The FPC adapter shown soldered between the BGA chip and the phone's mainboard, with the phone shown to have successfully booted, displaying an unlock prompt on the screen

IPhone 6S NVMe Chip Tapped Using A Flexible PCB

March 3, 2024 by Arya Voronova 3 Comments

Psst! Hey kid! Want to reverse-engineer some iPhones? Well, did you know that modern iPhones use PCIe, and specifically, NVMe for their storage chips? And if so, have you ever wondered about sniffing those communications? Wonder no more, as this research team shows us how they tapped them with a flexible printed circuit (FPC) BGA interposer on an iPhone 6S, the first iPhone to use NVMe-based storage.

The research was done by [Mohamed Amine Khelif], [Jordane Lorandel], and [Olivier Romain], and it shows us all the nitty-gritty of getting at the NVMe chip — provided you’re comfortable with BGA soldering and perhaps got an X-ray machine handy to check for mistakes. As research progressed, they’ve successfully removed the memory chip dealing with underfill and BGA soldering nuances, and added an 1:1 interposer FR4 board for the first test, that proved to be successful. Then, they made an FPC interposer that also taps into the signal and data pins, soldered the flash chip on top of it, successfully booted the iPhone 6S, and scoped the data lines for us to see.

This is looking like the beginnings of a fun platform for iOS or iPhone hardware reverse-engineering, and we’re waiting for further results with bated breath! This team of researchers in particular is prolific, having already been poking at things like MITM attacks on I2C and PCIe, as well as IoT device and smartphone security research. We haven’t seen any Eagle CAD files for the interposers published, but thankfully, most of the know-how is about the soldering technique, and the paper describes plenty. Want to learn more about these chips? We’ve covered a different hacker taking a stab at reusing them before. Or perhaps, would you like to know NVMe in more depth? If so, we’ve got just the article for you.

We thank [FedX] for sharing this with us on the Hackaday Discord server!

A freshly reballed BGA chip next to a clean PCB footprint

Working With BGAs: Soldering, Reballing, And Rework

March 23, 2023 by Robin Kearey 27 Comments

In our previous article on Ball Grid Arrays (BGAs), we explored how to design circuit boards and how to route the signals coming out of a BGA package. But designing a board is one thing – soldering those chips onto the board is quite another. If you’ve got some experience with SMD soldering, you’ll find that any SOIC, TQFP or even QFN package can be soldered with a fine-tipped iron and a bit of practice. Not so for BGAs: we’ll need to bring out some specialized tools to solder them correctly. Today, we’ll explore how to get those chips on our board, and how to take them off again, without spending a fortune on equipment.

Tools of the Trade

For large-scale production, whether for BGA-based designs or any other kind of SMD work, reflow ovens are the tool of choice. While you can buy reflow ovens small enough to place in your workshop (or even build them yourself), they will always take up quite a bit of space. Reflow ovens are great for small-scale series production, but not so much for repairs or rework. Continue reading “Working With BGAs: Soldering, Reballing, And Rework” →

Showing a RAM chip being removed from a Pi 4 board, hot air gun in the shot. Area around the chip is covered with kapton tape.

Upgrade RAM On Your Pi 4, The Fun Way

March 5, 2023 by Arya Voronova 17 Comments

The Raspberry Pi shortage has been a meme in hacker circles for what feels like an eternity now, and the Pi 4 seems to be most affected – though, maybe it’s just its popularity. Nevertheless, if you’re looking for a Pi 4, you would need to look far and wide – and things are way worse if you need the 8 GB version specifically. Or so we thought – [MadEDoctor] shows us that refreshing online store pages isn’t the only way, having successfully upgraded the RAM chip on the Pi 4 from 1 GB to 8 GB with help of a hot air gun.

These chips are BGA, and those might feel intimidating if you’re just starting out with hot air – however, we recommend you watch this video, as [MadEDoctor]’s approach is of the kind that brings BGA replacement to hobbyist level. First off, you get a compatible RAM chip somewhere like Aliexpress – lucky for us, those come equipped with a set of balls from the factory. The default balls are made of lead-free solder, and [MadEDoctor] reballed the RAM chip with leaded solder balls to lower the melting point, but it’s by no means a requirement that you do the same.

In fact, you only need a hot air gun, flux, a soldering iron and some solder wick to perform the replacement – no reballing equipment. Put some kapton or metal tape on the board for heat shielding, get the old chip off with hot air, use an iron with wick to clean the pads, add some flux, align the chip, then use hot air to solder a new chip onto the board. Replacing this chip can get your Pi 4 to the highly-sought-after 8 GB target – as an aside, we’re surprised that there was no configuration needed, as the Pi 4 booted right up and successfully recognized the extra RAM added.

We’d personally recommend preheating for such an upgrade – that said, this sure went without a hitch, and such a RAM swap method doesn’t require any stencils, solder paste or solder ball applications. Drop by the video description for compatible RAM chip part numbers, make sure you have your tacky flux and solder wick in order, and let [MadEDoctor] walk you through upgrading your Pi 4 the hacker way. Is this hack to your liking? Take it up a notch with this laptop soldered-in RAM upgrade journey, or that one RAM upgrade for an old GPU to comply to Apple’s whims.

A GPU PCB mounted on top of a preheater, with a hot air gun blowing on top of one of the DDR chips, held with tweezers, about to be removed from the board. Most of the other chips are already gone from the board, with only a few left.

