Database Users

How to hack hardware binary and bend it to your will

Before you start on actually modifying your hardware, you must know what it is you're after. Don't just go using your finely tuned soldering iron without doing some research first... http://twitpic.com/75maxq
I wanted to share some tricks I use when locating UnBrickable Mod on various devices because it has been requested many times. Overall, the methods I'm going to talk about can be called "reverse engineering", "hacking", or "circuit bending".
Each device is different so different methods may be used. I'll start with what I feel is the best method to use and move my way on through less accurate and more destructive/difficult methods. The methods I'm using here can be used on nearly ANY device for nearly ANY purpose, not just locating boot modes. Using the techniques I'm laying out here, you can locate any physical memory register on any chip.
For the purposes of this familiarization guide, we will be locating the xOM5 resistor which changes the S5PC110 boot mode from "boot from OneNAND" to "Boot from USB, then OneNAND". Other modes are available such as booting from SDCard or MMC but these modes do not allow dual booting into the standard OneNAND boot so they are not practical unless you have a NAND failure.
By reading the S5PC110 processor manual, we can see on page 6-8, this is achieved by setting the xOM bits to 101001 (hex value 29). These binary values correspond to pins on the processor. These pins can be set high or low, and they ARE set high and low on the development board for the S5PC110 development boards. On other processors like OMAP4460, or Exynos, different pins are used but the functionality is the same.
All binaries and reading materials used are availabe in the GalaxyS hack pack: http://forum.xda-developers.com/showthread.php?t=1111866
For installation of binaries, you can use the market app "mount rw/ro" and drop the binaries in your /system/bin folder. See here for more information on direct access to Linux and installing binaries: http://forum.xda-developers.com/showthread.php?t=1030107
For the purposes of this thread we will be using a S5PC110 chip which is what the entire GalaxyS series of device is based upon.
With this knolwedge in hand, lets continue into HOW we can locate these pins.
how to locate the xOM resistor cluster
If you orient the S5PC110 processor with the PIN-0 dot at the lower left corner, you will find the xOM cluster at the lower right corner. These resistors will always be near this location because the pins on the board are near this location. It's never a good idea to have "runs" on a board longer than necessary. Therefore, these resistors will always be near this corner.
NOTE: You need not remove the processor. This is only for illustration.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
For other devices, see the pinouts on the processor manual.
Methods for locating modificaton
Monitoring memory locations in real-time
You will need:
viewmem installed in /system/bin
bash installed in /system/bin
Market App: QuickSSHD allows you to terminal into the device.
1. we locate the xOM registers on the device. According to the processor manual
OM_STAT 0xE010_E100 R OM status register 0x0000_0000
Click to expand...
Click to collapse
the OM registers are at 0xE010E100. So we know where to look in memory to monitor changes.
2. ssh into your device. See QuickSSHD for more information. Once you are in, assume super-user, get into a bash terminal, and use the viewmem utility.
Code:
$ su
# bash
bash-4.1#viewmem 0xE010E100 0x4|hexdump
[INFO] Reading 4 bytes at 0xe010e100...
0000000 0009 0000
0000004
3. Short and test. While shorting the high value to the active side, NOT THE VISIBLY GROUNDED SIDE, monitor output from the terminal.
The PullUp resistors are 10Kohm and the Pulldown resistors are 100Kohm. This means there's 10x more force behind a digital high than a digital low, in other words, you can short any low value high without a problem...
Code:
viewmem 0xE010E100 0x4|hexdump
[INFO] Reading 4 bytes at 0xe010e100...
0000000 0029 0000
0000004
the 29 signifies that the device is modded properly. A value of 0x9 is a standard production device. When you see 0029, you've located the proper resistor for the modification.
Using overlays
Take a picture of the board, then use an annotated pinout to locate the proper pins on the processor. This allows for a visual of the device as though the processor were removed.
here's a picture of my own annotated overlay. Use this and we'll walk through overlay logic.
Now, with a xOM value of 0x9, that's a binary value of 001001, use your calculator in "programmer" or "scientiffic" mode if you don't believe me.
Broken Down:
xOM5=0
xOM4=0
xOM3=1
xOM2=0
xOM1=0
xOM0=1
xOM 3 and 1 are both high values, all the rest are low. We can use this to our advantage. We can see that 4 resistors are connected to ground on one side and 2 are not. Those two are obviously xOM3 and xOM1.
If we look at the processor pinout, we can see that if xOM3 and xOM1 resistors were swapped, one would be very much longer than the other so there's only one logical solution.
Moving on to the shortest ones, xOM4 and xOM2 would obviously be closest to the top of the resistor cluster, and it's also obvious wich one would be which.
Now that leaves two resistors in the middle. One is high and one is low. by drawing it out you can see that if xOM5 were on the right, then xOM1 would be very much longer than xOM5, so xOM5 must be on the left.
So, we've located all xOM values with this method.
Using relative positioning
This method is not nearly as scientiffic... Since there are now 10 guides made for modifying xOM5 on different boards, a resistor may be picked and chosen as though it were from anothe board. See here for various modifications: http://forum.xda-developers.com/showthread.php?t=1236273
Verification from this method may be made using UART. you would be expecting an output like this over the UART on your device.
See here for info on UART: http://forum.xda-developers.com/showthread.php?t=1235219
If the modification was sucessful, UART will output a line which states OM=0x29.
Using a multimeter
You can remove the processor from a device and trace out the pins manually. This method is only appropriate for a broken device.
conclusion
So, these are my methods for hacking hardware and making it do what I want. I'd like to hear others. Lets hack up some hardware and talk about it here.

