Isplumia635
ISP Lumia 635
The Nokia Lumia 635 is a Windows OS based smartphone. As of the time of this writing (2015AUG12), two methods are known to acquire a physical image of the eMMC on this device. A chip-off procedure can be used (which is a destructive procedure) or the phone can be read using the ISP method documented below. The ISP method provides you with a working device after the extraction is complete.
For the purpose of this document, a Nokia Lumia 635 was disassembled, read via ISP, and then reassembled.
Getting Started
What you need to dump the eMMC:
- An ATF Turbo Flasher
- Soldering skills and ultra-fine tip soldering iron.
- A hot air re-work station. The hot air re-work station used for this was an LF-852D Hot Air Station.
eMMC Dump Procedure
- Disassemble the phone down to the PCB.
- Solder wires to the eMMC connection points on the PCB.
- Connect the ATF box to the PC and start the ATF software.
- Configure the ATF software.
- Connect the PCB with the ATF 4in1 adapter to the ATF box.
- Connect the PCB via USB to the computer.
- Read the device via the ATF software.
Detailed Procedure
* Remove the back cover.
* Remove the battery.
* Remove the 6 x Torx T-5 screws from the back of the phone and the 2 x Torx T-5 screws to the right of the battery on the side of the phone.
* Remove the black sticker located above the USB port to reveal a hidden screw (Sneaky! Sneaky! Nokia).
* Using a pick, or plastic pry tool, separate the display from the back panel. Note that there is a ribbon cable that connects the display to the main board of the phone. Disconnect this cable.
* Disconnect the 2 remaining ribbon cables and remove the main board from the body of the phone.
* The ISP taps are located under the shield located adjacent to the volume up and volume down buttons. The shield can either be cut off or removed using a soldering iron or hot air rework station. Hot air was used in this case. Care must be taken to avoid damaging or removing components around the heat shield when removing it.
* The ATF box uses a colour combination in order to connect the ATF to the eMMC. The following table documents the colour mapping to the standard eMMC taps required for the Lumia 635:
Green --> DATAO
Blue --> CMD
Red --> CLK
Yellow --> TDO
Brown --> GND
* Using 0.040 gauge wire, solder the taps. Note: The yellow and red taps connect to the same test point. I recommend soldering a single wire to the tap and breaking it out to separate wires for the red and yellow connections. These wires are then connected to a ATF 4-in-1 adapter.
* For this procedure, the circuit was powered via USB connected to the computer. The following image documents the ATF settings used to read the eMMC:
