Database Users

Developing methods to recover bricks without JTAG

I have not seen anything in the Captivate forums about UART, I2C, or really anything other then Download Mode/Recovery Mode. We could use some developers to help with this project. It's an interesting combination of hardware, software, and inter-chip communications protocols...
I think everyone knows about the 301Kohm resistor between pins 4 and 5. Did you know about the 150Kohm or the 619Kohm resistors? How about the middle battery pin?
Watch this video.
Resources
Users
One-Click Unbrick was relesed This will unbrick softbricked phones http://forum.xda-developers.com/showthread.php?t=1153310
Kernel developers
UART Kernel debug log AND shell terminal (like adb shell without adb active) On the captivate you can get into the SBL prompt, then type
Code:
printenv
setenv SWITCH_SEL 6543
printenv
saveenv
This changes the SWITCH_SEL value from 65 to 6543 and enables extra output. This will give you a kernel debug output and drop you into a shell prompt.
Developers
bootloader source code For a simlilar samsung device: http://forum.xda-developers.com/showthread.php?t=1018862&page=68
here is the iROM,: I've rehosted it here: http://teamkomin.googlecode.com/svn-history/r75/branches/IROMcode/bootdumps.rar
here: http://www.mediafire.com/file/c9bg6gyk1cuapsz/bootdumps.rar
and here: ftp://adamoutler.dyndns.org/bootdumps.rar
we need help deciphering it. We think the annotations may be wrong. This is the unchangable code in the first few blocks of memory. There must be a way to communicate with this.
Hardware guys
S5PC110 processor datasheethttp://www.mediafire.com/file/3znisgfm3amxgpj/S5PC110_EVT1_UM10.pdf This is the processor in our phones. This documents everything which is capable natively with the processor. It is 2425 pages long.. I read through it and added some notes here.. This is the meat of the manual: http://forum.xda-developers.com/showthread.php?t=1018862&page=51
FSA9280A datasheet http://www.mediafire.com/?d4e21efhuktctcb This is the first time we've had access to this manual. Our phones use the FSA9480A chip, this chip is functionally the same. The datasheet here describes all functions available to the USB switching device. From the FSA9280 datasheet we've located all resistor values. http://forum.xda-developers.com/showpost.php?p=14408452&postcount=62
All
The All-In-One GalaxyS HackPack hardware, software and documentation on our phones http://forum.xda-developers.com/showthread.php?t=1111866
It has been revealed from a source which is not to be mentioned that the OM pins/registers are fixed and cannot be changed on the processor without removing the processor from the device or making some hardware modifications.
Here's some must read threads.
Fun with resistors:http://forum.xda-developers.com/showthread.php?t=820275 This thread shows all known resistor values
Lets save some bricks:http://forum.xda-developers.com/showthread.php?t=1018862 This thread deals with ways to revive phones from the dead. We are hacking the heck out of them in here.
Development platform booting from MMC http://hi.baidu.com/j2h3344/blog/item/85740dfc0be35951d7887dd5.html This is the platform used to develop our phones. We need to find these OM bits, or access them somehow.
the middle battery pin http://forum.xda-developers.com/showpost.php?p=13448859&postcount=253 This may be the answer. We could use some help in this area.
Download the GalaxyS Hack Pack here: http://forum.xda-developers.com/show....php?t=1111866
Known Causes of hard Bricking
1. PBL(Primitive bootloader) and SBL(secondary bootloader) were not designed for the phone
2. Mismatched PBL/SBL combination
3. SBL does not fit in the Partition information table, or location does not match Partition Information Table
4. Bad USB cables
5. power loss
6. Damaged PBL/SBL
--Theoretical--
7. Something known as Secondary Bootloader Rotation may be to blame for improper bootloaders sometimes. Apparently when flashing, the SBL and SBL2 blocks may switch places. In this case you may have the proper PBL, but the SBL is not proper for the device.
Hardware Used
If you're looking to help, you'll need some development hardware. I use an Arduino Mega. http://www.bizoner.com/arduino-atme...e-p-180.html?zenid=9mg23h688slfjgh88910o5jfd2 This is a programmable interface. You can use this code to talk to the phone. http://forum.xda-developers.com/showpost.php?p=13351363&postcount=223
Here's some plans for a communications adapter http://forum.xda-developers.com/showthread.php?t=925034
The plan
If we can get into a bricked phone via UART or the i2C bus, or the USB bus, or any other method available to U301, we can corrupt the PBL(boot.bin) in the OneNand which will cause the processor to search for a PBL and SBL on USB, UART and MMC.
If we can locate an additional communications port somewhere on the phone we can change or corrupt the code running in memory and then cause the processor to reboot into USB or UART mode.
So far we know of UART only and have eliminated that as a solution on it's own.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Using SBL, it is very likely possiblity that Windows7 phone or iOS, or ubuntu could be ported over.... Basically, full control.
Why you should help
We've been working on ways to recover these phones for months now. We're comming to an end. We need massive amounts of testing to figure out this last bit.
This is a call to duty. Every developer who has ever released a boot.bin, SBL.bin, param.ifs or a PIT with their release needs to be a part of this. Every member who has ever bricked a phone while using one of the many tools which are designed to upgrade your phone can help. Anyone who wants to feel secure while flashing their phone should put some effort into this because it's expensive and requires superhuman soldering to JTAG these phones. If you've even thought about using Odin3, we need your help.
Update: UnBrickable Captivate http://forum.xda-developers.com/showthread.php?t=1206216