+1
Good that every chip component is configureable on lowest level by set of external passive elements - opens big possibilities to change any hardware into something different.
Worth to add - always think twice, or even once more before short circuiting anything. If between some V line and another there is positive voltage, like +1V, it still doesn't mean that second one is GND. First one can be +2V and second one +1V. READ carefully all datasheets and documentation. Don't connect any power line straight to another without resistor - this will cause high current go through some component and probably damage it.
Example of bad test - there are some capacitors on the left of Adam's needle when testing resistor. It's highly possible that these capacitors are ARM_CORE stabilisers, which is 1.2V and can handle up to about 1.4V. Adam is operating with 1.8 or 2.8V from other V line - accidentally touching the capacitor with needle can damage CPU core.
If you never been doing any hardware mods but feels like you want to start - prepare for some victims in your electronic devices. That's all of my experiences for now.
//Damn me and my bad habit of reserving posts in Adam's thread. Sorry. :d

very informative

Excellent and authoritative article! Though I'm personally too scared to do anything like this on my phone!

I've gotten replies from people that removing a BGA chip is almost impossible. A tutorial on how to unsolder one would be helpful for aspiring hardware hackers.

Master Melab said:
I've gotten replies from people that removing a BGA chip is almost impossible. A tutorial on how to unsolder one would be helpful for aspiring hardware hackers.
Click to expand...
Click to collapse
It IS almost impossible. It's rediculously difficult. You'll end up pulling a pad or two off the board. You must heat up the entire chip with a heat gun or a hot air station, then pull it off... Meaning you're heating up the entire chip to the point where the solder melts. It takes a multi-thousand dollar professional setup in order to make sure no damage is done. I use a digital temperature controlled heat gun. It works, but it's not accurate.

If you could replace the pads with a socket or something like that you'll be set to go.

we need to get you a better camera

elmanortega said:
we need to get you a better camera
Click to expand...
Click to collapse
HAHHAHHAHHA. funny story about that...
You see, my 6 year old tried to do unbrickable mod on that today..
I no longer have a dedicated camera

I wish i could try it, but i am sure i wont be able to, lol

Thank you very much for this guide.
Could you also describe what tools (soldering iron etc) do you use?

I use a Radio Shack digital soldering iron. It's nothing special but it's temperature controlled and has a fine point.

