Unconfigured Ad Widget



No announcement yet.

NAND Chip Mask ROM Mode Short Location

This is a sticky topic.
  • Filter
  • Time
  • Show
Clear All
new posts

    Have an Teclast p10 RK3368 tablet.Dead as it seems to be, caused by flashing wrong firmware..I have my doubts, but maybe it reacts in mask rom.
    Busy to take it apart to take some pictures, here the info.
    -Teclast p10 RK3368, with 32g nand.
    -Nand, Sandisk sdin5c4-32g.

    Also under the nand there are contact points, try to make some pictures from that either.Couldn't find much info about this chip.


    Uploaded the files, extension etc etc..

    Will do it like this.

    Underside, the 4 dots are under the emmc, nand chip.

    the board arround the chip,

    I also tried to find some datasheet for my nand chip, i think its this one..And according layout clk is pin M6...But i am to novice to translate it to what side and the right pin.Or maybe a contact point, hope someone can help me(see page 20). :http://html.alldatasheet.com/html-pd...N5D1-2G-L.html

    Thanks , if they are not clear enough let me know, maybe it can bring it back.

    Last edited by scorp76; 02-19-2018, 20:07.


      Hello i bricked my device what pins must short to enter me mask mode ??

      Details of PCB is:
      MX4VB-V02 WW17090029

      edit: I entered the maskrom by shorting 8-9 pins
      Attached Files
      Last edited by natsisan; 02-13-2018, 21:50.


        du hast das probiert ?
        you tried that ?


        welche Funktion haben die Pins die man br├╝cken soll ?
        welche Aufgabe haben die Pins 17 und 18 beim KLMAG2GE4A-A001 ? -> http://www.datasheetspdf.com/pdf/810...AG2GE4A-A001/1
        wo sind die selben Anschl├╝sse beim KLMAG2GEND-B031 ? ->http://www.datasheets360.com/pdf/-7676236794147690674

        what function do the connections have bridged ?
        which task are the connections 17 and 18 KLMAG2GE4A-A001 ? http://www.datasheetspdf.com/pdf/810...AG2GE4A-A001/1
        where are the same connections at KLMAG2GEND-B031 ? http://www.datasheets360.com/pdf/-7676236794147690674




          it works by me, H96 pro plus -> PIN 17 & 18

          Click image for larger version

Name:	Samsung_Nand.jpg
Views:	7687
Size:	174.5 KB
ID:	709014


            Hi all,

            Can anyone help me?
            I've two Nexbox A95X bricked, both has the same problem, RED LIGHT and won't turn on.
            How can I unbrick these boxes?
            The board is RK3229_D16 1.2 and SV6051P wifi-Chip.
            I tried to short circuit on pins 6-7 without sucess, the Rockchip batch doesn't find the device.
            Attached Files


              Originally posted by Mike1832 View Post
              Hello. I need to unbrick the MXQ 4k (not pro version) with the chip RK3229. I don't know which pins are to shortcut. NAND is a Essencore 13t-8gq8t2h5tarc

              Here are the photos:

              Hi man,

              Did you find the pins? I've the same board and the same problem!



                thanks for your reply

                don't works with my Netbox-V3:
                - I use USB_Burning_Tool v2.0.6.2 - I think the driver WorldCup Device is realy installed on W7 because the setup end without error
                - I do not know if my 2 USB ports are OTG or not on the Netbox-V3 (is it important?)

                maybe a problem with the order of the actions, I do not know


                  if I remember rightly

                  i power up USB Burning Tool (2.0.9)
                  loading image -> USB Burning Image button Start/Stop -> Stop !
                  short PIN 17 and 18
                  plug in USB male to Box (without power adapter)
                  I've certainly done that 20 times
                  then sometime came "connect"
                  press Start button on USB Burning Tool
                  plugin power suply



                    finally, it was not 17-18 but like on this picture (red rectangle) (see first attachment)
                    so the status is 'HUB4-3 | Connect Success'

                    but i got an error during burning process (see the second picture)

                    i am not sure to have the correct firmware but it may not be the root cause...


                    -- SUCCESS !

                    after a long time, searches, tries, i finally unbrick my device (netboxV3)
                    I am not doing so far what i wanted to do, but booting from eMMC is working again.
                    So, the wrong firmware (package) had don't completely break down my device but only the u-boot part: (my analysis) boot0 & boot1 partitions.

                    summary of the rescue:

                    * a device without hardware issue.
                    * an micro SD card
                    * know the UART pins locations on the device (in my case shorted 17-18 or 8-9 not worked, so observations and feeling - PCB not documented).
                    * puTTY plus an USB/serial (UART) adapter (AliExpress is our friend)

                    the goal: flash u-boot on the eMMC partitions boot0 & boot1 (usually) :
                    * prepare an external SD card with fonctionnal u-boot.bin for the device (plenty tuto):
                    dd if=u-boot.bin of=/dev/sdb bs=1 count=360
                    dd if=u-boot.bin of=/dev/sdb bs=512 seek=1 skip=1
                    + copy 'u-boot.bin' file on SD card
                    * power on the device using fash mode (MASK ROM MODE) matching your eMMC chip (or in my case, my PCB : much more feeling here and lucky - still not documented).