Seems interesting / promising, unfortunately I can't help BC I moved back to Morocco (Africa) and only brought 1 captivate with me. Good luck that is all I can say.
Sent from my SGH-I897 using XDA Premium App

Really interesting and very cool.
But I have a fully bricked captivate which I still have cause it was a friends who just went onto the Inspire. Always have wondered if I could recover the hard brick.
Wish I could help but I'm pretty useless with Soldering and taking apart my phone. But if development moves along with this I'd love to support. The idea of porting those OS and helping everyone saving hard bricked phones would be great.
Good Luck!
Sent from my SGH-I897 using XDA App

im bookmarking this. i can only help in fabrication. im not a super genius dev. but threads/projects like this do interest me.

Middle battery pin? Reminds me of the battery jig trick on the original PSP.
All-in-all, this looks promising, I'll be following it.

Posted up the iROM in the first post. this is the code which we hope to establish communications...
Keep in mind, this could be over the USB port, the Middle battery terminal, or even the headphone port.

But I have a fully bricked captivate which I still have cause it was a friends who just went onto the Inspire. Always have wondered if I could recover the hard brick.
Click to expand...
Click to collapse
I'M GETTING ONE OF THOSE IN THE AM!!!!!
i have a fully bricked cappy that i bricked lastnight. i was able to recover from the phone..!..pc icon but then failed @95% via odin3 v1.00.
i will mail you the cappy if you can fix it and use it as a test mule for future brick\unbrick attempts...... the outer glass is broken thanks to a fall from my lap to the concrete

I think I actually discussed this with you before. I ran twice into some instance where no action would make difference on the phone, no response to key combos, no response to charger or USB. But, download mode was still accessible via USB Jig.
What could've happened there?

cumanzor said:
I think I actually discussed this with you before. I ran twice into some instance where no action would make difference on the phone, no response to key combos, no response to charger or USB. But, download mode was still accessible via USB Jig.
What could've happened there?
Click to expand...
Click to collapse
Not really positive at this point, id suspect corrupted pbl.bin or param.lfs partitions. I've seen some weird stuff with the pbl. One phone would only output uart when volume + was held for 5 seconds.
Basically from my understanding... The IROM loads into the processor. This is the first 40000 bytes and it's protected memory. The iROM brings up basic functionality for the processor, including the initial factory UART/MMC load of PBL & SBL. The IROM then instructs the phone to load the IBL/PBL(Initial Boot Loader/Primitive Boot Loader). The IBL initializes memory for the SBL(Secondary Boot Loader) , then the PBL loads Params(a partition on the OneNAND) and checks the pins on the processor for commands. The PBL then makes more memory available for applications, then locates and and loads the SBL. The SBL initializes other functions and then locates and loads the kernel.
The SBL is responsible for Download Mode and the SBL prompt. it is basically the system's "BIOS" for lack of a better word. I'm not sure of the steps which can be skipped for sucessful download mode.

The iRom download it broken.
Ill look at it once your reupload

Some kid reported the iROM code as being in violation of the terms of agreement of the hosting website... It must have been a kid because Samsung would not do that. Just as we have a right to use tools to disassemble our phones, take pictures, annotate those pictures and post them on the internet, we have the same right to the IROM. It's not hurting Samsung's sales, nor is it intellectual property of Samsung. We bought the phones and it came with this. The only intellectual property in this document belongs to the person who disassembled and annotated this code.
I've rehosted it here: http://teamkomin.googlecode.com/svn-history/r75/branches/IROMcode/bootdumps.rar
here: http://www.mediafire.com/file/c9bg6gyk1cuapsz/bootdumps.rar
and here: ftp://[email protected]/bootdumps.rar username xda password developers
Lets not be childish and hinder progress anymore by clicking buttons. I've removed that ability.

I think this is a wonderfull bunch of work that is being done here and if i can offer any assistance please let me know. If you would like a private IRC channel to discuss your work in with other developers I would be more than happy to provide to a quiet private place to do so. Just shoot me a pm if i can be of any assistance.

We can really use some SGS folks to help. Check out the lets save some bricks thread mentioned in the first post.