I made some more overlays
here is Exynos4210
This is from OMAP 4460, but I'm pretty sure it applies to OMAP 4430 as well

verry intresting, soon i try

Seriously this guys work is awsome, learnt quite abit from your work, thank you very much!
Sent from my Desire HD using XDA App

cdesai said:
I wish i could try it, but i am sure i wont be able to, lol
Click to expand...
Click to collapse
Same here but why dont giveit a try... just encourage

AdamOutler said:
... It takes a multi-thousand dollar professional setup in order to make sure no damage is done. I use a digital temperature controlled heat gun. It works, but it's not accurate.
Click to expand...
Click to collapse
Sorry Adam, you have a great writeup, but this is really a BS statement!
-- You can easily unsolder a BGA chip with a $5 micro-blow-torch! You just have to make sure you shield the surrounding components from the excessive heat. Put a small piece of copper (a penny?) on top of the chip, then put a piece of low-temperature (lead-free) solder on top of the coin, so you can get an idea when you have enough heat. Continue 10-20 seconds. Very carefully try to jam a few sharp toothpicks under any space between chip and PCB. Never bend!
This technique is well known and well demonstrated on YouTube, ever since the HP/Nvidia scandal of video chips falling of the MOBO after dust blocking the fan intake with (purposely) under-dimensioned and faulty heat-sink design.
The problem is getting it back ON! Then you need to invest in a professional heat plate and re-balling grid.

excuse me mister, i have done it, n my tab turn back on, now i have another problem, the screen is black and the bottom light is on, could you help me?

^^ good idea! I've always used a high power and small heat gun. It works for 99% of the pads, but I always lose 1 or 2. I never intend to put them back on.
apram75 said:
excuse me mister, i have done it, n my tab turn back on, now i have another problem, the screen is black and the bottom light is on, could you help me?
Click to expand...
Click to collapse
This is the wrong place to post that. And it does not really make sense that you did this in context.

Unsoldering a BGA is easy.
Doing it without causing unrecoverable damage is a different story. Same for resoldering it back on.
However it is getting easier nowadays - temp-controlled hot air rework stations have dropped drastically in price - http://www.amazon.com/Updated-Aoyue-Digital-Soldering-absorber/dp/B006FA481G/ref=pd_cp_hi_3
Also, reflowing a BGA without removing it (such as for Xbox360 RRoD fixes) is a LOT easier than remove-and-replace.
Also - my personal favorite deal in terms of soldering irons is http://www.amazon.com/Aoyue-937-Dig...ref=sr_1_1?s=hi&ie=UTF8&qid=1331244730&sr=1-1 - The Aoyue 937 is amazing considering it is <$50.

A DHD GPS Solution( Radical and Ugly :( )

My DHD GPS contacts were broken when I tried to improve GPS function. So I used an electric wire( or any metalic wire) for antenna. I connected it to the broken position. And I made a hole over the flash cover. I made about 3 ~ 4 cm long wire come out of the hole. It works very well but ugly. Wire is flexible, you can hide it inside a jelly case, and you can take it out when necessary
Acutually no need to contact two points. Only one contact near to camera is needed. Here are some pictures instead of my poor english
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

can you post more photos of the mod? I'm interested...

My another photos
You can use any conductive metalic wire for antenna.
View attachment 813848

Ugly indeed! :-\
Maybe you can mod that retractable telescopic old-style radio antenna thing on the phone casing. It'll give a retro look to the phone

if4ct0r said:
Ugly indeed! :-\
Maybe you can mod that retractable telescopic old-style radio antenna thing on the phone casing. It'll give a retro look to the phone
Click to expand...
Click to collapse
I have hoped so. And some manufacturer might make a special flash cover capable of enhancing GPS performance.

TO the OP: How broken are the contacts? I also had GPS issues, then I read somewhere that you can drop on a ball of solder to fix this. Basically, the thickness of the solder ball forces contact with the antenna.
See pic:

trekkie0927 said:
TO the OP: How broken are the contacts? I also had GPS issues, then I read somewhere that you can drop on a ball of solder to fix this. Basically, the thickness of the solder ball forces contact with the antenna.
See pic:
Click to expand...
Click to collapse
First I soldered them, but overheated to destroy the point on the cover So I created another solution. Anyway this works well. Somebody said the length of wire would be best if 9.5 cm because it fits the frequency of GPS signal. But I think it's too long to carry in my pocket. He suggested another length, 4.75cm ( 1/2 of 9.5 cm ).

What Watt soldering iron did you use?
Sent from my Desire HD using Tapatalk

Why would you do something as ugly as this mod to your phone when you could at least hide the wire inside? Not to mention this mod has been posted and around for awhile. This is old news. And whoever told you 9.5cm or 4.7cm for antenna was pulling your leg.
http://forum.xda-developers.com/showthread.php?t=1318892

Agoattamer said:
Why would you do something as ugly as this mod to your phone when you could at least hide the wire inside? Not to mention this mod has been posted and around for awhile. This is old news. And whoever told you 9.5cm or 4.7cm for antenna was pulling your leg.
http://forum.xda-developers.com/showthread.php?t=1318892
Click to expand...
Click to collapse
Well 4.7cm is the correct size for a quarter wave antenna. So that is correct.

GPS Accuracy 1 meter!
Yesterday on a moving( 88 km/h ) car.
I used about 5 cm long cable for GPS antenna replacement.

Do you have pictures of the inside connection to the GPS module ??

The inside connection to the GPS module.
I extracted a thin cable from a USB cable( including some thin cables inside).
I tied the cable to fix it tightly on the flash cover. And I made a hole over the cover.
The flash photo uploaded is an old one. I broke several covers : (
You can connect it to only single contact. But I think connecting two contacts would be better.
The cable is very thin, so you can hide it inside a jelly case. In my case, eiven if it is hidden inside, GPS signal can be detected( but accuracy is low then ).

My current cass with the GPS anttena.
It's a jelly case. I made a hole on the upper side of the case. Not very ugly, I think.

easy fix
Hey guy's,
Here is an easy fix download GPS status from market touch the menu button and select tools and select manage aGPS settings reset the data and select download restart your phone it worked for me got around 5 satellites in 5 seconds

But any software tweak is useless if you have connection problem... I tired every software, gps.conf file but eventually i ordered a replacement flash cover/gps antenna from ebay about 10$ with tools.

I don't know about u man but that really worked with my dhd

after using the sensation battery inside my desire hd, i'm curious about such mods, but i hope i don't have to use this one, because it's really ugly
but nice, really nice

jazon7 said:
after using the sensation battery inside my desire hd, i'm curious about such mods, but i hope i don't have to use this one, because it's really ugly
but nice, really nice
Click to expand...
Click to collapse
It's very possible to put the wire inside the antenna cover and get almost the same performance with no external sign of modification.

True. there are different ways of hiding the antenna. You'd only loose maybe 3-8m of accuracy, but it's better then having a wire sticking out.

I9000 Technician Service Manual (latest)

Contents :-
1. Specification
2. Product Function
3. Exploded View and Parts list
4. MAIN Electrical Parts List
5. Level 1 Repair ( Software un-bricking)
6. Level 2 Repair
7. Level 3 Repair
8. Flow Chart of Troubleshooting
Power On Failure
Initial Failure
Abnormal charging part
NO SIM Failure
Microphone Part
Speaker Part
Receiver Part
Blue Tooth & WiFi is not working
FM Radio does not work
LCD is still off after Power ON
Touch Screen does not work
Camera function does not work
GSM Failure
WCDMA Band 1
WCDMA Band 2
9. Schematic Diagrams
10. Concept and Main features
11. Block Diagram
12. Component and Location
13. Dis assembly and Assembly
14. Trouble shooting
15. Calibration
download and enjoy 22.2 MB
http://www.4shared.com/office/6tdZOd1J/I9000_Technician_Manual.html
http://www.mediafire.com/?or3hgpu1bvjf103
Check this out!You , YES! you are an " Android ". Not your phone but U.
You Must watch this documentary concerning your privacy Terms & Conditions we had agreed to, by using a PC or Smartphone
How to say Thank you? If you find any post helpful on XDA, please click on the Thanks button
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
If you are using XDA App or Tapatalk, long press on the post and select :good: Thanks Its easier to give "Feedback" in this manner than make an additional post.​

Any mirrors that do not reqiure signon?

skibbi_pl said:
Any mirrors that do not reqiure signon?
Click to expand...
Click to collapse
Nope, signing on is not a big deal actually, as a member it allows you to download anything else you need by searching that site and also upload what you want.
anyway..i will try to upload it elsewhere, as soon as i can sign up to them

thanks... Especially for the mediafire link
Sent from my GT-I9000 using XDA

madushan92 said:
thanks... Especially for the mediafire link
Sent from my GT-I9000 using XDA
Click to expand...
Click to collapse
you are welcome to it

