vr table en user manual final - teeltechcanada.com

© Multi-COM Sp. z o.o.

USER MANUAL

http://vr

USER MANUAL

rev 1.0b

http://vr-table.com


TABLE OF CONTENTS

INTRODUCTION ........................................................................................................................................3

CHECK LIST (PACKING LIST) ......................................................................................................................4

TECHNICAL DATA ......................................................................................................................................5

SCHEMATICS .............................................................................................................................................6

WARNING AND SAFETY RULES .................................................................................................................7

ENVIRONMENT DISPOSAL ........................................................................................................................7

TRADEMARKS ...........................................................................................................................................7

SETUP .......................................................................................................................................................8

eMMC – what is it ?............................................................................................................................... 10

FINDING EMMC POINTS - OVERVIEW ................................................................................................... 11

FINDING EMMC POINTS – CHIP-OFF ................................................................................................. 12

FINDING EMMC POINTS – ATF TP FINDER METHOD ......................................................................... 19

JTAG – what is it ? ................................................................................................................................. 23

JTAG – FINDING TP TO USE WITH JTAG ................................................................................................ 24

eMMC/JTAG/FBUS connection to computer ........................................................................................ 25

eMMC – Hints for use SD Card readers for eMMC and Android partitions .......................................... 26

eMMC – Hints for use SD Card readers for eMMC and Windows phones 8.0/8.1/10 partitions ......... 27

VR-JE02 ADAPTER CONFIGURATION ..................................................................................................... 28


INTRODUCTION

VR-TABLE is a precision tool for non-invasive ISP (In System Programming)

reading and writing via JTAG/EMMC/FBUS which replaces the need for

soldering or de-soldering anything on motherboard. This allows forensic

examiners to acquire data from Mobile Devices, GPS Devices and other

electronics units very quickly. Optimization of VR-Table is based on a fully

individually configurable VR-ARMS ended with precision probes. VR-Table can

be also freely used in the car diagnostics (car radios, controllers) as well as in

FBUS communication mode, completely replacing the RJ45/RJ48 cables.

ADVANTAGES:

• NON-Destructive (manufactured from high quality of German TECAFORM

AH Black and brushed aluminum)

• NO Consumables

• internal voltage VCC/VccQ build-in for EMMC (3,3V, 2,85V, 1,8V)

• equipped with 7 or 10* 300 mm (VR-ARMS) with hydraulic (central)

block, ended with precise tips/probes

• central silver VR-ARM allows locate the servicing device safely without

fear of his movement exactly over a target - by this you are close to

target and avoid communication errors

• set of 10 embedded on-board channels with gold-plated connectors (L1,

L2 .... / R1, R2 ....) connected to the socket IDC 10 that can be used in any

TTL/FBUS communications

• 2-2 banana type of cables that allows to sniff communication by putting

each cable into one., i.e.: oscilloscope

• on board USB connection cable for better cable routing


CHECK LIST (PACKING LIST)

Before starting, check that all the following items have been included with your

camera. If anything is missing, contact your dealer.

Model: ▫ 7 ARM edition ▫ 10 ARM edition

□ 1 x VR-Table □ 1 x VR-Table

□ 6 x VR BLACK arm □ 9 x VR BLACK arm

□ 1 x VR silver arm □ 1 x VR silver arm

□ 6 x black probe □ 9 x black probe

□ 2 x red probes □ 2 x red probes

□ 1 x VR holder tray □ 1 x VR holder tray

□ 1 x VR JE-02 adaptor □ 1 x VR JE-02 adaptor

□ 1 x 17cm cables for adapter □ 1 x 17cm cables for adapter

□ 4 x black 50cm cable □ 7 x black 50cm cable

□ 2 x red 50cm cables □ 2 x red 50cm cable

□ 2 x IDC 10 pin cable □ 2 x IDC 10 pin cable

□ 16 x plastic pads for arm □ 16 x plastic pads for arm

□ 1 x USB cable □ 1 x USB cable

□ 1 x TORX key □ 1 x TORX key


TECHNICAL DATA

Please find below specification for VR-Table unit

External case dimensions (L x W x H): 470 x 370 x 100 mm

VR-Table dimensions without arms (L x W x H): 395 x 315 x 75 mm

Weight of VR-Table without arms installed: 2,9 KG

Weight of unit with 9 arms installed: 6 KG

Arms length and type: VR-M8 hydraulic 300 mm

Arm movement range : 150 degree

Max. eMMC voltage 1,8V current output : 250mA



Magnifying glass and glass lens type socket: 5D MA-1225CF

USB to PC connector type (USB OUT): USB B

VR-Table to device connector type (USB IN): USB A

Main connector type used: IDC 10 pin / 2.54Mm

Banana type plugs type used: 4mm

All-in-One VR-TABLE JE-02 schematics output:

Interface Pin

RJ45

N/C 1 2 3 4 5 6 7 8 N/C

RJ48

1 2 3 4 5 6 7 8 9 10

JE-02

5 13 15 3 17 11 1 7 9 19

ATF DIP SWITCH JTAG MODE

- - - + - - - - - +

ATF DIP SWITCH EMMC MODE - - - - + - + - - -


SCHEMATICS

Below you will find scheme of internal cables routing inside VR-Table. There

are:

• 5 x 4mm gold plated channels on RIGHT side

• 5 x 4mm gold plated channels on LEFT side

All of them are connected to IDC10 connector that you can find on front of VR-

Table according to scheme below. You can use them in FBUS/TLL transmission

for better cable routing. To avoid communication problems due long signal

routing we don’t suggest to use them for eMMC/JTAG transmission.

5D MA-1225CF lamp connector

1. IDC 10 pin routing FBUS connector diagram


WARNING AND SAFETY RULES

Before using the machine, c

- The device is not a toy and should be kept away from children.

not aware of the risks and dangers that

- The unit should be used only for work

indoors.

- Do not make any modifications to the construction of the device.

- Do not allow contact with water or other liquids, and must not operate with

wet hands.

- Do not use or store the device in dusty, damp environme

or low temperatures Failure to follow these guidelines could cause damage to

and used in such conditions device

hazard.

- Do not connect to other devices not supplied by the manufacturer cables /

adapters - this can cause a danger of short circuits and damage the device.

ENVIRONMENT DISPOSAL

The device is subject to the WEEE Directive 2002/96 /

EC. This symbol indicates that the product must be

disposed of separately and should be delivered t

appropriate waste collection point.

disposed of with household waste.

please contact your company or local authorities in charge

of waste management.

TRADEMARKS

All trademarks mentioned on this

companies. Including product names, logos, commercial symbols, trade names

and slogans are trademarks of those respective or related companies, and are

protected by international trademark laws

information purpose.

Before using the machine, check to be strictly the following safety information.

The device is not a toy and should be kept away from children. Children are

not aware of the risks and dangers that entail contact with electronic devices.

The unit should be used only for work for which it is intended and only

Do not make any modifications to the construction of the device.

Do not allow contact with water or other liquids, and must not operate with

Do not use or store the device in dusty, damp environment or in extreme high


and used in such conditions device may not operate properly or cause a

Do not connect to other devices not supplied by the manufacturer cables /

this can cause a danger of short circuits and damage the device.


This symbol indicates that the product must be

disposed of separately and should be delivered t

appropriate waste collection point. It should not be

disposed of with household waste. For more information,


of waste management.

All trademarks mentioned on this manual are property of their respective



protected by international trademark laws. They are used here ONLY

heck to be strictly the following safety information.

Children are

contact with electronic devices.

for which it is intended and only

Do not make any modifications to the construction of the device.

Do not allow contact with water or other liquids, and must not operate with

nt or in extreme high


may not operate properly or cause a

Do not connect to other devices not supplied by the manufacturer cables /

this can cause a danger of short circuits and damage the device.


This symbol indicates that the product must be

disposed of separately and should be delivered to an

It should not be

For more information,


erty of their respective



ONLY for


SETUP

1. Open case and remove all arms

2. Pull up foam, take out VR

3. Take out from case a small bag with 16 pcs of black plastic pads and

count 7 or 9 of them (depends on purchased version)

4. Take one black plast

M8 hole. Arms can be attached into any of the screw

table – total there are

probe points. In most of situations best will be to install

right side of table. Each arm can be adjusted by loosening the dial.

(photo 2)

5. Install silver VR Arm on position where holder can be stored over the

target device. (photo

6. Loose screws on VR holder and move it to desired position where PCB

will be stored. (photo

7. Put board into place and hold it tight to avoid movements.

8. Install probe, adjust

9. Adjust probes and arms to fit to desired position of connection

pads/elements. (photo

10. Ready unit fully assembled and ready to work (

Setup movie you can also watch at

NOTE:

In case you want to use eMMC power lines for your target use banana

connector to connecting target to VCC or V

DON’T USE POWER SECTION FOR BATTERY TERMINAL CONNECTION

Open case and remove all arms (photo 1)

take out VR-Table and place it on desk

Take out from case a small bag with 16 pcs of black plastic pads and

count 7 or 9 of them (depends on purchased version)

Take one black plastic pad and one black VR arm and install it in desired

M8 hole. Arms can be attached into any of the screw holes around the

are 16 holes. Choose positions near to the identified

probe points. In most of situations best will be to install it on left and

Each arm can be adjusted by loosening the dial.

