A lot of networking device are coming out with eMMC flash storage instead of SPI or even NAND flash, making it difficult to read and write flash out of band. What if we can use pluggable flash modules instead of soldered BGA eMMC flash? It turns out that with some soldering skills you can convert soldered eMMC flash to pluggable module that can be read and written outside of device. Good use cases for this are replacing bad flash or expanding storage on out of warranty Edgerouter 4/6P/12 routers, or accessing filesystems of newer routers used by ISPs.
Warning: This guide describes process that requires specific skills and safety measures. I am not responsible if you brick your device, set your house on fire or kill your neighbors dog while following this guide.
Before attempting this, I have never soldered BGA devices in my life. This takes some care and patience, but if someone like me with no experience can do this by following Youtube videos, it's likely others may also be successful in it. If you want to mod your device and don't feel comfortable doing it yourself, your local cell phone repair store may have the right skill set and equipment to do this for you.
It goes without saying that you should not be modding anything owned by your ISP.
I got inspiration for this from ODROID project, which utilizes pluggable modules for eMMC flash.
The pinouts of connectors described in this guide are fully compatible with ODROID - you should be able to use ODROID compatible flash readers and use ODROID compatible eMMC flash modules with your modded devices (as long as the devices can recognize flash modules).
In this mode we are desoldering existing eMMC flash from device being modded, and replacing it with an interposer - a special PCB with eMMC BGA footprint on one side and ODROID-compatible flash connector on the other side.
I have designed an eMMC interposer using eMMC IC datasheets and ODROID adapter schematics and designed an eMMC module PCB in eMMC 11.5x13mm footprint.
This is the second time I am designing my own PCBs, so the board layouts may look amateurish. But they do work. Data traces lengths are tuned to +/-1 mil.
A picture is worth a thousand words:
PCBs for both interposer and eMMC-compatible module can be ordered from OSHPARK for less than $4 for 3 boards.
ODROID-compatible eMMC module
The boards are using smaller tolerances than allowed by OSHPARK, so while I've had success with the designs above, it is possible that the boards may not work if the drill is shifted too much from center of vias. Use microscope or zoom in on a picture taken from your phone to inspect the vias. You want the drill hole to be as close to the center of vias as possible, or at least within the surface of the via - not protruding from it's footprint. If the drill hole is too off-center, try ordering again - a different batch may be centered better.
Besides the boards you will need some tools and supplies.
For eMMC interposer you need:
- GB042-34P-H10 connector
- 0.3mm solder balls. Low-temperature solder balls are easier to work with. I've used Sn/Pb solder balls
- GB042-34S-H10 connector
- 0.3mm solder balls to re-ball your eMMC IC (unless you are using a new one factory-reballed)
- Some capacitors and resistors in 0603 SMD form factor listed at OSHPARK board page.
When ordering parts and PCBs, unless you are very good at SMD soldering, it's best to order more than you need in case you you don't succeed from first attempt.
- Soldering iron with temperature control
- Something that can be used for de-soldering an re-soldering BGA like hot plate, skillet, hot air station, PCB reflow oven, IR rework station. You can find techniques for soldering BGA using the described tools in Youtube. I have used a DIY reflow oven converted from a toaster and a hot air gun (with temperature control).
- Digital Multimeter, preferably with thermocouple that can be used to measure board temperature
- Solder wick
- Kapton tape (1 mil thickness)
- Rosin flux
- Isopropyl alcohol for cleaning contacts and removing flux
- Solder paste and/or solder. I like using Sn/Pb, but other low-temperature solders should work too.
- HVAC aluminum tape to cover plastic parts of the board when re-flowing BGA.
- IC suction tool (not necessary, but helps to cleanly desolder eMMC IC)
- LCD microscope is not strictly necessary if your vision is good, but is very handy to have
- BGA reballing station is not necessary, but makes working with small parts a lot more comfortable. I've used this kind.
- Having eMMC stencils (and PCB stencils) makes it a lot easier to accomplish the steps in this guide. I've used my own eMMC stencil, but generic ones should work too. Below are links to my stencils. I've used oshstencils.com to order the stencils in 4 mil stainless steel. Below are the gerber files for stencils used in this guide:
I have used a DIY reflow oven set for leaded solder thermal envelope to heat up the whole board to the top of leaded thermal envelope, then removed the board from oven and heated the eMMC some more with hot air until I was able to remove it with suction tool.
I have also wrapped all the plastic parts with HVAC aluminum tape to avoid melting them
I've ordered adapter from OSHPARK using gerbers from here: https://github.com/voltlog/emmc-wfbga153-microsd but factory-made adapters from Ebay or other sites would work too. If ordering eMMC to SD adapter from OSH Park using gerbers from GitHub, use 2oz copper boards - they are thinner and closely match thickness of SDXC cards.
Important note: eMMC Interposer is about five times heavier than regular eMMC IC. Use two layers of 1 mil thick kapton tape as standoff when reflowing eMMC Interposer to avoid solder balls collapse causing bridging and electrical shorts. Cover PCB with a very thin layer of rosin flux and attach kapton tape.
Now that we are confident that our eMMC Interposer works, let's solder one to our device. Again, use two layers of 1 mil thick kapton tape to avoid solder balls from collapsing under the weight of interposer and use a very thin layer of rosin flux. If you use too much flux it may boil and shift the interposer.
I've used the following commands to make backup copy of contents of eMMC: