eMMC pinout on fire TV stick basic ?

[rdpdo]

Hi,

Do you have informations about pinout of eMMC chip on stick basic edition ?

Do you know if it can be rooted with hardware using rom for v2 or v1 ?

Thanks a lot !

Regards

 

[WheelchairArtist]

https://xdaforums.com/fire-tv/general/hardware-root-via-emmc-chip-t2885344

https://www.exploitee.rs/index.php/Amazon_Fire_TV_Stick​

 

[rdpdo]

Thanks you for the links... but the links above are for TV stick v1 not for TV stick basic edition.

Anyway, I will post there.

 

[iLLNiSS]

I'm also looking for the eMMC pinout on the basic. From what I've read, it's the same as the FireTV Stick 2nd Gen, but even that I can't find pinouts for.

Here are some board pics for the Basic.
UPDATE: pic updated with pinouts as I find them.

 

[iLLNiSS]

UPDATE: It seems as though the difference between the two chips may be more important than I had previously thought. The PD/ZB is the package code, and comparing the MT29TZZZ8D5JKEZB-107 W.95Q to the MT29TZZZ8D5JKETS-107 W.95Q it would appear as though the BGA is completely different (168 pin vs 221, layout also being completely different). I may just have to donate this FireTV basic to the cause and lift it. If i'm lucky my BGA rework skills are still half as good as the Xbox 360 days.


Did a bit of digging, and it seems the markings on the eMMC do not simply reflect any internal models of the chip (as evident by a simple google search), but luckily Micron has their own decoder you can use.

The chip beside the ARM CPU appears to be an eMMC/RAM combo unit. Searching their site I cannot locate anything for MT29TZZZ8D5JKEPD-107 W.95T specifically, but there are some that are very close, like the MT29TZZZ8D5JKEZB-107 W.95Q. The difference between the chips is one has 8GM RAM the other (which I can't find) is the FireTV Basic which has 1GB ram.

Regardless, it looks like we're gonna have to pull the chip to determine where the required BGA pins can be accessed externally as there doesn't appear to be anything close to the eMMC. My guess is the underside of the board will be where most the pins will be accessed (hopefully).

Data sheet can be found here

And below is a cheat sheet:

 

[iLLNiSS]

My SMD rework station came in (needed a new iron and was sick of heatgunning BGAs) so I put it to use right away and lifted the eMMC/RAM BGA.

Lo and behold, my guesstimate appears to be correct.

It would appear as though the MT29TZZZ8D5JKEPD-107 W.95T layout matches that of the board.

I unfortunately lost my bottle of rubbing alcohol so couldn't clean up the board for better pictures so this will have to do for now. Hopefully I'll have some time to trace some of the required pins in the near future once I get some more rubbing alcohol. CMD/DAT0/DAT5 can be visibly traced to outside the chip, the others will require manually mapping across the PCB for alternate locations. But for now, this is looking promising.

It's also worth noting (I picked up another FireTV in case I can't reball this one) that the one I just lifted the BGA from was a Samsung eMMC and not a Micron like my first FireTV Basic. Of course though, the datasheet is not available so I will work from the pinout in the MT29TZZZ8D5JKEPD-107 W.95T as planned.

 

[rdpdo]

Thanks you it's really a great work !

 

[iLLNiSS]

Well guys, I'm trying to interface with the eMMC by dead bug (pulled BGA, wired it to the exploiteers low voltage adapter but I'm not having any luck. Can't seem to find any issues with the wiring, but she just won't recognize in the computer. Anyone got some hints/ideas?

 

[goalguy10]

iLLNiSS do you have the pinouts? I have the same device and would be willing to try.

 

[iLLNiSS]

iLLNiSS do you have the pinouts? I have the same device and would be willing to try.

Negative. I took a break after the dead bug method came up empty handed for me. I suppose I can trace out the points still and someone else can try without lifting the BGA but I wouldn't make any guarantees.

Keep an eye out here in the near future. If I get around to it I'll have them posted here right after, I'm just busy with other projects and work.

 

[pd_ace]

Hey guys,
I opened also my fire TV stick (2nd gen) that shoud be the same like the fire tv stick basic and found the same layout of the board as shown in the picture of iLLNiSS.
The emmc on my fire tv stick is made by SK HYNIX with the part number "H9TQ64A8GTACUR-KUM".
I didn´t find the data sheet for this emmc. However, I found the data sheet for "H9TQ17ABJTMCUR" that has the same dimension but 16gb storage. In this data sheet there you can see that the pinout is the same as found by iLLNiSS. So we are heading the right direction.

 

[goalguy10]

Negative. I took a break after the dead bug method came up empty handed for me. I suppose I can trace out the points still and someone else can try without lifting the BGA but I wouldn't make any guarantees.

Keep an eye out here in the near future. If I get around to it I'll have them posted here right after, I'm just busy with other projects and work.

You get a chance to trace the points? I have one with the chip still on it I would be willing to try.

 

[Android LEDTV]

EMMC Connections 100 Images

Here is a link for buying those emmc connections
H t t p
electronics-tricks.blogspot.com/2018/07/emmc-connection-pictures.html?m=1

 

[iLLNiSS]

Well, I'm back!

Sorry for the delay, I mostly lost interest due to taking on a new position at my company.

So, good news! I've successfully communicated with the eMMC. I was having the same issues as I mentioned previously, and was about to give up when I traced some voltages while the MMC was plugged into the reader and it came alive. Not sure why, but I'm not complaining. I can confirm that the cheatsheet pinout I previously posted is correct.

Currently setting up a linux distro again so I can dump the contents. Hopefully all goes well!

If anyone who knows what they're doing feel free to request the dumps. Maybe it could help with a non hardware root.

UPDATE: So it wasn't dumping the partitions fully (kept failing randomly) and now it's no longer reading like it was before. I suspect there is too much interference so I may try shortening my wires (they are only like 6" long). So for now, all I can say is the pinouts are accurate.
UPDATE2: CLK pad ripped up as is tradition! Looks like I'll have to look at tracing again. Sorry folks!

Please refer to this post for pinouts. I will be adding them as I find them. https://xdaforums.com/showpost.php?p=74633569&postcount=4

 

[oktay50000]

since nobody helped on emmc pinout i had to do it myself

http://s6.picofile.com/file/8375750792/firestick_basic_emmc_pinout.jpg

 

[Sus_i]

since nobody helped on emmc pinout i had to do it myself

http://s6.picofile.com/file/8375750792/firestick_basic_emmc_pinout.jpg

Have you tested this with an emmc adapter?
I suppose you have to desolder the clk resistor, in order to stop the SOC from booting?

 

[oktay50000]

Have you tested this with an emmc adapter?
I suppose you have to desolder the clk resistor, in order to stop the SOC from booting?

you have to pull the emmc to use in the adaptor , if your micros soldering skill is good then you can do it without removing the resistor by using thin wires if not ,remove it program the emmc and then solder the resistor back ,its better than removing the ic itself lol

 

[Sus_i]

you have to pull the emmc to use in the adaptor , if your micros soldering skill is good then you can do it without removing the resistor by using thin wires if not ,remove it program the emmc and then solder the resistor back ,its better than removing the ic itself lol

Ok, thank you.
Yeah, I have the low voltage emmc adapter from exploitee.rs, had it connected to the first generation stick and the first generation firetv.
Yes, it's far better that removing the emmc itself :laugh: I've tried a reflow on a playstation3 years ago, it's a real mess to solder chips back with hotair

 

[oktay50000]

Ok, thank you.
Yeah, I have the low voltage emmc adapter from exploitee.rs, had it connected to the first generation stick and the first generation firetv.
Yes, it's far better that removing the emmc itself :laugh: I've tried a reflow on a playstation3 years ago, it's a real mess to solder chips back with hotair

hey mate if you have the device can you do me a favor?
i need resistor values for cmd clk and data

 

[Sus_i]

i need resistor values for cmd clk and data

CLK = 0,0 ohms
DAT = 10,0k ohms
CMD = 10,0k ohms