Comprehensive eMCP Desoldering Guide - Part 1


Desoldering eMCP (embedded Multi-Chip Package) components is a sophisticated technique in hardware security analysis, offering a pathway to uncover vulnerabilities not detectable through software penetration testing. This process involves removing the eMCP from a device's circuit board to access the data directly or to analyze the hardware for potential security flaws. Given the complexity and risks associated with this method, it's predominantly utilized by specialized security professionals and researchers aiming to identify bugs or to rewrite encrypted data files. Here's a simplified overview of the process and considerations.

Note : This blog is completely educational purpose only, we have chosen target device Amazon Firestick 1st Generation

Types of memory and storage components commonly used in electronic devices

Steps:

1. Attach the Board to PCB Holder
2. Apply Minimal Flux
3. Kapton Tape Application
4. Heating the eMCP
5. Checking if eMCP is Desoldered
6. Removing the eMCP
7. Cleaning with IPA (Isopropyl Alcohol)
8. Placing eMCP on Tissue Paper
9. Soldering Station Temperature Setting
10. Flux Application on Wick
11. Desoldering Process
12. Cleaning with Haired Brush & IPA
13. Using Stencil
14. Magnetic Holder Usage
15. Preparing PPT (Pb-Free Solder Paste)
16. Applying Solder Paste
17. Reballing Process
18. Final Removal and Adjustment

Notes:

1. Ensure Precision and Patience During the Process: Desoldering the eMCP chip is a delicate task that demands meticulous attention to detail. Rushing through this step can lead to irreversible damage to the chip.

2. Work in a Static-Free Environment: Static electricity can cause damage to electronic components. It's important to conduct desoldering in an environment where static discharge is minimized. This may involve using antistatic mats and wrist straps, and ensuring the workspace is free from materials that generate static electricity.

3. Use Appropriate Safety Equipment: When desoldering, it's crucial to use protective gear such as gloves, safety glasses, and lab coats. Ensure proper ventilation and follow all safety protocols to prevent accidents.

Note: This guide is intended for professional use. Adequate training and experience in electronic repair are required.

Comprehensive eMCP Desoldering Procedure

This document is a detailed guide for the eMCP (Embedded Multi-Chip Package) desolering process, aimed at professionals in electronic repair and hardware security analysis.

Detailed Steps and Required Tools:

  • Attach the Board to PCB Holder:
    • Tools: PCB Holder
    • Ensure the board is firmly secured in a PCB holder to maintain stability. For this purpose, we recommend using a mechanical holder as it offers both cost-effectiveness and reliable steadiness.
 
  • Clean Area Around eMCP:

    • Tools: Isopropyl Alcohol (IPA), Lint-Free Cloth

    • Carefully clean the vicinity of the eMCP using isopropyl alcohol, applying it with a lint-free cloth to eliminate any residual substances or contaminants. This step guarantees a pristine surface for flux application, safeguarding against the interference of any impurities in the procedure.

       
  • Apply Minimal Flux:

    • Tools: Flux Pen or Syringe

    • Gently dispense a minimal amount of flux directly onto the eMMC/eMCP using a flux pen or syringe. Aim for a thin, even layer to cover the targeted area without excess. This careful application ensures optimal flux penetration and distribution, critical for enhancing soldering quality and preventing potential solder bridges or defects.

  • Kapton Tape Application:

    • Tools: Kapton Tape
    • Carefully wrap the eMCP with Kapton tape to protect the surrounding components. This step ensures that nearby parts are shielded from potential damage during soldering or rework, by providing thermal insulation and electrical isolation.
  • Heating the eMCP:

    • Tools: Heat Gun

    • Temperature Measurement:

    • Utilize a thermocouple to accurately gauge the temperature in the vicinity of the eMCP. Solder paste typically melts at either 138 degrees Celsius or 183 degrees Celsius. By observing the thermocouple's reading, you can determine the solder paste's melting point. For example, if bubbles form on the eMCP's surface at temperatures around 110-120 degrees Celsius, it suggests that the solder paste with a melting point of 138 degrees Celsius is in use.

       
  • Desoldering Process:

    • Tools: Soldering Iron

    • Using the soldering iron set between 300-350°C, guide the desoldering wick across the eMCP pads in a direction resembling the hands of a clock at 7:30. This technique facilitates the efficient removal of solder by absorbing it into the wick, ensuring a clean pad surface for subsequent operations.

  • Cleaning with Haired Brush IPA:

    • Tools: Haired Brush, IPA
    • Gently scrub the eMCP using a haired brush moistened with isopropyl alcohol (IPA). This method effectively removes any residue or contaminants, ensuring the surface is clean and prepared for further processing.
  • Using Stencil:

    • Tools: Stencil (Universal if necessary), Magnetic Holder

    • Position the stencil accurately over the eMCP, opting for a universal stencil if specific dimensions are needed. Employ a Magnetic Holder to ensure the stencil remains precisely aligned during the process. For this task, the RB-01 eMCP reballing station is utilized to facilitate accurate and efficient reballing.

  • Preparing PPT (Pb-Free Solder Paste):

    • Tools: Solder Paste, Cloth
    • To prepare the solder paste for use, press it against a cloth. This action helps to extract any excess moisture from the paste, ensuring its optimal consistency for application.
  • Applying Solder Paste:

    • Tools: Solder Paste

    • To apply the solder paste, spread it across the target area by moving in a manner similar to the motion of a clock's hand pointing to 4:00. Once applied, carefully wipe away any surplus paste by moving in the reverse direction, resembling a clock's hand at 10:00. This method guarantees a uniform and accurate application of the solder paste, ensuring optimal coverage and adherence.

       
  • Reballing Process:

    • Tools: Hot Air Gun, ESD-Safe Tweezers

    • After applying the solder paste, thoroughly clean the chip. Next, proceed to reflow the solder balls by carefully positioning them with ESD-safe tweezers. Use a hot air gun set to 240°C to melt the solder, ensuring the balls securely attach to their designated pads on the chip. This technique provides precise control over the placement and attachment of solder balls, crucial for successful reballing.

  • Final Removal and Adjustment:

    • Tools: ESD-Safe Tweezers, Heat Gun
    • Carefully remove the chip using ESD-safe tweezers. After removal, reapply flux to the chip's contacts, and if needed, use a heat gun to slightly reheat the solder balls. This step allows for fine adjustments to ensure the solder balls are correctly positioned and prevent any unwanted bridging between the soldered balls and the eMCP adapter during the data reading process. This precaution helps maintain the integrity of the connections and facilitates accurate data transfer.
    •  

continue in part 2…!

Happy Hacking 🎉