Nikon NHHS-2 - Flash Memory

All things embedded

Nikon NHHS-2 - Flash Memory

Postby 4cc3ss » Sat Jan 12, 2013 11:36 am

I've removed both S29GL064N's from D3100 main board, as i was curious to which point was going to NHHS-2 from the flash memory.
As you see from the picture it's CE#, i can't see any other reason why nikon has done this, unless it's done for the right reasons, i'm seeing this
as when the usb is in use CE# goes high which disables the flash memory and preventing anyone retrieving the ID or dumping the contents via usb.
I've not tested this yet, but can't find another reason why CE# connected to Nikon Nhhs-2.
AA.jpg

I'm Impressed by the fact you could follow tracks that way. Can you confirm it's a direct connexion (0 ohm) ?
And, sorry if I'm not that familiar with those chips, but what signal is CE# ?
Best regards,

Vicne
4cc3ss
Core Developer
 
Posts: 708
Joined: Fri Mar 23, 2012 11:38 am
Location: Uk
Been thanked: 173 times

Re: Nikon NHHS-2 - Flash Memory

Postby leegong » Sun Jan 13, 2013 5:20 am

I have been looking for NHHS-2 or NHHS-1 DATASHEET for two months , but unfortunately not successful .
leegong
Core Developer
 
Posts: 1612
Joined: Mon Mar 19, 2012 12:21 am
Been thanked: 113 times

Re: Nikon NHHS-2 - Flash Memory

Postby 4cc3ss » Mon Jan 14, 2013 8:46 am

leegong wrote:I have been looking for NHHS-2 or NHHS-1 DATASHEET for two months , but unfortunately not successful .


I did look before posting this, if it hasn't been released i doubt it ever will, maybe be giving too much away.
but to bring both rom 0 &1 CE# to a single point on the NHHS-2, that tells me one thing. :)
I've not looked at D5100 yet, i'm confident to say it'll be the same for the 128mb rom.
4cc3ss
Core Developer
 
Posts: 708
Joined: Fri Mar 23, 2012 11:38 am
Location: Uk
Been thanked: 173 times

Re: Nikon NHHS-2 - Flash Memory

Postby 4cc3ss » Mon Jan 14, 2013 1:39 pm

4cc3ss wrote:I've removed both S29GL064N's from D3100 main board, as i was curious to which point was going to NHHS-2 from the flash memory.
As you see from the picture it's CE#, i can't see any other reason why nikon has done this, unless it's done for the right reasons, i'm seeing this
as when the usb is in use CE# goes high which disables the flash memory and preventing anyone retrieving the ID or dumping the contents via usb.
I've not tested this yet, but can't find another reason why CE# connected to Nikon Nhhs-2.

I'm Impressed by the fact you could follow tracks that way. Can you confirm it's a direct connexion (0 ohm) ?
And, sorry if I'm not that familiar with those chips, but what signal is CE# ?
Best regards,

Vicne


Hi Vicne

I've just seen you added to my post, yes these connections are 100% and yes 0 ohm :) ...was the reason i lifted the other bga's to reduce resistance & find the points needed.
I'm not to familiar with these chips neither, i'm assuming when 3.0v applied to CE# this will disable the rom, i'm also doing my homework on OE# & RESET#.
As you know my hands are tied till i get my delivery, before i can say for sure what the voltages are and to which rom or roms are in use.

4cc3ss
4cc3ss
Core Developer
 
Posts: 708
Joined: Fri Mar 23, 2012 11:38 am
Location: Uk
Been thanked: 173 times

Re: Nikon NHHS-2 - Flash Memory

Postby Vicne » Mon Jan 14, 2013 1:54 pm

4cc3ss wrote:I've just seen you added to my post

OMG I'm really sorry. I clicked on Edit instead of Quote, and ended up modifying your post instead of replying to it :-(
Not the first time it happens to me, but previous time I was able to revert my edits. Really sorry again :-( :-(
yes these connections are 100% and yes 0 ohm :) ...was the reason i lifted the other bga's to reduce resistance & find the points needed.
I'm not to familiar with these chips neither, i'm assuming when 3.0v applied to CE# this will disable the rom

Another reason why memory could be disabled could also be to save power. Just speculation again, of course.

Best regards,

Vicne
Vicne
Core Developer
 
Posts: 1703
Joined: Tue Nov 29, 2011 2:30 pm
Been thanked: 155 times

Re: Nikon NHHS-2 - Flash Memory

Postby 4cc3ss » Mon Jan 14, 2013 2:29 pm

Vicne wrote:
4cc3ss wrote:I've just seen you added to my post

OMG I'm really sorry. I clicked on Edit instead of Quote, and ended up modifying your post instead of replying to it :-(
Not the first time it happens to me, but previous time I was able to revert my edits. Really sorry again :-( :-(
yes these connections are 100% and yes 0 ohm :) ...was the reason i lifted the other bga's to reduce resistance & find the points needed.
I'm not to familiar with these chips neither, i'm assuming when 3.0v applied to CE# this will disable the rom

Another reason why memory could be disabled could also be to save power. Just speculation again, of course.

