Accessing BGA pins
From JLiMe.com
Contents |
Problem
When hacking hardware there sometimes occurs a need to access a specific pin on a BGA chip. I hereby present a method which I have used to determine USB host vias on a Jornada 720 mainboard.
What will be needed
- board with a chip to examine
- An old toothbrush (or a 0.2-0.25mm fishing line)
- thin enameled winding wire (0.1-0.2mm)
- blade for a box knife
- a multimeter or another device capable of determining connectivity (preferably with a sound signalisation)
Preparation
You need to perform the following steps:
- pluck a piece of a toothbrush bristle:
- cut approximately 20cm of enameled wire and remove enamel from the last 0.5mm of it with the box knife blade (scrub it off):
- scrub off enamel from about 2cm of the other end of the wire
- determine which pins you want to find on the board:
- let's assume that you want to find USB_PWRCNTL (red one above). Determine the edge of the chip closest to it (beware top/bottom view mixups). It's the left one on the picture above.
- Push the toothbrush hair under the chip so that it will be parallel to the closest edge and placed right behind the pin to be found (from the closest edge perspective)
- Push the enameled wire (short scrubbed end first) under the chip so that it will be perpendicular to the toothbrush hair and go right next to the pin to be found. Push it until you can see that it moves the toothbrush a bit (touching it under the chip - brown is the wire, turquoise is the toothbrush hair):
(this shows accessing different pin than the picture above, sorry)
Determining connection
You will need to be able to tell whether the enameled wire is touching the ball you want it to touch. We can safely assume that the tested chip is a CMOS one. CMOS chips usually have pins protected agains overvoltages by a simple circuit:
So what you need to do is to connect the positive lead of the multimeter to the ground of the board and negative one to the enameled wire. Then touching a chip ball with the enameled wire should cause a beep (the diode at the bottom will conduct) - beware that some multimeters have positive voltage on a black lead (check it with a diode). If you are looking for an output and have trouble using the above way, you can power on the device (which is a bit risky here) and determine connection by observing voltage readings (if operating output voltage is 0, you can measure it against VCC).
Determining wire position
Steps:
- check that wire touches the toothbrush hair under the chip (pushing it a bit should cause the hair to move).
- gently pull the toothbrush hair so that wire moves towards the ball to be checked (that is why an old toothbrush is perfect here - hair surface is uneven making it better at moving the wire)
- play with the wire and the hair until you hear a beep (connection is made)
- tape the wire to some surrounding surface so that it won't move later
- check again that you have a connection
Finding the via
Now you have a wire that is connected to the ball you are looking for on a board. Next steps:
- Disconnect the positive lead of the multimeter from the ground and attach the box knife blade to it:
- Now for each via surrounding the chip (and under the chip) you need to push the blade pit into the via. This way you will get through the protective layer. Remember not to twist the blade in the via or you may break it! If you have a connection and the resistance (or voltage drop - if it's higher than it may be some component or a protecting diode shorting the connection) is around 0, then congratulations! you have found the connection:
