eMMC Adventures, Episode 2: Resurrecting a dead Intel Atom-based tablet by replacing failed eMMC storage

As seen on Hackaday!

Recently, I purchased a cheap Intel Atom-based Windows 8 tablet (the DigiLand DL801W) that was being sold at a very low price ($15 USD, although the shipping to Canada negated much of the savings) because it would not boot into Windows – rather, it would only boot into the UEFI shell and cannot be interacted with without an external USB keyboard/mouse.

The patient, er, tablet

The tablet in question is a DigiLand DL801W (identified as a Lightcomm DL801W in the UEFI/BIOS data). It uses an Intel Atom Z3735F – a 1.33GHz quad-core tablet SoC (system-on-chip), 16GB of eMMC storage and a paltry 1GB of DDR3L-1333 SDRAM. It sports a 4500 mAh single-cell Li-ion battery, an 8″ 800×1200 display, 802.11b/g/n Wi-Fi using an SDIO chipset, two cameras, one microphone, mono speaker, stereo headphone jack and a single micro-USB port with USB On-The-Go support (this allows the port to act as a USB host port, allowing connections with standard USB devices like keyboards, mice, and USB drives).

Step 1: Triage & troubleshooting

The first step was to power on the tablet to get an initial glimpse into the issues preventing the tablet from booting. I was able to confirm that the eMMC was detected, but did not appear to have any valid MBR or file system; therefore, the UEFI firmware defaulted to entering the UEFI shell (which was of little use on its own as there is no on-screen keyboard available for it).

DSC_2191

DigiLand DL801W with UEFI shell

However, one can immediately notice there is an issue with the shell: how do you enter commands without an on-screen keyboard? The solution was to use a USB OTG (On-The-Go) dongle to convert the micro-USB type B port into a USB type A host port.

Using the shell commands, I tried reading the contents of the boot sector, which should end with an MBR signature of 0x55AA. Instead, the eMMC returned some nonsensical data: the first half of the sector had a repeating byte pattern of 0x10000700,  and the second half was all zeroes (0x00) except the last 16 bytes which were all ones (0xFF). The kicker was that this data was returned for every sector I tried to read. No wonder the eMMC was unbootable – the eMMC had suffered logical damage and the firmware was not functioning correctly.

After creating a 32-bit Windows 10 setup USB drive (these cheap low-RAM PCs often use a 32-bit UEFI despite having a 64-bit capable CPU), I opened Hard Disk Sentinel to take a deeper look at the condition of the onboard eMMC.

DSC_2198

Malfunctioning Foresee 16GB eMMC visible in Hard Disk Sentinel

The eMMC identified itself with a vendor ID of 0x65, and an MMC name of “M”. It reported a capacity of 7.2 GB instead of the normal 16 GB, another sign that the eMMC was corrupted at the firmware level.

DSC_2199

Foresee 16GB eMMC returning corrupted data

Using HDS, I performed a read scan of the entire eMMC despite its failed condition. The read speeds were mostly consistent, staying between 40 to 43 MB/s. A random read test revealed a consistent latency of 0.22 ms.

In order to assess whether the eMMC was writable in its current state, I ran a zero-fill and subsequent read scan. The eMMC appeared to accept writes but did not actually commit them, as HDS threw verification errors for all sectors.

After the tests in HDS, I decided to attempt an installation onto the eMMC to assess its writability. Windows Setup failed to create the disk partition structures, throwing an error message reading “We couldn’t create a new partition or locate an existing one”.

Step 2: Teardown & eMMC replacement

Since the onboard Foresee NCEMBS99-16G eMMC module was conclusively determined to be faulty, there was no point keeping it on the tablet’s motherboard. This also provided an opportunity to upgrade the eMMC to a a larger and faster one. Since this required the tablet to be disassembled, I decided to do a teardown of the tablet before attempting to replace the failed eMMC module (the teardown will be in a separate blog post when the time comes).

After removing the insulating plastic tape on the bottom of the PCB, I masked off the eMMC with some kapton tape to protect the other components and connectors from the heat of my hot-air rework station. With some hot air and patience, the failed Foresee eMMC was gone. This also revealed that the eMMC footprint supported both the 11.5×13 mm and 12×16 mm sizes, but the 12×16 mm footprint did not have the extra 16 solder balls for reinforcement (most eMMC balls are unused so their omission had no negative functional effect).

