Mystery eMMC flash chip pinout?

[D Straney]

Had my phone (Teracube 2e) brick itself to an amazing degree recently, and while my backups are recent enough to not be disastrous, they're also far enough in the past that it would be really convenient to be able to pull the data off of it.  Inspired by other stories of hooking up salvaged phone flash chips to SD card readers, I took the shields off the motherboard, but sadly this BGA I removed doesn't match any of the standard BGA flash pinouts shown here, for example: https://www.allsocket.com/en/ProductView.asp?ID=13

I'm pretty sure this is a multi-die package that has both the RAM and flash, as there's nothing else on the motherboard that "looks" right for any kind of memory (plus it's on the thick side): there's an MT6762 ARM SoC (which does not have any package-on-package stacking happening), and an MT6357 power management chip, and everything else is obviously either part of the RF section or way too small.  Searching "PA090" hasn't turned up anything useful for me so far, and I don't recognize the logo.  I may be just SOL, but wanted to check first in case anyone happened to recognize either the chip itself or the footprint.

[DavidAlfa]

Yep, called MCP memory (Multi-Chip Package), probably eMMC+DDR4.
This seems to be a BGA254 package.

Check this datasheet:
https://szrayson.com/uploadfiles/2020/05/20200521152233448.pdf

I used one of these to repurpose a dead laptop emmc, worked nicely, shows as a card reader, no config required,  just solder and use.

https://www.aliexpress.com/item/1005004787516690.html

[D Straney]

Wow, much appreciated, that all is exactly what I needed - will buy one of those adapters and try my BGA-soldering skills for the first time (or maybe just get scared and jump a few wires over based on that pinout).  Looks like my chip is missing a couple of the balls on each side but is otherwise identical to that footprint.

[fzabkar]

Spectek Laser Mark to Marketing Part Number Decoder:
https://www.spectek.com/menus/mark_code.aspx

Code: [Select]

Mark Code        Part Number            Product Family
------------     --------------         ----------------
PA090            SUVJ9K8ZZAD8DQKSL      ALL-IN-ONE MCP
FCC filings for Teracube 2E:
https://fccid.io/2AT6G-TERACUBE2E
https://fccid.io/2AT6G-TERACUBE2E/Internal-Photos/Internal-photos-5005756.pdf (internal photos)
https://fccid.io/2AT6G-TERACUBE2E/User-Manual/User-Manual-5005765.pdf (user manual)

Code: [Select]

Mark Code        Part Number            Product Family
------------     --------------         ----------------
PG022            SUVJ9D8ZZAD8DQKSM      MASS FLASH/MOBILE SDRAM MCP
SMVJ9D8ZZAD8DQKSM-062BT、SUVJ9D8ZZAD8DQKSM-053BT - 64GB: e.MMC and 32Gb: 4 x 8Gb, Dual-Channel LPDDR4X 254-Ball MCP:

https://szrayson.com/uploadfiles/2020/05/20200521152454917.pdf (datasheet)

[amyk]

Might be a bit too late to say this now but as that's a Mediatek-based smartphone, did you try using SPFlashTool to read the eMMC? Unless the SoC itself is dead,  you should be able to use SPFlashTool to boot it into Preloader/BootROM mode and image the flash.

[D Straney]

Unfortunately it is too late for that, with the flash desoldered, but that's good to know for next time!  I hadn't expected there would be a lower-level method via USB, had thought the next level down would be via JTAG or something (which Teracube support couldn't tell me anything about - they also didn't know about SPFlashTool either though).  I'm not sure about the SoC as the phone stopped responding to the point where the power LED wouldn't even turn on, but as that's likely under software control I'm not sure if that's something that happens only once it reaches the bootloader anyways.

[DavidAlfa]

Yeah, you will be having a much harder time doing it outside.
Sp flash tool can read memory back, test RAM, so you can easily check the hardware... And dump the flash!

I first tried the flying wires method, it would recognize a weird 0MB drive with a generic name, googling it showed to be a emmc controller issue.
When properly soldering it into a board, with all vdd/gnd joined, it worked.
Then bought that USB board I showed earlier, worked great, got the data and made a fast pendrive, does 30MB/s R/W over USB 2.0.