Best regards,

Vicne


It's ok i've done it myself, lucky enough i noticed & corrected it.

You have a good point Vicne and i do agree it could be to save power, but it would also stop you ID-ing the roms or rom.

I've been wrong all along, assuming NHHS-2 was usb interface, D- D+ points run directly to EXPEED, but roms to NHHS-2 is correct.
4cc3ss
Core Developer
 
Posts: 708
Joined: Fri Mar 23, 2012 11:38 am
Location: Uk
Been thanked: 173 times

Re: Nikon NHHS-2 - Flash Memory

Postby Simeon » Mon Jan 14, 2013 2:58 pm

Just looking at the ROM flashing code of the D3100 it appears to be mostly the same as the D5100 ROM flashing code.
Simeon
Core Developer
 
Posts: 2093
Joined: Wed Nov 30, 2011 6:12 am
Location: Christchurch, New Zealand
Been thanked: 395 times

Re: Nikon NHHS-2 - Flash Memory

Postby 4cc3ss » Mon Jan 14, 2013 3:45 pm

Simeon wrote:Just looking at the ROM flashing code of the D3100 it appears to be mostly the same as the D5100 ROM flashing code.


With two roms, i wouldn't of thought they be sharing the same data lines and have there own independent one's, i know this isn't the case with the D3100.
I'll be interested how the roms are flashed Simeon, with roms using the same data lines, is the flash in two half's 0 then 1 or is the flash divided in smaller,
parts between the two roms.

I would like to add that D3100 roms uses MirrorBit technology, so it can hold twice as much data.
4cc3ss
Core Developer
 
Posts: 708
Joined: Fri Mar 23, 2012 11:38 am
Location: Uk
Been thanked: 173 times

Re: Nikon NHHS-2 - Flash Memory

Postby stuge » Mon Jan 14, 2013 3:51 pm

How is the NHHS-2 chip generally connected?

Is it known if the NHHS-2 USB is full speed or high speed USB? Using a voltmeter between GND and either D+ or D- in a running system would answer this.

It would of course be interesting to listen to the USB communication between EXPEED and NHHS-2.

It would also be interesting to connect the NHHS-2 to a PC instead of the EXPEED. USB is USB.

CE# is an active low signal. This means that in idle condition, when noone is driving the signal, it will be high, ie. 3.3V.

Active low signals can be driven low by more than one output, but in the case of this flash chip only one at a time. CE# being driven low by any one output means that the flash chip is selected. Think of it as the flash chip being in it's own room with a closed door to a hallway. In other rooms there are other chips. When the door is opened (CE# is driven low) then the flash chip receives whatever someone is saying in the hallway. Sorry for the cheesy analogy, I hope it helps.

Anyone who wants to read or write to or from the flash chip needs to drive CE# low in order to do so. Everyone who is able to directly read or write the flash will have a connection to the CE# pins.

I am not sure what the purpose of NHHS-2 is. It is theoretically possible that it can be used to debrick a camera with a faulty firmware, if there is some magic trickery inside the EXPEED for passing the D+ and D- signals on to the actual USB connector - but that is a long shot speculation. I would appreciate to know what else the NHHS-2 connects to, and how. Every signal helps create understanding. If anyone has a spare mainboard I'd be interested in performing some measurements on it.
stuge
 
Posts: 77
Joined: Fri Feb 03, 2012 3:00 am
Been thanked: 0 time

Re: Nikon NHHS-2 - Flash Memory

Postby stuge » Mon Jan 14, 2013 3:59 pm

4cc3ss wrote:With two roms, i wouldn't of thought they be sharing the same data lines

I guess they simply hold half of the image each, I think that's what you mean by 0's and 1's.

I would like to add that D3100 roms uses MirrorBit technology, so 64mb rom can store 128mb of data.

I don't know where you got that from. The 64Mbit rom stores 64Mbit, no more. :)

Since you have the chips off the board, I would be interested in knowing what pins connect where. Let's start with ball F6 to find out if the chips use byte mode or word mode? F6 should have a connection to 3.3V (VCC ball G4) or GND (VSS balls H1 H6) maybe with some resistance but possibly directly connected.
stuge
 
Posts: 77
Joined: Fri Feb 03, 2012 3:00 am
Been thanked: 0 time

Next

Return to Firmware

Who is online

Users browsing this forum: No registered users and 6 guests