Install silver VR Arm on position where holder can be stored over the

photo 3)

Loose screws on VR holder and move it to desired position where PCB

photo 4)

Put board into place and hold it tight to avoid movements. (

probe, adjust angle and put banana connector to it. (

Adjust probes and arms to fit to desired position of connection

photo 7)

nit fully assembled and ready to work (photo 8)

Setup movie you can also watch at http://vr-table.com/videos.php


target to VCC or VccQ according target.


GND – GROUND also called VSS

1.8V – in most cases V

2.8v/2.85V – in most cases V

3.3V - in most cases it will be

Take out from case a small bag with 16 pcs of black plastic pads and

ic pad and one black VR arm and install it in desired

holes around the

16 holes. Choose positions near to the identified

it on left and

Each arm can be adjusted by loosening the dial.

Install silver VR Arm on position where holder can be stored over the

Loose screws on VR holder and move it to desired position where PCB

(photo 5)

(photo 6)

Adjust probes and arms to fit to desired position of connection

table.com/videos.php



also called VSS

in most cases VccQ

in most cases VccQ

it will be VCC


Photo 1

Photo 3

Photo 5

Photo 7

Photo 2

Photo 4

Photo 6

Photo 8


eMMC – what is it ?

eMMC is an open, royalty

and the JEDEC. Commonly eMMC are used in mobile phones, PDAs, digital

cameras but nowadays also in

eMMC Flash memories include an interface controller which is in most

cases Processor/Chip and a Flash memory. Access to the Flash memory is

performed by the interface controller on the slave side.

eMMC Master controller

eMMC protocol uses 3 communication signals

want to use use full bandwidth

shown below:

There are also three additional

(called also Ground), VCC

(power of internal eMMC

CLK - MCC clock

CMD - Command in / Response out

DAT0 - Data input / Output.........DAT1 - Data input / OutputDAT2 - Data input / OutputDAT3 - Data input / Output

CPU (Processor) / Chip

CORE

Controller

Interface for

eMMC

open, royalty-free standard which was developed by the MMCA


cameras but nowadays also in latest TV and electronic devices.


and a Flash memory. Access to the Flash memory is

performed by the interface controller on the slave side.

controller eMMC Slave controller

communication signals (CLK, CMD, and DAT

bandwidth of 4 bits it will need additional DATA signals

additional signals needed for communication

, VCC (power of NAND memory inside eMMC)

eMMC controller).

esponse out

utput (1-bit)

utput (2-bit)utput (3-bit)utput (4-bit)

eMMC Flash Memory

Controller

Interface for

eMMC

Controller

Interface for

eMMC

Memory

Flash

CLK

CMD

DAT

CLK

CMD

DAT

was developed by the MMCA



and a Flash memory. Access to the Flash memory is

controller

and DAT). In case you

it will need additional DATA signals, as

r communication as: GND/VSS

) and VccQ

Memory

Flash


FINDING EMMC POINTS - OVERVIEW

There are two ways of locating eMMC points if they are not available:

• De-soldering BGA method which uses Chip OFF (fits for all devices and

CPU's)

• Non soldering/De-soldering method for Advance Turbo Flasher Box

called “TP Finder method “ which work Qualcomm, Exynos, Marvell,

Broadcom and Spreadtrum based devices

While first one require from you to remove the eMMC chip from a board the

second one uses unique method to find them very quickly without need for any

soldering.

Note: Please note that no meter if you SOLDER to PCB or NOT - never attempt

searching processes on your exhibit.

Before attempt to search process we first suggest to check if pinout is not

already available at Internet forums:

http://forum.gsmhosting.com/vbb/f672/emmc-direct-pinout-collection-m-1717874/index12.html

http://winkgsm.blogspot.com/2016/05/pinout-direct-emmc-samsung.html

http://www.unlockforum.com/showthread.php/tested-emmc-pinouts-25378.html

https://www.exploitee.rs/index.php/Main_Page

There are several other GSM box producers websites where you can find pin

outs too.


FINDING EMMC POINTS – CHIP-OFF

This method will require from you good soldering skills as also additional tools:

- multimeter with continuity tester option

- soldering station suitable for BGA rework.

STEPS:

1) Locate eMMC on PCB and de-solder it using soldering station. We

suggest small BGA station for this but if you got enough skills you can use

even manual hot air station with small down preheater.


2) Once BGA removed you will see ball grid - please use BGA chip

schematics for your bag (159, 16, 169, 221 etc) to find correct pinout for

BGA grid array. Please make sure that orientation PIN is putted in same

place as on your BGA, if not rotate PCB to get exact same view as on

scheme.

POSITION PIN


3) From previous chapter about eMMC we know what signals are required

to connect and now we will try to find representative points on PCB for

them. We will use scheme in finding signals one by one as below:

o CMD

o VccQ

o CLK

o VCC

o DAT0 (for 1 bit communication)

o GND/VSS

Before starting next steps please note that NOT ALL phones have exposed

CMD/CLK locations on the PCB. Some phones/tablets got those TP pins only

available under BGA so extraction is possible only by chip off.

