Decode
26-05-2008, 10:30 AM
http://home.gna.org/linux4nano/
Since the 2nd and 3rd gen nanos came out they have been ecrypted so there is no firmware editing and cutsom themes, but ipod linux are getting closer to cracking it.
http://home.gna.org/linux4nano/dumping_SST39WF800A.html
Dumping the SST39WF800A Chip
tof wrote us to give us some update about his work on dumping the SST39WF800A, he finally succeded on a second attempt but here is what he wrote us about the first attempt:
« This week I tried to extract the bootloader from a flash, but the chip was damaged during the soldering, either by the iron heat, or static electricity, or mechanical stress during "unsoldering".
What I did:
"Unsolder" the flash by pulling it (brutal, next time I will unsolder by hot air);
Glue it to a test board;
Solder 40 coil wires to the balls;
Check electrically the connections via the clamp diodes presence. I automated this step;
Check shorts between wires (automated);
Read it out with a microcontroller and send the results to a serial port. The electrical tests fail, there are some clamp diodes lacking (failed pins, especially /OE).
Some photos of the different steps are available further down.
I will try again as soon as I find another broken nano.
A few advises:
For the unsoldering, I lifted the chip with a blade. This probably cracked the die, so next time I will try unsoldering with hot air. the BGA is glued down, so I do not know how the glue will behave in the hot air. lifting the chip was not too difficult, the glue was not too strong.
If the hot air fails, another method is to bend the PCB, then the balls remain on the chip and not on the board like I had. I tried it after with the ram chip, it seems to work.
Use very thin wires, I first tried with thicker ones, but it makes mechanical stress on the solder joints use a very thin iron tip, not too hot, because we solder directly to the chip.
Use a good magnifying glass and thin tweezers.
Static electricity counter measures are needed.
First put solder on 1/2 mm of wire to get rid of the lackering. the iron heat together with the flux burns away the lackering. You can use a second iron with a normal tip and hotter setting for this part.
then gently and very quickly press the end of the wire onto the ball with the iron tip. then place, cut and solder the other end of the wire. We now can extract the bootloader, but we really need your help !!
We need broken nanos II to succeed ;)) »
Since the 2nd and 3rd gen nanos came out they have been ecrypted so there is no firmware editing and cutsom themes, but ipod linux are getting closer to cracking it.
http://home.gna.org/linux4nano/dumping_SST39WF800A.html
Dumping the SST39WF800A Chip
tof wrote us to give us some update about his work on dumping the SST39WF800A, he finally succeded on a second attempt but here is what he wrote us about the first attempt:
« This week I tried to extract the bootloader from a flash, but the chip was damaged during the soldering, either by the iron heat, or static electricity, or mechanical stress during "unsoldering".
What I did:
"Unsolder" the flash by pulling it (brutal, next time I will unsolder by hot air);
Glue it to a test board;
Solder 40 coil wires to the balls;
Check electrically the connections via the clamp diodes presence. I automated this step;
Check shorts between wires (automated);
Read it out with a microcontroller and send the results to a serial port. The electrical tests fail, there are some clamp diodes lacking (failed pins, especially /OE).
Some photos of the different steps are available further down.
I will try again as soon as I find another broken nano.
A few advises:
For the unsoldering, I lifted the chip with a blade. This probably cracked the die, so next time I will try unsoldering with hot air. the BGA is glued down, so I do not know how the glue will behave in the hot air. lifting the chip was not too difficult, the glue was not too strong.
If the hot air fails, another method is to bend the PCB, then the balls remain on the chip and not on the board like I had. I tried it after with the ram chip, it seems to work.
Use very thin wires, I first tried with thicker ones, but it makes mechanical stress on the solder joints use a very thin iron tip, not too hot, because we solder directly to the chip.
Use a good magnifying glass and thin tweezers.
Static electricity counter measures are needed.
First put solder on 1/2 mm of wire to get rid of the lackering. the iron heat together with the flux burns away the lackering. You can use a second iron with a normal tip and hotter setting for this part.
then gently and very quickly press the end of the wire onto the ball with the iron tip. then place, cut and solder the other end of the wire. We now can extract the bootloader, but we really need your help !!
We need broken nanos II to succeed ;)) »