0.4A, no shorts, init eMMC failed (Hekate)

tonike · March 20, 2021, 7:55am

This unpatched switch does not boot. There is no signs of prior rework and no signs of dropping damage or liquid damage. The owner said it has been used only on stock fw and it was sitting on the official dock for few months without use and now it didn’t turn on anymore.

When I plug the charging cable (draws current at 0.4A) there is only black screen and most likely goes to autoRCM mode. I can run Hekate (without jig) but I cannot launch the eMMC (failed to init).

I have tested it with a known good battery. I checked the USB-port with breakout board and everything looks normal. I couldn’t find any shorts on the caps of M92, BQ, P13, MAX77620 and inductors were not open line. BQ diode values also look normal (and voltage were 15V and 4V), at M92 I get 3.3V and 1.8V

Is the eMMC corrupted? How can I verify it?

Based on this forum the problem could also be on the fuel gauge IC (MAX17050) or on CPU buck failure MAX77621. How can I troubleshoot these chips?

What other troubleshooting I can do with Hekate?

Severence · March 20, 2021, 9:58am

BQ, M92, and Fuel gauge seem fine afaict, though it doesn’t hurt to let the battery charge up a little just to verify.

What’s your resistance to ground on 1V8PDR and 3V3PDR, these rails are needed for EMMC and if either are being pulled low can cause the failed to init issue,

It’s also worth doing a diode/resistance check on the EMMC connector on the board and verify all lines are good.

Though it doesn’t always give conclusive results, you can measure resistance to ground on the inductor output and compare to a known good, then switch polarity.

You could also attempt to boot L4T Ubuntu and if it boots measure the voltage on the Inductor

tonike · March 21, 2021, 9:52am

Thank you again Severence!

1V8PDR is 14kohms (9k reversed polarity)
3V3PDR is 0.X Mohms (21k reversed polarity)

I did diode check on the eMMC female connector and the values were close to Calvin’s.

Ubuntu does boot. and charging current draw is at around 1.7A. To which inductor you are referring to? I’d guess that since Ubuntu works, the fuel gauge and CPU bucks are fine also.

Is the eMMC tied to the SoC? If not can I use another eMMC to test on this switch?

tonike · March 21, 2021, 10:08am

And to add, I do get 3v3 and 1v8 at the eMMC female connector

De9ed · March 21, 2021, 12:09pm

I think there is 2 question: Was it hardware damaged that lead to the switch going into rcm mode or the owner misleading you and said it was only used in stock fw ? (within hekate can you turn off autorcm ?)

Would you be able to run atmosphere and see what error it shows? atmosphere on sysnand (emmc)

Download and run lockpick.rcm : https://github.com/shchmue/Lockpick_RCM/releases/tag/v1.9.0

Download atmosphere and hekate and place in a formatted fat 32 sd card

Place hekate_ipl.ini in the sd root/bootloader/

[config]
autoboot=0
bootwait=1
verification=1
backlight=100
autohosoff=0
autonogc=1

{------ Atmosphere ------}
[Atmosphere via Fusee]
payload=atmosphere/fusee-primary.bin
icon=bootloader/res/emu_boot.bmp
{}

[Atmosphere FSS0 emuMMC]
fss0=atmosphere/fusee-secondary.bin
kip1=atmosphere/kips/*
icon=bootloader/res/emu_boot.bmp
{}

[Atmosphere FSS0 SYS]
fss0=atmosphere/fusee-secondary.bin
kip1=atmosphere/kips/*
emummc_force_disable=1
icon=bootloader/res/sys_cfw_boot.bmp
{}

[Stock SYS]
fss0=atmosphere/fusee-secondary.bin
stock=1
emummc_force_disable=1
icon=bootloader/res/stock_boot.bmp
{}

Severence · March 21, 2021, 4:12pm

Indeed.

I’ve never done this on a switch directly, but can you try dumping the EMMC from terminal? I have no idea if you can do this from wthin L4T Ubuntu but it would save a process for the next few steps and it would also be nice to know if this works for future reference

Failing that, what does Biskydump display, can it successfully retrieve keys, smiley face?

I think the next best thing to do here is try and get and backup your Boot0, Boot1, prodinfo and prodinfof partitions and transfer them to another module so we can rule that out.

It is unfortunately

You can read the data off an EMMC that is not paired with the SoC using Hekate etc but you have to watch out for the FW version, if you were to stick this suspected bad EMMC module on another switch board and lets say it was on FW V9.XX but the boards original EMMC etc was on FW V8.XX then you’ll burn the fuse, at which point you’d effectively brick it until you update the FW up to or past that point, this isn’t a huge deal on unpatched boards as you can use Hekate etc but this would be a real problem if the one of the boards was patched… hope that makes sense.

tonike · March 21, 2021, 6:04pm

I can turn it off but it will turn back on automatically and I don’t need to use jig to enter RCM mode.

I tried all those launch configs and I get “failed to init emmc”. Should I try emuNAND?

I get “No emuMMC config found” and when I choose “Dump from sysNAND” I get “Unable to init MMC”

I’m not familiar with this tool and I couldn’t find any useful information about it. Is it some kind of payload? Can you send it to me via PM?

I tried the backup tools in Hekate but pretty much all those give the same error “failed to init emmc”. If I run fusee-primary payload I get error “[NXBOOT] Failed to mount emmc”

I need to find more information how to make dumps from ubuntu terminal

Severence · March 21, 2021, 6:16pm

You can find it here https://switchtools.sshnuke.net/
sorry my typo probably prevented you from finding it, though I’m expecting this to fail with an error given your previous tests as i think you have something physically wrong with the EMMC module. Can you take a photo of it front and back so i can inspect the PCB. It’s not uncommon for them to fail though it’s typically as a result of liquid damage, but i think you mentioned this board wasn’t liquid damaged.

It will involve the DD command, but whether you have access to nand I’m not sure. It’s possible you could use a GUI based tool, i think gparted lets you make backups… sorry been so long since I’ve used a Linux system i forget.

tonike · March 21, 2021, 7:44pm

Sure, please watch these videos
https://youtu.be/G9PpFmffFbE (NAND at 0:10)
https://youtu.be/7J2NE4UyeZw

Severence · March 21, 2021, 8:00pm

Hmm EMMC looks fine and everything looks stock and nothing is really jumpring out at me, can you flip the EMMC module over also, it’s likely not going to reveal anything but can’t hurt.

The 0 ohm resistors around the Realtek IC look very discoloured, for whatever reason the Realtek IC is always covered in flux on stock boards, this might be that… but they look darker than normal which might indiicate excess heat in this area, might be worth checking - though i don’t think this relates to your EMMC issue in any way.

Let me know the results of Biskeydump or DD in ubuntu.

I think failing that it will be connecting the EMMC module up to a computer and attempting to dump from there or failing that an IC reball or deadbug and failing that it will be freeze or heat and see if that can temp resolve an internal fault on the EMMC and if the partitions become temp availiable to dump the critical partitions (which I’ve had to do before) quickly

tonike · March 21, 2021, 8:37pm

I’ll clean the resistors around the ALC IC and measure the resistance the next time I’ll remove motherboard.

I have done similar thing with N3DS. I soldered SD card reader to the eMMC NAND chip, backupped the data and restored modified data. Not sure if I can do the same here or if it’s any helpful.

I can try reflowing the NAND chip but I want to leave it as a last resort.

No success. Error initializing SDMMC

![IMG_0150|666x500]

Severence · March 21, 2021, 9:16pm

EMMC looks pristine as you say. but it does appear to be your issue.

If dumping via L4T Ubuntu doesn’t work i think you’ll have to move on to the other methods.

I don’t recall what the IO voltage is on the EMMC, might be worth checking the datasheet and making sure it’s tolerant to whatever voltage your SD adapter is, last thinig you want to do is unintentionally fry the IC.

I use a low voltage EMMC adapter, though i have got a more dedicated board coming soon which is more plug and play, I’ll digg ip the link for you

I wouldn’t bother refflowing the IC, very rarely the issue, plus we want to save the heat cool cyles for later in an effort to temporary resolve an internal fault. Hitting it with over 300C will redce the chances of that being successful

Severence · March 21, 2021, 9:19pm

Links here https://github.com/ignasurba/mmcblkNX

tonike · March 22, 2021, 11:40am

Okay, so I guess my options are

attempt to access the partitions using Ubuntu
attempt to dump the partitions by manipulating temperature and using an external eMMC reader and restoring it to another eMMC module
reballing IC (last resort)

I don’t have any excess eMMC modules. Are these easily available?

Wow, this tool looks convenient

dogethedog · March 23, 2021, 2:06am

its just a standard bga169 emmc module. you can find those on any mobile phone board and solder to the original emmc riser board

tonike · April 19, 2021, 6:50am

I tried to access the memory module’s partitions using single bit mode with a little bit of heat and also reflowing, but no success. I guess I have to pronounce this switch dead.