@whitex Thank you for the helpful post! When I DDRescue my chip, I get no errors. If I ddrescue the entire chip, it takes a "normal" amount of time. If I ddrescue just p3, it takes maybe 4 seconds. When I open that image (just p3) in R-Studio Hex viewer/editor, I see nothing but zeros. If I take the whole image (all 4 partitions) and look at it in R-Studio, I get the expected squashfs for p1/2 and associated files, but p3 and p4 still show all zeros. I have tried freezing (that's what took me from seeing no data to being able to make images). I only have the Allsocket USB reader at this time, so I haven't tried a different reader. The pads all look decent, but I could probably try to get them reballed once the world is open again (Covid-19).
-
Want to remove ads? Register an account and login to see fewer ads, and become a Supporting Member to remove almost all ads.
whitex
Well-Known Member
@Banjo, partition table might have gotten corrupt as @EV-Fixme said, however you said you got 5GB of zeros. Do you still see 5GB of 0's when reading the entire chip (therefore ignoring the partition table)? I don't think there would be 5GB of zeros on a valid used chip, which is what makes me wonder what did it. Erasing would do it (either accidental or maybe a bunch of consecutive failed erase-write cycles during OTA update?). A flash cell loss of retention failure would a lot more likely end up with a bunch of read errors, rather than 0 value cells - getting all 5GB of them in a row which show no read error but 0 instead just seems improbable. Have you had the Allsocket USB reader configured to Read-Only from the very beginning?
PS> About your comment about waiting for COVID-19 to go away and then reballing:
PS> About your comment about waiting for COVID-19 to go away and then reballing:
- I have been able to read chips using both SD and USB reader with and without reballing, as long as they were in good shape (carefully cleaned up not to lift pads, removed all the flux, etc). Still, it might be worth a try to reball.
- You can actually order stuff, even from China (CDC says no proven danger from Chinese goods). When I ordered my 2nd Allsocket reader a week ago (had USB, wanted to issue MMC commands for which I needed SD reader), I ordered it Thursday night with expedited shipping ($25 extra IIRC) and it arrived Monday morning - which is way faster than when I ordered the USB one (also expedited shipping) few weeks ago.
- Sadly, COVID-19 is not going away any time soon - it will be the world's new reality for months.
- During this time of social distancing and extended homestays, it's good to have things to keep one busy and the mind exercising - good time to learn new things, experiment with stuff, etc.
Last edited:
@whitex - When the eMMC was read while still on the T3, it showed all 0s as well. I tried the freezing method, but unfortunately no change, still shows up as all 0s for p3 and p4. The car was not in the middle of an OTA update when it failed, so I don't see erase-write cycles being the cause. You would think I would be getting at least some read errors and strange data, rather than all 0s. I'm considering shipping off the chip to MediaCom to see if they can get the data. It's 350 EUR though for the recovery, and I'm concerned they will just recover 5 and a half gigs of 0s as well.
If you mean Multi-COM: they only recover keys/certs in P3 - but they check if it's possible before you have to pay
P3 and P4 are generated from the MCU personal information. Your current p3 is complete short of your certificate and mcu keys which are car specific. Your P4 is complete. Just letting you know in case you don't get a lot of volunteers.
Yeah, I suspected I may not get any responses. I was just thinking it'd be nice to have a copy not on the chip to poke around in. The Multi-Com folks think they may be able to recover the data, so we'll see how that goes.
Greetings.
I am experiencing the same thing as Banjo - that is i have complete p1 and p2 partitions, but p3 and p4 are all-zero. I have done numerous reads on both the tegra board, and with the chip in a RT809H programmer.
All the on-board reads i have done have equal checksums, but the read from the programmer does not, though i have yet to pinpoint the difference. At least i'm reasonably sure it's not in p3 or p4.
Is there a way to identify which firmware is loaded from the p1/p2 data?
I am experiencing the same thing as Banjo - that is i have complete p1 and p2 partitions, but p3 and p4 are all-zero. I have done numerous reads on both the tegra board, and with the chip in a RT809H programmer.
All the on-board reads i have done have equal checksums, but the read from the programmer does not, though i have yet to pinpoint the difference. At least i'm reasonably sure it's not in p3 or p4.
Is there a way to identify which firmware is loaded from the p1/p2 data?
Interesting. Had you reported the MCU failure to Tesla prior to trying to read the chip?
Yes. My MCU failed one day while I was at work. Tesla quoted me $3k to replace with a refurb MCU 1. I elected to pull the t3 and send it to a 3rd party for the eMMC swap. Unfortunately, p3 and p4 were present, but all 0s (no data)
SC refuses to work on it. The only thing they're willing to do is put in a refurb MCU 1 for $3000. El Paso is my nearest SC.
If you still have the old EMMC a recovery might be possible via direct NAND access by someone who does flash data recovery.
I learned in TFF forum that one austrian guy managed to force tesla into providing the VPN and Certificate data by pointing towards EU anti-trust regulations related to 3rd-party car repair shops (point 15 in this document https://ec.europa.eu/competition/sectors/motor_vehicles/legislation/mv_faq_en.pdf ). But in the US that will unfortunately not help you...
I learned in TFF forum that one austrian guy managed to force tesla into providing the VPN and Certificate data by pointing towards EU anti-trust regulations related to 3rd-party car repair shops (point 15 in this document https://ec.europa.eu/competition/sectors/motor_vehicles/legislation/mv_faq_en.pdf ). But in the US that will unfortunately not help you...
That same individual posted here. I'm still fighting the fight with Tesla, but so far no response in over 13 days. I'm giving them some grace considering the virus outbreak, but if no response by 30 days I'll likely involve my legal team.
