Tapping In to the eMMC
My prior post is the way to fix this problem of the eMMC chip 'wearing out' with age. In early years Tesla did extensive logging which writes to /var in this chip. This Hynix chip is not very good quality, and anyway chips not labeled 'endurance' or similar can't take too much writing.
The result is at some point, now affecting cars 2016 and older, the eMMC will wear out, the Tegra processor will not be able to boot, and your MCU screen will be black or the MCU will reboot and reboot. This is inevitable, unless one of these commercial rooters has disabled logging. Most ppl have their MCU replaced and reprogrammed, but all that needs done is the eMMC chip replaced. I believe I'm the first to suss this out three years ago.
Myself, I replaced the 8GB Hynix with an industrial-grade SwissBit chip as I'd detailed before.
So doing the rework to remove and replace this chip is risky. And once the MCU is dead it is not very likely you'll be able to recover the /var partition, which is partition 3 on the chip. It would be a very good idea to get a dump of the chip before it fails so here is a less risky way to do that.
MMC/SD is actually an interface standard which allows different manufacturers to make chips that are drop-in replacements. If you don't want to replace the chip for now and just dump it, you can solder fine wires onto the right pads on the back of the CID, connect those to the AllSocket's header pins, and read the eMMC that way.
This isn't one of those easy things to do. It's not for shoe salesmen... worthwhile things are rarely easy. But if you've a steady hand and an accurate mind, you'll be fine.
So assuming you've made it this far, here's what my early effort looks like:
What are the connections? (credit: ce2078)
Connect these wires to the correct header pins on the AllSocket, tune the voltage, and plug it into your machine. Use my instructions from the prior post for dumping the images. Likely you'll only get 1bit mode to work, and it will take a good while.
Update from scaesare
"Well, crap. I can't read from my eMMC at all. The block device shows up, but I couldn't dd from it, and ddrescue has been chewing on it for 15 minutes, and midway through the second pass it's managed to recover 0.00%
Not what I had hoped for."
Our engineer confirms that the BGA153/169-SD Adapter is with the 0.1μf capacitor, but it can be changed to 1uf by setting the C2(capacitor) on the SD Adapter, please view this screenshot:
This will correct the problem some are having with reading the Hynix chip using the AllSocket carrier.
Where to get a cap like this? Well 1μF is a common rating fortunately, and the size is confirmed to be 0603. Check Mouser to pay alot, or go to a manufacturer like Kemet and request engineering samples. (free) The correct Kemet part# is C0402C102J8RAC. Also these will work: C0402C102J8JAC and C0402T102J8RBC. I have a bunch extra if you'd like a free one. Get out your magnifying glass (or Coils) and tweezers!
Thank you scaesare.
Carl A. Cook