Probably a different issue... Magically bricking is uncommon.
Have you tested the battery voltage?
Should be 4.2V when charged, most phones won't turn on below 3.8-3.7V.
The usual problem is the USB connector, damaged or full of dirt preventing the connection.

I guess you have proper bga tooling, you're going nowhere without putting new balls!

Updating will wipe your data, which seems the target of this adventure.

https://community.myteracube.com/t/advanced-installing-factory-android-image-w-sp-flash/1003

[D Straney]

Ok good to know, thanks, will go straight for the hot air then and not bother with jumpers.  I don't have reballing equipment so given the small number of connections, was hoping I could get a good enough one-time readout by balling solder manually on either the board or BGA pads with my fine-tipped iron and thin solder (after cleaning up the bottom of the chip carefully with braid of course), concentrating on the flash and power supply pins to make it less likely that inconsistent-size balls on one of the unimportant ones would keep one of the important ones from connecting.

And yeah I checked the battery voltage and it was totally fine at 4.2V, the USB connector was nice and clean too, never had any connection problems before or during.  Also tried unplugging all the peripherals (cameras, fingerprint sensor, etc.) from the motherboard in case something was dragging down a power rail.  But yes I get the disbelief 100%, because I too have trouble figuring out how an ADB firmware upgrade through the bootloader would immediately make the phone show zero signs of life on reboot, even if something went wrong with the download.  Currently trying to convince Teracube support that this should count as a flaw and not "accidental damage" on my part (the difference is a $120 repair fee) as I was correctly following official Murena (e/OS) instructions and there's no way this is supposed to happen if the phone is working correctly, but we'll see how that goes...

For what it's worth, in case anyone trying to make phone decisions runs across this, I wouldn't recommend the Teracube to anyone - low price was nice, but as far as designed-for-repair phones go, the support experience has been pretty awful.  The repair guides are half-assed, they keep very few replacement parts actually in stock (they didn't have replacement speakers or vibration motors up until very recently, it took about 2 months for me to get a new USB-C board after I sheared off the mic due to their incomplete screen replacement instructions, and the screen replacement was only needed because the original protective case they shipped with it was far too loose and didn't actually hold the phone in when dropped, which they officially acknowledged at one point), and the whole process has been slow - this time it took about 2 weeks between getting in touch with them and actually shipping out a replacement phone.  I get the idea the company is just 10 people in an office somewhere.  If I'd had to actually buy a new phone, would've absolutely gone with a Fairphone 4 and never gone back to Teracube, but saving a few hundred $$ is worth the extra trouble I guess.

[DavidAlfa]

That's 0.25mm balls. I also tried, several times, didn't work  .
First try with Chinesium balls, worked!

[wellman86]

I'm in the position of the OP, D Straney.

From what I can tell this is the only message on the Internet about this, but it exactly matches the situation I'm in.  I bought a Teracube 2e for a buddy (with three flip phones) as a starter smartphone.  It got loaded with data he needs to do his job for three years then bricked with no backup.  The battery with good voltage no joy, no signs of life at all. 

Since I found this thread I've used pictures here (or referenced here) to take it down (gently enough I think I could put it back), I have the same chip.  I don't need the phone anymore (I had two spare Teracube 2es) but badly want the contents of the chip.  I have a lot of IT experiences, a decent workbench, have never worked on a phone or anything this small.

(while writing this, I felt a wave of 'am I a dumbass?' wash over me. Can I simply put this board, not yet desoldered, in a matching phone that lying here?  if the SOC is dead, I'm still where I was. If not, the phone powers up and I can get the data off?)

Anyway, there seems to be a BGA256 programming module available here, not that I'll spend that much.  https://www.hklrf.com/Medusa-ProII-Pro2-UFS153-UFS254-EMMC-Full-Set-Programmer_1917.html

[wellman86]

I tried moving the main (SOC?) board between the 'bad' and 'good' phones, the problem moved with the SOC board.  So no good news for me, but I know where the issue is now.  I just hope it's not the memory itself that took a dirt nap.