NAND Chip Mask ROM Mode Short Location

[scorp76]

Have an Teclast p10 RK3368 tablet.Dead as it seems to be, caused by flashing wrong firmware..I have my doubts, but maybe it reacts in mask rom.
Busy to take it apart to take some pictures, here the info.
-Teclast p10 RK3368, with 32g nand.
-Nand, Sandisk sdin5c4-32g.

Also under the nand there are contact points, try to make some pictures from that either.Couldn't find much info about this chip.
Thanks!

Scorp

Uploaded the files, extension etc etc..

Will do it like this.

Underside, the 4 dots are under the emmc, nand chip.

http://www.mediafire.com/view/4u2nvxsofaibbl4/IMG_20180212_193309.jpg

the board arround the chip,

http://www.mediafire.com/view/7vvxvtum6c8sm1q/IMG_20180212_182517.jpg

http://www.mediafire.com/view/h52bu6r03bf5x46/IMG_20180212_191353.jpg

http://www.mediafire.com/view/aei4ck...212_182253.jpg

I also tried to find some datasheet for my nand chip, i think its this one..And according layout clk is pin M6...But i am to novice to translate it to what side and the right pin.Or maybe a contact point, hope someone can help me(see page 20). :http://html.alldatasheet.com/html-pd...N5D1-2G-L.html

Thanks , if they are not clear enough let me know, maybe it can bring it back.

Thanks!

[natsisan]

Hello i bricked my device what pins must short to enter me mask mode ??

Details of PCB is:
2.3.60.101.mx4vb0200R
MX4VB-V02 WW17090029
A170909

edit: I entered the maskrom by shorting 8-9 pins

[Cju]

@philip63
du hast das probiert ?
you tried that ?

@all

welche Funktion haben die Pins die man brücken soll ?
welche Aufgabe haben die Pins 17 und 18 beim KLMAG2GE4A-A001 ? -> http://www.datasheetspdf.com/pdf/810...AG2GE4A-A001/1
wo sind die selben Anschlüsse beim KLMAG2GEND-B031 ? ->http://www.datasheets360.com/pdf/-7676236794147690674


what function do the connections have bridged ?
which task are the connections 17 and 18 KLMAG2GE4A-A001 ? http://www.datasheetspdf.com/pdf/810...AG2GE4A-A001/1
where are the same connections at KLMAG2GEND-B031 ? http://www.datasheets360.com/pdf/-7676236794147690674

KLMAG2GE4A-A001=169FBGA
KLMAG2GEND-B031=153FBGA

[Cju]

KLMAG2GEND-B031

it works by me, H96 pro plus -> PIN 17 & 18

[renandare]

Hi all,

Can anyone help me?
I've two Nexbox A95X bricked, both has the same problem, RED LIGHT and won't turn on.
How can I unbrick these boxes?
The board is RK3229_D16 1.2 and SV6051P wifi-Chip.
I tried to short circuit on pins 6-7 without sucess, the Rockchip batch doesn't find the device.

[renandare]

Hello. I need to unbrick the MXQ 4k (not pro version) with the chip RK3229. I don't know which pins are to shortcut. NAND is a Essencore 13t-8gq8t2h5tarc

Here are the photos:

https://imgur.com/a/wlddi

Hi man,

Did you find the pins? I've the same board and the same problem!

[philip63]

Cju
Hi,

thanks for your reply

don't works with my Netbox-V3:
- I use USB_Burning_Tool v2.0.6.2 - I think the driver WorldCup Device is realy installed on W7 because the setup end without error
- I do not know if my 2 USB ports are OTG or not on the Netbox-V3 (is it important?)

maybe a problem with the order of the actions, I do not know

[Cju]

if I remember rightly


i power up USB Burning Tool (2.0.9)
loading image -> USB Burning Image button Start/Stop -> Stop !
short PIN 17 and 18
plug in USB male to Box (without power adapter)
I've certainly done that 20 times
then sometime came "connect"
press Start button on USB Burning Tool
plugin power suply

[philip63]

Hi,

finally, it was not 17-18 but like on this picture (red rectangle) (see first attachment)
so the status is 'HUB4-3 | Connect Success'

but i got an error during burning process (see the second picture)

i am not sure to have the correct firmware but it may not be the root cause...

-------------------------------------------------------------------------------------------------------------------------------------------------------

-- SUCCESS !

after a long time, searches, tries, i finally unbrick my device (netboxV3)
I am not doing so far what i wanted to do, but booting from eMMC is working again.
So, the wrong firmware (package) had don't completely break down my device but only the u-boot part: (my analysis) boot0 & boot1 partitions.
26/5000

summary of the rescue:

prerequisits:
* a device without hardware issue.
* an micro SD card
* know the UART pins locations on the device (in my case shorted 17-18 or 8-9 not worked, so observations and feeling - PCB not documented).
* puTTY plus an USB/serial (UART) adapter (AliExpress is our friend)

the goal: flash u-boot on the eMMC partitions boot0 & boot1 (usually) :
* prepare an external SD card with fonctionnal u-boot.bin for the device (plenty tuto):
dd if=u-boot.bin of=/dev/sdb bs=1 count=360
dd if=u-boot.bin of=/dev/sdb bs=512 seek=1 skip=1
sync
+ copy 'u-boot.bin' file on SD card
* power on the device using fash mode (MASK ROM MODE) matching your eMMC chip (or in my case, my PCB : much more feeling here and lucky - still not documented).

