Any test clip grabbers for my package ?

[jnok]

Dears,

I'm coming from the software side of the world, with very limited skills in electronic/hardware and I am trying to reverse engineer my wireless alarm. So far I've been able to extract firmwares of various components (sensors, motion captors, ...) and to analyze (+decrypt) radio communications.  It's a very funny project which helps me to learn a bit about embed devices hacking.

Now my problem.
I'm stuck finding the JTAG port of the central device. I've tried various approaches against the exposed pinouts of the PCB such as logic/voltage analyzing (based on http://www.devttys0.com/2012/11/reverse-engineering-serial-ports/), JTAGulator, etc, but nothing worked so far.
Therefore, I would be interested to hook directly on the dedicated pins of the chipset. The problem for me is that the chip is a 128 pins STR91xFA, so small that I can't solder anything on it my self. Pins are 0.007 inch (0.2 mm) large. I'm also trying to find test clips grabbers small enough, but here again, without luck.
Here is the datasheet, package dimensions are on page 96:
http://www.st.com/st-web-ui/static/active/en/resource/technical/document/datasheet/CD00159308.pdf

Could anyone point me an alternated technique (or hardware) to hook on these small pins ?
Do test clips exists for this ? and where could I get them ?

Any other advices or idea would be very welcome in any case !
Thank you very much

Ps: Sorry for my English.

[T3sl4co1l]

"Any test clip grabbers for my package ?"

Kinky...

sorry 

Tim

[miguelvp]

"Any test clip grabbers for my package ?"

Kinky...

sorry 

Tim

Funny I was about to mention something about the new uRuler being phallic shaped at 7 inches and not flat at the end, but not wide enough.
But then I thought, nah I've been drinking, so I didn't, then I've drank some more and saw this so I did

BTW OP don't do an image Google of "clip grabbers for my package" you'll regret it.

[miguelvp]

Actually I found some:

http://www.digikey.com/product-highlights/us/en/chipquik-microgripper/105

No idea if they will work for your needs, but they are very expensive, around $80 for 2.

[jnok]

Thanks! Expensive but looks interesting indeed.
In the meantime, I wonder if using test clips is at least possible in this situation. Example, without creating bridges between pins 

Maybe that another approach could be to use very thin insulated wires, to remove a small piece of insulation, and to insert the wire between two pins (so creating contact with one pins, safely). I don't know how experts work in their labs, but it could be a cheap alternative  ?

[tautech]

I use these Tek grabbers for SOIC, but I wouldn't think they could go much finer.
http://www.ebay.com/itm/Lot-20-Tektronix-TEK-SMT-KlipChip-Adapter-Mini-Test-Clips-Grabbers-206-0364-01-/261474295590?pt=LH_DefaultDomain_0&hash=item3ce1151f26

Try Pomona

[T3sl4co1l]

Thanks! Expensive but looks interesting indeed.
In the meantime, I wonder if using test clips is at least possible in this situation. Example, without creating bridges between pins 

Maybe that another approach could be to use very thin insulated wires, to remove a small piece of insulation, and to insert the wire between two pins (so creating contact with one pins, safely). I don't know how experts work in their labs, but it could be a cheap alternative  ?

If you're going to that trouble, you want to solder a wire-wrap wire (silver plated 30AWG core, kynar insulated) to the pin.

I've seen grabbers small enough for SOIC, but not sure about, like, TSSOP/QFP pitch.  That's pretty tiny.  If nothing else, the amount of force against the grabber body and lead wire will be considerable.  You're often better off with the jumpers -- see some of the hack jobs Mike's made, like reverse engineering the iPod Nano screens.

Tim

[dentaku]

Actually I found some:

http://www.digikey.com/product-highlights/us/en/chipquik-microgripper/105

No idea if they will work for your needs, but they are very expensive, around $80 for 2.

Wow that's tiny. I didn't now such a thing existed.

It's certainly different than the old days when you could get a way with these things

[miguelvp]

I've seen grabbers small enough for SOIC, but not sure about, like, TSSOP/QFP pitch.  That's pretty tiny.  If nothing else, the amount of force against the grabber body and lead wire will be considerable.  You're often better off with the jumpers -- see some of the hack jobs Mike's made, like reverse engineering the iPod Nano screens.

Tim

You should look at the link I provided above, out of those these are the smallest ones I believe (0.5mm to 0.2mm) but at $89 for just a pair:
http://www.digikey.com/product-detail/en/SMDFP-2S-2/SMDFP-2S-2-ND/2334394

Datasheet in the part has more info about stress and other considerations, including max bandwidth of 100 MHz

[DanielS]

You should look at the link I provided above, out of those these are the smallest ones I believe (0.5mm to 0.2mm) but at $89 for just a pair

It is quite a wonder how the usual suspects charge over $25 per IC-grabber when you can get bags of 50-100 for less than $20 on eBay and other sources. Maybe not all the way down to 0.2mm pitch though.

[jnok]

Thank you all for your valuable inputs!
Not sure that I will someday find the right test clips unfortunately since the gap between the pins is definitely limited (see attached picture).

I'm keep practicing soldering (also with solder paste and hot air gun) on a testing board and the same chip. Maybe that I will finally made it even it will take a few months :-)
I'll keep you posted

Cheers and thanks again!

[jnok]

PS: It is worth asking: IF an equipped expert want to solder it for me, I'm open to send the PCB over the world and to pay him (just drop me a email) 

[andrewwong2000]

I bought some EZ Hook 2015s .. They work for QFP pitch. $17 each. A lot cheaper than the Pomona/Agilent/Tek ones


Sent from my iPhone using Tapatalk

[Smokey]

It sounds like you put a ton of work into it already.  Take the leap and buy yourself a decent stereo microscope and a nice soldering iron with a tiny tip.  With that stuff its pretty easy to tack some kynar wire on. 

[ConKbot]

Get a single layer flex made and use some Z-tape and a chunk of rubber and some clamps to keep the breakout pressed in place?

http://imall.iteadstudio.com/open-pcb/pcb-prototyping/2layer-flexible-printed-circuits-fpc-5cm-x-10cm-max.html

$100 to get it done in gold.  Cheaper than buying 2 pairs of those grabbers.

[Smokey]

Another tip:
Those pins go somewhere, either to component pads or exposed vias.  Assuming the component pads are bigger than the tiny pitch of that chip, it should be easier to tack wires on that than the actual pins of the original chip.  Take your meter and probe around until you find where those signals go and then tack the wires on there. 
Vias are especially good once you scrape off the solder mask and expose the copper.

[jnok]

Tank you very much for the tip.
On the top, there are no pads linked to the JTAG pins. However, there are indeed via under the chip (other side of the board). I'll give a try.

[jnok]

Get a single layer flex made and use some Z-tape and a chunk of rubber and some clamps to keep the breakout pressed in place?

....

Thanks for the idea ! PCB design software are new to me, but why not. I keep the link in my pocket !

I bought some EZ Hook 2015s .. They work for QFP pitch. $17 each. A lot cheaper than the Pomona/Agilent/Tek ones

Thanks ! I've just ordered one to get a try ! 

[jnok]

Another tip:
Those pins go somewhere, either to component pads or exposed vias.  Assuming the component pads are bigger than the tiny pitch of that chip, it should be easier to tack wires on that than the actual pins of the original chip.  Take your meter and probe around until you find where those signals go and then tack the wires on there. 
Vias are especially good once you scrape off the solder mask and expose the copper.

I FOUND MY JTAG 
Confirmed by both Jtagulator and openocd !

Thank you again for the tip Smokey, and to all participants who tried to help me ! Firmware reversing can finally start