Yes, that's exactly what I recommended. (Internal card readers are usually PCI/PCIE-based, which present the card directly to the OS, rather than emulating a USB flash drive.)

If you use Linux, changing the bootloader may be even easier, as it will show up as a separate block device "/dev/mmcblkXboot1" (or maybe boot0 - you will need to check it yourself). By default, this device will not be writable, to guard against accidental overwrites - read the documentation for enabling writes to the boot partitions.

Hi,

I am still yet to see somebody implement off power read/write of the eMMC chip. ATF manages with so many wires by the fact that the chip
is still wired to the CPU and all control signals are handled correct. If you watch the protocol on screen you will see that ATF FGPA asserts
low's and high's(high levels slightly higher than phone's 1s and lows via bridging few gates in parallel to assert low impedance on the bus) during
the important boot mode check when the eMMC is in 1bit SDIO mode, immediately after restart.

To use external MMC reader and not powered phone PCB you will need bit more lines connected, maybe less with a small microcontroller
development board and using the HW SDIO interface(most chips have it these days) e. g. - STM32F4Discovery, but you still need to cook
custom boot sequence yourself.

The standard firmware in off the shelf reader would probably not manage to take control of the eMMC as i suspect it not communicate in 1 bit
SDIO mode, probably do in the beginning and then switches to wider interface.

BR

Actually, the eMMC chip documentation shows that it fully supports 1-bit MMC (not SDIO, and not SPI) mode, and only switches to a higher bus width when explicitly requested to do so.

EDIT: Not very relevant, but open the Lumia 710 boot loader MBN in a hex editor, and go to address 0x1E490 for a good laugh. Or, if you have the Lumia 800 Qualcomm boot loader image, it's @ 0x1E52C.

Hi,

I guess 1-bit MMC = SDIO, sorry my bad. The phone for sure switches to wider bus after initial boot sequence, i haven't reversed this part, not sure
where it is, probably the bootrom. But during this initial chip inquiry is the golden opportunity to take control and off course hats off to X-Shadow for
the hack and implementation (!).

What version of the bootloader ? I have some old diss, i have ptr to a string at this location.

BR

Originally Posted by .NetRolller 3D

Actually, the eMMC chip documentation shows that it fully supports 1-bit MMC (not SDIO, and not SPI) mode, and only switches to a higher bus width when explicitly requested to do so.

EDIT: Not very relevant, but open the Lumia 710 boot loader MBN in a hex editor, and go to address 0x1E490 for a good laugh. Or, if you have the Lumia 800 Qualcomm boot loader image, it's @ 0x1E52C.

How about accessing the eMMC while the board is otherwise down? In that case, no worries about switching to a higher bit width.