Boot from external device <<<
TE : 747374

System Started

U-boot-00005-g8c3fb41-dirty(m8b_m201_v1@8c3fb416) (Nov 28 2014 - 17:25:56)
exit abortboot: 1

[here you could use fatload instead of DHCP/TFTP server like me]
m8b_m201_1G#tftp u-boot.bin
Using Meson_Ethernet device
TFTP from server 192.168.1.100; our IP address is 192.168.1.244
Filename 'u-boot.bin'.
Load address: 0x12000000
Loading: T #########################
done
Bytes transferred = 364512 (58fe0 hex)

in my case:
m8b_m201_1G#mmc list
SDIO Port B: 0 < SD
SDIO Port C: 1 < eMMC

m8b_m201_1G_th12#mmc
mmc - MMC sub system

Usage:
mmc read <partition name> ram_addr addr_byte# cnt_byte
mmc write <partition name> ram_addr addr_byte# cnt_byte
mmc erase <partition name> addr_byte# cnt_byte
mmc erase <partition name>/<device num>
mmc rescan <device num>
mmc part <device num> - show partition infomation of mmc
mmc list - lists available devices
mmc switch <device num> <part name> - part name : boot0, boot1, user

m8b_m201_1G#mmc rescan 1
m8b_m201_1G#mmc switch 1 boot0
mmc switch part boot0 success
m8b_m201_1G##mmc erase boot0
m8b_m201_1G#mmc write 1 0x12000000 0 2000

m8b_m201_1G#mmc switch 1 boot1
mmc switch part boot1 success
m8b_m201_1G##mmc erase boot1
m8b_m201_1G#mmc write 1 0x12000000 0 2000

m8b_m201_1G#reset
resetting ...
QA5:A;SVN:B72;POC:1BF;STS:0;BOOT:0;INIT:10;BOOT:1; INIT:10;USB:3;SERIAL:4;STS:0;BOOT:0;INIT:10;BOOT:1 ;INIT:10;USB:3;SERIAL:4;STS:0;BOOT:0;INI
T:10;BOOT:1;INIT:10;USB:3;SERIAL:4;QA5:A;SVN:B72;P OC:1FF;STS:0;BOOT:0;INIT:0;READ:0;CHECK:0;PASS:0;

no sdio debug board detected
TE : 138606
BT : 10:10:17 Feb 9 2015
PMU:NONE
##### VDDEE voltage = 0x044c

CPU clock is 792MHz

DDR mode: 32 bit mode
DDR size: 1GB (auto)
DDR check: Pass!
DDR clock: 636MHz with 2T mode
DDR pll bypass: Disabled
DDR init use : 14843 us

HHH
Boot From SDIO C
SD_boot_type: 00000002
card_type: 00000003
0x0000009f
ucl decompress...pass
0x12345678
Boot from internal device 1st eMMC on SDIO C <<<< YES

TE : 358813

System Started

U-boot(m8b_m201_th12@4b99c74c) (Feb 09 2015 - 10:10:13)

Thanks


PS: netboxV3 is not an m201 model but they have S805 both

Yes, it sounds like you have a mismatched burn package. You really need to use a known good .img file.

[philip63]

Guest

thanks for your reply
so far, i can't find firmware for my netbox V3 (s805) from Hexabyte (but seem simply be an ATV485 from Geniatech
those on Geniatech site are not usable with 'USB burning tool' which is my only option at this point i guess and i found nothing on Hexabyte site.
so far, the best result i has gain is an u-boot prompt (with SD and shorted pins); it should be enough for those who can take advantage...

[catalin0231]

Hello,
tv box h96 became brick(does not see usb)
please help me which are reset pins
short the pins indicated for the tv box h96 max 32gb rockchip 3399

[J_Tech]

V88 Mini with RK3229, wifi SV6051p and board states MX4MN-V13.
Short pins are 8 and 9.

[CaptainBenSisko]

Hello! I own a Nexsmart d32 with a rk3229 and am stuck. I was flashing a rom to the device when it suddenly stopped loading and a fialed error message appeared. When I plug it in now, my computer does not recognize it whatsoever, nor does any light come on. I tried this method and walked down every pin on the NAND to no avail. Am I doing something wrong?

[the_clam]

For Alcatel OneTouch T10 7" tablet

NAND -- 29F32G08CBACA

Note: for this device, maskrom control is available via reset & Vol - buttons (I checked the schematics) - you shouldn't need to short the pins

short pins 8 & 9

Pin 1 is bottom left of NAND chip in this image;

[Fernandoc]

Hello! Any ideas on how to short pin this version? I got the red led on only, the reset button does nothing. It is detected using the male-male USB.
Thanks in advance.