View Single Post
Old 04-02-2020, 19:14   #5 (permalink)
Crazy Poster
Join Date: Jun 2006
Location: indonesia
Posts: 50
Member: 300199
Status: Offline
Thanks Meter: 261
1. you can use ISP methode use eMMC ISP adapter

When we connect to the eMMC through the ISP procedure, make
sure to give a "check" to the direct eMMC (ISP) options, and then emmc box will automaticaly apply setting that ussualy successed to boot eMMC in this procedure, but you always have possiblilty to change the setting that you wanna apply to boot the eMMC, including the VCC and VCCQ, clock speed and bus width that you wanna use as well

2. you can put off you eMMC ic form your mobile phone PCB, and put that ic in eMMC socket, you can use all other eMMC socket that have correct pinout with the box, on the market for doing this

it was the best connection that we could have, just put your eMMC to the socket, if you use the old eMMC from broken phone, maybe you still need perform setting that we already talking about, if you put new eMMC as replacement ic for the target mobile phones, please notice that you no need perform any special setting, thats replacement ic must have a normal condition, and should success boot in a normal condition or default setting of OCR ( operation condition register )

if it not ? why you still wanna use that ic as replacement ic for your mobile phone ? take another one bro..
so we are done talking about connection setting, we will continue to talking about information that we get from identify process.


1. Select devices and Check connection :
This function will allow you to select to use syscobox as interface or use sd card reader for raw access methode, and then you can check connection between emmc box software and selected devices, all of supplies, clock, and IO ready to communicated or not

2. Configure connection :
This function will allow you to change :
- VCC value ( 2,8 volt - 3,3 volt )
- VCCQ value ( 1,8 volt - 3,3 volt )
- Clock / speed ( 1 Mhz - 52 Mhz )
- Bus width ( 1 / 4 / 8 ) interface
you can leave it default anyway or thick to the "ISP" profile if you make communicate to eMMC trough ISP methode

3. Identify target :
This function will start access to the eMMC, the sysco will acces the eMMC controler block and read the eMMC controler registry, such as :


from this registry any emmc box will get information of eMMC, including the manufacturer ID ( Samsung, SKhynix, Sandisk, Toshiba, Kingston, etc )
the product name ( KJS00M, NJS00M, VTU00M, V2W00M, K8U00M, etc ) the serial number, the manufacture date, the eMMC firmware rev, the emmc version from ext_csd revision, the partition size of boot1 - boot2 - rpmb - user area, partiton configuration, status repartition, status write protect, etc.
any emmc box also show information of android / OS ROM inside it ( if content not blank )

4. eMMC general procedure
any emmc box can access eMMC directly as binnary access, we can READ, WRITE ( binnary FILE, known as DUMP FILE ) or ERASE to the spesific partition :

- BOOT 1
- BOOT 2
- RPMB ( no need to access for now )

we can also backup or write the value of EXT_CSD to change partition configuration, resize partition, make enhanced GP to the USER AREA partition here

5. manualy execute configuration
any emmc box will allow you to change / modifiy partition configuration, including which partition enable for boot, boot acknowledge sent or not during boot procedure
you can also change the size of boot and rpmb partition here, any emmc obox will change your eMMC partition size as you wish ( not all of eMMC models supported )

6. Write CID and Restore CID
When we replace eMMC IC to the MTK based phones, we need to check the list of eMMC supported in the preloader file of the target phones, we will faced the condition that we dont have any eMMC in the list, all you need to do is :

- make sure the replacement IC have same spesification
- choose eMMC / eMCP from samsung semiconductor
- do the ussual procedure to prepare and write eMMC
- do not forget to change eMMC product name to the one of eMMC name in the list of preloader, use write CID procedure ( Product name is a part inside CID )

and if something goes wrong, you can restore it to the original product name use the button of it

7. eMMC Testpoint ( #RE TP forced boot mode ) for dead eMMC
collection of picture that show te pin #TP position on the emmc
i will put in the next post

8. Disable permanent WRITE PROTECT
WRITE PROTECT is a eMMC features that make your eMMC only can read and cant be write, in this case the phones will be looks freeze, if we USB flash programming to the phone, it would not change anythings, when we do wipe, erase,.... the phone will still in previous state, even if the phone use custom wallpaper it will remain there.

normally we are give up use a USB flash procedure and decided to use eMMC direct programming, after identify syscobox will show you the eMMC WP features is active or not, if it active we can use this button to make the WP features disabled.

Note : WP status activated when your eMMC NAND block has a problems, maybe some bad blocks, maybe some communication distract, you must realize that your eMMC condition maybe isnt health enaugh, if the phones have some problems in the near future you need to replace the eMMC IC.

9. Nand TEST
this feature allow you to make some test to the random NAND sector, any emmc box will write on it and verified it, please feel free to make few of NAND test clicking and clicking, make sure our eMMC is health enaugh.

