Hi all, following on from kurohyou's excellent work on the KF2, I thought I would go about trying to develop a tutorial for unbricking a hardbricked Kindle Fire HD 7". This would be for the 2012 model, NOT the 2013.
A little bit of background on myself. I have always had a keen interest in electronics and studied microelectronics at college. I am pretty good at soldering etc even on small SMD devices, even more so now I have spent out on some decent kit (helping hands, rework station etc). Now I have decided to carry out this project as a summer hobby and hopefully I will get some support from you guys.
I have managed to piece together enough information that I think will enable me to complete this tutorial, with the exception of Linux, something that I am very new to and would need some assistance with.
I have seen common names among the forums when it comes to this type of subject, stunts513, soupmagnet, hashcode to name a few. I am hoping with the assistance of these members I can complete a comprehensive guide on unbricking a Kindle Fire HD 7", similar to http://forum.xda-developers.com/showthread.php?t=2415870
But please beware, IF YOU HAVE ANYTHING OTHER THAN A KINDLE FIRE HD 7" DO NOT USE THIS GUIDE!!
My main goal is to acquire a dead Kindle Fire HD 7" motherboard, as easily as possible. Unfortunately looking on eBay there seem to be very few from the UK and they are normally very expensive. I will keep looking but if anyone is willing to donate a non working or working motherboard for this cause I would be very grateful, just PM me if you can help. Just bear in mind due to the process it needs to go through, you will not get a working motherboard back, should you want it returned.
I aim to completely remove the eMMC from the motherboard and get exact pinout locations, as kurohyou did with his excellent KF2 guide. I will then use the same USB SD Card adaptor to see if the eMMC can even be read in the same way as the KF2. I have working knowledge of GParted in linux so I will also be using this to verify partition layouts and sizes. Once I have had any success in doing this I will update this post to reflect my progress.
There is my plan so far, if this has already been done, someone please tell me as I cannot find it anywhere.
overlode said:
Hi all, following on from kurohyou's excellent work on the KF2, I thought I would go about trying to develop a tutorial for unbricking a hardbricked Kindle Fire HD 7". This would be for the 2012 model, NOT the 2013.
A little bit of background on myself. I have always had a keen interest in electronics and studied microelectronics at college. I am pretty good at soldering etc even on small SMD devices, even more so now I have spent out on some decent kit (helping hands, rework station etc). Now I have decided to carry out this project as a summer hobby and hopefully I will get some support from you guys.
I have managed to piece together enough information that I think will enable me to complete this tutorial, with the exception of Linux, something that I am very new to and would need some assistance with.
I have seen common names among the forums when it comes to this type of subject, stunts513, soupmagnet, hashcode to name a few. I am hoping with the assistance of these members I can complete a comprehensive guide on unbricking a Kindle Fire HD 7", similar to http://forum.xda-developers.com/showthread.php?t=2415870
But please beware, IF YOU HAVE ANYTHING OTHER THAN A KINDLE FIRE HD 7" DO NOT USE THIS GUIDE!!
My main goal is to acquire a dead Kindle Fire HD 7" motherboard, as easily as possible. Unfortunately looking on eBay there seem to be very few from the UK and they are normally very expensive. I will keep looking but if anyone is willing to donate a non working or working motherboard for this cause I would be very grateful, just PM me if you can help. Just bear in mind due to the process it needs to go through, you will not get a working motherboard back, should you want it returned.
I aim to completely remove the eMMC from the motherboard and get exact pinout locations, as kurohyou did with his excellent KF2 guide. I will then use the same USB SD Card adaptor to see if the eMMC can even be read in the same way as the KF2. I have working knowledge of GParted in linux so I will also be using this to verify partition layouts and sizes. Once I have had any success in doing this I will update this post to reflect my progress.
There is my plan so far, if this has already been done, someone please tell me as I cannot find it anywhere.
Click to expand...
Click to collapse
Great job,will be useful to a lot of people if successful. And as for the support,we're all here to help ya
A lot of people spend time tinkering with Linux partitions,so getting support won't be as difficult as getting a dead motherboard,which is what worries me now. I would suggest you to buy a Fire HD,root it and leave the rest to your imagination (I would try to flash a Galaxy S3 Kernel using Odin or something )
Anyway,good luck!