DSC_2215

Foresee eMMC removed from DL801W’s motherboard

Instead of a barely-usable 16 GB of eMMC storage, I opted to use the Samsung KLMBG4GEND-B031 – a 32 GB eMMC 5.0 module. This chip boasts more than 2000 IOPS for 4K random I/O, which should be a boon for OS and application responsiveness.

DSC_2219

Replacement Samsung KLMBG4GEND-B031 eMMC installed

A little flux and hot air was all I needed to give the 32 GB eMMC a new home. Time to reassemble the tablet and try installing Windows 10 again.

Step 3: OS reinstallation

After spending a few minutes cleaning the board and reinstalling it in the tablet, it was time to power the tablet back on, confirm the presence of the new eMMC and reattempt installing Windows.

DSC_2221

Installing Windows 10 from USB drive via USB-OTG adapter

The eMMC replacement proved to be successful; within minutes, I was off to the races with a clean installation of Windows 10.

Conclusion

DSC_2223

DL801W restored, running Texas Instruments’ bqSTUDIO software

This was a pretty fun project. With some electronics and computer troubleshooting skills, I had a tablet capable of running desktop Windows programs. Its low power consumption and USB host capabilities made for a great platform to run my Texas Instruments battery hardware and software without being tethered to my desktop.

However, I was not finished with this tablet. The 1 GB of onboard RAM made Windows painfully slow to use, as the CPU was constantly bogged down performing memory compression/decompression. The 32GB of eMMC storage I initially installed began feeling cramped, so I moved to a roomier 64GB (then 128GB) eMMC.

I won’t go into the details of how I upgraded the RAM in this post, as it’s a long story; simply put, soldering the RAM ICs was the easy part.

Advertisements

25 thoughts on “eMMC Adventures, Episode 2: Resurrecting a dead Intel Atom-based tablet by replacing failed eMMC storage

  1. Pingback: Hot Air Surgery Revives a Cheap Windows Tablet | Hackaday

  2. Pingback: Hot Air Surgery Revives a Cheap Windows Tablet – Hacking Space

  3. Great Hack!

    I’ve been waiting for someone to post information about how to swap out these chips on the Internet. DIYer’s in Shenzhen have been upgrading 16GB iPhones to 128GB using hot-air rework for 18+ months already.

    This knowledge can be applied to Chromebooks and bargain-bin Windows laptops which often ship with tiny amounts of eMMC storage memory – only 16 or 32 GB. These devices don’t even have enough free space to perform a full Windows update. A Cherry Trail or older device can be upgraded and a stripped down Linux variant like Mint or Gallium can be installed making a very good, cheap device for browsing, coding, and document publishing. Plenty of non-upgradable laptops can be given a few more years of life with little risk.

    I’m actually more interested in the RAM upgrade; using a laptop with only 2 GB of RAM with any OS is torture.

    • The 16GB-equipped Windows devices shouldn’t even be a thing in my opinion. The only way they managed to pack Windows 8/8.1 into such a cramped space is with a method called “WIMBoot”, which uses the recovery partition’s data for normal Windows operations, overlaying the rest of the file system on top to look like a normal Windows installation. Windows 10 appears to have removed this feature in favour of adaptive file compression, but it makes in-place upgrades on space-constrained devices nearly impossible. (https://blogs.windows.com/windowsexperience/2015/03/16/how-windows-10-achieves-its-compact-footprint/)

      That said, it would be interesting trying to install a Linux OS on a tablet SoC like this and seeing how well it can act as a (wireless) router, compared to a standalone device – I’d find it amusing if the x86 cores in the SoC outperform the MIPS32/64 cores found in consumer network equipment!

      Given how unserviceable these devices are, eMMC replacement is by far the easiest upgrade to perform. The RAM upgrade required digging into how UEFI works (and I still don’t quite get it), and part of the reason I succeeded at all is because I was able to “steal” data from BIOS images meant for similar devices, but sold by other companies.

  4. Hey there, awesome hack!
    Can you give me some advice? I’m at loss right now, my windows tablet (Vulcan XB) is stuck at EFI shell with no usb support, I mean, the OTG doesn’t link usb keyboard and tablet so I’m not able to type a thing in the shell. How did you do it?

    • Are you using a USB OTG dongle with the correct ID pin connection (the 4th microUSB pin, ID, needs to be shorted to ground to enable host mode)? Also, are you using a wireless or wired keyboard?

      Looking at pictures online, this tablet should have a keyboard. Does yours not have the keyboard (or does it just not work)?

