RIFF Box version 2 released

Hello there !
After six successful years since the first RIFF Box hardware was released, we’re proud to introduce our new v2 RIFF Box hardware. We did our best to develop a reliable, marvelous, yet functional device.

Below you can read the basics about it. Of course, this is preliminary and just a start. RIFF Box v2 hardware is designed so that it can accommodate a large variety of communication protocols, including those of highest importance for starters.

RIFF BOX v2 H/W Specification

  • Dual-core Cortex-M4 MCU @ 204MHz;
  • PC to Box USB (Device) Speed: Hi-Speed (480 Mbps);
  • Box to Device (Host) Speed: Full-Speed (48 Mbps);
  • SD/MMC Interface with 1-Bit (DAT0) and 4-Bit (DAT0-DAT3) Bus Width support and SD_CLK up to 52 MHz;
  • UART Interface;
  • RIFF™ Smart Probing Feature;
  • Level-adjustable 23 GPIO Lines (1.65V to 3.6V) for interfacing a range of devices and protocols, such as NAND, SPI, I2C, Pin Finder, etc.;
  • 4 fixed 3.3V GPIO Lines;

RIFF BOX v2 Interface Specification

  • 20-Pin Male Connector:
    JTAG Interface: TRST, TDI, TMS, TCK, RTCK, TDO and NRST;
    SWD (Serial Wire Debug) Interface: SWCLK, SWDIO (SWDIO and SWCLK are overlaid on the TMS and TCK pins);
  • 30-Pin Male Connector:
    SD/MMC Interface 1/4Bit @ 52MHz;
    Level-adjustable 23 GPIO Lines (1.65V to 3.6V);
    USB Device Connector: connects the Box with PC @ Hi-Speed (480 Mbps), approx. 20 MByte/sec;
  • USB Host Connector: connects the Box with USB devices @ Full-Speed (48 Mbps), approx. 1.5-2 MByte/sec;
  • RJ-45 Connector:
    RIFF™ Smart Probing Feature;
    UART Port;
    4 Fixed 3.3V GPIO Lines;

Supported SD/MMD Revisions:
Revisions 1.0 to 1.7 (for MMC: v4.0, v4.1, v4.2, v4.3, v4.41, v4.5, v4.51, v5.0) and higher

Supported JTAG Cores:

  • ARM7,
  • ARM920,
  • ARM926,
  • ARM946,
  • ARM7EJS,
  • ARM11,
  • CORTEX-A5,
  • CORTEX-A8,
  • CORTEX-A9,
  • CORTEX-A15,
  • OMAP3430,
  • OMAP3630,
  • OMAP4430,
  • TEGRA2 (CORTEX-A9),
  • TEGRA2 (ARM7),
  • QUALCOMM S3 (ARM7, ARM11, SCORPION),
  • QUALCOMM S4 (ARM7, ARM11, SCORPION),
  • NOVATHOR,
  • PXA270,
  • PXA312
  • MIPS32™ IR5Bit,
  • MIPS32™ IR8Bit,

RIFF Box v2 software:

  • RIFF JTAG Manager
  • RIFF Remote helper
  • RIFF Admin client / SN reader
  • RIFF Box USB drivers

New hardware and software is fully compatible with Windows 10, which provides effortless installation. Just connect RIFF Box to Windows 10 based PC and everything will be installed automatically. For older Windows versions, there are custom drivers provided with RIFF JTAG Manager installer.

Few photos of new RIFF Box v2 hardware:

Riff2-b(1) Riff2-a Riff2-cables

RIFF JTAG Manager v1.60 released

JTAG Manager 1.60
—————————
– Fixed bug related to some Server communication problems
– Transfer credits from account to account is simplified, no need to enter the destination Login name, the destination S/N is enough.
– Link to RIFF Support forum is added on two dialog boxes (which are usually signal errors)
– RIFF License Server is also updated, thus older versions (v1.58, v1.59) will not be able to connect the server.