I have managed to get myself a cheap Fire HD so just waiting for it to come in the post.As far as I can tell the Fire HD uses a very similar eMMC chip as the Fire 2 so I am hoping the partition structure is the same. If /dev/sdc2 is 256Kb and listed as bootloader then I think it should be straightforward to flash in the same way using the dd command.
Anyway, more updates to come
Update - I have now got a motherboard from a Kindle Fire HD 7", will go ahead and solder USB adaptor in the next few days and see what happens - more details to follow.
Ok, so I have opted to try and use a mini SD card adaptor for this project as it is very easy to kill a USB SD card adaptor if you get just one wiring point wrong, although this does have an increased risk of frying your USB port if you are VERY unlucky.
The SD card is wired like so -
https://www.dropbox.com/s/9zsrbevo97ifccj/SD%20Card%20wiring.JPG?dl=0
I drilled some very small holes close to the end of the mini SD internal connections to add stability to the wires. I used Valery_'s image to get the connection labels -
https://www.dropbox.com/s/fur0gxy72lox6yb/SD%20Card%20pinout.jpg?dl=0
For the VCC and VccQ wires, because there are two paired together it was not going to be possible to fit them into the SD card adaptor so I made a fly lead off of the main VCC wire -
https://www.dropbox.com/s/ocmw7p2dgsp4ia6/VCC%20fly%20lead.JPG?dl=0
Next I will be attempting to solder each wire onto the KFHD7 motherboard.
All done. I haven't cut the tracks that have been indicated in this picture as my PC recognises the eMMC under Windows 8 -
https://www.dropbox.com/s/1lyumxvw5h7agx4/Fire%20HD%20Pinout%20with%20VDDI.jpg?dl=0
So here is the motherboard soldered up -
https://www.dropbox.com/s/n30jpvbyhapoub7/Motherboard%20wiring%20KFHD7.JPG?dl=0
Update - after the eMMC was not recognised by Ubuntu I cut the 2 tracks in question, and still nothing. I am also now getting 0v from the card reader however the laptop still recognises SD cards inserted. I will acquire some more USB SD card adaptors and try again with those. More to follow.
Ok, a little frustrating but after checking and rechecking the solder points on the motherboard they are definitely correct, however Vcc, VccQ and Vss are still casting some doubt in my mind, considering that the VccQ and Vss points are both sides of capacitor 801 (C801). I am not 100% convinced that Vcc, VccQ and Vss have other points on the board. Reading the eMMC specifics here there are lots of Vcc, Vss and VccQ. I am not totally sure if there is a definite one that needs connecting
Any help on this would be much appreciated.
Ok, another post, sorry
Been doing some more research on the eMMC chip and I have found an official data sheet for the chip here
It seems that there are different pins for Vss and Vcc and I am wondering if this is causing the problem as I may be supplying power to the wrong part of the eMMC. Will see if R10 and T10 on the schematic lead to anywhere else and negate the need to cut the tracks, something which I still don't quite fully understand. Edit - R10 (Vss) does not seem to have a place on the board
As you can see from the following table it lists all the necessary locations for applying power to modify the eMMC -
https://www.dropbox.com/s/a7f299p492gf7qe/eMMC%20Pinout.jpg
VDDF is Vcc and VDD is VccQ .
I will check out these two pins later on and see where they lead on the board.
More to follow...
overlode said:
Ok, a little frustrating but after checking and rechecking the solder points on the motherboard they are definitely correct, however Vcc, VccQ and Vss are still casting some doubt in my mind, considering that the VccQ and Vss points are both sides of capacitor 801 (C801). I am not 100% convinced that Vcc, VccQ and Vss have other points on the board. Reading the eMMC specifics here there are lots of Vcc, Vss and VccQ. I am not totally sure if there is a definite one that needs connecting
Any help on this would be much appreciated.
Click to expand...
Click to collapse
http://forum.xda-developers.com/attachment.php?attachmentid=2784284&d=1402079403
http://forum.xda-developers.com/showthread.php?t=2775022
good luck
Valery_ said:
http://forum.xda-developers.com/attachment.php?attachmentid=2784284&d=1402079403
http://forum.xda-developers.com/showthread.php?t=2775022
good luck
Click to expand...
Click to collapse
Ok, I have put your image side by side with your top image and colour coded the points (Just bear in mind the right hand image is a mirror image of the BGA). No matter how I look at it, everything is correct and all Vcc, VccQ and Vss points are interconnected so I do not see how it is not working. Can you explain to me the need for cutting the tracks in your original image and what the version 1 and version 2 mean please?
How have you got on with this? The closest I have been is Windows 8 detecting something but Ubuntu doesn't see anything.
Cheers
overlode said:
Can you explain to me the need for cutting the tracks in your original image and what the version 1 and version 2 mean please?
Click to expand...
Click to collapse
Cutting the tracks had two goals: 1. to decrease power of supply from cardreader, 2. to protect the chips which are supplying 1.8 V
Additionally I used diode Schottky to decrease voltage to 1.6 V
There were impulses CMD and CLK, but there was a problem with signals Data0 - Data3. Level on these pinouts didn't change, was about 1 V
Supposedly the processor blocked Data0..3
I tried to connect cardreader with signal Reset on the motherboard, but there weren't Data0..3
So both in the case with 1.8 V and in the case with 3.3 V on the contact VccQ, there was a voltage about 1 V on Data0..3
I think there is a possibility of access to eMMC if OMAP is blocked and then it will make Data0..3 free (third output state Z)
Valery_ said:
Cutting the tracks had two goals: 1. to decrease power of supply from cardreader, 2. to protect the chips which are supplying 1.8 V
Additionally I used diode Shotky to decrease voltage to 1.6 V
There were impulses CMD and CLK, but there was a problem with signals Data0 - Data3. Level on these pinouts didn't change, was about 1 V
Supposedly the processor blocked Data0..3
I tried to connect cardreader with signal Reset on the motherboard, but there weren't Data0..3
So both in the case with 1.8 V and in the case with 3.3 V on the contact VccQ, there was a voltage about 1 V on Data0..3
I think there is a possibility of access to eMMC if OMAP is blocked and then it will make Data0..3 free (third output state Z)
Click to expand...
Click to collapse
I can't understand why they changed it so radically just for the KFHD 7" as the eMMC on the KF2 and the KFHD 8.9" are both easily accessible. It seems weird how they would use the OMAP to block it just on this model. Looking at the datasheet, are we missing something with VDDI, there is a suggestion to ground it via a 0.1 micro farad capacitor. Any thoughts on this?
VDDi Connections
The VDDi (K2) ball must only be connected to an external capacitor that is connected to VSS. This signal may not be left floating. The capacitor’s specifications and its placement instructions are detailed below.
The capacitor is part of an internal voltage regulator that provides power to the controller.
Caution: Failure to follow the guidelines below, or connecting the VDDi ball to any external signal or power supply, may cause the device to malfunction.
The trace requirements for the VDDi (K2) ball to the capacitor are as follows:
• Resistance: <2 ohm
• Inductance: <5 nH
The capacitor requirements are as follows:
• Capacitance: >=0.1 uF
• Voltage Rating: >=6.3 V
• Dielectric: X7R or X5R
Click to expand...
Click to collapse
Thanks to RolF2 from this post
SanDisk iNAND has three power domains assigned to VCCQ, VCC and VDDi, as shown in Table
10.
Table 10 - Power Domains
Pin Power Domain Comments
Supported voltage ranges:
High Voltage Region: 3.3V (nominal)
VCCQ Host Interface
Low Voltage Region: 1.8V (nominal)
VCC Memory Supported voltage range:
High Voltage Region: 3.3V (nominal)
VDDi Internal VDDi is the internal regulator connection to an
external decoupling capacitor.
Page 25+26 of this document explains it more. Looks like we may only need to ground VDDI with a 0.1uf capacitor. From what I can see on the motherboard all other connections already have capacitors grounding Vcc and VccQ.
Found the connection for VDDI -
https://www.dropbox.com/s/gzk11dywlmxzcmk/Fire%20HD%20Pinout%20with%20VDDI.jpg
overlode said:
Found the connection for VDDI -
https://www.dropbox.com/s/gzk11dywlmxzcmk/Fire%20HD%20Pinout%20with%20VDDI.jpg
Click to expand...
