode is the one we need.
[Fire TV General] jockyw2001:
[MENTION=1926908]YourNameInHere[/MENTION]: are both your devices now in the same mode (dload)? Your 2nd device does not boot up normally after you ungrounded the CMD pin? With Linux you can try to mount emmc partitions. (cat /proc/partitions). If not then the next thing to try is some basic qc_dload commands via the serial link. If it is an insecure qc chip it is possible to upload an initial bootloader and reflash the entire emmc. You should start with installing the qpst toolchain and try to run a memory dump. Send me a pm if you can't find qpst.
[Fire TV General] YourNameInHere:
the frist device remains in this mode because i think i killed the emmc or at least it is corrupted.

The second one will only be in this mode if i ground the pin while powerup - without it will boot normally.

I played a little bit with qpst (found v2.7 Build 411) but don't know how to deal with it :silly:

Mostly i got "device not supported" or "is in download mode".

Do you know what tool i had to use for memory dump? Just tried the "MemoryDebugApp" and got "NAK response received (1536): Unknown NAK reason code"

thx
[Fire TV General] jockyw2001:
Hi, the NAK is because the memory dump commands are not supported by this version of qc dload mode.

My friend just brought me his ftv (bought in germany and running latest firmware) so that I can play with it :)

Can you post a photo where it can be see which pin you grounded at power up?

Please also check if you can mount any partitions from linux. It is unlikely but you never know.
[Fire TV General] YourNameInHere:
see h t t p ://gtvhacker.com/images/e/ed/FireTV_EMMC_Pinout.jpg

i grounded the one which is labled as CMD (only pin with resistor). Trying now to desolder the emmc on the broken one ....

EDIT: emmc chip is out - will post pinout ....

P.S i'm from germany too :)
[Fire TV General] jockyw2001:
You mean you connect that CMD pin to ground with a resistor? What value does the resistor have?

Nice that you desoldered the emmc chip. How many balls does it have? I may have an bga adapter for my flash programmer.
[Fire TV General] YourNameInHere:
sorry for missunderstanding - i mean it's the only pin there (labled with R89) which has a resistor (the resistor is missing in the gtvhacker-picture). You don't need an extra one for grounding.

The emmc has 153 balls (info from datasheet: h t t p ://omapworld.com/iNAND_e_MMC_4_41_IF_data_sheet_v1_0[1].pdf). But i don't think we can reuse the one i soldered out.

The gtv-pinout is correct from my what i can say at the moment. VCCQ (1.8Volt) is at C170, C171 and C172, VCC (3.3Volt or 2.9Volt) is at C173, C174, C175. If i find a better camera i will post a picture.

Sadly this is exactly what i tried. I can also verify CLK, CMD is correct. DAT0 seems also correct but i'm not 100% sure. So pins i used during my tests (before the chip died) where the same - but i couldn't get it working.
[Fire TV General] jockyw2001:
Okay great work :good:

What is the emmc chip make and model? I can then check if it is supported by my universal programmer and dump it. I can unsolder the chip from my ftv if needed.

PS: does the ftv have a UART for dumping the kernel log ?
[Fire TV General] YourNameInHere:
sorry have to steal the gtvhacker picture:

h t t p s://enigma2.qc.to/FireTV_EMMC_Pinout_new.jpg

again for everyone - i already tried with this pinout but i wasn't able to get it working.

EDIT3: just to be clear: you only need one wire to VCCQ and one to VCC (it's not relevant what pin you use)

this one was a Sandisc (SEM08G), the new box has a samsung-chip (first were shipped with toshiba - looks like amazon will use the cheapest one they could get :p).

Well our main goal is to find a way to root the box. You could also try to solder VCC, VCCQ, CMD, CLK, DAT0 and Ground and try to read the chip as an SD-Card - for me it doesn't work :(

Another method would be this QHSUSB_DLOAD mode or it least we have to find a way to switch to the "Download mode" were the emmc is accessable via usb. I can send you contact details if you want :)

EDIT: There was a thread about UART ... just don't find it at the moment ...

EDIT2: Ok sorry - it was JTAG not UART - UART pinout is already there: h t t p ://gtvhacker.com/index.php/File:FireTV_Uart_Pinout.jpg

But i think you could only see the bootmessage and nothing else ...

thx
[Fire TV General] YourNameInHere:
another try with the not broken one - no success.

Also tried with 4bit-mode (DAT0, DAT1 (pin to the left of DAT2), DAT2, DAT3 (guessed, i think it's the one to the right of DAT0) connected).

I think this is a problem of dual-power. Maybe my reader isn't able to speak with the eMMc at 1.8Volt (forced the driver to do so):

source: h t t p s://lkml.org/lkml/2014/4/18/490

Maybe i can find someone who is able to read a eMMc with a sdcard-reader and give us the model.

[MENTION=487710]jockyw2001[/MENTION] can you tell us what programmer you have? Are you able to access the contents of an emmc-chip?

thx
[Fire TV General] tonyv2:
Hi

I came across this thread [1].