                    Boot from external device <<<
                    TE : 747374

                    System Started

                    U-boot-00005-g8c3fb41-dirty([email protected]) (Nov 28 2014 - 17:25:56)
                    exit abortboot: 1

                    [here you could use fatload instead of DHCP/TFTP server like me]
                    m8b_m201_1G#tftp u-boot.bin
                    Using Meson_Ethernet device
                    TFTP from server; our IP address is
                    Filename 'u-boot.bin'.
                    Load address: 0x12000000
                    Loading: T #########################
                    Bytes transferred = 364512 (58fe0 hex)

                    in my case:
                    m8b_m201_1G#mmc list
                    SDIO Port B: 0 < SD
                    SDIO Port C: 1 < eMMC

                    mmc - MMC sub system

                    mmc read <partition name> ram_addr addr_byte# cnt_byte
                    mmc write <partition name> ram_addr addr_byte# cnt_byte
                    mmc erase <partition name> addr_byte# cnt_byte
                    mmc erase <partition name>/<device num>
                    mmc rescan <device num>
                    mmc part <device num> - show partition infomation of mmc
                    mmc list - lists available devices
                    mmc switch <device num> <part name> - part name : boot0, boot1, user

                    m8b_m201_1G#mmc rescan 1
                    m8b_m201_1G#mmc switch 1 boot0
                    mmc switch part boot0 success
                    m8b_m201_1G##mmc erase boot0
                    m8b_m201_1G#mmc write 1 0x12000000 0 2000

                    m8b_m201_1G#mmc switch 1 boot1
                    mmc switch part boot1 success
                    m8b_m201_1G##mmc erase boot1
                    m8b_m201_1G#mmc write 1 0x12000000 0 2000

                    resetting ...
                    QA5:A;SVN:B72;POC:1BF;STS:0;BOOT:0;INIT:10;BOOT:1; INIT:10;USB:3;SERIAL:4;STS:0;BOOT:0;INIT:10;BOOT:1 ;INIT:10;USB:3;SERIAL:4;STS:0;BOOT:0;INI
                    T:10;BOOT:1;INIT:10;USB:3;SERIAL:4;QA5:A;SVN:B72;P OC:1FF;STS:0;BOOT:0;INIT:0;READ:0;CHECK:0;PASS:0;

                    no sdio debug board detected
                    TE : 138606
                    BT : 10:10:17 Feb 9 2015
                    ##### VDDEE voltage = 0x044c

                    CPU clock is 792MHz

                    DDR mode: 32 bit mode
                    DDR size: 1GB (auto)
                    DDR check: Pass!
                    DDR clock: 636MHz with 2T mode
                    DDR pll bypass: Disabled
                    DDR init use : 14843 us

                    Boot From SDIO C
                    SD_boot_type: 00000002
                    card_type: 00000003
                    ucl decompress...pass
                    Boot from internal device 1st eMMC on SDIO C <<<< YES

                    TE : 358813

                    System Started

                    U-boot([email protected]) (Feb 09 2015 - 10:10:13)


                    PS: netboxV3 is not an m201 model but they have S805 both

                    Last edited by philip63; 03-04-2018, 18:47. Reason: partially RESOLVED


                    • Magendanz
                      Magendanz commented
                      Editing a comment
                      Yes, it sounds like you have a mismatched burn package. You really need to use a known good .img file.


                    thanks for your reply
                    so far, i can't find firmware for my netbox V3 (s805) from Hexabyte (but seem simply be an ATV485 from Geniatech
                    those on Geniatech site are not usable with 'USB burning tool' which is my only option at this point i guess and i found nothing on Hexabyte site.
                    so far, the best result i has gain is an u-boot prompt (with SD and shorted pins); it should be enough for those who can take advantage...


                      tv box h96 became brick(does not see usb)
                      please help me which are reset pins
                      short the pins indicated for the tv box h96 max 32gb rockchip 3399
                      Click image for larger version

Name:	43234234564fdd.jpg
Views:	7430
Size:	116.2 KB
ID:	710201Click image for larger version

Name:	4234324reweds.jpg
Views:	6932
Size:	104.2 KB
ID:	710202Click image for larger version

Name:	2312156fdd.jpg
Views:	6881
Size:	127.8 KB
ID:	710203


                        V88 Mini with RK3229, wifi SV6051p and board states MX4MN-V13.
                        Short pins are 8 and 9.

                        Click image for larger version

Name:	V88Mini_RK3229_SV6051p_ShortPins.jpg
Views:	7034
Size:	126.9 KB
ID:	710254


                          Hello! I own a Nexsmart d32 with a rk3229 and am stuck. I was flashing a rom to the device when it suddenly stopped loading and a fialed error message appeared. When I plug it in now, my computer does not recognize it whatsoever, nor does any light come on. I tried this method and walked down every pin on the NAND to no avail. Am I doing something wrong?


                            For Alcatel OneTouch T10 7" tablet

                            NAND -- 29F32G08CBACA

                            Note: for this device, maskrom control is available via reset & Vol - buttons (I checked the schematics) - you shouldn't need to short the pins

                            short pins 8 & 9

                            Pin 1 is bottom left of NAND chip in this image;

                            Last edited by the_clam; 02-28-2018, 06:09. Reason: *extra info


                              Hello! Any ideas on how to short pin this version? I got the red led on only, the reset button does nothing. It is detected using the male-male USB.
                              Thanks in advance.
                              Last edited by Fernandoc; 02-27-2018, 16:42.