Click to collapse
I think that this will not resolve the problem. Connection of capacitor is strange. But this finding is a plus in the investigation.
Valery_ said:
I think that this will not resolve the problem. Connection of capacitor is strange. But this finding is a plus in the investigation.
Click to expand...
Click to collapse
The thing that confuses me is the fact that there are no other connections to the BGA array that come from a different source, all Vcc, VccQ and Vss connections are linked and already grounded with capacitors so you should be able to apply power to anywhere of these points. The fact that it is stated that this particular chip has 3 power domains, not 2 like the previous chips is encouraging.
As for your comment about the OMAP blocking access to the eMMC I don't think this is the case as the chip is used in a lot of nand flash technologies that do not have any OMAP device paired with them.
As soon as I get my next motherboard I am going to try the VDDI connection, it cannot do any harm as it controls internal voltage to the eMMC.
I will keep digging but I am pretty sure there is nothing more we have missed as I have been over the data sheet again and again.
Ok, I understand VDDI now, you don't need to touch this connection as it is used internally to regulate chip voltage. So back to the drawing board
Ok, I am going to make a simple voltage regulator to go inline with my USB card reader to make sure input voltage to the eMMC is 3.3v as I suspect over voltage may be causing a malfunction within the internal voltage stabiliser circuit of the eMMC. It seems over voltage triggers complete shutdown of the eMMC using internal diodes so this may explain the 1v or less output from the DAT pins.
Valery_, if I make sure input voltage is 3.3v then that would dismiss the need to cut the tracks yes?
Ok, I think this project has to be put on hold again. No matter what I try Ubuntu will not recognise the partitions of the eMMC even though the SD card adaptor flashes and then stops flashing as if being read properly. Connecting to VDDI fries your card reader instantly so do not try this!!
I just cannot see what we are missing and why this motherboard is so different from the KF2 yet not?
There has to be some way to gain access to the eMMC as the chip is so commonly used with other devices.
I will continue this project if I make any break through or if someone finds out something that we may be missing.
For the meantime I will continue with the KF2 unbricking as that is going rather well for me at the moment.
Reserved
overlode said:
Reserved
Click to expand...
Click to collapse
Maybe this information will be useful:
The MAX3002 accept VL voltages from +1.2V to +5.5V and VCC voltages from +1.65V to +5.5V, making them ideal for data transfer between low-voltage ASICs/PLDs and higher voltage systems.
Valery_ said:
Maybe this information will be useful:
The MAX3002 accept VL voltages from +1.2V to +5.5V and VCC voltages from +1.65V to +5.5V, making them ideal for data transfer between low-voltage ASICs/PLDs and higher voltage systems.
Click to expand...
Click to collapse
Isn't this just what we have been supplying though? My simple voltage regulator supplied 3.3v
picture not load
overlode said:
Ok, so I have opted to try and use a mini SD card adaptor for this project as it is very easy to kill a USB SD card adaptor if you get just one wiring point wrong, although this does have an increased risk of frying your USB port if you are VERY unlucky.
The SD card is wired like so -
Update - after the eMMC was not recognised by Ubuntu I cut the 2 tracks in question, and still nothing. I am also now getting 0v from the card reader however the laptop still recognises SD cards inserted. I will acquire some more USB SD card adaptors and try again with those. More to follow.
Click to expand...
Click to collapse
can you fix those picture? . it was prolem with dropbox
Thanks
kero2005 said:
can you fix those picture? . it was prolem with dropbox
Thanks
Click to expand...
Click to collapse
Pictures fixed, for what it's worth
Did anybody notice the two antenna connection points near the SD card? Does anybody know what connector this is? I'd like to buy an adapter to test with an external antenna.
It's called U.FL I assume that one is for the cell radio and the other is for wifi/bluetooth. Does anybody know for sure which is which?
Re: Blu R1 HD Antennas
The coax going from the u.fl near the sim/SD going to the bottom of the phone is the cell antenna. I had to replace my speaker and also upgraded it, requiring me to remove parts of the plastic backing. I didn't see the adhesive antenna and cut through it. My WiFi works great, but almost no cell signal.