Two quick questions:
1. How would you manage to get these files? First, aren't they burned into the nand? Secondly, wouldn't they be assembled already? How do you disassemble them?
2. Do you have any good links/books on how to learn arm assembly? I know some x86, but I've never found a good link to arm based stuff (or any sort of dev platform, for that matter).
Sorry about being semi-offtopic.

Subscribed, and very interested in following progress on this.
Also: Sending PM.

Nothing revolutionary to add just yet.
However, I just finished adding a JTAG breakout to my collection. This is what my current test setup looks like:
We could use some more DIYer's on this project. The biggest thing to have is an Arduino and a microUSB breakout board. We need to figure out how to get this phone to boot from MMC, USB, or UART... and we know Samsung does this to bricks.

this looks interesting.. gonna keep my eye on it

AdamOutler said:
Nothing revolutionary to add just yet.
We could use some more DIYer's on this project. The biggest thing to have is an Arduino and a microUSB breakout board. We need to figure out how to get this phone to boot from MMC, USB, or UART... and we know Samsung does this to bricks.
Click to expand...
Click to collapse
i can build anything, the purchase of and arduino and making the breakout board are easy but i would have no idea what to do with it afterwards.
it is funny the time you posted this because my friend found out about a club that works with arduino boards making all sorts of things and asked me if i wanted to go to there meetings. this thread popped up the next day.
well i may buy an arduino board or 2 but im not sure if even then i can be helpful

Well, a pretty much unexplored area of the phone is the middle battery terminal. The middle battery terminal is a ADC(analog to digital converter) pin. We know for a fact that it triggers something called EXT-I2C (External Inter-Integrated Circuit). EXT-I2C can be used to communicate with any chip on the I2C bus. The I2C bus connects with everything on the phone... Call Processor, OneNand, Memory and Application Processor. Using the EXT-I2C, we would have full control over the phone.
I know the middle battery terminal has something to do with it because I managed to get my phone to boot-loop with the pin disconnected and I saw messages about EXT-I2C NACK( EXT-I2C not acknowledged) when playing with resistance values and watching the UART output on my Arduino MEGA.
The unanswered questions are,
How to reproduce that EXT-I2C message?
What are the Addresses on the I2C bus?
Which pins control the I2C bus?
Here's some of the possible I2C bus connections:
USB VCC
USB Ground
USB D+
USB D-
Batt+ (when powered on USB)
Batt- (when powered on USB)
BSI (Battery Signal Indicator - middle battery pin)
Headphone Left Audio
Headphone Right Audio
Headphone Video
Headphone Ground
all External-SDCard (MMC) connections
all SIM connections
This is something you can bring to the table at that Arduino club. You can also read up on this hackaday article http://hackaday.com/2011/05/11/i2c-101/

If anyone has a good idea of which pins may be OM pins here, let me know..
Side facing LCD screen
Side facing back of unit