Thank you
Thank you very much. I gave it a read and page 96,97 & 98 relate to component level information and is relevant to my question.
Although, I couldn't find a part number for the motherboard as a whole. May be I should provide more information about the problem I'm facing to help narrow things down.
After a pretty(very) bumpy ride, I noticed that the phone had switched off and wasn't coming back on. I assumed that I had damaged the phone. I put it on charge and a few hours later, to my surprise, it came back on. Ever since, I've been facing these problems.
a. Phone consumes battery whilst in switched off mode. I'm talking ~40% drop overnight.
b. 2g works only via 64K SIM cards. Phone disconnects from the network when I set it to 2g when on a 32K SIM.
c. Wi-Fi doesn't work - I get the obtaining IP address error. From the battery usage stats, I can tell that the Wi-Fi unit is drawing power.
Folks at the Samsung service centre suggested that I replace the entire motherboard. It costs ~ £120, which is a little too steep and much to invest on a 2 yr old phone. Spares and peripherals usually carry a nasty mark up, which is why I'm trying to get one from the makers or others who are willing to sell it for lesser.
Edit: Stock ROM fixed the Wi-Fi issue.

vinu_h said:
Thank you very much. I gave it a read and page 96,97 & 98 relate to component level information and is relevant to my question.
Although, I couldn't find a part number for the motherboard as a whole. May be I should provide more information about the problem I'm facing to help narrow things down.
Click to expand...
Click to collapse
Pages 8 to 16 gives the part and code numbers, although, these are not detailed, without them, you will have a hard time trying to buy online...best thing to do is let a technician at your end, check it and let him tell you what parts you need and than you try and purchase them online with part numbers
from what you are saying it could be a simple cracked board ...that may need some reconnection as it is obviously shorting causing power drain even when in OFF mode .
off course technicians can be tricky, so may need to find someone you can trust

xsenman said:
Pages 8 to 16 gives the part and code numbers, although, these are not detailed, without them, you will have a hard time trying to buy online...best thing to do is let a technician at your end, check it and let him tell you what parts you need and than you try and purchase them online with part numbers
from what you are saying it could be a simple cracked board ...that may need some reconnection as it is obviously shorting causing power drain even when in OFF mode .
off course technicians can be tricky, so may need to find someone you can trust
Click to expand...
Click to collapse
You're right. Finding a trustworthy technician can be tricky. Even when I do, they won't offer any kind of assurance. £120 with a guarantee is starting to appear more attractive than £50 with none.
I was lazy. It's listed on page 9. This must be the part number of the motherboard - QMP01 A/S ASSY-PBA MAIN_GT-I9000B,BRAZ (SVC) GH82-04996A
Online search of that part# doesn't help in anyway whatsoever.

Where is the internal memory located on hardware
can anyone tell me if internal memory of the phone ( where the recovery, rom , bootscreen and so on ) is located in MoviNand piece of hardware on the motherboard ?

laurentiudll said:
can anyone tell me if internal memory of the phone ( where the recovery, rom , bootscreen and so on ) is located in MoviNand piece of hardware on the motherboard ?
Click to expand...
Click to collapse
[Tutorial][A.I.O Rescue & Recovery] My Secure Digital (SD card) Storage
look for the Embedded SD or iNAND as shown in the image
Check this out! Links to useful Guides and " Banned " Documentaries ​

thanks for the file, great to have around for reference

Cube i7 Stylus

{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Details:
Display: 10.6" PLS, 1920x1080 with Wacom Stylus support
CPU: Intel Core M-5Y10c
GPU: Intel HD Graphics 5300
RAM: 4GB Dual Channel LPDDR3-1833
SSD: Foresee 64GB
Audio: Realtek ALC283
WiFi/Bluetooth: Realtek RTL8723BU
Cameras: 5.0 MP, 2.0 MP
Battery: 3.7V x 4300mAh x 2 cells = 31.8Wh
Connectivity: 3.5mm Audio, mini HDMI, microSD, micro USB 3.0, DC 12V
Material: Magnesium Alloy
Weight: 690g
Size: 27.4cm x 17.2cm x 10.5mm
Interior:
Detailed component list
Drivers:
Intel Graphics Driver
Misc (Software):
Undervolting with ThrottleStop
Misc (Hardware):
DIY Copper heatspreader
Battery information
Accessories:
Keyboard CDK02

Successor:
Cube Mix Plus / Cube i7 Book / Cube i9

thanks for new op for this great tablet
have u bought it ?? we want user review not chinese translated.