10. Update eMMC firmware
this feature will write eMMC controler firmware, will make your eMMC to the default state, all logs will cleared, all register will restored to the original one, it will make your eMMC just like a new eMMC state
Note : not all of eMMC supported for this features

11. Factory erase & Factory reset
this features will clean up your NAND area just like new, clear and wipe all content inside of all partition, just like FLUSH it use "0"

12. Health report & smart report
this features will reporting the emmc status, emmc erased counter, how many bad blocks, ECC report,......


when you click the identify button on software GUI, you will get The infromation from connected eMMC, this information from eMMC controller register, such as OCR, CID, CSD and EXT_CSD :

box device information :
Check device connection... OK
Check Device... Done
Identify device target... OK

eMMC operation condition information
Setting device operation...
Vcc: 3.3 V, Vccq: 3.0 V
Clock frequency is 24 MHz
Connect Bus Width in 8 bit
BGA connection... Ready

eMMC CID ( card identity data ) information :
Manufacturer ID: 0x15 (Samsung)
Product name: VTU00M (56545530304D), rev: 0xF7
Serial number: 0x37C120B0
Manufacturing date: Jan 2014
CID: 15010056545530304DF737C120B01168
explaination :
from CID you will get 32 bit hexadecimal character
15010056545530304DF737C120B01168, if we make some bit slice to it, we will get :

15 : MID / manufacture id ( samsung : 15, sandisk : 45, skHynix : 90, etc )
0100 : sparebit / not specific use for now
56545530304D : PNM / product name ( 565445530304D : VTU00M )
F7 : REV / firmware version or revision of controller inside the eMMC
37C120B0 : SN / serial numberof eMMC that connected
11 : MDT / manufacturing date ( 1 : january, 1 : 2014 in the table of MDT )
68 : checksum

CSD ( card spesific data ) information :
CSD: D02701320F5903FFF6DBFFFF8E40406C
CSD register content, i will explain in the next sesion, after all of basic things alread explained

EXT_CSD ( extended card spesicfic data ) information :
EXT_CSD revision: MMC VERSION 4.5
Partition Info:
Boot1: 2,048 KB
Boot2: 2,048 KB
RPMB: 128 KB
User Area: 14.68 GB (15,028 MB)
GP Partitions: None
Hardware reset function: 0
Partition configuration:
Boot acknowledge is sent during the boot operation
Device is not boot - enabled(default)
Partition support:
Device support partitioning feature
Device can have enhanced technological features
Device partitioning possible
Boot bus conditions: 0x00
Bus width: x1 (sdr) or x4 (ddr)(default)
Boot mode: sdr(default)
Reset bus width to x1 sdr(default)
Boot area write protection: 0x00
User area write protection: 0x50
Cache size: 0 MB

Explaination :

information configuration inside eMMC that connected, it will inform you about size / density of each partiton inside, as we know, there are 4 default partition inside emmc, boot1, boot2, rpmb and user area. we can get detail size information from this logs, also we can get information of GP ( general purpose partition ) if it already created in user area partition. GP is a enhanced partition that need to create when you prepare eMMC for intel platform mobile phone, such as asus zenfone 4, 5, 6, 2 or lenovo K900, until now GP not needed by other platform, so defaultly GP must be not existing ( none ) when you identify eMMC.

partition configuration information that apply in that eMMC, such as partition to take a boot file for booting procedure, enable / disable option of send boot acknowledge during boot procedure, etc. we need to perform this configuration refer to mobile phone target requirement, some of mobile phone platform need boot 1 enable for boot and boot ack send during boot procedure, some other platform need boot 1 enable for boot, boot ack not send during boot procedure, theris 8 condition that we can set to this configuration refer to mobile phone target requirement.

and information condition of another configuration inside EXT_CSD, such as device already partitioning or not, device wp feature are active or not, etc.

Nand content information :
Read user partition... eMMC BLANK

Check eMMC contents... BLANK no OS
Get Android OS details... BLANK not Have
this information will explore nand content inside eMMC,
is it blank or have content inside nand, ofcourse it will show BLANK if you identify new eMMC or empty eMMC.

Label type that match to the PNM ( product name )
Target selected: Samsung KMVTU000LM-B503

it will select automaticaly label type of ic, this
will show information from syscobox database, what ic is it, the spesification of that ic will be informed, it is eMCP if it have RAM inside
and it will be use to automaticaly select the correct firmware for FFU procedure, when you perform update eMMC firmware.


i think we are completed the sesion 1 of the eMMC direct programming
we already explain the basic knowledge of it, i hope you enjoy to learn eMMC with micromedia STTSI indonesia

i will explain about :

2. Do read ( backup ) the partial / whole partition, if necessary
3. Do a emmc repair step if found any discrepancy on it
4. Do the appropriate configuration for the target device
5. Do write correct dump file for the target device
6. Do a final check to make sure the eMMC is ready to reused

in the next sesion in this thread, please stay with us...


im sorry if i do any mistake, CMIIW

yongky felaz

Last edited by micro_media; 04-02-2020 at 19:22.
  Reply With Quote
The Following 6 Users Say Thank You to micro_media For This Useful Post:
Show/Hide list of the thanked
Page generated in 0.10374 seconds with 7 queries