"if SBLl1 fail's it switches to QDLOAD, if the fail happens after SBL1 it's Q-HSB mode, same Pid/Vid"

"is down to each device, some do go into Q-HSB mode and others dont"

SBL1 -secondary boot loader one

Assume q-hsb usb mass storage mode. This is for a 8660 ,but assuming it applies to firetv's APQ8064.

On this assumption the bricks that lead to this "Q-HSB mode" will have sbl2 disrupted.

If could detect when sbl1(second stage boot loader) is finished and disrupt emmc (ie gnd cmd) before finished reading sbl2 assume goes into mode if (signature ? hash) failure of sbl2 maybe use fpga to count no clock cycle since reset and (binary?) search for it.

This [2] describes the boot process for APQ8064

"1.When the board is powered on, the RPM processor (a small ARM7 core in the SoC along the side of the main Krait cores) is reset and executes the Primary Boot Loader (PBL) from ROM which in turn, loads the initial Secondary Boot Loader (SBL1) into RPM memory

2. The RPM runs SBL1 which in turn load SBL2 into memory, and takes the first Krait out of reset

a seperate arm runs sbl1 (Resource Power Manager Processor ) and then loads SBL2 into memory, and takes the first Krait out of reset ."

Maybe this transition is detectable (poss clock speed change or power consumption ) so could find no clock cycles below which emmc should be disrupted.

Tried to look for other successful attempts to use QDLOAD mode on APQ8064 [3] was a failure SnowLeopardJB [4] reckoned they needed a signed MPRG8064.HEX though [5] implies needs MPRG8064.BIN using hex2bin

http://xdaforums.com/showthread.php?t=2136738&highlight=qdload+py+zip

.I found other chinese sites that claimed success with APQ8064 just googled MPRG8064 .This is a toolkit to debrick some qualcomm chips including the APQ8064 https://github.com/aureljared/unbrick_8960 .

[1] http://rootzwiki.com/topic/36658-tpdebrick-v01/page-19

[2] https://wiki.linaro.org/Boards/IFC6410

[3] http://xdaforums.com/nexus-4/general/wip-unbricking-nexus-4-using-qpst-t2208289

[4] http://xdaforums.com/showpost.php?p=39798212&postcount=6

SHV-E160L Debricking Tool / Qualcomm Tool Pack V2-1 README in first post very useful

[5]http://xdaforums.com/showthread.php?t=2136738&highlight=qdload+py+zip

lots tools in download qdload.py etc

Other refs

[R&D][QUALCOMM] Using QDL, EHostDL and DIAG interfaces & features

http://xdaforums.com/showthread.php?t=2086142

[REF][R&D] Building Bootloaders on Qualcomm Devices

http://xdaforums.com/showthread.php?t=1978703

howto generate msimage.mbn

http://web.archive.org/web/20130715...12/04/how-to-build-emmc-flash-programmer.html

http://web.archive.org/web/20130117...g/2012/05/how-to-generate-8660msimagembn.html

https://github.com/aureljared/unbrick_8960

Just to check which side of resistor did you short to ground to disable emmc ie is resistor a pull up etc ?

Cheers tony
[Fire TV General] mastafunk:
Ive been trying to ressurect my briked unit using a MPRG8064.BIN i found for another device an am not getting anywhere fast... Ive been reading those same threads you link... please keep me advised if you have any progress in this area. I am in DLOAD mode.
[Fire TV General] xXhighpowerXx:
Ok here is an updated image of the pinout. I have triple check everything should be 100% correct :fingers-crossed:
[Fire TV General] YourNameInHere:
impressive and thx for sharing. :good:

Sorry if this is a dump question - how did you get out the emmc that clean? I did it too but most of the lines are still at the emmc itself and not at the board anymore :(

Thx
[Fire TV General] xXhighpowerXx:
Heh i just used this:

http://www.harborfreight.com/1500-watt-dual-temperature-heat-gun-572-1112-96289.html

+

http://www.radioshack.com/2-oz-non-spill-rosin-soldering-paste-flux/6400022.html#q=Flux&start=3
[Fire TV General] tonyv2:
Hi xXhighpowerXx

Have you done this hack, if so could you give some more details .

Which usb card reader did you use?

Did you use some sort of level translation ?

If so what did you use ?

Did you just attach dat0 or ?

Thanks Tony
[Fire TV General] xXhighpowerXx:
Hey, tonyv2

I remember you from the Roku thread ;)

Yea. I was successfully rooted the box with the eMMC removed, and one time I got lucky with eMMC in circuit.

I have a eMMC adapter that convert the logic level to 1.8V but the issue is that the CPU was interfered with bus. It pulled some data pins to logic low(while CPU in reset mode) that make the SD reader can't detect it. You can check this by connect up VCC + VCCQ, then measure DAT0-7 with voltmeter or logic analyzer and see if anything pulled low. Pull the pins to high first with 10K resistor to VCCQ. It isn't populated in the firetv)

I tried to hold the CPU in reset mode with the SRST pin on the JTAG header on the back pulled low. This still doesn't free the eMMC data bus.