Mainboard components:
Intel Core M-5Y10c
SK Hynix H9CKNNNBPTAT: LPDDR3 (2x 2GB)
Realtek RTL8723BU: WiFi/BT Single Chip
Realtek ALC283: High Definition Audio Codec
Realtek RTS5170: SDCard Controller
Parade PS8625: eDP to LVDS Converter
Parade PS8201A: HDMI Repeater
Kionix KXCJ9: Accelerometer
Winbond W25Q64BV: 3.3V Flash Memory (BIOS)
ITE IT8110E: Embedded Controller
Other components:
Samsung LTL106HL01-001: Display Panel
FocalTech FT5826: Touch Controller

---

---

Been using it for more than a week and very impressed so far
The best Wacom-based bargain out there right now. Well-built, accurate, surprisingly fast SSD (not eMMC) and CPU. If I were you, I would order straight from manufacturer despite the slightly higher price.

---

I had some free time so i tried installing windows 10 rtm. Works nice. Was even able to activate it, which didn´t work with 8.1 bing.
Pros: The driver script didn´t work, but i was able to install individual drivers. Seems snappy. Edge browser is superfast. Some benchmarks heaven 4.0: 329 points. 3dmark 2011: P871.
Cons: Couldnt install the reg file for the sensor, so the orientation sensor doesnt work. Windows doesnt allow me to edit the registry at all. The physical windows button works, but there is no vibration feedback. Any ideas?

Another interesting program is ThrottleStop:
Download is available here
The main window gives a brief overview about temperature, package power, clock multiplier and throttling reason:
A click on TPL (Turbo Power Limits) shows different settings to manually adjust the cpu TDP:
(Note: TDP locks need to be disabled in UEFI -> CPU settings to have access here).
The most interesting feature is probably the integrated voltage control, it allows to undervolt specifically parts of the core package:
(It needs further testing to see if and how much impact does this function have on an ultra-low voltage cpu.)

Ok so i´ve tried that, doesnt install any of the drivers. Cannot access the files on mega, could you try reuploading them and i will try them out!
Btw the vibration on the windows button came back by itself =)

---

Thx! The driver install fine. The orientation is upside down though. Ive been playing around with the orientation reg file, but Ive only been able to get the screen rotated 90 degrees to the side. If i do that and lock the screen the accelerometer works in games at least. Asphalt 8 works very smoothly!
There seems to be trouble with the bluetooth as well, it only keeps on searching indefinitly. Maybe a driver issue. I will try to look into it.

My order is from Geekbuying.com which seems to cause much trouble for several Cube i7 buyers.
It was in customs "custody" for several weeks because they declared it completely wrong.
It's probably for the best to avoid Geekbuying.com
granaten said:
I also ordered through geekbuying. The tablet was very buggy out of the box, thats why i went along and tried windows 10. The screen was water damaged with a large dark spot in the middle. I was able to fix it with this trick though!
https://www.youtube.com/watch?v=PxUOlqaN6N8
Click to expand...
Click to collapse
Wootever said:
Geekbuying is absolutely inadvisable (to put it politely), i also got the version with pre-installed kms activator which is a very questionable practice for a "proper" retailer.
Click to expand...
Click to collapse
shinynickler said:
I agree. My i7 stylus was shipped weeks after they deducted payment, the seals were broken, the screen protector had serious scratches all over it (may have been a display unit), and windows was bootlegged. I would strongly advise against doing business with them.
Click to expand...
Click to collapse

Thx mate! That reg setting set everything right with the orientation! The bluetooth driver gave the same error, maybe a windows 10 issue.
I also ordered through geekbuying. The tablet was very buggy out of the box, thats why i went along and tried windows 10. The screen was water damaged with a large dark spot in the middle. I was able to fix it with this trick though!
https://www.youtube.com/watch?v=PxUOlqaN6N8

The first trustworthy review is online: Techtablets.com
Thanks @Hendrickson

Has anyone opened the tablet?
Has anyone opened the tablet to replace the SSD or anything else and can give instructions on how to do it without damage?

Here there are photos but no instructions
http://bbs.51cube.com/thread-102113-1-1.html

KoryandR said:
Here there are photos but no instructions
Thanks for the photos. I have seen them before but there are reportedly some pins that are easily breakable so was hoping for someone who opened the tablet to comment on what was done to prevent damage.
Click to expand...
Click to collapse

I just realized that THERE ARE instructions but Google Translate does a mess with chinese and it's very difficult to understand

Evolution / HDK Forester Golf Cart Touchscreen

Hello -
My golf cart has a 9" touchscreen that has very limited capability. I'd like to see if there's anything that can be done to enhance by maybe adding an app launcher and then adding a few better apps.
Based on the number I see inside the unit "zl201721508032.8", I think this might be a iMars or Jmance but I really don't know.
Any ideas on how to approach this? Can developer mode be enabled? I clicked around on the version but there's no response. I've connected my laptop to the USB and I see no serial port action.
thanks for any ideas.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

I'm always a sucker for a good UART hunt.
Got a voltmeter? Got a USB UART?
Check the voltages on these three pins.
Mmm, I think this is a really low end device. I think that it's not Android at all.
1 GB flash and 64 MB RAM doesn't get you a lot of buzz these days.

Oh good eye on seeing those pins, I completely missed those. I'll give that a try. I've got a couple of the usb-uart things that I've used on routers.
The UI sure looks a lot like other Android auto tablets like that eBay auction and the ones in Jmance website so I was thinking it's Android.
Novice question, could that allwinner board be just the MCU part and the Android part/tablet is below the black plastic with the zl201721508032.8 stamp?

droidard said:
Novice question, could that allwinner board be just the MCU part and the Android part/tablet is below the black plastic with the zl201721508032.8 stamp?
Click to expand...
Click to collapse
Nope. The white ribbon cable is the fixed pushbuttons on the left of the screen, the orange is the LCD, the black is the I²C interface for the capacitive touch sensor.

Renate said:
I'm always a sucker for a good UART hunt.
Got a voltmeter? Got a USB UART?
Check the voltages on these three pins.
View attachment 5742927
Mmm, I think this is a really low end device. I think that it's not Android at all.
1 GB flash and 64 MB RAM doesn't get you a lot of buzz these days.
Click to expand...
Click to collapse
Renate said:
I'm always a sucker for a good UART hunt.
Got a voltmeter? Got a USB UART?
Check the voltages on these three pins.
View attachment 5742927
Mmm, I think this is a really low end device. I think that it's not Android at all.
1 GB flash and 64 MB RAM doesn't get you a lot of buzz these days.
Click to expand...
Click to collapse
I finally got back to this. Flipping the board over, those pins and several others are labeled. Those 3 pins you mentioned (to the upper right of the 18V sticker in new photo) may not be a UART, they are labeled 3V3, GND, KEY1. Any idea what they may be?
The labeling on the 5 vertical pins seem to be a single wire interface module (SWIM) test point. A test module that I don't own.
And there are two groups that do look like UARTS. One in the bottom right and one in the middle below the 3 caps.
The bottom right didn't seem to generate any output but the middle one was quite yappy. I think it was outputting at 115200 but I saw nothing that looked like english text log output, no boot-up logs, I think it was all data. It did react to button presses, turn signals and such.
This was fun but I got no where and it doesn't look very capable or customizable. I think I'm yanking it out and replacing with an Android.
Thanks for your help

I'd think that the yappy one was it.
Did you try 921600 (the new high speed one) or even 38400.
Make sure it's all 8-n-1.

Renate said:
I'd think that the yappy one was it.
Did you try 921600 (the new high speed one) or even 38400.
Make sure it's all 8-n-1.
Click to expand...
Click to collapse
I'm pretty sure I tried 38400 but probably not 921600. I think I was using 8-N-1 but I will dbl check