{"id":1390,"date":"2025-09-16T13:12:55","date_gmt":"2025-09-16T11:12:55","guid":{"rendered":"https:\/\/redero.fr\/?p=1390"},"modified":"2025-09-29T17:10:20","modified_gmt":"2025-09-29T15:10:20","slug":"reverse-engineering-bga-pinouts-to-try-fixing-some-music-gear","status":"publish","type":"post","link":"https:\/\/redero.fr\/?p=1390&lang=en","title":{"rendered":"Reverse-engineering a BGA pinout just to fix a guitar pedal"},"content":{"rendered":"\n<p>A friend gave me this guitar loop pedal, a Digitech JamMan Solo (released circa 2010), to try and repair.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full wp-duotone-unset-1\"><img loading=\"lazy\" decoding=\"async\" width=\"314\" height=\"450\" src=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/jamman_solo.png\" alt=\"\" class=\"wp-image-1404\" srcset=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/jamman_solo.png 314w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/jamman_solo-209x300.png 209w\" sizes=\"auto, (max-width: 314px) 100vw, 314px\" \/><\/figure>\n\n\n\n<p>The pedal did not start. Its main LED lighted on for 3 seconds at boot, and then, nothing else happened. I plugged it to my computer and no USB was enumerated. Since nothing seemed wrong at first glance, I opened the gear and found this Atmel SAM9G45-based architecture.<\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;69f0d1477b55e&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"69f0d1477b55e\" class=\"wp-block-image size-large wp-duotone-unset-2 wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"1024\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/5-pcb_top_annotations-768x1024.jpg\" alt=\"\" class=\"wp-image-1391\" srcset=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/5-pcb_top_annotations-768x1024.jpg 768w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/5-pcb_top_annotations-225x300.jpg 225w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/5-pcb_top_annotations.jpg 960w\" sizes=\"auto, (max-width: 768px) 100vw, 768px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Agrandir\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Main components<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-vivid-red-color has-text-color has-link-color wp-elements-48aabade3fdf92e18cee05bd1cdf4193\">Atmel AT91SAM9G45<br>MPU with ARM926EJ-S 400 MHz ARM Thumb Processor<\/li>\n\n\n\n<li class=\"has-vivid-cyan-blue-color has-text-color has-link-color wp-elements-04734b2373188a5eea680693d3882b30\">Micron NW266<br>NOR Flash<\/li>\n\n\n\n<li class=\"has-vivid-green-cyan-color has-text-color has-link-color wp-elements-f3ab7dff93b46020cf316d2d54d1dbce\">Nanya (Kynix) NT5TU32M16C6<br>DDR2 SDRAM 32Mx16<\/li>\n\n\n\n<li class=\"has-luminous-vivid-amber-color has-text-color has-link-color wp-elements-110d5c52607b4f9bb901e04d38411fbe\">AKM AK4556VT<br>Audio stereo codec 24bits<\/li>\n\n\n\n<li class=\"has-vivid-purple-color has-text-color has-link-color wp-elements-90b9540a5a1f1865de852823eb5a62af\">HMSemi JRC4580<br>A bunch of audio-quality operational amplifiers<\/li>\n<\/ul>\n\n\n\n<p>After checking nothing burnt and all power supplies were present, I moved on to figuring out whether the processor was alive or dead.<\/p>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>A note about the music gear 9V power supply<\/summary>\n<p>In the music gear world, the standard power supply is DC 9V over a 5.5mm \/ 2.1mm barrel jack&#8230; but beware, because the barred jack is connected with the + outside of the barrel and the &#8211; inside!<\/p>\n\n\n\n<figure class=\"wp-block-image size-full wp-duotone-unset-3\"><img loading=\"lazy\" decoding=\"async\" width=\"282\" height=\"97\" src=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/9v_polarity.png\" alt=\"\" class=\"wp-image-1493\"\/><\/figure>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;69f0d1477bfe5&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"69f0d1477bfe5\" class=\"wp-block-image size-large wp-duotone-unset-4 wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"433\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/thomann_jack-1024x433.png\" alt=\"\" class=\"wp-image-1485\" srcset=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/thomann_jack-1024x433.png 1024w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/thomann_jack-300x127.png 300w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/thomann_jack-768x324.png 768w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/thomann_jack-1536x649.png 1536w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/thomann_jack.png 1920w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Agrandir\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<p>Those adapters have to be used with caution. I measured my amplifier\u2019s one and found a solid 11.5V output instead of the expected 9V.