The Captivate Development Platform mod AKA UnBrickable Mod

Background
First off, big thanks to TheBeano and Midas5 for teaching me about UART, decompiling bootloaders and figuring out how the OM values work. Their initial work and dedication in "Lets Save Some Bricks" inspired me greatly. Since the work started we've analyzed UART outputs, hacked the heck out of the SBL prompt, obtained both decompiled and source for bootloaders, and generally learned a **** ton about our devices... Mind you, that's a Metric **** ton, not the Imperial **** ton, which is equivalent to nearly 2000 assloads. The reason I'm branching this operation at the current point is because this modification is specific to our device. The proper modifications for other Samsung devices have not been identified yet. We're first! Yay! We need to focus on Captivate firmware development now. The firmware may encompass all GalaxyS models as well, but this modification will only work on the Captivate.
introduction
I'm not kidding when I say UnBrickable. Modifying the OM pins means you can boot from USB, UART or MMC. This makes the phone quite UNBRICKABLE. There is nothing you can do software wise to prevent the device from booting into this mode. We are communicating with the unrewritable, efused IROM on the processor. It's the thing that makes the system on a chip into a "system on a chip".I am here now to tell you how to turn your Samsung Captivate into a KIT-S5PC110 development board. The KIT-S5PC110 development board is the platform used to develop our phones. There are some differences between this mod and the official development platform. The S5PC110 has a removable internal SDCard and no touchscreen.
Why would you want to do this? When you plug in the battery and connect it to the computer in "off" mode, it will become an S5PC110 board awaiting download of a program to run. This occurs long before anything like software or firmware enters the processor. This is the IROM of the device awaiting commands or a power on signal.
Because it is accepting a memory flash, anything may be put onto the device to perform a boot sequence..... Apple iOS (iPhone4 has the same processor) WP7 (mango supports this processor).
This will be a replacement for JTAG once we are able to make some firmware. How could it possibly be better then JTAG? Let's count the ways....
1. The only part required is a wire.
2. No shipping time.
3. No cost for a box to interface the computer.
4. Permanent.
5. Can be done as a preventive measure.
6. Gives the ability to test new Bootloaders temporarily.
7. Allows development of the entire system.
8. Removes worry about flashing and acts as a backup.
After performing this mod:
Remove the battery, replace the battery, your phone will connect to the computer via USB and await commands. Otherwise it will pretty much act like a captivate. See the Special Instructions section.
Modification
You will need:
1. Get someone who knows what they're doing with a soldering iron. If they don't know what flux is, then they don't know what they're doing. You can send me a PM(my username @gmail.com) or Connexion2005(aka MobileTechVideos.com). Note: I do not work for/with mobiletechvideos.com.
2. soldering iron - make sure it's sharp, if it's not sharp, then sharpen it, flux it and retin it.
3. flux
4. solder
5. tweezers
6. A relay (for the wire contained within)
getting started:
You will need a very small peice of wire. Tear apart the relay unravel the coil within and grab about 12cm~ of wire. The fact that it comes from a relay is important because relays generally have very small wire which are individually treated with a non-conductive coating.
Take the 12cm~ wire from the relay and tin the very edge of it. No more then 1/32". If you tin more then 1mm, cut off the excess. It is desirable to have a slight bit of excess solder on the tip of this wire.
performing the modification:
1. tear apart your phone... remove 6 #0 phillips screws from the back. Two of them are under the battery slide flap. The slide flap must be up on one end and down on the other in order to get to these screws... Don't LIFT the slide flap, just rotate it at an angle. Once the 6 screws are out, then you can separate the back from the front. Make sure to take out your SIM and external SDCard before you do this.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
2. remove the mainboard... there's a single screw and 5 connectors which require removal. Remove them. Pull the board out and place it on your workspace
3. remove the EM shield from the processor side.
4. remove the OM5 resistor in the picture below. It's coated in glue. I've found the best thing is to just coat the area in flux and let it do the work while prodding with the iron to move the resistor out of place.
5. Connect the active side of xOM0 resistor to the active pad on OM5's resistor pads.
http://i51.tinypic.com/160zmty.jpg
6. reassemble the phone.
Special Instructions
This replaces the battery charging sequence. The normal battery charging sequence can be activated by holding power for 4 seconds.
To turn on the device, and operate in normal mode, you must hold the power button for 5 seconds.
3 button Download mode works as usual, however you must not have the S5PC110 drivers installed on the computer. You can use your custom rom menu option, adb reboot download, or use a terminal to "reboot download". 301Kohm Factory Mode JIGs work as well, but you must press power to bypass the S5PC110 mode.
Conclusion
Congratulations. You now have a device which works like a KIT-S5PC110 with an OM Value of 29. Now get to developing some serious custom software. See here for setting up the UART output http://forum.xda-developers.com/showthread.php?t=1235219
reading material
Creating your own Samsung Bootloaders: http://forum.xda-developers.com/showthread.php?t=1233273
KIT-S5PC110 manual: http://www.mediafire.com/?94krzvvxksvmuxh
how to use DNW: http://tinyurl.com/dnw-how-to
Flash using openOCD and DNW: http://www.arm9board.net/wiki/index.php?title=Flash_using_OpenOCD_and_DNW
another DNW example: http://www.boardset.com/products/mv6410.php
ODroid dev center: http://dev.odroid.com/projects/uboot/wiki/#s-7.2
drivers and utilities
This will be an ever expanding list
Windows Drivers http://forum.xda-developers.com/attachment.php?attachmentid=678937&d=1312590673
Windows Download Tool DNW: http://forum.xda-developers.com/attachment.php?attachmentid=678938&d=1312590673
Windows Command Line tool: http://forum.xda-developers.com/showpost.php?p=17202523&postcount=27
Linux DNW Utility: http://dev.odroid.com/projects/uboot/wiki/#s-7.2
Linux Detector tool: http://forum.xda-developers.com/showthread.php?t=1257434
Linux Automated UnBricker:http://forum.xda-developers.com/showthread.php?t=1242466
firmware
Bootloader Hello World by Rebellos http://forum.xda-developers.com/attachment.php?attachmentid=698077&d=1314105521
UnBrick tool http://forum.xda-developers.com/showthread.php?t=1242466

Great work adam. cant wait to see this used to reflash bootloaders or something.

now we need firmware... i figured adam would have flashed something already , and thought about getting back from that flash later

https://github.com/teamhacksung/uBoot
possibility of uBoot on our devices... so much nicer than our current bootloaders. initial work has been done by codeworkx for compatibility with our boards, but (obviously) hasn't been tested

COOOL
looks good

Very exciting work y'all! Any plans on using it to dual boot Andbuntu/iOS?

Wow dude, you do some great work. Keep us posted!
Now if it only was a light sabor too....

i did a little bit of reading and definitly agree it would be cool to get uboot on our phones,
along with unbicking devices.
I would love to help sadly I have no knowledge of this low level stuff, or soldering skills.
I will watch this thread closely. Good luck guys.
http://www.linuxfordevices.com/c/a/...s-UBoot-the-universal-open-source-bootloader/

I was attempting to see what i could "upload" from my daily phone. I messed up my daily phone while performing this modification. I was trying to remove the xOM5 resistor and got impatient. I broke it off, it took the pad with it and I and was left with only a .001mm wire on the board. I attempted to solder it for about 6 hours straight and after a while I swiped off 5 resistors in a line. I'm sure I could repair it, but I just went and bought another phone.
Lesson: Take your time, and don't try to force anything. That glue is tough and it acts as a heat sink. Remove the glue from one side of the resistor, heat the entire resistor up and let it slide off. Don't try to speed it up.
Once you perform this modification everything works just fine. No problems. It's a risky procedure though.
I still have not tested any firmware sucessfully. I tried a few precompiled uboots, but I did not yet try the uboot mentioned above.

This looks awesome, although I'm hesitant to do it, because there's always that chance that I will need to RMA. Sorry about your phone Adam, I think everyone in the forum is probably in love with you now though!
Sent from my SAMSUNG SGH-I897 using XDA Premium App

I would add that when doing this work, you should use ESD protections. Wrist strap (you can rig a homemade version), ESD mat, etc. Not as big of a risk in a humid environment, but as relative humidity drops, the risk increases. You can never be to safe if your phone is valuable to you. Typically, consumer electronics are hardened to ESD through connectors and the housing, but when you are directly handing the PCBA, you are potentially bypassing the hardware filters.

I need something to flash with this bad boy now.
Sent from my GT-I9000 using XDA Premium App

Adam, thanks for all your work, and everyone else for that matter. Connexion never responded to my PM about jtag work, but this little modification is so damned easy I went ahead and did it. I'll be patiently waiting for a firmware we can use to reflash bricked phones in the future.
Again, thanks a ton!

I don't need to rework the board do I? As in is picture 4 simply for reference?

Proxyep said:
I don't need to rework the board do I? As in is picture 4 simply for reference?
Click to expand...
Click to collapse
Picture 6.

Adam, did you try tracing the i2c?
It might give us an un-brick mode without even soldering om5.

So what would this exaclty do?, dont wanna do it till i know exactly what it does.
Sent from my Cappy with Glitch V11 LL at 1.6GHz stable, Juwe's RAM script, V6 script, V8 kickass kernel tweaks, and 3G booster script using XDA Premium App

midas5 said:
Adam, did you try tracing the i2c?
It might give us an un-brick mode without even soldering om5.
Click to expand...
Click to collapse
No, I have not been messing with hardware since I found the OM5 mod. I wish to develop this further. If you can get me a pin number to trace I will do that. Please look up the pin in the S5PC110 manual and I will trace it... I've been very busy locating software for this mod.
b-eock said:
So what would this exaclty do?, dont wanna do it till i know exactly what it does.
Sent from my Cappy with Glitch V11 LL at 1.6GHz stable, Juwe's RAM script, V6 script, V8 kickass kernel tweaks, and 3G booster script using XDA Premium App
Click to expand...
Click to collapse
Currently we are running into this:
Code:
��������������������������������������������������������������������������������
Uart negotiation Error
Secure Fail Error
Secure Fail Error is likely because the uBoot I am loading violates the S5PC110 chain of trust. I am working to locate software which will not violate the chain of trust.
See this post for more:
popfan said:
I found this while waiting for the reply from Samsung.
http://www.aesop.or.kr/?document_srl=266600&mid=Board_Download_S5PC100
This is Linux Native - Complier Package
Please note this is in Korean.
One more found:
http://www.aesop.or.kr/?mid=Board_Download_S5PC100&page=2&document_srl=75581
USB OTG-Mon Binary ??
Last one - S5PC100 Code Visor Debug resource
http://www.aesop.or.kr/?document_srl=267106&mid=Board_Download_S5PC100
Click to expand...
Click to collapse
I have a 3 day waiting period for my id on that site to become active, at which point, I believe we will have a solution.

I believe the binary on this page will be the solution http://www.aesop.or.kr/?mid=Board_Download_S5PC100&page=2&document_srl=75581

b-eock said:
So what would this exaclty do?, dont wanna do it till i know exactly what it does.
Sent from my Cappy with Glitch V11 LL at 1.6GHz stable, Juwe's RAM script, V6 script, V8 kickass kernel tweaks, and 3G booster script using XDA Premium App
Click to expand...
Click to collapse
Allows you to boot from things other than the internal sdcard, and overwrite memory on the phone. Basically, if you break a bootloader, this is the only thing that could fix it beyond re-jtaging it.
At this point, there's no real point unless a) your device is bricked or b) Adam gets the software half up and running, in which you could do it as a pre-emptive measure.