But I have an idea and it could work and I haven't test it myself yet cause I don't have the box anymore:

Power up the box and give it enough time so the eMMC at standby state.

Kill the CPU Clock by shorting out the crystal oscillator (CPU should hang in that state).

Hopefully now the eMMC bus is clear and we can talk to the flash.

Hook up to an eMMC adapter + connect to SD Card reader.

Now we should see the Flash detected

If I have a box I would test it but sadly I sold it already :(
[Fire TV General] simondo22:
So your ftv is rooted? But the emmc Is desoldered?

Also there is no simplyl way to root that fuxcking box.

---------- Post added at 03:49 PM ---------- Previous post was at 03:38 PM ----------

Nice work. It's my daly work to desolder and solder things like that. And you did a super job only using an air gun. Respekt
[Fire TV General] freezer2k:
Hey,

Did you guys see this?

http://gtvhacker.com/index.php/GTVHacker_e-MMC_Adapter

It's being used to root the FireTV stick via eMMC !

It supports low voltage eMMC, and as far as I understand, this is what is needed for the FireTV as well?

Any clue if this would work out of the box for accessing the eMMC of the FTV?
[Fire TV General] YourNameInHere:
saw it yesterday and broke up the idea to test it with a normal logic-converter.

Will give it a try as soon as the needed hardware arrives (ordered today - have to build the pcb by myself).
[Fire TV General] freezer2k:
Cool, so you will use the layout from Maximus and etch the pcb/solder components yourself?
[Fire TV General] YourNameInHere:
yup :)

i asked xXhighpowerXx aka maximus64 if he can provide the cad-files for the layout - it would make it much easier.
[Fire TV General] freezer2k:
lol,

did not know that :D
[Fire TV General] nufclad:
Very best of luck! You located in europe? UK?
[Fire TV General] xXhighpowerXx:
Oh hey. You order the EMMC adapter from me? There was a couple of orders from Germany. Not sure who you are. If you order it from me, then it would already assembled.

Anyway here are the gerbers + BOM file if you interested to build one yourself.

I don't have the FireTV box anymore to try it on :( sorry. It sold as I told in the last post.
[Fire TV General] freezer2k:
Was wondering, is it required to use enameled for soldering to the FireTV, or can some thicker wire with regular insulation be used?
[Fire TV General] xXhighpowerXx:
Yea you can. Doesn't have to be enameled wire. But you could run the risk of pulling pads / shorting stuff if the wire are too big. I would go with #30 or smaller.

---------- Post added at 08:38 PM ---------- Previous post was at 08:31 PM ----------

Very close. The driver detected the emmc "SEM08G". What voltage you feed to VCCQ + VCC? and you just wire it direct to your SD Card reader?

---------- Post added at 08:48 PM ---------- Previous post was at 08:38 PM ----------

I will get another FireTV box soon and will see :cool:
[Fire TV General] YourNameInHere:
thx - yes, europe/germany.

thank you again :)

nope - i didn't order from you.

Damn ... i thougt you will not ship to europe due to the costs ... but ok ... making the pcb shouldn't be so difficult (my dad does it for years. And yes, i told him to let the china guys make it for him)

right, connected everything direct to the sd-card reader. VCCQ was 1.8 volts, VCC was 3.3 volt. Both came from the sd-card reader vcc (1.8volt through voltage-regulator).

I tried to tell the driver to irgnore 3.3volt signaling and forced it to 1.8volt (see the log: OWN DEBUG: 1 (0=MMC_SIGNAL_VOLTAGE_330, 1=MMC_SIGNAL_VOLTAGE_180, 2=MMC_SIGNAL_VOLTAGE_120)), because it never tried other voltages when it fails (not sure if it is a kernel-bug). But at the end i wasn't able to see the file-system of the emmc :(
[Fire TV General] freezer2k:
Okay thanks,

I have some 0,5mm (~AWG 24) stranded wire here, AWG30 is only 0,255mm ; think i will get new one then.

//update

Just picked up some 0,2mm enameled wire, hope this stuff is good :)
[Fire TV General] nufclad:
Any further progrees with this?the only thing i dont understand is, it must be doable as instructions are out there. (Not to the extent of step by step like the stick though). So has this actually been reported to have worked with the fire tv?
[Fire TV General] xXhighpowerXx:
Stay tune :P putting together a tut heh
[Fire TV General] no_spam_for_me:
That would be nice :)

And if someone will find a way to use your toy to root the AFTV, you will get at least one more order from Germany (I think not only one :) or maybe someone at Germany like to handle it)...
[Fire TV General] cyablo:
Woot? Did you manage to read/write the eMMC and Root the Fire TV?