GPU RAM Upgrades Are Closer Than You Think

January 30, 2022 by Arya Voronova 33 Comments

We’re all used to swapping RAM in our desktops and laptops. What about a GPU, though? [dosdude1] teaches us that soldered-on RAM is merely a frontier to be conquered. Of course, there’s gotta be a good reason to undertake such an effort – in his case, he couldn’t find the specific type of Nvidia GT640 that could be flashed with an Apple BIOS to have his Xserve machine output the Apple boot screen properly. All he could find were 1GB versions, and the Apple BIOS could only be flashed onto a 2GB version. Getting 2GB worth of DDR chips on Aliexpress was way too tempting!

The video goes through the entire replacement process, to the point where you could repeat it yourself — as long as you have access to a preheater, which is a must for reworking relatively large PCBs, as well as a set of regular tools for replacing BGA chips. In the end, the card booted up, and, flashed with a new BIOS, successfully displayed the Apple bootup logo that would normally be missing without the special Apple VBIOS sauce. If you ever want to try such a repair, now you have one less excuse — and, with the GT640 being a relatively old card, you don’t even risk all that much!

This is not the first soldered-in RAM replacement journey we’ve covered recently — here’s our write-up about [Greg Davill] upgrading soldered-in RAM on his Dell XPS! You can upgrade CPUs this way, too. While it’s standard procedure in sufficiently advanced laptop repair shops, even hobbyists can manage it with proper equipment and a good amount of luck, as this EEE PC CPU upgrade illustrates. BGA work and Apple computers getting a second life go hand in hand — just two years ago, we covered this BGA-drilling hack to bypass a dead GPU in a Macbook, and before that, a Macbook water damage revival story.

Continue reading “GPU RAM Upgrades Are Closer Than You Think” →

You Can’t Upgrade Soldered-On Laptop RAM? Think Again

November 24, 2021 by Jenny List 80 Comments

Upgrading the memory in a computer is usually a straightforward case of swapping out a few DIMMs or SODIMMs, with the most complex task being to identify the correct type of memory from the many available. But sometimes a laptop manufacturer can be particularly annoying, and restrict upgradability by soldering the RAM chips directly to the board. Upgrading memory should then be impossible, but this reckons without the skills of [Greg Davill], who worked through the process on his Dell XPS13.

The write-up is a fascinating primer on how DRAM identification works, which for removable DIMMs is handled by an onboard FLASH chip containing the details of the chips on board. A soldered-on laptop has none of these, so instead it employs a series of resistors whose combination tells the BIOS what memory to expect. Some research revealed their configuration, at which point the correct chips were sourced. Surprisingly it’s not as easy as one might expect to buy small quantities of some RAM chips, but he was eventually able to find some via AliExpress. An aside is how he checked the chips he received for fakes, including the useful tip of hiring a dentist to take an x-ray.

The final step is the non-trivial task of reballing and reworking the new BGAs onto the board, before testing the laptop and finding the process to be a success. We’ll leave you with his final words though: “But next time I think I’ll just buy the 16GB variant upfront.“.

We’ve seen quite a lot of [Greg]’s work here at Hackaday, one of his most recent was this amazing LED D20.

Incredible Soldering In The Name Of Hardware Support

September 5, 2020 by Tom Nardi 31 Comments

If you’re developing a performant IP-KVM based on the Raspberry Pi, an HDMI capture device that plugs into the board’s CSI port would certainly be pretty high on your list of dream peripherals. Turns out such devices actually exist, and somewhat surprisingly, are being sold for reasonable prices. Unfortunately the documentation for the chipset they use is a bit lacking, which is a problem if you’re trying to wring as much performance out of them as possible.

As the creator of Pi-KVM, [Maxim Devaev] needed to truly understand how the Toshiba TC358743 chip used in these capture devices worked, so he decided to build his own version from scratch. In the name of expediency, he didn’t have a proper breakout board made and instead decided to hand-solder the tiny BGA chip directly to some parts bin finds. The resulting perfboard capture device is equal parts art and madness, but more importantly, actually works as expected even with 1080p video signals.

Ultimately, the lessons learned during this experiment will lead to a dedicated KVM board that will plug into the Pi’s expansion header and provide all the necessary hardware in one shot. As [Maxim] explains in the Pi-KVM docs, the move to the CSI connected Toshiba TC358743 cuts latency in half compared to using a USB capture device. That said, USB capture devices will remain fully supported for anyone who just needs a quick way to get things working.

This DIY capture card is a perfect example of how the skills demonstrated while working on a project can be just as impressive as the end result. [Maxim] didn’t set out to hand-solder a BGA HDMI capture chip, it was merely one step in the process towards creating something better. Those intermediary achievements are often lost in the rush to document the final project, so we’re always glad when folks take the time to share them.

[Thanks to Eric for the tip.]

Hackaday Podcast 026: Tamper-Proof Electronics, Selfie Drones, Rocket Fuel, Wire Benders, And Wizard-Level Soldering

July 12, 2019 by Mike Szczys 1 Comment

Hackaday Editors Mike Szczys and Elliot Williams are back after last week’s holiday break to track down all of the hacks you missed. There are some doozies; a selfie-drone controlled by your body position, a Theremin that sings better than you can, how about a BGA hand-soldering project whose creator can’t even believe he pulled it off. Kristina wrote a spectacular article on the life and career of Mary Sherman Morgan, and Tom tears down a payment terminal he picked up in an abandoned Toys R Us, plus much more!

Take a look at the links below if you want to follow along, and as always tell us what you think about this episode in the comments!

Take a look at the links below if you want to follow along, and as always, tell us what you think about this episode in the comments!

Direct download (60 MB or so.)