Ask HN: How to read data directly from a flash chip?
5 comments
First thing to do is have a look at the datasheet <http://www.eonssi.com/upfile/p200892917341.pdf>. I was hoping that it'd be SPI or I2C, but it's a big parallel flash, so reading it is going to take some hardware.
Comes in two packages a TSOP and a BGA. I'm hoping you have the TSOP. If you've got a TSOP, you can get a socket for it / probe it. You can probably also get a socket for the BGA but you might be paying out the nose.
I like the JTAG approach as well. Assuming it's connected to a processor or FPGA that's got boundary scan, even if the rest of the system isn't cooperative you can bitbang the contents of the flash out using the JTAG hardware.
The JTAG silicon - even if it's on the same die as the processor / FPGA is totally separate. It's something like a tiny state machine. Read up on it, really powerful. <https://en.wikipedia.org/wiki/Boundary_scan>
Another option is to transplant the interesting flash from the dead device to an identical working device. Use the working device to read out the contents of the memory. This will require some soldering skills.
Or.. you can pull it off the board, and get a programmer. The industry std is Xeltek but they're $$$$. I've got a TL866, works pretty well. <http://www.eevblog.com/forum/blog/eevblog-411-minipro-tl866-...
Or.. you can read the datasheet and build yourself something with an arduino. You'll run out of pins though, so maybe a pro? or maybe port expanders.
Good luck!
Comes in two packages a TSOP and a BGA. I'm hoping you have the TSOP. If you've got a TSOP, you can get a socket for it / probe it. You can probably also get a socket for the BGA but you might be paying out the nose.
I like the JTAG approach as well. Assuming it's connected to a processor or FPGA that's got boundary scan, even if the rest of the system isn't cooperative you can bitbang the contents of the flash out using the JTAG hardware.
The JTAG silicon - even if it's on the same die as the processor / FPGA is totally separate. It's something like a tiny state machine. Read up on it, really powerful. <https://en.wikipedia.org/wiki/Boundary_scan>
Another option is to transplant the interesting flash from the dead device to an identical working device. Use the working device to read out the contents of the memory. This will require some soldering skills.
Or.. you can pull it off the board, and get a programmer. The industry std is Xeltek but they're $$$$. I've got a TL866, works pretty well. <http://www.eevblog.com/forum/blog/eevblog-411-minipro-tl866-...
Or.. you can read the datasheet and build yourself something with an arduino. You'll run out of pins though, so maybe a pro? or maybe port expanders.
Good luck!
Some more info - openocd is a not bad open source JTAG server. <http://openocd.org/>
The TL866 I suggested does support your part.
If you've got the flash in a TSOP - another trick for getting at the flash is to find a FPC cable that has the same pitch as your TSOP and solder it down on the board. FPCs with varying pitches are available at Digikey etc. That way you don't have to remove the flash from the board.
The TL866 I suggested does support your part.
If you've got the flash in a TSOP - another trick for getting at the flash is to find a FPC cable that has the same pitch as your TSOP and solder it down on the board. FPCs with varying pitches are available at Digikey etc. That way you don't have to remove the flash from the board.
It will all depend on the PCB assembly & design. If that is still somewhat functional or even if you think it is bricked, you may still be able to recover the flash through the processor. I have had to deal with a PCB Design that utilizes the AtMega 1284p processor and if the clock flag(s) get set wrong it is "bricked" but can be reset and functional again. Like you I am not a hardware engineer but have written my share of firmware although it always helps to have a hardware guy with some design/debug experience around.
Either way, if you have never dealt with the hardware part it might take you a little bit but you can figure it out. I suggest you start with the processor data sheet and familiarizing yourself with JTAG. That is usually your saving grace, at least it has been mine a number of times. BTW, this can be done even on third party boards, you just have to figure out the processor and the pin outs to get the right access.
bisrig has good suggestions and he is absolutely right you might be able to find a PCB shop that has the ability to pull the flash data off for you. There are even smaller shops you can find that might be able to do it at a reasonable cost. Just a thought too, you might look specifically for data recovery companies, many generally focus on Hard Drives, but my bet is some pull data off flash too (never know at least worth a phone call or two).
Either way, if you have never dealt with the hardware part it might take you a little bit but you can figure it out. I suggest you start with the processor data sheet and familiarizing yourself with JTAG. That is usually your saving grace, at least it has been mine a number of times. BTW, this can be done even on third party boards, you just have to figure out the processor and the pin outs to get the right access.
bisrig has good suggestions and he is absolutely right you might be able to find a PCB shop that has the ability to pull the flash data off for you. There are even smaller shops you can find that might be able to do it at a reasonable cost. Just a thought too, you might look specifically for data recovery companies, many generally focus on Hard Drives, but my bet is some pull data off flash too (never know at least worth a phone call or two).
A couple of general ideas to help you scope the solution space:
- If you can do something with the part still in-circuit (i.e. the PCB assembly itself is still functioning), that's probably a preferable way to proceed. For instance, if the part is connected on the PCB to a processor, you may be able to connect to the processor via its JTAG or debug interface and dump the attached memory that way.
- If you're going to try to go down the flash programmer route, note that this will require you to get the part off the board, which can be tricky if you don't have the right equipment (especially if it's a BGA).
- One thought that comes to mind re: flash programmers is that some of the components distributors will do pre-programming as a service, which means they have equipment to program the loose parts (& may be able to use the same equipment to read the contents back out). If you or your company have a relationship with one of these sorts of companies, you might be able to lean on your sales rep to get a favor.
- If you can do something with the part still in-circuit (i.e. the PCB assembly itself is still functioning), that's probably a preferable way to proceed. For instance, if the part is connected on the PCB to a processor, you may be able to connect to the processor via its JTAG or debug interface and dump the attached memory that way.
- If you're going to try to go down the flash programmer route, note that this will require you to get the part off the board, which can be tricky if you don't have the right equipment (especially if it's a BGA).
- One thought that comes to mind re: flash programmers is that some of the components distributors will do pre-programming as a service, which means they have equipment to program the loose parts (& may be able to use the same equipment to read the contents back out). If you or your company have a relationship with one of these sorts of companies, you might be able to lean on your sales rep to get a favor.
If you are looking to just dump your Flash then you should look for tools such as http://www.ezoflash.com/ezoflash.htm. JTAG is good option but for that you need your controller to be able to exercise JTAG sequence (above responses have good suggestions). [Google Search Term: EN29LV640B Adaptor or Programmer].
However, fundamental question is, if your device is bricked, then why you are not asking how to un-brick it or recover it and why you want memory dump? I am asking this question because dumping the flash memory which is on PCB is daunting task for even seasoned hardware engineer. May be there is alternate way to fix your actual problem.
But again it all depends what you want to achieve.
However, fundamental question is, if your device is bricked, then why you are not asking how to un-brick it or recover it and why you want memory dump? I am asking this question because dumping the flash memory which is on PCB is daunting task for even seasoned hardware engineer. May be there is alternate way to fix your actual problem.
But again it all depends what you want to achieve.
What is a good method to go about this? Are there any flash-dumping-as-a-service companies anywhere? If I need to do this myself, what pitfalls can I expect and what equipment do I need?
The chip is a EN29LV640B btw.