Nikon NHHS-2 - Flash Memory

[4cc3ss]

I've removed both S29GL064N's from D3100 main board, as i was curious to which point was going to NHHS-2 from the flash memory.
As you see from the picture it's CE#, i can't see any other reason why nikon has done this, unless it's done for the right reasons, i'm seeing this
as when the usb is in use CE# goes high which disables the flash memory and preventing anyone retrieving the ID or dumping the contents via usb.
I've not tested this yet, but can't find another reason why CE# connected to Nikon Nhhs-2.

I'm Impressed by the fact you could follow tracks that way. Can you confirm it's a direct connexion (0 ohm) ?
And, sorry if I'm not that familiar with those chips, but what signal is CE# ?
Best regards,

Vicne

[leegong]

I have been looking for NHHS-2 or NHHS-1 DATASHEET for two months , but unfortunately not successful .

[4cc3ss]

I have been looking for NHHS-2 or NHHS-1 DATASHEET for two months , but unfortunately not successful .

I did look before posting this, if it hasn't been released i doubt it ever will, maybe be giving too much away.
but to bring both rom 0 &1 CE# to a single point on the NHHS-2, that tells me one thing.
I've not looked at D5100 yet, i'm confident to say it'll be the same for the 128mb rom.

[4cc3ss]

I've removed both S29GL064N's from D3100 main board, as i was curious to which point was going to NHHS-2 from the flash memory.
As you see from the picture it's CE#, i can't see any other reason why nikon has done this, unless it's done for the right reasons, i'm seeing this
as when the usb is in use CE# goes high which disables the flash memory and preventing anyone retrieving the ID or dumping the contents via usb.
I've not tested this yet, but can't find another reason why CE# connected to Nikon Nhhs-2.

I'm Impressed by the fact you could follow tracks that way. Can you confirm it's a direct connexion (0 ohm) ?
And, sorry if I'm not that familiar with those chips, but what signal is CE# ?
Best regards,

Vicne

Hi Vicne

I've just seen you added to my post, yes these connections are 100% and yes 0 ohm ...was the reason i lifted the other bga's to reduce resistance & find the points needed.
I'm not to familiar with these chips neither, i'm assuming when 3.0v applied to CE# this will disable the rom, i'm also doing my homework on OE# & RESET#.
As you know my hands are tied till i get my delivery, before i can say for sure what the voltages are and to which rom or roms are in use.

4cc3ss

[Vicne]

I've just seen you added to my post

OMG I'm really sorry. I clicked on Edit instead of Quote, and ended up modifying your post instead of replying to it
Not the first time it happens to me, but previous time I was able to revert my edits. Really sorry again

yes these connections are 100% and yes 0 ohm ...was the reason i lifted the other bga's to reduce resistance & find the points needed.
I'm not to familiar with these chips neither, i'm assuming when 3.0v applied to CE# this will disable the rom

Another reason why memory could be disabled could also be to save power. Just speculation again, of course.

Best regards,

Vicne

[4cc3ss]

I've just seen you added to my post

OMG I'm really sorry. I clicked on Edit instead of Quote, and ended up modifying your post instead of replying to it
Not the first time it happens to me, but previous time I was able to revert my edits. Really sorry again

yes these connections are 100% and yes 0 ohm ...was the reason i lifted the other bga's to reduce resistance & find the points needed.
I'm not to familiar with these chips neither, i'm assuming when 3.0v applied to CE# this will disable the rom

Another reason why memory could be disabled could also be to save power. Just speculation again, of course.

Best regards,

Vicne

It's ok i've done it myself, lucky enough i noticed & corrected it.

You have a good point Vicne and i do agree it could be to save power, but it would also stop you ID-ing the roms or rom.

I've been wrong all along, assuming NHHS-2 was usb interface, D- D+ points run directly to EXPEED, but roms to NHHS-2 is correct.

[Simeon]

Just looking at the ROM flashing code of the D3100 it appears to be mostly the same as the D5100 ROM flashing code.

[4cc3ss]

Just looking at the ROM flashing code of the D3100 it appears to be mostly the same as the D5100 ROM flashing code.

With two roms, i wouldn't of thought they be sharing the same data lines and have there own independent one's, i know this isn't the case with the D3100.
I'll be interested how the roms are flashed Simeon, with roms using the same data lines, is the flash in two half's 0 then 1 or is the flash divided in smaller,
parts between the two roms.

I would like to add that D3100 roms uses MirrorBit technology, so it can hold twice as much data.

[stuge]

How is the NHHS-2 chip generally connected?

Is it known if the NHHS-2 USB is full speed or high speed USB? Using a voltmeter between GND and either D+ or D- in a running system would answer this.

It would of course be interesting to listen to the USB communication between EXPEED and NHHS-2.

It would also be interesting to connect the NHHS-2 to a PC instead of the EXPEED. USB is USB.

CE# is an active low signal. This means that in idle condition, when noone is driving the signal, it will be high, ie. 3.3V.

Active low signals can be driven low by more than one output, but in the case of this flash chip only one at a time. CE# being driven low by any one output means that the flash chip is selected. Think of it as the flash chip being in it's own room with a closed door to a hallway. In other rooms there are other chips. When the door is opened (CE# is driven low) then the flash chip receives whatever someone is saying in the hallway. Sorry for the cheesy analogy, I hope it helps.

Anyone who wants to read or write to or from the flash chip needs to drive CE# low in order to do so. Everyone who is able to directly read or write the flash will have a connection to the CE# pins.

I am not sure what the purpose of NHHS-2 is. It is theoretically possible that it can be used to debrick a camera with a faulty firmware, if there is some magic trickery inside the EXPEED for passing the D+ and D- signals on to the actual USB connector - but that is a long shot speculation. I would appreciate to know what else the NHHS-2 connects to, and how. Every signal helps create understanding. If anyone has a spare mainboard I'd be interested in performing some measurements on it.

[stuge]

With two roms, i wouldn't of thought they be sharing the same data lines

I guess they simply hold half of the image each, I think that's what you mean by 0's and 1's.

I would like to add that D3100 roms uses MirrorBit technology, so 64mb rom can store 128mb of data.

I don't know where you got that from. The 64Mbit rom stores 64Mbit, no more.

Since you have the chips off the board, I would be interested in knowing what pins connect where. Let's start with ball F6 to find out if the chips use byte mode or word mode? F6 should have a connection to 3.3V (VCC ball G4) or GND (VSS balls H1 H6) maybe with some resistance but possibly directly connected.