Just an fyi here You can get a FM radio to work on blu r1 hd with the unlock tool which can be found here
https://forum.xda-developers.com/r1-hd/how-to/unlock-tool-t3561333
You have to go to the second menu by pressing 5
Hi guys, i bought this phone (used) and there was no issues, but in one day it stops searching wifi. It sometimes may do it, but most time it shows that there is no networks nearby.
I think i should replace wifi module, but found no information where is it on this phone. May somebody told me that?
Hello, I don't think you can change the wifi module : it most likely is a chip soldered on the mainboard, you might want to check the connection between the mainboard and the antenna ?
matmutant said:
Hello, I don't think you can change the wifi module : it most likely is a chip soldered on the mainboard, you might want to check the connection between the mainboard and the antenna ?
Click to expand...
Click to collapse
this might make sense, which antenna should I check?
I don't own the Xperia 10 but it can be either embedded on the chassis with little nipples pressed on contacts on the mainboard (or the over way around) or it could be "standard" U.FL connector. If your device has fallen many times they could be a little loose as these are quite flimsy
Hi all. Somebody gave me a phone with a really smashed up screen and said I could have it if I could save the date. Anyway, I swapped the screen out but haven't glued the phone back together again yet. Everything appears fine but I notice there's no sound and the WiFi/network signal is awful and the best I can get is "can't provide internet" even when I stand next to the router.
My question is are these functions dependent on the back panel being assembled again? The sound probably is but shouldn't the WiFi be OK? The white and grey antenna cables look like they are fine and in place.
Thanks!
I don't know how this model is built exactly. but in my old smartphone (redmi note 4), the wifi/bluetooth board was separate, along with the usb port, and connected to the main board by wires and, if i'm not mistaken, an antenna. I had to replace this with a new one because it was faulty (poor BT/Wi-fi signal and broken USB Port). check if these cables are ok and if this board (if any) were not damaged along with the screen
Virtuazada said:
I don't know how this model is built exactly. but in my old smartphone (redmi note 4), the wifi/bluetooth board was separate, along with the usb port, and connected to the main board by wires and, if i'm not mistaken, an antenna. I had to replace this with a new one because it was faulty (poor BT/Wi-fi signal and broken USB Port). check if these cables are ok and if this board (if any) were not damaged along with the screen
Click to expand...
Click to collapse
Thanks! I did some more tests today and if I literally touch the phone off the router and use the regular (not 5G) band I can get the internet on the phone so I think it's a problem of degree and not something totally broken. The antennas cables definitely appear 100% and I've no idea how they could have been affected by anything I've done but that's something I'll keep in mind before I glue the back on again.
OK so I've put the frame together and everything works great! Except the 5Ghz Wifi. Connects to router but no internet. The 2.4GhZ works great, as does the phone network. Sound is great too. In fact the last issue I have is that the selfie cam is VERY blurry. Maybe I dirtied the glass during the screen change? Anyway, looks easy enough to lift out the selfie cam and clean in there, should be OK.
The back fits on very snug, should be fine to glue once that's done.
100% fixed, yay!
And fer gawds sake I scrape some sort of film covering off the inside of the glass through the gap where the selfie cam goes... and then when I assembled it all again the screen cracked!
Cursed! It's one hairline all across it but it still works fine now otherwise and I'm leaving it like this!
DannySolo said:
OK so I've put the frame together and everything works great! Except the 5Ghz Wifi. Connects to router but no internet. The 2.4GhZ works great, as does the phone network. Sound is great too. In fact the last issue I have is that the selfie cam is VERY blurry. Maybe I dirtied the glass during the screen change? Anyway, looks easy enough to lift out the selfie cam and clean in there, should be OK.
The back fits on very snug, should be fine to glue once that's done.
100% fixed, yay!
Click to expand...
Click to collapse
In this case, could be the wireless router. My phone cant connect to 80mhz bands on 5Ghz wi-fi, but in 20 or 40mhz It connects successfully. Did you checked this?
Virtuazada said:
In this case, could be the wireless router. My phone cant connect to 80mhz bands on 5Ghz wi-fi, but in 20 or 40mhz It connects successfully. Did you checked this?
Click to expand...
Click to collapse
It connects directly to my 2.4Ghz router but not to either 5Ghz or 2.4Ghz bands coming out of my range extender. Weird. Maybe there's some settings in the extender I can change.