[Soldering?] Move internal memory chip

Hello lovely people.
Not long ago, my wonderful Samsung Galaxy S2 dropped dead. Before I send it in for service, I would LOVE to get the data on the internal storage back.
The phone does not get hot while charging, and nothing else whatsoever makes it show sings of life.
Is it possible to swap out the internal storage chip from the motherboard, and place it on an another identical phone, and retrieve the data that way?
Any sort of tips for businesses that would do something like this is welcome!
As you can guess, I learned to back up my stuff the hard way. My last clockwork backup was 20 days ago. Precious 20 days ago

probability = 99,99% yes ... a SD-card no matter of where it was before. have good luck

psytr0nic said:
probability = 99,99% yes ... a SD-card no matter of where it was before. have good luck
Click to expand...
Click to collapse
And the deadly .01% is if the damaged part is the internal memory itself.
:good:

While emmc chip got like 20 important pads to solder (out of even hundred, when most are there being N/C) it is still BGA. A ****ass small BGA covered with glue. That would require someone really experienced with reworking such things. I do not know the prices but I would be prepared to pay even 100$ or more for such job, done right.
That from HW level. From SW+HW look: in theory there should be no trouble with properly swapped emmc ic from other phone. But you shall not forget about the said 0.01%, maybe more - reworking such chip might have influence on its content (I might be wrong) + GS2 had the emmc hardbrick bug - how did it die?
Please let us know how did it go.
Oh and btw - there must be companies working on such data recovery with proper HW to wire up to the unsoldered chip with sort of socket or other hackaround - I'd lookup there.

Max specified operating temperature of an eMMC is about 85 °C, there's no telling what happens above that... So whatever way you use to re-connect your eMMC, make sure it is not by soldering!

Of course it is possible but you need highly expensive tools for it to solder of the chip. it is BGA it's not just like a transistor..
It does have hundreds of micro balls under the chip. Did you try adb shell already? Or is it really 99% dead.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
You may find a company that can do it but it will cost A LOT of money. Because you need special tools for it.
Something like this
You best bet would be to try to use a heat gun on the main board. Just heat it up for a few seconds and cool it down to zero as quick as possible. Maybe the bga is cracked because it got hit by the ground when you accidentally dropped it. By heating it up you may temporarily fix this crack(will also cause slightly damage to the chips) in the soldering. So you can back it up and sent it back. I think it will void the warranty, but you have to decide for yourself what to do. Try to get back the data or get a new working main board from Samsung (if you sent the phone back they will just replace it with a new one most likely).
Bga soldering crack

0,1% of chance .. playing with Samsung EMMC chip = bye bye phone . look around forum or elsewhere 100% of bricked is due to it .
Question : what make you confident to say that your internal memory is good ?
to remind : it is also your phone flash chip which manage boot sequence and all . don't forget it .
Max specified operating temperature of an eMMC is about 85 °C, there's no telling what happens above that.
Click to expand...
Click to collapse
Of course it is possible but you need highly expensive tools for it to solder of the chip
Click to expand...
Click to collapse
every time I tried with hot air , I removed chip with missing pads cause of glue under chip which make hard to remove .
why not to give a try ? have good luck
You best bet would be to try to use a heat gun on the main board
Click to expand...
Click to collapse

Those are options you have instead of paying hundreds of euro's to a company that can recover it if it isn't the nand/emmc itself that is the dead part of the phone.
Of course i recommend him to go to a professional company and let them do recover it. Because they will do it the proper way but like i said before it cost you a lot of money.
So your best bet would be to try it yourself or just sent it back to Samsung for warranty.(by trying yourself i don't mean to solder it off because thet will not work out good. It will probably kill the chip, just try to reflow the mainboard and maybe you have luck.)
I know about glue in the corners of bga based chips in HP & Acer and other brands in laptops and such but didn't know that phones had that too.
But glue under the chip, never seen that before. And btw you cannot remove a bga soldered chip with a heatgun you need ir so that the whole surface under the chip gets loose. And you need to cover up all other components or they will get loose too or fry
Acer bga soldered chip -> glue in corners (this is not nand or emmc, its the chipset & cpu/gpu)
http://i.imgur.com/aIHNu.jpg
Irda soldering
http://www.youtube.com/watch?feature=player_detailpage&v=RrA-trDZPNs#t=170s

Recovering data from snapped Galaxy s2 motherboard
Hi everyone, i really need some help
My galaxy s2 motherboard has snapped (around the long thin bit) with all other parts of the motherboard still intact. I really need to recover all of the data. The data has sentimental value and cannot be replaced. Is there any chance of recovering the data either through chip extraction and onto new board? Can the existing motherboard be fixed?
All i keep hearing is that it is too difficult, the motherboard is multi-layered and would be impossible to fix. I am reluctant to take this as an answer. Is there anybody out there that has a solution for recovering all the data? Who would i go to? who do i pay? Ive contacted samsung and they say it is impossible, when questioning them why it is impossible they state tit would cost too much and they cannot do it.
Please help. thank you.

