Dumping the SST39WF800A Chip

tof wrote us to give us some update about his work on dumping the SST39WF800A, he finally succeded on a second attempt but here is what he wrote us about the first attempt:

« This week I tried to extract the bootloader from a flash, but the chip was damaged during the soldering, either by the iron heat, or static electricity, or mechanical stress during "unsoldering".

What I did:

  • "Unsolder" the flash by pulling it (brutal, next time I will unsolder by hot air);
  • Glue it to a test board;
  • Solder 40 coil wires to the balls;
  • Check electrically the connections via the clamp diodes presence. I automated this step;
  • Check shorts between wires (automated);
  • Read it out with a microcontroller and send the results to a serial port.

The electrical tests fail, there are some clamp diodes lacking (failed pins, especially /OE).

Some photos of the different steps are available further down.

I will try again as soon as I find another broken nano.

A few advises:

  • For the unsoldering, I lifted the chip with a blade. This probably cracked the die, so next time I will try unsoldering with hot air. the BGA is glued down, so I do not know how the glue will behave in the hot air. lifting the chip was not too difficult, the glue was not too strong.
  • If the hot air fails, another method is to bend the PCB, then the balls remain on the chip and not on the board like I had. I tried it after with the ram chip, it seems to work.
  • Use very thin wires, I first tried with thicker ones, but it makes mechanical stress on the solder joints use a very thin iron tip, not too hot, because we solder directly to the chip.
  • Use a good magnifying glass and thin tweezers.
  • Static electricity counter measures are needed.
  • First put solder on 1/2 mm of wire to get rid of the lackering. the iron heat together with the flux burns away the lackering. You can use a second iron with a normal tip and hotter setting for this part.
  • then gently and very quickly press the end of the wire onto the ball with the iron tip. then place, cut and solder the other end of the wire.

We now can extract the bootloader, but we really need your help !!
We need broken nanos II to succeed ;)) »

Here are the pictures and few comments from tof who tried to dump the content of the chip.

Extracting the chip from its socket was more difficult than expected, the chip was damaged during the process. You should be using a heatgun if you want to do it.

Connecting the chip to the microcontroller in order to extract data from it.

A close up from the previous.

The whole thing.