<\/p>\n\n\n\n<p>In order to get a real 9V, I like to use USB-C power delivery, since 9V is among the possible voltages. You can find small USB power delivery decoy boards from your favourite Chinese supplier, on which you solder bridge to get the voltage you want. This is how I manufacture my own USB-C to guitar pedals power adapters.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full wp-duotone-unset-5\"><img loading=\"lazy\" decoding=\"async\" width=\"403\" height=\"262\" src=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/usb_pd-1.png\" alt=\"\" class=\"wp-image-1490\" srcset=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/usb_pd-1.png 403w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/usb_pd-1-300x195.png 300w\" sizes=\"auto, (max-width: 403px) 100vw, 403px\" \/><\/figure>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;69f0d1477c5ad&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"69f0d1477c5ad\" class=\"wp-block-image size-large wp-duotone-unset-6 wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"768\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/music_usbc_to_9v-1024x768.jpg\" alt=\"\" class=\"wp-image-1504\" srcset=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/music_usbc_to_9v-1024x768.jpg 1024w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/music_usbc_to_9v-300x225.jpg 300w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/music_usbc_to_9v-768x576.jpg 768w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/music_usbc_to_9v-1536x1152.jpg 1536w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/music_usbc_to_9v-2048x1536.jpg 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Agrandir\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/details>\n\n\n\n<h2 class=\"wp-block-heading\">Where are the debug ports?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">A quick look at the board<\/h3>\n\n\n\n<p>This board has lots of through-hole connectors, but none of them is annotated.<\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;69f0d1477cb50&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"69f0d1477cb50\" class=\"wp-block-image size-full wp-duotone-unset-7 wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"606\" height=\"546\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/4-pcb_bot_what.jpg\" alt=\"\" class=\"wp-image-1392\" srcset=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/4-pcb_bot_what.jpg 606w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/4-pcb_bot_what-300x270.jpg 300w\" sizes=\"auto, (max-width: 606px) 100vw, 606px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Agrandir\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-vivid-red-color has-text-color has-link-color wp-elements-02e83257c7654cfa603fa4c5193b4678\">Connector to SD Card<\/li>\n\n\n\n<li class=\"has-luminous-vivid-amber-color has-text-color has-link-color wp-elements-184c759d460b93aa12ef162a62a15a25\">Connector to UI board (display, buttons&#8230;)<\/li>\n<\/ul>\n\n\n\n<p>So, how do we find the JTAG and debug UART ports?<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Fun with Gimp<\/h3>\n\n\n\n<p>I took photographs of top and bottom, and a screenshot of the BGA footprint from the datasheet, and imported it all in Gimp for image manipulation.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full wp-duotone-default-filter\"><img loading=\"lazy\" decoding=\"async\" width=\"346\" height=\"312\" src=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/datasheet.png\" alt=\"\" class=\"wp-image-1539\" srcset=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/datasheet.png 346w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/datasheet-300x271.png 300w\" sizes=\"auto, (max-width: 346px) 100vw, 346px\" \/><\/figure>\n\n\n\n<p>First I aligned top and bottom: I trimmed the board edges for reference, mirrored top, and used the \u00ab\u00a0Unified Transformation\u00a0\u00bb to resize and reshape the two images.<\/p>\n\n\n\n<p>Then I used top layer to fit the screenshot of the BGA footprint, making sure I have it on the right side. It is a bottom view in the datasheet and my reference is bottom, so I did not need to mirror this one. I also rotated it to match the pin 1 indicator placement.<\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;69f0d1477d2d8&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"69f0d1477d2d8\" class=\"wp-block-image size-large wp-duotone-unset-8 wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"813\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/top_bot_bga-1024x813.jpg\" alt=\"\" class=\"wp-image-1393\" srcset=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/top_bot_bga-1024x813.jpg 1024w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/top_bot_bga-300x238.jpg 300w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/top_bot_bga-768x610.jpg 768w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/top_bot_bga-1536x1219.jpg 1536w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/top_bot_bga-2048x1626.jpg 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Agrandir\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<p>Once this is done, if I hide the top layer picture, I can get a pretty good view of the BGA fanout. Of course this is not very precise because a same via could correspond to any of the 4 balls around it, but it greatly narrows down the possibilities.<\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;69f0d1477d7a3&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"69f0d1477d7a3\" class=\"wp-block-image size-large wp-duotone-unset-9 wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"813\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/bot_bga-1024x813.jpg\" alt=\"\" class=\"wp-image-1394\" srcset=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/bot_bga-1024x813.jpg 1024w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/bot_bga-300x238.jpg 300w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/bot_bga-768x610.jpg 768w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/bot_bga-1536x1219.jpg 1536w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/bot_bga-2048x1626.jpg 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Agrandir\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<p>Now I would like to verify my image layering. I usually use GND and power supply pins to do this type of checks, but this time the best option I found was the main clock tracks on the top layer.<\/p>\n\n\n\n<p>According to the datasheet:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ball V11: XOUT<\/li>\n\n\n\n<li>Ball V12: XIN<\/li>\n<\/ul>\n\n\n\n<p>We can see here that the tracks stop between V10 and V11, and V11 and V12, so it is easy to imagine they just continue a little bit to the left under the BGA. It seems to be matching!<\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;69f0d1477dd13&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"69f0d1477dd13\" class=\"wp-block-image size-large wp-duotone-unset-10 wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"790\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/clocktracks-1024x790.png\" alt=\"\" class=\"wp-image-1395\" srcset=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/clocktracks-1024x790.png 1024w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/clocktracks-300x231.png 300w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/clocktracks-768x592.png 768w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/clocktracks.png 1106w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Agrandir\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Hunting for debug ports<\/h3>\n\n\n\n<p>Since the board has lots of connectors, I decided to start the detective work from the ports I wanted to find. First, the JTAG port.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>NTRST = N10<\/li>\n\n\n\n<li>TMS = P10<\/li>\n\n\n\n<li>TDI = R10<\/li>\n\n\n\n<li>TCK = U10<\/li>\n\n\n\n<li>TDO = V10<\/li>\n<\/ul>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;69f0d1477e321&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"69f0d1477e321\" class=\"wp-block-image size-large wp-duotone-unset-11 wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"543\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/bgajtag-1024x543.png\" alt=\"\" class=\"wp-image-1396\" srcset=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/bgajtag-1024x543.png 1024w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/bgajtag-300x159.png 300w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/bgajtag-768x408.png 768w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/bgajtag.png 1078w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Agrandir\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<p>The JTAG ports are all aligned in column 10. We can see a bunch of tracks starting around here, let&rsquo;s go follow them.<\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;69f0d1477e7fa&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"69f0d1477e7fa\" class=\"wp-block-image size-full wp-duotone-unset-12 wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1004\" height=\"715\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/bgafollow.png\" alt=\"\" class=\"wp-image-1397\" srcset=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/bgafollow.png 1004w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/bgafollow-300x214.png 300w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/bgafollow-768x547.png 768w\" sizes=\"auto, (max-width: 1004px) 100vw, 1004px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Agrandir\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<p>I created a nice new layer with some transparency and started highlighting the surrounding tracks. But hey, they are going into vias! I hope this design does not have signals in internal layers so I can catch them back on the top layer.<\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;69f0d1477ec9f&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"69f0d1477ec9f\" class=\"wp-block-image size-large wp-duotone-unset-13 wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"735\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/bgafollowtop-1024x735.png\" alt=\"\" class=\"wp-image-1398\" srcset=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/bgafollowtop-1024x735.png 1024w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/bgafollowtop-300x215.png 300w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/bgafollowtop-768x551.png 768w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/bgafollowtop.png 1046w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Agrandir\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<p>Here we have a top layer where our signals emerge from vias, and seem to be finding some pull-up resistors. The red one is not equipped, the other ones are. It is a special cookie, the only optional one, which gives a good hint of which net it is.<\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;69f0d1477f0fc&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"69f0d1477f0fc\" class=\"wp-block-image size-full wp-duotone-unset-14 wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"796\" height=\"702\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/bgaend.png\" alt=\"\" class=\"wp-image-1399\" srcset=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/bgaend.png 796w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/bgaend-300x265.png 300w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/bgaend-768x677.png 768w\" sizes=\"auto, (max-width: 796px) 100vw, 796px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Agrandir\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<p>And we finish our path on top layer on this nice connector, which is not a 2.54mm but a 2mm header.<\/p>\n\n\n\n<p>For the purple track, since it was not visible all the way long, I used the multimeter in continuity mode. After reaching R106, it is indeed going to the connector, but it is hidden by the D21 overlay marking.<\/p>\n\n\n\n<p>There is not a lot of possibilities, because we have found 5 signals and need to fit 5 JTAG nets, so my hypothesis is this one:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>NTRST = N10 Red and green, with a non-equipped resistor<\/li>\n\n\n\n<li>TMS = P10 Yellow<\/li>\n\n\n\n<li>TDI = R10 Light blue<\/li>\n\n\n\n<li>TCK = U10 Purple<\/li>\n\n\n\n<li>TDO = V10 Dark blue<\/li>\n<\/ul>\n\n\n\n<p>I also drew a red and a purple track going under the button, those tracks start close to my debug BGA balls:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>DRXD on PB12 = P6 ball (Purple)<\/li>\n\n\n\n<li>DTXD on PB13 = R6 ball (Red)<\/li>\n<\/ul>\n\n\n\n<p>Fortunately I did not need to desolder the button to verify where those tracks were going, because a bit of probing gave me a beautiful TX signal on board boot on the connector pin.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Pinout<\/h2>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;69f0d1477f7b7&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"69f0d1477f7b7\" class=\"wp-block-image size-large wp-duotone-unset-15 wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"813\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/usefulconnectors-1024x813.jpg\" alt=\"\" class=\"wp-image-1402\" srcset=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/usefulconnectors-1024x813.jpg 1024w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/usefulconnectors-300x238.jpg 300w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/usefulconnectors-768x610.jpg 768w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/usefulconnectors-1536x1219.jpg 1536w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/usefulconnectors-2048x1626.jpg 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Agrandir\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full wp-duotone-default-filter\"><img loading=\"lazy\" decoding=\"async\" width=\"380\" height=\"336\" src=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/pinout_bot-1.png\" alt=\"\" class=\"wp-image-1443\" srcset=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/pinout_bot-1.png 380w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/pinout_bot-1-300x265.png 300w\" sizes=\"auto, (max-width: 380px) 100vw, 380px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">It\u2019s alive!<\/h2>\n\n\n\n<p>After soldering my wires to plug a good old USB-UART converter at baud rate 115200, I got a console log at board reboot.<\/p>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>&gt; screen \/dev\/ttyUSB0 115200\nQNX Neutrino Initial Program Loader for JamManSolo ATMEL AT91SAM9G45\nATMEL AT45DB321D SPI Flash detected.\n\nQNX IFS image detected on page: 00000020 Offset: 00000000 Size: 00137E7C\n\n###################Done\n\nfound image, calling image setup\u2026\nimage_setup OK, calling image start\u2026\n\nPIO init : DBGU, NAND, EMAC.\nWelcome to QNX Neutrino 6.4 on the JamManSolo Atmel AT91SAM9G45\nStarting DBGU driver\u2026\nfs-etfs-at91sam9xx: Yes this is you !!!\nfs-etfs-at91sam9xx: id&#91;1] = ba\nfs-etfs-at91sam9xx: devio_init: Flash ID: Manufacturer ID=0x2c, Device ID=0xba\n\/mnt\/nandfs\/lib\/fs-dos.so<\/code><\/pre>\n\n\n\n<p>So we are running some <a href=\"https:\/\/en.wikipedia.org\/wiki\/QNX\">Blackberry QNX<\/a>.<\/p>\n\n\n\n<p>It seems to have some trouble at boot:<\/p>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>ldd:FATAL: Could not load library libUniString.so\nldd:FATAL: Could not load library libUniString.so<\/code><\/pre>\n\n\n\n<p>I suspect the NAND flash, containing the QNX system files, got corrupted somehow.<\/p>\n\n\n\n<p>Good news, it has a prompt! I can interact with things!<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Repair attempts<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Firmware update<\/h3>\n\n\n\n<p>User update can be done by copy-pasting the installation firmware file on the SD card, then at boot the device  automatically installs the file if present. But I could not reinstall the system because the firmware update file was nowhere to be found. I found a nice <a href=\"https:\/\/www.facebook.com\/groups\/1926879020757630\/permalink\/6752701964841954\/\">Facebook community<\/a> where a bunch of people tried asking the manufacturer for help, with no answers from their part. What a shame!<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Manual rewriting<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">Copying the firmware<\/h4>\n\n\n\n<p>QNX has some Unix-like commands and file directory, so let us play a bit with it.<\/p>\n\n\n\n<p>We can find 2 memory storage: one is a standard SD Card, which can be removed from the device and read on a computer, the other is a soldered NAND chip, whose content is apparently damaged.<\/p>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code># ls \/mnt\/\nnandfs     sdfs<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code># ls \/dev\/\nconsole    hds        name       sem        slog       stdout     tymem\netfs1      hds1       null       ser1       stderr     text       zero\netfs2      mem        pipe       shmem      stdin      tty<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code># df\n\/dev\/etfs2                508928     83572    425356      17%  \/mnt\/nandfs\/    \n\/dev\/etfs2                512904    512904         0     100%  (\/mnt\/nandfs\/)  \n\/dev\/etfs1                 15480     15480         0     100%          <\/code><\/pre>\n\n\n\n<p>I can use the <a href=\"https:\/\/www.qnx.com\/developers\/docs\/6.4.0\/neutrino\/utilities\/e\/etfsctl.html\" target=\"_blank\" rel=\"noreferrer noopener\">etfscl<\/a> command, we can get info on the memory (etfs1 is for bootloader and raw binaries, etfs2 is the filesystem):<\/p>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code># etfsctl -d \/dev\/etfs1 -i \nDevice NAND2cba\n   Blocks     Clusters\/Block Clustersize            Totalsize\n         2048             64        2048            268435456\n&#91;...]\n# etfsctl -d \/dev\/etfs2 -i\nDevice NAND2cba\n   Blocks     Clusters\/Block Clustersize            Totalsize\n         2048             64        2048            268435456\n&#91;...]<\/code><\/pre>\n\n\n\n<p>Copying files (-r for structured, -R for raw):<\/p>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code># etfsctl -d \/dev\/etfs2 -r \/mnt\/sdfs\/etfs2   \n# etfsctl -d \/dev\/etfs1 -r \/mnt\/sdfs\/etfs1 \n# etfsctl -d \/dev\/etfs1 -R \/mnt\/sdfs\/etfs1raw\n# etfsctl -d \/dev\/etfs1 -R \/mnt\/sdfs\/etfs2raw <\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code># dd if=\/dev\/mem of=\/mnt\/sdfs\/mem.img     \ndd: \/dev\/mem: Server fault on msg pass\n14336+0 records in\n14336+0 records out<\/code><\/pre>\n\n\n\n<p>There is a -w \/ -W function to copy from file.<\/p>\n\n\n\n<p>I can also copy the content of the nandfs partition:<\/p>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code># cp -r \/mnt\/nandfs\/* \/mnt\/sdfs\/nandfs\ncp: read (nandfs\/JamManSolo\/Patch22\/PhraseA\/phrase.wav): Input\/output error\ncp: read (nandfs\/boot\/dhcp.client): Input\/output error\ncp: read (nandfs\/boot\/io-pkt-v4): Input\/output error\ncp: Can't get file status (nandfs\/boot\/libcam.so): No such file or directory\ncp: read (nandfs\/usr\/audio\/JamManSolo\/Patch09\/PhraseA\/phrase.wav): Input\/output error\n&#91;...]\ncp: read (nandfs\/usr\/audio\/JamManSolo\/Patch02\/PhraseA\/phrase.wav): Input\/output error\ncp: read (nandfs\/usr\/lecmd): Input\/output error<\/code><\/pre>\n\n\n\n<p>It is weird that some files give errors while I try to copy them.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Almost fixed&#8230; but not<\/h4>\n\n\n\n<p>So, someone took the the time to copy the content from an operational pedal, along with his logs, and I know have files to try and fix mine.<\/p>\n\n\n\n<p>First, I analyzed the files and logs with diff, vimdiff, hexdump and tree. Interestingly, some files are missing.<\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;69f0d14780282&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"69f0d14780282\" class=\"wp-block-image size-large wp-duotone-unset-16 wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"227\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/diff_tree_nandfs-1024x227.png\" alt=\"\" class=\"wp-image-1457\" srcset=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/diff_tree_nandfs-1024x227.png 1024w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/diff_tree_nandfs-300x67.png 300w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/diff_tree_nandfs-768x170.png 768w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/diff_tree_nandfs.png 1515w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Agrandir\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<p class=\"has-text-align-center has-small-font-size\" style=\"margin-top:0;margin-bottom:0\">Left: broken pedal filesystem copy, right: normal pedal<\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;69f0d147806fc&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"69f0d147806fc\" class=\"wp-block-image size-large wp-duotone-unset-17 wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"358\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/vimdiff_start-1-1024x358.png\" alt=\"\" class=\"wp-image-1466\" srcset=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/vimdiff_start-1-1024x358.png 1024w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/vimdiff_start-1-300x105.png 300w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/vimdiff_start-1-768x268.png 768w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/vimdiff_start-1.png 1511w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Agrandir\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<p class=\"has-text-align-center has-small-font-size\" style=\"margin-top:0;margin-bottom:0\">Left: normal pedal boot log, right: broken pedal<\/p>\n\n\n\n<p>I checked one or two libs with diff to check if the broken pedal and the new could use the same binaries, and the lib files are exactly identical. This is very good news.<\/p>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>diff broken\/nandfs\/lib\/libWavWriter.so ok\/nandfs\/lib\/libWavWriter.so\n<em>&lt;No diffs><\/em>\ndiff broken\/nandfs\/lib\/libc.so.2 ok\/images\/nandfs\/lib\/libWav\/libc.so.2\n<em>&lt;No diffs<\/em>><\/code><\/pre>\n\n\n\n<p>I then tried to copy only the files that failed with cp or that I found in fail logs. For instance, when the UI tries to load:<\/p>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code># \/mnt\/nandfs\/usr\/JamSoloUI   \nldd:FATAL: Could not load library libUniString.so<\/code><\/pre>\n\n\n\n<p>The diff on this file shows there are not the same, which is suspicious.<\/p>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>$ diff files_broken_jamman\/nandfs\/lib\/libUniString.so files_pristine\/images\/nandfs\/lib\/libUniString.so \nLes fichiers binaires files_broken_jamman\/nandfs\/lib\/libUniString.so et files_pristine\/images\/nandfs\/lib\/libUniString.so sont diff\u00e9rents<\/code><\/pre>\n\n\n\n<p>I copied this file from the working pedal files, and it got better! The UI application and the USB CDC are now loading.<\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;69f0d14780ca6&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"69f0d14780ca6\" class=\"wp-block-image size-large wp-duotone-unset-18 wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"542\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/vimdiff_start_almost-1-1024x542.png\" alt=\"\" class=\"wp-image-1464\" srcset=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/vimdiff_start_almost-1-1024x542.png 1024w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/vimdiff_start_almost-1-300x159.png 300w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/vimdiff_start_almost-1-768x406.png 768w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/vimdiff_start_almost-1.png 1168w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Agrandir\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<p class=\"has-text-align-center has-small-font-size\" style=\"margin-top:0;margin-bottom:0\">Left: boot log with new library copy, right: initial boot log<\/p>\n\n\n\n<p class=\"has-medium-font-size\">Then, since the USB CDC has started, my device gets USB enumeration. So I tried updating the app through the official application. The device was detected, but the update still failed. Then I tried to copy all the NAND files, in case I missed one:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cp -r \/mnt\/sdfs\/nandfs\/* \/mnt\/nandfs<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Finesse failed: moving on to violent erase and rewrite<\/h4>\n\n\n\n<p>So since the device was still not usable, it was time to rewrite everything. Per etfsctl documentation, rewriting requires to erase the drive first.