  5. Fantastic blog and post, I recently had my iphone storage chip upgraded (living in China currently). Very interested in the RAM Upgrade post, looking forward to it!

  6. great job ! thank you for sharing
    mi tablet is showing similar problems ( mediacom w911)
    i whould like to ask you some questions :
    how have you managed to check the emmc with hard disk sentinel ?
    wich command are you using in the efi shell to check the boot sector ?
    thank you

    • I have a copy of the Portable edition of Hard Disk Sentinel that I opened inside the Windows Setup environment that I’ve placed alongside the Windows setup files on a USB drive. At the initial “Install Windows” screen, press Shift+F10 to bring up a command prompt. Navigate through the command prompt to open HDS – or you can cheat by using Notepad’s Open dialog while selecting “All Files (*.*)”, right-clicking HDSentinel.exe and selecting “Run as administrator”. Many (32-bit) Portable edition apps can be run this way in Windows Setup, as it’s simply a customized instance of WinPE (Windows Preinstallation Environment).

      The EFI Shell command to read the boot sector of the eMMC is:
      dblk blk0

      Regards,
      Jason

  7. hello jason
    instead of soldering a new emmc chip , do you think that using an sd whould work ?
    the pinout seems to be similar
    thank you

    • It depends on whether the eMMC interface supports 3.3 volt signalling instead of 1.8 volts, AND the host system must support SD commands and not just MMC. Another commenter said they tried this sort of mod but weren’t unsuccessful.

  8. Nice hacking, I have a dead eMMC also may give it a go. Where do you get the eMMC chips at resonable price? Mine has the 16GB like yours but if the 128GB will go for a fair price I’ll do it.

    • For a reasonably priced 128GB? Honestly I’ve yet to find such a thing – my 128GB eMMCs I’ve had were around $70 USD each from AliExpress, and I’ve already bricked one of my Samsung chips during experimentation.

  9. i have iball slide i701 (windows based tablet) and when i deploy a windows .wim image on this tab then emmc of this tablet corrupt and i face same problem as you face . my drive only show 7.2 gb and not writable but before this corruption i have 14.4 gb of space in my emmc. i thought that reprogramming using easy jtag solve my issue , what you think?

    • JTAG reprogramming won’t help if the eMMC firmware is corrupted. Even if the eMMC part itself had a JTAG port you would still have to desolder it to access those test pads (almost certainly it won’t, only raw NAND I/O), and have a working firmware to flash from the manufacturer.

      Unfortunately the only viable solution is to replace the eMMC. At least 32 GB parts are relatively cheap but even 64 GB ones are available for around $30 USD (larger capacity means no need for WIMBoot and therefore have higher performance).

  10. I don’t understand…
    According to the datasheet, Foresee NCEMBS99-16G, which you replaced, has BGA 169 package. But, Samsung KLMBG4GEND-B031 has BGA 153 package!
    How is that possible?

      • So, you wanna say, that pinouts of these two packages are identical? I wanted to replace eMMC of my old, but good-working, tablet with a faster and larger one. Its package is BGA 169. But, I haven’t found BGA 169 eMMCs for that which are fast and cheap enough!
        I like Samsung eMMCs, but they are mostly BGA 153.
        So, it is very interesting to me, if is it possible to replace tablet’s BGA 169 eMMC with BGA 153 one?

      • Yes, as long as it’s an x86-based tablet. Oftentimes ARM-based tablets store their firmware on the eMMC boot partition which makes the repair harder without access to an eMMC socket.

      • Have you had any issues with pin alignment during soldering? I wonder, do I need any special actions to solder BGA 153 chip on BGA 169 plate? Like, align the chip in some special way or something… Or, the soldering has no difference with a regular soldering?

      • The fine ball pitch means you will need to be sure the alignment is exactly right (the BGA pinout has an index that indicates pin 1, and the top of the package will have a corresponding marker as well). As with any BGA soldering technique that isn’t deadbug-style, you will need to reflow with something like hot air. Use a liberal amount of tacky flux on the underside. Look up some tutorials to see how it’s done, but you may want to try reflowing other surface-mount chips for practice first (preferably some scrap boards just to get the hang of it).

        The BGA153 basically sits right in the center of the BGA169 footprint. Most devices that use eMMC will have silkscreen corresponding to multiple different sizes including the most common BGA153 11.5x13mm footprint.
        This is one of my eMMC-based USB drives that I built, and you can see how the BGA153 fits in the BGA169 footprint; notice the metallic triangle index mark on the PCB, and the index marker on the eMMC itself.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.