To download it, click “Check Updates” button, or download setup file from here.

RIFF JTAG Manager v1.59 released

JTAG Manager 1.59
—————————
– Changed the RIFFBOX pinout picture (added eMMC pinout interface on RJ-45)
– Fixed bug in Package Editor: Flash Memory/Direct eMMC Flash actions, Automatic Parameters, building list of partitons for write via Plugins, was done with invalid lengths of paritions.
– [eMMC/SD Advanced]/[Select eMMC for Info & Read]: Pictograms are added to the list of chips.
The pictogram is blue if info file is present, gray – if not present (the one displayed by the Show eMMC Testpoint button).
– Now it’s possible to log-in using either registered user name or e-mail address

.
1122
.
2211

To download this update, simply click “Check for Updates” button in Your JTAG Manager software.

RIFF Box eMMC Activation resellers

Hello dear visitors!

Please be advised that safest and best way to purchase RIFF Box eMMC Activation credits is directly from this site (PayPal only):

– Read Your BOX S/N using JTAG Manager and copy it to clipboard (ctrl+v)
– Paste Box S/N to appropriate field and click “Buy Now” button.
– Shortly after payment is processed an e-mail will be dispatched to Your PayPal address. Just follow instructions from there.

Another safe method is to visit our main credits dealer page, www.softmobile.net .
You can either buy from there with more payment options, or You can pickup Your local dealer if it’s listed there.
You can also purchase credits at some of the world’s most reliable GSM web shops:

www.gsmserver.com

FoneFun UK

MultiCom EU

Nadim Raza India

YogYaphone Indonesia

Mtunlocker Bangladesh

Please be aware of existing scam going on some sites in India or Indonesia, as reported here:
www.unlockforum.com 

If You have any doubts or if You have any questions, please visit our official support forum and freely ask any question related to RIFF Box:
www.unlockforum.com

RIFF JTAG Manager v1.58 RIFF Box Firmware v1.38 released (eMMC Support)

Hello,

Here is JTAG Manager v1.58 with ISP/Direct eMMC support.
To use it, please prepare Your RIFF Box installation folder:

– Rename JTAG Manager v1.56 so You can continue using it if Your account is expired
– Backup “Useful plugins” folder content because old plugins are incompatible with new Exe, and old exe is incompatible with new plugins.
– Start v1.58 exe and download license (If Your account is not expired)
– Update Box firmware to v1.38
– Download new plugins

Whats new:
JTAG Manager 1.58

—————————
– Added direct eMMC Access Interface on the RIFFBOX RJ-45 port (check pinout picture for CMD, CLK, DAT0, etc pins positions).
– Added eMMC/SD Access page for Read/Write operations on eMMC/SD card via direct interface
– Added eMMC/SD Advanced dialog which allows to perform advanced operations with eMMC/SD cards
(reading info, browsing through OCR, CID, CSD (and EXT_CSD for eMMC only) registers’ fields, edit separate fields and writting back to card, reading/writting eMMC card’s MCU’s internal firmware, etc)
– Added convenient information presentation for specific eMMC chips: pinouts for testpoints, manuals how to use testpoints to resurrect dead eMMC, etc). These INFO files (*.riffinfo) are stored in JTAG Manager’s Documents folder and can be downloaded via generic <Check for Updates> operation.
– Added eMMC Firmware Update option
– Added eMMC Firmware Reading option (firmware is stored in *.riffemmcfw format)
For firmware read need to select chip from the list
– *.riffemmcfw eMMC firmware files are now used by RIFF for firmware updates (plain binary files are supported too)
– Added elapsed time info for eMMC firmware update stages
– Added eMMC Testpoint info displaying (info files must be downloaded from support and are located in the JTAG Manager’s ‘Documents’ folder.
– Added CMD42 Lock/Unlock functionality for eMMC. User can set/change/remove password to protect/unprotect (lock/unclock) the User Area Partition
– Added the User Area Partition Forced Erase to erase Locked User Area Partition and to reset Device lock/unlock state and password (CMD42’s consequences)
– Added Samsung Factory Erase which erases and re-formats the Samsung eMMC chips.
– Fixed bug displaying wrong SD card size for cards capacity less than 2GB
– Few small improvements and bug fixes

Firmware v1.38
– Added direct eMMC Access Interface functionality
– Improved several parameters  in the emmc communication
– Added the CMD42 Lock/Unlock/Pasword reset features
– Added Forced erase of locked User Area Partition
– Added Samsung eMMC Factory Format
– Fixed bug with SD card support
– eMMC firmware update feature added

This version is available for download at support forum.

Important information related to RIFF Box eMMC support

Hello dear users !

This topic will serve as initial guide for RIFF Box eMMC ISP/Direct functionality. This is not regular update, but rather a major upgrade.
As such, it will come free for all RIFF Boxes registered in last 6 months, and of course for all new RIFF Box customers.

To prepare everything on Your side for this upgrade, You’ll need the following:

  • RJ45 cable
  • 2×100 ohms resistors
  • External source for VCC and VCCQ (Optional)
  • Moorc adapters (Optional)
  • Activation credits (If Your box is older than 6 months)

RJ45 cable is required to connect RIFF Box to eMMC as RIFF Box RJ45 port is used for this function.

2×100 Ohms resistors are required as pull up, to increase signal levels and improve stability.

Extarnal source for VCC and VCCQ is required in case that You don’t want to open Your RIFF Box, in order to connect RIFF Box internal VCC voltage source. We know that there are already some adapters on market, which offer this function.

Moorc adapters are well known, and they offer best at price range.

Activation credits You can get in exchange for some money. We have too many of those, and we will be happy to exchange some of them to real money.

RIFF Box RJ45 port pinout:

1-NC
2-SD_CLK
3-SD_DAT0
4-SD_CMD
5-NC
6-NC
7-NC
8-GND
VCC pin is located on RIFF Box motherboard, bottom side. You can locate it if You check attached photo.

Pull up resistors should be connected from VCC to both SD_CMD and SD_DAT0 lines.

RIFF JTAG – Some of the beta tests with eMMC ISP

So, as already announced here, there is whole lot of users testing newly developed RIFF Box features. Here are some of the posts and logs:

Default

direct adopter connect emmc gt-i9300 emmc VTU00M

Open serial port…OK
Connecting to the RIFF Box…OK
Firmware Version: 1.38.3b, JTAG Manager Version: 1.57 [BETA 2]

Connecting to the SD/eMMC Card…OK
Set I/O Voltage reads as 3.30V, SD_CLK Frequency is 960 KHz

Memory Type …………………….. eMMC
Manufacturer ID …………………. 0x15
OEM/Application ID ………………. 0x00
Product Name ……………………. “VTU00M”
Package ………………………… BGA
User Area Parition Size ………….. 0x0003AB400000 Bytes (14.68 GB)
Boot Partition Size ……………… 0x000000200000 Bytes (2.00 MB)
RPMB Partition Size ……………… 0x000000020000 Bytes (128.00 KB)
OCR Register ……………………. 0xC0FF8080 (Dual Voltage, High Capacity)
Write Protection Bits ……………. NONE
Boot Configuration ………………. Boot from Boot Partition 1 (Bus Width = 4Bit)
Chip Revision …………………… 15.12
Multimedia Card Revision …………. 1.6 (eMMC v4.5, v4.51)
Serial Number …………………… 0x3D398686
Memory Manufacturing Date ………… May, 2014

Open serial port…OK
Connecting to the RIFF Box…OK
Firmware Version: 1.38.3b, JTAG Manager Version: 1.57 [BETA 2]

Connecting to the SD/eMMC Card…OK
Set I/O Voltage reads as 3.30V, SD_CLK Frequency is 960 KHz

Detected eMMC Chip, ID: 0x15/0x00 (VTU00M), User Area Partition = 0x0003AB400000 Bytes (14.68 GB)

Reading “User Area Partition” address space from 0x000000000000 to 0x000001FFFFFF
Completed in 00:06:33.669 (Average Transfer Rate: 83.24 kB/s)

Smile Samsung S5282 ISP Connection Successful

Connection Method: ISP
Hand Set Model: Samsung S5282
Phone Status: Alive
Reason: Emmc Backup and Riff box Application TestingProblems encountered: I was unable to scan or read the handset with Riff.
Solution: I have soldered the 5K pull ups on Pin 2 and 3 of the RJ45 to Pin 9(VCC/VCCQ) Of Riff Box.Pinouts used: Z3x S5282 EMMC pinoutsRiff Box LogsOpen serial port…OK
Connecting to the RIFF Box…OK
Firmware Version: 1.38.3b, JTAG Manager Version: 1.57 [BETA 2]

Connecting to the SD/eMMC Card…OK
Set I/O Voltage reads as 3.28V, SD_CLK Frequency is 393 KHz

Memory Type …………………….. eMMC
Manufacturer ID …………………. 0x15
OEM/Application ID ………………. 0x00
Product Name ……………………. “S5U00M”
Package ………………………… BGA
User Area Parition Size ………….. 0x0000E9000000 Bytes (3.64 GB)
Boot Partition Size ……………… 0x000000200000 Bytes (2.00 MB)
RPMB Partition Size ……………… 0x000000020000 Bytes (128.00 KB)
OCR Register ……………………. 0xC0FF8080 (Dual Voltage, High Capacity)
Write Protection Bits ……………. NONE
Boot Configuration ………………. Boot from Boot Partition 1 (Bus Width = 1Bit)
Chip Revision …………………… 0.10
Multimedia Card Revision …………. 1.5 (eMMC v4.41)
Serial Number …………………… 0x7D4BB668
Memory Manufacturing Date ………… February, 2014

Phase 2: Read the partitions of the hans set and post results.

Partitions Read: BOOT PAT1, BOOT PAT2, RPMB Area PAT.
Status: All Susscessful(RIFF BO ROCKS 🙂 )

Logs

Open serial port…OK
Connecting to the RIFF Box…OK
Firmware Version: 1.38.3b, JTAG Manager Version: 1.57 [BETA 2]

Connecting to the SD/eMMC Card…OK
Set I/O Voltage reads as 3.28V, SD_CLK Frequency is 960 KHz

Detected eMMC Chip, ID: 0x15/0x00 (S5U00M), User Area Partition = 0x0000E9000000 Bytes (3.64 GB)

Reading “Boot Area Partition 1” address space from 0x000000000000 to 0x0000001FFFFF
Completed in 00:00:23.837 (Average Transfer Rate: 85.92 kB/s)

Open serial port…OK
Connecting to the RIFF Box…OK
Firmware Version: 1.38.3b, JTAG Manager Version: 1.57 [BETA 2]

Connecting to the SD/eMMC Card…OK
Set I/O Voltage reads as 3.28V, SD_CLK Frequency is 960 KHz

Detected eMMC Chip, ID: 0x15/0x00 (S5U00M), User Area Partition = 0x0000E9000000 Bytes (3.64 GB)

Reading “Boot Area Partition 2” address space from 0x000000000000 to 0x0000001FFFFF
Completed in 00:00:23.852 (Average Transfer Rate: 85.86 kB/s)

Open serial port…OK
Connecting to the RIFF Box…OK
Firmware Version: 1.38.3b, JTAG Manager Version: 1.57 [BETA 2]

Connecting to the SD/eMMC Card…OK
Set I/O Voltage reads as 3.28V, SD_CLK Frequency is 960 KHz

Detected eMMC Chip, ID: 0x15/0x00 (S5U00M), User Area Partition = 0x0000E9000000 Bytes (3.64 GB)

