Simpler solution for disabling the DCM telematics - Silencing Antennas

That 3rd link suggests it’s eMMC, which leads me to think this might be the pin out?

https://easy-jtag.com/faq-pinouts/bga162/

If so might not be too hard to dump it with the right hardware.

 

Some more links you might be interested in:
MT29RZ4B2DZZHHWD-18I.84F Micron Technology Inc. | Integrated Circuits (ICs) | DigiKey

MT29RZ4B2DZZHHWD-18I.84F Micron | Mouser

MT29RZ4B2DZZHHWD-18I.84F - Micron - Flash Memory, NAND with Mobile LPDDR2, 6 Gbit (newark.com)

Finally found a data sheet:
4Gb: x8 NAND with 2Gb: x32 LPDDR2 MCP (farnell.com)
at 265 pages that should give you some reading time.

 

https://xkcd.com/356/

 

I wonder if we could just ground out the write protect pin (WP#) to prevent writing to the chip.

 

I'm not the one to ask; @jboudreaux1965 is the one who has shown interest in this chip. I would be lost in the microprocessor and memory world. However, with a pin out that is inaccessible such as this 162-ball chip, how would you get to the pin to ground it. Seems like taking a heat gun and removing it is the best bet. That is if it does not do something catastrophic to the rest of the board. Removing the SIM seems to have not any consequence to the rest of the DCM.

 

Yeah it may not be possible. If that pin connects to something, it could be grounded at the other end. Or a clever person could get to it from the side since it’s one of the outside balls.


Short of that yeah I’d just desolder the whole chip and see what happens.


A person may also be able to cut power to the storage part of the chip by cutting the trace for Vcc with an exactly knife.


I guess it comes down to what the side effects are and do we care about them.

 

I don't think any of the traces are readily accessible, if you haven't already seen: This is before I removed my SIM (lower right corner).

 

True, but I bet at least one of those numerous capacitors is on our vcc. Would definitely take some probing with it powered up to find it though.

 

does anyone know what pin powers up the board with the modem on it? i can try to communicate with the Qcom chip through the usb interface, but i am not sure where to apply power

 

someone would have to sacrifice a unit and pull the daughter board off and maybe the BGA chip to find the traces. probably the best route would be to treat it like a mobile phone or hotspot and go in through the QCOM chip. I pulled out the couple of old readers i still had in the attic and the jtag is parallel and I2c is serial. i'd have to load windows on an old laptop to even try to start digging.

If i can get a USB connection to the qcom chip I can at least talk to it. without the specific drivers for the chip access would be limited

 

I am loving this thread!

Keep throwing the info at us.

 

Yes, one of those many intimidating caps. However, I liked your suggestion of the "Write pin" grounding better.

 

Why not power the whole board? That should power all the chip(s). Wiring diagram was shown earlier in this thread to find the pins on the connector.

 

I missed the wiring diagram I'll go back and find it, thanks!

 

I assume you are talking about the Micron BGA? First off someone needs to pull the chip off the board and we have to identify the traces to the WP and VCC pins to even get access. Then to prevent writing to any flash IC you have to connect the WP to the VCC or other spot with the same voltage. I didnt look at the specs, but its probably 5v. By default the WP pin is always connected to GND to allow writing. In the old days you could just disconnect the WP pin, now you almost always have to supply voltage to lock it. You have to be careful, some newer chips have a security feature built in, when I have time I'll read more on the chip.

Along those lines I have been reading the white papers on the XM unit, there is security built into the subscription chip to prevent a simple WP, but I may be able to find a way around it so they can't deactivate it
I wish I still had all my old equipment, but like I said I got away from hardware hacking years ago.

anyone have some extra boards laying around that I can take apart?

 

Post #166, took me a while to find the post.

Also see: Part Detail | Micron Technology Inc.
seems to have the I/O at 1.8VDC; do not know if the VCC is ever much higher than the I/O.

Edited: added info

 

I do not know specifically which chip @0xDEADBEEF was referencing, I just "suspect" without any real information that there may be various voltage levels running around on the DCM to the associated chips. I know nothing about the write levels as you can see.

I believe I did find the Spec sheet:
4Gb: x8 NAND with 2Gb: x32 LPDDR2 MCP (farnell.com)
Don't know enough to make heads or tails from it thought.

 

on an amateur with home equipment level you have to apply hot air to the BGA and remove it from the board. You get the pinout diagram for the chip and identify the pins you are looking for. Then you look on the board and trace the lead that comes from that pin and hopefully there is a place you can tap into it there. Otherwise (not home level DIY) you have to remove the BGA, solder in a socket or a test board for the BGA to access the pins.


https://hackaday.com/2023/03/23/working-with-bgas-soldering-reballing-and-rework/

this will give you an idea of what I am talking about, you have to remove the chip and find the leads to each pin

 

Yup, that is how I removed the SIM with hot air, really was much more simple than I expected. First time working with SMD. On the SIM note the large solid solder pad under the chip. I don’t know why they would use such a large pad, as far as I know there is no heat generation from a SIM. Post #121 for pictures.

As far as the other chips within the AL-T52V1 I would think Denso would follow the same practices they did in mounting the AL-T52V1. See the exposed pads on the underside of the area occupied by the AL-T52V1. I think most traces are within the interior layers of the DCM PCB.