<\/p>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code># etfsctl -e\nError status on option 'e' : Resource busy<\/code><\/pre>\n\n\n\n<p>So I killed apps, and erased the memory etfs2. And now the SD card is not mounted anymore, maybe I erased the SD card driver too&#8230; Which is a huge problem since it contained the image I wanted to copy from. Oops&#8230;<\/p>\n\n\n\n<p>Fortunately it still worked after a reboot, and the SD card could mount again. The proper way to do this would be to store this somewhere safer before erasing etfs2.<\/p>\n\n\n\n<p>After reading the <a href=\"https:\/\/www.qnx.com\/developers\/docs\/6.4.0\/neutrino\/utilities\/e\/etfsctl.html\">etfs documentation<\/a> more carefully, I realized that the following command handles the system stop and restart, the erasing, and the rewriting processes (every option switch is important here):<\/p>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>etfsctl -d \/dev\/etfs2 -S -e -w \/mnt\/sdfs\/etfs2.structured.bin -c<\/code><\/pre>\n\n\n\n<p>And voil\u00e0! After a reboot, the pedal started working again. <\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;69f0d14781345&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"69f0d14781345\" class=\"wp-block-image size-large wp-duotone-unset-19 wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"315\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/vimdiff_now_works-1024x315.png\" alt=\"\" class=\"wp-image-1479\" srcset=\"https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/vimdiff_now_works-1024x315.png 1024w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/vimdiff_now_works-300x92.png 300w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/vimdiff_now_works-768x237.png 768w, https:\/\/redero.fr\/wp-content\/uploads\/2025\/09\/vimdiff_now_works.png 1120w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Agrandir\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<p class=\"has-text-align-center has-small-font-size\" style=\"margin-top:0;margin-bottom:0\">Left: boot log after fix, right: initial boot log<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><strong>Disclaimer<\/strong>: do not be fooled by the survivorship bias, most of my repair attempts end up in failure, bitterness, and regrets.<br>If you want to repair stuff:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Never be afraid to break something that is already broken<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Just keep trying, no matter how many times you fail<\/li>\n<\/ul>\n<\/blockquote>\n\n\n\n<p>You may notice I did not even have to use the JTAG port, so maybe the BGA reverse-engineering was overkill. But it was really fun to do and I think I will reuse this technique in the future.<\/p>\n\n\n\n<p>This was also a perfect opportunity to create a new <a href=\"https:\/\/www.ifixit.com\/Guide\/Rewriting+corrupted+firmware+on+Digitech+JamMan+Solo\/195105\">iFixit tutorial<\/a>!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Honestly I though I would just have to resolder a cable or replace a damaged capacitor&#8230; and here I am trying new reverse-engineering techniques.<\/p>\n","protected":false},"author":1,"featured_media":1416,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[49],"tags":[95,106,108],"class_list":["post-1390","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog_en","tag-hardware-en","tag-ifixit","tag-reverse"],"_links":{"self":[{"href":"https:\/\/redero.fr\/index.php?rest_route=\/wp\/v2\/posts\/1390","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/redero.fr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/redero.fr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/redero.fr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/redero.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1390"}],"version-history":[{"count":146,"href":"https:\/\/redero.fr\/index.php?rest_route=\/wp\/v2\/posts\/1390\/revisions"}],"predecessor-version":[{"id":1856,"href":"https:\/\/redero.fr\/index.php?rest_route=\/wp\/v2\/posts\/1390\/revisions\/1856"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/redero.fr\/index.php?rest_route=\/wp\/v2\/media\/1416"}],"wp:attachment":[{"href":"https:\/\/redero.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1390"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/redero.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1390"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/redero.fr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1390"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}