Dump of UN46B8500 Need help/info

[kpkev]

http://img850.imageshack.us/img850/7030 ... 163828.jpg table for pin settings to perform operations on the nand.

The pinout for the chip seems kind of useless to me as the chip covers the connections, but there must be alternate test points. In the image of the chips the left one is the primary and has traces going to the cpu. now I am going to assume that these traces also can be used to read and write the chip as the cpu can. I looked at the traces going to the cpu and there are test points for each trace.



If Anyone send care to elaborate on some specifics like alternate point I would greatly appreciate it

Kevin

[kpkev]

http://www.elnec.com/sw/samsung_ecc_alg ... r_256b.pdf

Unless someone else knows diferent i guess this could be the information for applying ecc.

i am just trying to piece things together.
if there is an issue with me posting please let me know, posting helps me keep important info in one place.

[arris69]

http://www.dataio.com/Default.aspx?tabid=107 may you can request information here about programmer, but guess to buy a new motherboard is a bit cheaper.

[sbav1]

Real chances for recovery at this point: slight to none, IMO. Sorry . Looks like a motherboard replacement is a best way to go.

OneNAND flashing by itself is a little bit tricky (using it's primary built-in parallel interface, covered in detail in datasheet). I think you'll need to desolder the OneNAND (BGA) chip to gain access to all needed pads/pins (I really doubt all pins required are accessible as test pads on the B8500 mainboard; it's certainly not a case for any "lesser" B-series models mainboards I've ever seen). Doable, but (at best): a lot of work. Most likely not worth it. ECC/bad blocks management makes it even more tricky (i.e. you can't simply clone OneNAND contents from another/similar device at raw level; it's slightly more complicated than that).

OneNAND flashing via JTAG interface: AFAIK, for Samsung B-series, it's still (almost) completely uncharted territory; I'm quite sure it's theoretically possible to re-program OneNAND using JTAG (e.g. via boundary scan method) on B-series TV SoCs. Problem is: nobody knows exactly how (not counting some unnamed Samsung engineers: probably 5-7 people in total..). Figuring it out from scratch may take weeks/months and some additional bricks . Again: a lot of work, no success guarantee.

Alternative methods/access points/angles of attack: there are some promising (?) mysteries remain unsolved . For example: on PCB "solder" side, for each OneNAND in great many Samsung B/C/D TV models, there are typically two mysterious test pads located directly below the OneNAND chip.. Alternative (not mentioned in any datasheet) OneNAND serial interface, perhaps? Not very likely, IMO, but who knows..

[kpkev]

Hey thanks for the info. I do have a way to access the onenandchip thru serial over ardunio board. And evenanew method that I am trying. Till I expirment more with the jtag. I have found alternate points for ce and we and power on the via traces going from the nand to the cpu. Also there points on the back on the chip as well, but my ocilscope is downat the moment. I will have it fixed soon as the parts come in. My back ground in electronics is from the US Navy, 8 years avation electronics, submarine antiwarefare, weapons and communicatio
It's no big deal see you for dinnerthe tv is down as I have ordered 2 more boards. One to experiment with.

I am working on rewriting a nand reader and writer for this chip.

I am only doing this for fun . This will be a repeatable method when I finish and I hope I can get it in the wiki.

Kevin

[arris69]

awesome news, good luck

[juusso]

I am only doing this for fun . This will be a repeatable method when I finish and I hope I can get it in the wiki.
Kevin

I really hope you get success! The jtaging, direct NAND flashing are here almost uninvented territories...

[kpkev]

till i figure out ecc im stumped and short on time at the moment. i am still going to work on this just because i like the challenge. juuso do youknow why it didnt work. like maybe a setting or something. if i can ever get a good image from the chip maybe i could gind and fix/hexedit it. . i only flashed the bml0_10.
is there any way to start the other fw . i never flashed bml0_08.

[juusso]

If you ever get dump of flash, all what is needed is to rename /mtd_rwarea/PartitionSwitch_1_0 to /mtd_rwarea/PartitionSwitch_0_0 and flash all back.
Or it is enough to patch this one byte and TV starts to previous original firmware. The brick is due some RFS records because i used mount -o loop for edit image file (yes, yes, i know, my fault). If the unsquash/edit/squash/flash procedure was used, then this would not happened. Copying the code of bml0/8 to bml0/10 could make some good result as well...

[juusso]

Any success?