# Hardware Hacking - Spying on the boot process and iNAND



## calris (Aug 22, 2011)

OK, time to get serious 

This photo shows the iNAND non-volatile memory of the TouchPad. I'm going out on a limb, but I suspect the 8 blank (plus two with SMD capacitors/resistors) solder pads arranged in a vertical line to the left of the chip expose the SD bus used by the iNAND. To confirm this, someone needs to hook up a logic analyser (a 16 channel, 100MHz analyser would be perfect, although an 8 channel, 50MHz one might also do the trick). The signals are 1.8V so a reasonably new analyser would be needed (older ones only go down to 3V)

I, unfortunately, do not have either - Does anyone have one (or know someone that does). Failing that, is anyone willing to shell out a few hundred bucks for the cause?

An already borked device would be ideal - Seeing activity on this pads as the device attempts to boot would be enough to prove my point. If these pads are indeed the SD interface, that would mean it is highly possible to:

a) Stream out the raw contents of the iNAND
b) Re-write the contents of the iNAND

That would mean we could start to tinker with the boot partitions and still be able to unbrick


----------



## TecKnight (Aug 28, 2011)

calris said:


> OK, time to get serious
> 
> This photo shows the iNAND non-volatile memory of the TouchPad. I'm going out on a limb, but I suspect the 8 blank (plus two with SMD capacitors/resistors) solder pads arranged in a vertical line to the left of the chip expose the SD bus used by the iNAND. To confirm this, someone needs to hook up a logic analyser (a 16 channel, 100MHz analyser would be perfect, although an 8 channel, 50MHz one might also do the trick). The signals are 1.8V so a reasonably new analyser would be needed (older ones only go down to 3V)
> 
> ...


This is great news !!!
I have several Oscillioscopes, but I do not have a logic analyser. 
Would anything else give you the information you would need or is a logic analyser the only option ?
Also, what equipment would it take to re-write the iNAND, assuming the solder pads are what you suspect ?


----------



## Rakeesh (Aug 22, 2011)

Might want to talk to this guy:

http://forum.xda-developers.com/showpost.php?p=17150555&postcount=28


----------



## Turbo3 (Aug 24, 2011)

I have a GoLogic analyzer by NCI that would do the job. 64 channels @ 250,125 or 50 MHz or 32 channels @ 500 MHz with 1 million samples/channel. I have a small lab with binocular microscope and soldering equipment.

I live in San Jose if someone has an opened touchpad I can use I could capture and forward the data files.

Jim


----------



## calris (Aug 22, 2011)

TecKnight said:


> This is great news !!!
> I have several Oscillioscopes, but I do not have a logic analyser.
> Would anything else give you the information you would need or is a logic analyser the only option ?


A logic analyser is really the tool to use


> Also, what equipment would it take to re-write the iNAND, assuming the solder pads are what you suspect ?


This would probably do the trick


----------



## sypherz28 (Sep 6, 2011)

Any progress?


----------



## calris (Aug 22, 2011)

OK, I'm just going to ping this thread one last time

It would be really great if somebody with a multi-channel logic analyser could meet up with someone who is willing to crack open their touchpad...


----------