4) Using a multimeter set to continuity tester, place one probe on exposed

point starting from CMD on BGA grid array and touch each of the

resistors/TP pads on the board until the continuity tester indicates you

have a direct connection. Don't try to find CMD on capacitors (brown

color elements) it is NEVER correct for this signal. Try only resistors and

test point pads around eMMC Area (resistors are black color elements).

Also do NOT attempt too much force on the resistors as they may come

off! If Test Point is not found around the eMMC area, you can try looking

for it around the CPU area.


5) Once CMD found, the there is two options to find VccQ. First: if CMD

from both side of resistor giving a “BEEP” then you should start looking

for VccQ on capacitors. Second if there is no “BEEP” once you test a CMD

place resistor from both end is USUALLY on the other side of the CMD

resistor test point. You will find more than one VccQ - it does not matter

which one you use but can be simpler for you to use VccQ from different

resistor location for better VR arm routing over PCB. If you want to find a

better location for VccQ for easier probing, then you can use same

method which we use for CMD. Put a multimeter on continuity test and

check which resistor around the eMMC will "BEEP" when you test it

against the VccQ test point on the opposite side of the CMD.

6) We got now two signals - CMD and VccQ, we will now find CLK and DAT0.

Similar to CMD finding process, CLK and DAT0 test points signal are

available ONLY on resistors and test point pads around eMMC Area

(resistors are black color elements).

HINT: DAT0 signals are always found NEAR eMMC Area but If is not

found, you can try looking for it around the CPU Area.


CLK PIN TP

DAT0 PIN TP

7) Once CLK/CMD/DAT0/VccQ test points were found we will now process

to find VCC. This time do not try to TP resistors - try only TP to capacitors

(brown color elements) using same scheme as above.

8) Last step is finding GND (called also VSS). This can be easily located by

connecting to any RF Shield of target or checking opposite end of VCC.

Similar to scheme above you will find more than one GND/VSS - it does

not matter which one you use but can be simpler for you to use GND/VSS

from different capacitor location for better VR arm routing over PCB. If

you want to find a better location for GND/VSS for easier probing, then

you can use same method which we use for CMD or VccQ. Put a

multimeter on continuity test and check which capacitor around the

eMMC will "BEEP" when you test it against the GND Test Point on the

opposite side of the VCC Resistor. You can also use negative battery

hook terminal (-) for GND.


FINDING EMMC POINTS – VCC/VccQ values

We got now all points - all we need is determine what VCC and VccQ of your

target uses.

First check if VCC and VccQ are connected together or not - for this use similar

method ad we used for finding other points. Put a multimeter on continuity

test between VCC and VccQ and check if it will "BEEP". If you identified by

continuity tester that VCC and VccQ were directly connected then you will note

they both require the same voltage and then when using VR-Table you can

extract using 5 arms and connection to only 1 power line on VR-Table. If the

VCC and VccQ voltages are different (so there is no connection between them)

then you will need to use 6 arms and connect those to separate power line

connectors on VR-Table since your eMMC use different voltage for

eMMC/NAND and controller.

Now once we know if eMMC/NAND and controller works on same voltage we

need to find information what voltage VCC and VccQ requires. As from previous

chapter we know VCC is a power of eMMC/NAND memory inside eMMC (can

be 2.8 - 3.3V) and VccQ is a power of internal eMMC controller (can be 1.8 -

2.8V). To determine voltages of VCC/VccQ you will need a working board and

multimeter but this time in set to DC Voltage test. There are two methods for

this process:

a) using battery from device/DC power supply

b) using USB cable in case your target is Qualcomm based devices

METHOD A:

Apply power to the board (either from the battery or the external DC power

supply) and turn the device on. While device is powering ON, take your

multimeter RED and BLACK prongs and apply them between VCC and GND to

check voltage on the PCB. Repeat same procedure for VccQ/GND if in previous

step you noted that they were not together connected.


METHOD B:

In this method we will use USB cable to check what is the actual voltage of your

VCC/VccQ TP when USB cable is connected to the PCB. Sometimes the voltage

will only appear for less than 5 seconds after power ON target, so be sure to

catch it quickly. The best practice is to ask someone else to connect the USB

cable while you position your multitmeter RED and BLACK prongs on the phone

PCB and apply them between VCC and GND. Repeat same procedure for

VCCq/GND if in previous step you noted that they were not together

connected.


FINDING EMMC POINTS – ATF TP FINDER METHOD

This method will require from you some additional tools to perform but it’s not

destructive:

- ATF Box

- Multimeter with continuity tester

- VR-JE 02 adapter

- latest probe with moving pin (not fixed standard one)

- optionally active USB HUB where VR-Table will be connected

BEFORE STARTING WE SUGGEST TO MAKE HIGH QUALITY PHOTO OF YOUR PCB WHICH

CAMERA AND PRINT IT - THIS WIL BE PLACE WHERE YOU CAN MARK FOUND TPS

1) Find phone battery terminal and prepare 2 probes - black and red

2) Connect VR probe to GND (-) negative terminal of phone battery and

Positive terminal battery to 3.3V on VR-Table

3) Take JE-02 adapter and make sure that DIP switch are set to OFF for

PIN1/2. Connect JE-02 adapter to ATF and connect one probe to JE-02

IDC pin number 9 (with will reflect to pin 8 on RJ45 of ATF)

4) Now find a way that Power Button on your phone target will be always

pressed during TP find stages. Use rubber band or tie cables for this.

5) Run latest ATF software, change tab to Nokia and from drop down list

choose ATF Plus:

REPEAT <--- number of times TP finder will loop itself automatically (choose 50)

INTERVAL <--- delay in seconds before the next TP Finder operation will start

(choose 2 seconds)

6) Press Find eMMC Test Point button in software and start connecting VR

Probe Test Point to resistors/TP pads on the phone's PCB around the

eMMC area. Do NOT put too much force on the resistors as they may

come off. Allow at least 2 tries per possible location on the PCB and

always wait for message "Please Check Another Location..." before trying

other TP locations in ATF software. Try only resistors and test point pads


around eMMC Area (resistors are black color elements). If Test Point is

not found around the eMMC area, try looking for it around the CPU area.

NOTE: Please note that NOT ALL phones have exposed all signals locations on

the PCB (especially CMD/CLK). Some phones/tablets got those TP pins only

available under BGA so extraction is possible only by chip off.

When a correct Test Point is found you will see message in software as

for example CLK or CMD found. Repeat this step until you will have those

both signals found so CLK and CMD. Please mark found TP on printed

photo.

7) Once CMD found, the VccQ is usually on the other side of the CMD

resistor test point. You will find more than one VccQ - it does not matter

which one you use but can be simpler for you to use VccQ from different

resistor location for better VR arm routing over PCB. If you want to find a

better location for VccQ for easier probing, then you will need a

multimeter. Put a multimeter on continuity test and check which

resistor/capacitor around the eMMC will "BEEP" when you test it against

the VccQ test point on the opposite side of the CMD. When got it we

need also know which voltage to use for internal eMMC controller (can

be 1.8 - 2.8V). For this we will need USB cable with mini/micro

connector which will fits to your target. Simply use multimeter set to DC

Voltage TEST to check what is the actual voltage of VccQ when USB cable

is connected to the PCB. Simply put probes to VccQ and RF shield (you

can use even VRARMs for it) and connect the USB Cable to target - note

readings.

8) We have already found CMD, CLK, and VccQ - now we will find VCC. For

this please disconnect VR Probe from PIN 9 on JE-02 adapter and connect

it by 50cm banana cable to 3.3V power line of VR-Table. In this step all


VR-Arm with probes should be connected to already found points as

below:

SIGNAL WHERE TO CONNECT PIN 1 on JE-02 adapter CLK connect to already found CLK TP on PCB by VR-Arm

PIN 11 on JE-02

adapter

CMD connect to already found CLK on PCB by VR-Arm

PIN 7 on JE-02 adapter GND connect to already found GND TP on PCB by VR-Arm

VR-Table power socket 1,8V or 2,85V* connect to already found VccQ by VR-Arm

VR-Table power

socket

3.3V connect to probe that you will use to search

VR-Table power socket GND connect to probe GND (pin 7 so one will be putted into

second)

*choose value which you previously read for VccQ

9) Now on ATF software, make the necessary settings for eMMC finder loop

so choose correct CPU target model, signal which we will find (VCC) and

number of repeats. Allow at least 2 tries per possible location on the PCB

and always wait for message "Please Check Another Location..." before

trying other TP locations. This time do not try to TP resistors - try only TP

to capacitors using same scheme as above (capacitors are brown color

elements). When you have connected the test point cable to the correct

VCC Test Point, the ATF software will announce to you that the VCC

Pinout has been located.

10) Now when CMD, CLK, VCC, VccQ, GND (VSS), was found last signal

which is required is DATA (DAT0). For this signal you need to

DISCONNECT positive (+) battery probe from PCB leaving only negative (-

) battery hook connected as also changing VR-Table JE-02 adapter into

eMMC mode which will connect together CLK1/CLK2. In this situation we

will use VR Probe connected to PIN 9 ID 20 pin JE-02 adapter.