EMMC reball and some other tips
Hey guys,
I know this thread is a little bit old but I'll try to give in my 2 cents maybe someone here may find it helpful
So I come from background where I do around 20 bga reballs per week, so I do know a thing or two I guess about this although my knowledge on Samsung platform is relatively low compared to an iphone logic.
So to begin with replacing the emmc chip alone is not enough as you'll need a programmer box which connects to a jtag interface which is able to rewrite the initial files like bootrom to the emmc. You can find these boxes at any prominent gsm repair shops; boxes named such as RiffBox or Z3X Samsung box are the best I found recently.
Having said that before any repair is attempted by mainly removing the flash chip it is imperative to try to resurrect the phone using these said boxes, to try to find whether or not the NAND chip is actually detected. As one may have simply installed a ROM which is not compatible with the phone and all that is required is to rewrite the bootrom files. If the NAND (basically the same name as a flash chip) fails to be detected then obviously something went wrong and it either could be the NAND is burnt inside, or the NAND has some cracks under its critical ball pins or even may be a problem that the main power management chip inside the phone is failing from supplying usually around 3V to power up the NAND.
The emmc chip at least found in a samsung is a 14 by 14 pins which only about 1/3 of it's pins are critical, the rest are dummy and do not worry if they eventually get removed, while removing the chip or cleaning the board after desoldering prior installing the new chip.
Some tips on reworking:
Always cover critical glued components like CPU + POP (package on package) RAM, baseband processor usually XGOLD found in Samsung.
Clean surrounding chip glue before attempting to remove by giving around 250C of heat and with a needle scratching the glue around
Do not exceed more than 350C to remove the actual chip to prevent more damage to the built in tracks inside the motherboard.
Last and not least a schematic for your phone would always be a lot of help to help you detect what voltages are missing on bootup to make sure that the boot up sequence is starting fine and also the relative points of each pin under a chip while knowing which pins are critical and which are dummies, or NC (not connected)
If you need any help you can always message me and I'll try my best to answer your questions.
Regards,
Ryan

solder with care
Solder with care mate, else it will be totally gone

psytr0nic said:
0,1% of chance .. playing with Samsung EMMC chip = bye bye phone . look around forum or elsewhere 100% of bricked is due to it .
Question : what make you confident to say that your internal memory is good ?
to remind : it is also your phone flash chip which manage boot sequence and all . don't forget it .
every time I tried with hot air , I removed chip with missing pads cause of glue under chip which make hard to remove .
why not to give a try ? have good luck
Click to expand...
Click to collapse
The glue in samsung is very easy to remove you just need to heat the board up to 250C and gently scratch the glued area with a needle. Do not worry on the removed pads as 1/3 of the pads under the EMMC are not connected and therefore not needed. Always clean the chip from the glue and use leaded solder for best shiny connections.

If you need any help you can always message me and I'll try my best to answer your questions.
Regards,
Ryan[/QUOTE]
Can you please explain more about JTAG.., types and the connections, how to get files for the different phones, where can we get the software etc. Thank you.:good:

richie16171 said:
If you need any help you can always message me and I'll try my best to answer your questions.
Regards,
Ryan
Click to expand...
Click to collapse
Can you please please explain more about JTAG.., types and the connections, how to get the files from different phones, where can we get the softare etc. Thank you.:good:[/QUOTE]
You will need special programmer boxes like riffbox to be able to rewrite the bootloader. JTAG is a dedicated space on the board where the riffbox will communicate with the phone.

AnArChYm said:
Can you please please explain more about JTAG.., types and the connections, how to get the files from different phones, where can we get the softare etc. Thank you.:good:
Click to expand...
Click to collapse
You will need special programmer boxes like riffbox to be able to rewrite the bootloader. JTAG is a dedicated space on the board where the riffbox will communicate with the phone.[/QUOTE]
Thank you., what about the riffbox connections? Which pin to connect what and is it common to all devices?

richie16171 said:
You will need special programmer boxes like riffbox to be able to rewrite the bootloader. JTAG is a dedicated space on the board where the riffbox will communicate with the phone.
Click to expand...
Click to collapse
Thank you., what about the riffbox connections? Which pin to connect what and is it common to all devices?[/QUOTE]
Edit: I already got the site. And everything is explained in forum there. If anyone wants.. you can find here http://faq.riffbox.org/showcat.html

