Riff box 2 emmc support needed....can't get it to work

[giaguaro]

Hi everybody, please help to workout RIFF BOX 2 emmc read/write. I used box and jtag part is working ok...can't manage to make it work with emmc (isp 30 pin port). example : htc m8s I soldered wires directly to board, and I get VCC and VCCQ directly from Moorc adapter 5 in 1 and connected also to riff pins 1 , 2 , and 17 , got same error...emmc is recognized by EasyJtag without any problem...with same wires connected same way but Riff2 give me this error....
Connecting to the SD/eMMC Card...ERROR
Set I/O Voltage reads as 2.80V, SD_CLK Frequency is 10.2 MHz
Connecting to the SD/eMMC Card Failed (ERR[006E], POS[0003])
I want to use riff 2 as I have boufht it brand new 4 months ago, guess is time for support ,so got to solve this somehow. Thanks in advance

[Legija]

Maybe You missed GND ?

[giaguaro]

ground also connected...did a short test on an SD CARD to see if riff box is ok...test was ok so continued on M8s...I tryed with mobile battery connected and voila....it worked..Hynix was seen by riff...managed to complete ressurection but phone still dead...made a dump from emmc is empty...write 512mb of dump and after that read it but reading is empty...I think it is fake writing HAG2e emmc or what else?

[Legija]

If You use phone battery, in that case You must disconnect CLK line from phone CPU by desoldering CLK line resistor.

[giaguaro]

can you please help me locate clk line resistor on HTC M8s?

[nicolayer]

ground also connected...did a short test on an SD CARD to see if riff box is ok...test was ok so continued on M8s...I tryed with mobile battery connected and voila....it worked..Hynix was seen by riff...managed to complete ressurection but phone still dead...made a dump from emmc is empty...write 512mb of dump and after that read it but reading is empty...I think it is fake writing HAG2e emmc or what else?

So, change memory chip, it's Hynix shit, lol, btw same shit as Sandisk )))).
For additional, model M8su don't have modem cert jail - you can write any working dump.


!!! How to isp_M8su_improved

One M8su = 0PKV100-00 = M8QL_UL


How to isp HTC OneM8su

For emmc_isp operation:

- remove CLK resistor (22R)
- soldering wire to TP "CLK"
- soldering wires to TP's "Dat0" and "CMD" and "GND"
- plug in USB and attach Battery
- click emmc detect

After emmc_isp operation done:

- unplug USB and Battery
- desoldering wires and pull jumper instead of CLK resistor (or soldering back CLK resistor)



Open serial port...OK
Connecting to the RIFF Box...OK
Firmware Version: 1.41 (RIFFBOX1), JTAG Manager Version: 1.62

Connecting to the SD/eMMC Card...OK
Set I/O Voltage reads as 2.83V, SD_CLK Frequency is 960 KHz
Memory Type .......................... eMMC
Manufacturer ID ...................... 0x90
OEM/Application ID ................... 0x4A
Product Name ......................... "HAG2e "
Package .............................. BGA
User Area Partition Size ............. 0x0003AB800000 Bytes (14.68 GB)
Boot Partition Size .................. 0x000000400000 Bytes (4.00 MB)
RPMB Partition Size .................. 0x000000400000 Bytes (4.00 MB)
OCR Register ......................... 0xC0FF8080 (Dual Voltage, High Capacity)
Write Protection Bits ................ NONE
Boot Configuration ................... No Boot
Chip Revision ........................ 0.7
Multimedia Card Revision ............. 1.7 (eMMC v5.0)
Serial Number ........................ 0x6A7BD53B
Memory Manufacturing Date ............ April, 2015