Reading “RPMB Area Partition” address space from 0x000000000000 to 0x00000001FFFF
Completed in 00:00:01.482 (Average Transfer Rate: 86.37 kB/s)

Default Connect & Read Dump SM-T211 EMMC M8G1WA .. Done

Connect & Read Dump SM-T211 EMMC M8G1WA .. Done

Conecting with Riff box

Open serial port…OK
Connecting to the RIFF Box…OK
Firmware Version: 1.38.2b, JTAG Manager Version: 1.57 [BETA 2]

Connecting to the SD/eMMC Card…OK
Set I/O Voltage reads as 3.28V, SD_CLK Frequency is 1 MHz

Memory Type …………………….. eMMC
Manufacturer ID …………………. 0x15
OEM/Application ID ………………. 0x00
Product Name ……………………. “M8G1WA”
Package ………………………… BGA
User Area Parition Size ………….. 0x0001D2000000 Bytes (7.28 GB)
Boot Partition Size ……………… 0x000000200000 Bytes (2.00 MB)
RPMB Partition Size ……………… 0x000000020000 Bytes (128.00 KB)
OCR Register ……………………. 0xC0FF8080 (Dual Voltage, High Capacity)
Write Protection Bits ……………. NONE
Boot Configuration ………………. No Boot
Chip Revision …………………… 0.10
Multimedia Card Revision …………. 1.5 (eMMC v4.41)
Serial Number …………………… 0xF2A45264
Memory Manufacturing Date ………… February, 2014

 LENOVO k900 EMMC MAG2GA connect Successful

Code:
Open serial port...OK
Connecting to the RIFF Box...OK
Firmware Version: 1.38.3b, JTAG Manager Version: 1.57 [BETA 2]

Connecting to the SD/eMMC Card...OK
Set I/O Voltage reads as 3.30V, SD_CLK Frequency is 960 KHz

Memory Type .......................... eMMC
Manufacturer ID ...................... 0x15
OEM/Application ID ................... 0x00
Product Name ......................... "MAG2GA"
Package .............................. BGA
User Area Parition Size .............. 0x0003A3E00000 Bytes (14.56 GB)
Boot Partition Size .................. 0x000000200000 Bytes (2.00 MB)
RPMB Partition Size .................. 0x000000020000 Bytes (128.00 KB)
OCR Register ......................... 0xC0FF8080 (Dual Voltage, High Capacity)
Write Protection Bits ................ NONE
Boot Configuration ................... No Boot
Chip Revision ........................ 1.5
Multimedia Card Revision ............. 1.5 (eMMC v4.41)
Serial Number ........................ 0xFE1E4658
Memory Manufacturing Date ............ May, 2012

direct EMMC VCC = VCCQ = 3V3

RIFF JTAG – Samsung SGH-i337M Galaxy S 4 LTE Total Repair supported

RIFF JTAG – Samsung SGH-i337M Galaxy S 4 LTE Total Repair supported

– This PKG contains GPT for 32GB chips !
– There is both Total Repair ™ and BootChain only repair options

Use “Total Repair” option in case that EFS is damaged after unlock. Otherwise use BootChain only option.

337m

Please keep in mind that it’s not possible to downgrade this phone to lower version software !
.
samsung_galaxy_s_4_2

RIFF JTAG – Asus Padfone A66 bootloader repair supported

RIFF JTAG – Asus Padfone A66 bootloader repair supported

– This PKG contains BootChain partitions for 5 different MCU ID-s. To select proper BootChain pack, read MCU ID first by using “Analyze JTAG Chain” function on JTAG Read/Write TAB.
– GPT is from 32GB version !
– Android Kernel and Recovery are same for all versions

a66
In case that You have to wipe Cache partition, and it can’t be done via recovery, You can do it by using eMMC Plugin:

– Start eMMC plugin
– Click “Load layout from device”
– Double click “Cache” partition
– Click “Flash Selected”

This will write zeros to Cache partition and practically wipe it’s content.
.
asus_padfone_3