Before attempting to find DATA make sure that all previous signals are

correctly connected as below

SIGNAL WHERE TO CONNECT PIN 1 on JE-02 adapter CLK connect to already found CLK TP on PCB by VR-Arm

PIN 11 on JE-02 adapter CMD connect to already found CLK on PCB by VR-Arm

PIN 7 on JE-02 adapter GND connect to already found GND on PCB by VR-Arm

PIN 9 on JE-02 adapter DATA connect to probe that you will use to search

VR-Table power socket 1,8V or 2,85V* connect to already found VccQ by VR-Arm

VR-Table power socket 3.3V connect to already found VCC by VR-Arm

VR-Table power socket GND connect to probe GND (pin 7 so one will be putted into

second)

*choose value which you previously read for VccQ

11) Now on ATF software, make the necessary settings for eMMC

finder loop so choose correct CPU target model, signal which we will find

(DATA) and number of repeats. Remember to NOT put too much force

on the resistors as they may COME OFF and allow at least 2 tries per

possible location on the PCB and always wait for message "Please Check

Another Location..." before trying other TP locations. Try only resistors

and test point pads around eMMC Area (resistors are black color

elements). If Test Point is not found around the eMMC area, try looking

for it around the CPU area. When you have connected the test point

cable to the correct DATA Test Point, the ATF software will announce to

you that the DATA Pinout has been located.


JTAG – what is it ?

The JTAG interface, collectively known as a Test Access Port

following signals to support the operation of boundary scan.

In case of phones you might also need to connect:

• TCK (Test Clock) – this signal synchronizes the

operations.

• TMS (Test Mode Select) –

determine the next state.

• TDI (Test Data In) – this signal represents the data shifted into the device's

test or programming logic. It is sample

internal state machine is in the correct state.

• TDO (Test Data Out) – this signal represents the data shifted out of the

device's test or programming logic and is valid on the falling edge of TCK when

the internal state machine is in the correct state.

• TRST (Test Reset) – this is an optional pin which, when available, can reset the

TAP controller's state machine.

• VREF (Voltage Reference

VCC and may be used to power

levels: 5V, 3.3V, 2.5V

TCK (Test Clock)

TMS (Test Mode Select)

TDI (Test Data In)

TDO (Test Data Out)

TRST (Test Reset)

TMS (Test Mode Select)

VRef (Voltage Reference)

The JTAG interface, collectively known as a Test Access Port (TAP

following signals to support the operation of boundary scan.

In case of phones you might also need to connect:

this signal synchronizes the internal state machine

– this signal is sampled at the rising edge of TCK to

determine the next state.

this signal represents the data shifted into the device's

test or programming logic. It is sampled at the rising edge of TCK when the

internal state machine is in the correct state.

this signal represents the data shifted out of the


machine is in the correct state.

this is an optional pin which, when available, can reset the

TAP controller's state machine.

Voltage Reference) – on the most devices this pin is tied to the device's

and may be used to power a buffer IC chip. Used to indicate a JTAG signal

TAP), uses the

internal state machine

this signal is sampled at the rising edge of TCK to

this signal represents the data shifted into the device's

d at the rising edge of TCK when the

this signal represents the data shifted out of the


this is an optional pin which, when available, can reset the

n the most devices this pin is tied to the device's

sed to indicate a JTAG signal


JTAG – FINDING TP TO USE WITH JTAG

There are several solutions for finding JTAG Test Points using different devices

but all of them working on similar probing method. Difference between them

are finding time, multi TAPs in scan chain support also maximal amount of

finder pin scans.

Please just remember:

GND – must be always connected to ground PIN on device (use JE-02 scheme

or check your GND location on device you will use to connect)

Battery+ PIN (pad which is directly connected to positive battery terminal) -

must be always excluded from searching JTAG pins process

RESET/NRST PIN - must be first found and then excluded since it will interrupt

searching process of JTAG. How to find NRST? You will need for this multimeter

in diode probing mode. Please turn ON target and connect one probe of

multimeter to GND (GND are easy to detect by multimeter because they are

directly wired on battery terminals). Then search all other pins one by one by

touching them. Once RESET/NRST pin will be found phone/target will restart.

HINT: Most powerful method is to connect test points to GND via 1kOm

resistor but in most situations enough tapping it by tweezers or multimeter

probe will works.

Below you will find devices which offer finding all other JTAG lines as TCK, TMS,

TDO, TDI and TRST. You can of course use VR-Table to found those pins without

any soldering:

JTAG Finder from ORT - http://www.jtagfinder.com/x/

GPG eMMC - http://www.gpgemmc.com/features.html

Medusa PRO - http://medusabox.com/

Easy Z3x JTAG - http://z3x-team.com/easy-jtag-activation/


eMMC/JTAG/FBUS connection to computer

Once you got proper pin out for your device you can start placing probes over

correct TP. VR-Arm which comes with VR-Table can be moved in many

direction and adjusted by loosening the dial. Also ending tip of VR-arm can be

moved UP/Down by loosening small screw on it - you can use this feature in

connection process. Best procedure is to:

a) Place banana connector with cable into PROBE/VR-Arm that you will use

b) Move VR arm with installed probe into position where your desired TP is

located

c) Gently push the spring probe tip onto the correct position - please DO NOT

put too much force on the resistors/capacitors as they may come off!!

d) Once probe is only place lock the arm by dial and adjust with up screw in

necessary

e) Take USB cable and connect it to back of VR-Table at one end and to box

which you will use for reading target at second end - place device on VR-Holder

tray

f) Connect USB cable A-B to front of VR-Table and to your computer


eMMC – Hints for use SD Card readers for eMMC and Android partitions

If you are using SD Card readers for signal sniffing or eMMC connection for

Android please note that they use EXT2, EXT3 and EXT4 Partitions. It means

that to see logical disk under Windows you need to use special application as:

- Paragon ExfFs for Windows (https://www.paragon-software.com/home/extfs-windows/

- EXT2FSD (http://www.ext2fsd.com)

Once you got your eMMC connected below are interesting Folders/Files inside

a User Data Partition:

Phone book \data\data\com.android.providers.contacts\

databases\contacts2.db

SMS, MMS messages \data\data\com.android.providers.telephony\

databases\mmssms.db

Calendar \data\com.android.providers.calendar\databases\

calendar.db

Log \data\com.sec.android.provider.logsprovider\data

bases\logs.db

User's data \data\system\users\accounts.db

Web-browser history \data\data\com.android.browser\databases\brow

ser2.db

Dictionary \data\user\comc.android.providers.userdictionary

\databases\user_dict.db


eMMC – Hints for use SD Card readers for eMMC and Windows phones 8.0/8.1/10 partitions

If you are using SD Card readers for eMMC connection on Windows phones

note that they use NTFS Partitions

Here are interesting Folders/Files Inside a Windows Phone Data/MainOS

Partition:

SMS, MMS messages Users\WPCOMMSERVICES\APPDATA\Local\Unistore\

store.vol

Call Logging Users\WPCOMMSERVICES\APPDATA\Local\UserData\

phone

Internet Cache:

Users\DefApps\APPDATA\INERNETEXPLORER\INetCac

he

and

Users\DefApps\APPDATA\Local\Microsoft\Windows\

WebC acheV01.dat.

Pictures from Camera

Roll:

Users\Public\Pictures\CameraRoll\

Pictures From

Facebook Etc:

Users\Public\Pictures\SavedPictures\

More about getting data from Nokia phones you can read at

http://www.sans.org/reading-room/whitepapers/forensics/windows-phone-8-

forensic-artifacts-35787


VR-JE02 ADAPTER CONFIGURATION

Device name Connector type / Protocol Pin out / Output signals

Riff BOX IDC-20 pin -> JTAG

PIN 3, 5, 7, 9, 11, 13, 15, 17, 19 – GND

PIN 6 – JTAG NRST

PIN 8 – JTAG TDO

PIN 10 – JTAG RTCK

PIN 12 – JTAG TCK

PIN 14 – JTAG TMS

PIN 16 – JTAG TDI

PIN 18 – JTAG TRST

PIN 20 – JTAG VCC

Riff BOX RJ45 8 pin-> eMMC/UART

PIN 1 – PROBE

PIN 3 – UART RXD / eMMC DAT0

PIN 7 – BSI

PIN 9 – GND

PIN 11 – MBUS

PIN 13 – 4.2V UART

PIN 15 – UART TXD / eMMC CLK

PIN 17 – UART TX2 / eMMC CMD

Riff BOX 2 RJ45 8 pin-> GPIO/UART

PIN 1 – SGPIO-PIN / PROBE

PIN 3 – UART RXD

PIN 7 – 5V

PIN 9 – GND

PIN 11 – VCC-REF

PIN 13 – 4.2V UART

PIN 15 – UART TXD

PIN 17 – GPIO PIN

Riff BOX 2 IDC-20 pin -> JTAG

PIN 3, 5, 7, 9, 11, 13, 15, 17, 19 – GND

PIN 6 – JTAG NRST

PIN 8 – JTAG TDO / SWDO


PIN 12 – JTAG TCK / SDWCLK

PIN 14 – JTAG TMS / SWDIO

PIN 16 – JTAG TDI


PIN 20 – JTAG VCC

ATF BIG CHROME/GOLD RJ45 8 pin -> eMMC

PIN 1 – eMMC ATF CLK1

PIN 7 – GND

PIN 9 – eMMC DAT0

PIN 11 – eMMC CMD



PIN 15 – VCC/VCCQ

Please make sure that DIP SWITCH is

SET to eMMC MODE on adapter for use

with eMMC protocol (CLK1 + CLK2)

ATF NITRO RJ45 8 pin -> eMMC


PIN 7 – GND

PIN 9 – eMMC DAT0

PIN 11 – eMMC CMD


Please make sure that DIP SWITCH is

SET to eMMC MODE on adapter for use

with eMMC protocol (CLK1 + CLK2)

ATF NITRO / CHROME RJ45 8 pin -> SPI

PIN 1 – SCK

PIN 7 – GND/VSS

PIN 9 – CE#

PIN 11 – SI

PIN 15 – VDD/VCC

PIN 17 – S0

ATF (Advance Turbo

Flasher) RJ48 10 pin -> FBUS (Flash Bus)

PIN 1 – MBUS

PIN 3 – BSI

PIN 7 – GND

PIN 9 – VPP

PIN 11 – FBUS/UART RX

PIN 13 – FBUS/UART RX2

PIN 17 – FBUS/UART TX

PIN 19 – VBAT

Easy Z3x JTAG IDC-20 pin -> JTAG/eMMC

PIN 1, 3, 5, 7, 9, 11, 13, 15, 17, 19 –

GND/VSS

PIN 6 – JTAG NRST / SYSRST

PIN 8 – JTAG TDO


PIN 12 – JTAG TCK

PIN 14 – JTAG TMS

PIN 16 – JTAG TDI / eMMC DAT0

PIN 18 – JTAG TRST / eMMC CLK

PIN 20 – JTAG VREF / eMMC CMD


Cyclone Key RJ48 10 pin -> FBUS (Flash Bus)

PIN 1 – MBUS

PIN 3 – BSI

PIN 7 – GND

PIN 9 – VPP

PIN 11 – FBUS/UART RX

PIN 13 – FBUS/UART RX2

PIN 17 – FBUS/UART TX

PIN 19 – VBAT

ORT (Omnia Repair Tool) IDC-20 pin -> JTAG

PIN 3, 5, 7, 9, 11, 13, 15, 17, 19 – GND


PIN 8 – JTAG TDO


PIN 12 – JTAG TCK

PIN 14 – JTAG TMS

PIN 16 – JTAG TDI


PIN 20 – JTAG VREF

OctoPlus JTAG/Medusa

Box RJ48 10 pin -> JTAG

PIN 5 – GND



PIN 3 – JTAG TDI

PIN 17 – JTAG TMS

PIN 11 – JTAG TCK

PIN 1 – JTAG RTCK

PIN 7 – JTAG TDO

PIN 9 – JTAG RESET

Medusa PRO IDC-20 pin -> eMMC / JTAG

PIN 1 – eMMC 1.8V

PIN 3 – eMMC 2.8V

PIN 5,19 – GND

PIN 6 – JTAG RST

PIN 7 – eMMC CMD

PIN 8 – JTAG TDO

PIN 9 – eMMC CLK


PIN 11 – eMMC DAT3

PIN 12 – JTAG TCK


PIN 14 – JTAG TMS


PIN 16 – JTAG TDI




GPG eMMC BOX IDC

GPG JTAG PRO

SMTI JTAG

“Universal” Fbus pinout


IDC-20 pin -> eMMC/JTAG

PIN 3, 17 – GND / VSS


PIN 8 – JTAG TDO


PIN 12 – JTAG TCK

PIN 14 – JTAG TMS

PIN 16 – JTAG TDI



In configuration, set PIN as:

IDC-20 pin -> JTAG

PIN 3, 17 – GND


PIN 8 – JTAG TDO


PIN 12 – JTAG TCK

PIN 14 – JTAG TMS

PIN 16 – JTAG TDI



In configuration set PIN as:

RJ45 8 pin -> JTAG

PIN1 – JTAG TMS

PIN 3 – JTAG TDI

PIN 7 – JTAG TCK

PIN 9 – GND

PIN 13 – JTAG VPP

PIN 15 – JTAG TDO

PIN 17 – JTAG nTRST

RJ45 8 pin-> FBUS

PIN 1 – MBUS/CBUS

PIN 3 – UART TX

PIN 7,9 – GND

PIN 11 – UART RTS

PIN 13 - +5V

PIN 15 – UART RX

PIN 17 – UART CTS

JTAG VREF

GND / VSS

JTAG NRST / SYSRST

JTAG RTCK

JTAG TMS

JTAG TRST

JTAG VREF

In configuration, set PIN as:

JTAG NRST / SYSRST

JTAG RTCK

JTAG TMS

JTAG TRST

JTAG VREF

In configuration set PIN as:

JTAG TDO

JTAG nTRST

MBUS/CBUS

UART RTS

UART CTS

vr table en user manual final - teeltechcanada.com

Documents