Would like the learn how to reball
AnArChYm said:
Hey guys,
I know this thread is a little bit old but I'll try to give in my 2 cents maybe someone here may find it helpful
So I come from background where I do around 20 bga reballs per week, so I do know a thing or two I guess about this although my knowledge on Samsung platform is relatively low compared to an iphone logic.
So to begin with replacing the emmc chip alone is not enough as you'll need a programmer box which connects to a jtag interface which is able to rewrite the initial files like bootrom to the emmc. You can find these boxes at any prominent gsm repair shops; boxes named such as RiffBox or Z3X Samsung box are the best I found recently.
Having said that before any repair is attempted by mainly removing the flash chip it is imperative to try to resurrect the phone using these said boxes, to try to find whether or not the NAND chip is actually detected. As one may have simply installed a ROM which is not compatible with the phone and all that is required is to rewrite the bootrom files. If the NAND (basically the same name as a flash chip) fails to be detected then obviously something went wrong and it either could be the NAND is burnt inside, or the NAND has some cracks under its critical ball pins or even may be a problem that the main power management chip inside the phone is failing from supplying usually around 3V to power up the NAND.
The emmc chip at least found in a samsung is a 14 by 14 pins which only about 1/3 of it's pins are critical, the rest are dummy and do not worry if they eventually get removed, while removing the chip or cleaning the board after desoldering prior installing the new chip.
Some tips on reworking:
Always cover critical glued components like CPU + POP (package on package) RAM, baseband processor usually XGOLD found in Samsung.
Clean surrounding chip glue before attempting to remove by giving around 250C of heat and with a needle scratching the glue around
Do not exceed more than 350C to remove the actual chip to prevent more damage to the built in tracks inside the motherboard.
Last and not least a schematic for your phone would always be a lot of help to help you detect what voltages are missing on bootup to make sure that the boot up sequence is starting fine and also the relative points of each pin under a chip while knowing which pins are critical and which are dummies, or NC (not connected)
If you need any help you can always message me and I'll try my best to answer your questions.
Regards,
Ryan
Click to expand...
Click to collapse
Hi Ryan,
My son's galaxy s3 i9300 was inadvertently given a spin in the washing machine. When I realised what had happened I took it apart into its various components and put it in rice for a week. When I switched it on everything worked except the cell phone signal. From what I can gather the eMMC chip has been damaged and no software can fix it. I don't have it with me now but I think IMEI and baseband is unknown. The EFS folder is empty or corrupt.
Stumbling across your post I was interested in the fact that you seem to be an expert in re-balling. My son has since got a new phone and since I am a basic amateur in phone repair (for family and friends) I have been toying with the idea of replacing the eMMC chip on the s3 after watching this video:
http://www.youtube.com/watch?v=s38vQxXv0GE
I don't mind if I buy the chip and it doesn't work I am more intent on gaining the experience and going through the stages. Do you think this is a good idea and do you have any tips or things I can research on the topic?
Yiannos
---------- Post added at 07:30 AM ---------- Previous post was at 07:14 AM ----------
Sorry I meant this video:
http://www.youtube.com/watch?v=ds04BTVL8i0&feature=youtu.be

yiannos50 said:
Hi Ryan,
My son's galaxy s3 i9300 was inadvertently given a spin in the washing machine...
Click to expand...
Click to collapse
Hi,
If the imei is available (null), it could be the case that it needs repairing rather than actually chaging the eMMC chip , however you'll need a special tool to do this, which honestly do not know which exactly is as I'm more into hardware repairs rather than software.
Another possible issue could be that the phone can also have corrosion around critical components, ie around the main baseband supply, which is stopping from the baseband switch on, thus no signal or any radio communication from starting up. It would be best to have a microscope and inspect each part of the board for bad components, rather than rushing to the eMMC replacement.
It's very important to read this post very carefully and understand it as it is not easy to be done, but it is very much possible. And find a lot of youtube videos before even trying so you'll be more familiar with the process and different techniques.
Anyways for the most interesting part
Basically the eMMC chip is a 14 by 14 bga, ball grid array chip which is fairly easy to reball comapred to other complex ones, like baseband processor or the main application processor, You'll also be needing a reballing stencil to put the balls on top of the solder pins, and solder paste to paste the solder onto the holes and a hot air gun to melt that solder into balls. (Basically the solder paste will melt between those holes inside the stencil and will form nice silverish balls.
The chip also has got a lot of not connected pads (aka dummy pads) so do not worry when removing the chip as you'll be more then likely to lift pads from the board especially if this your first reball job.
First of all, you'll need to clean the surrounding glue around the chip by using around 200C and with a needle scrape off the glue, be very gentle not to scrape any tracks or board layers.
Then to remove the chip from the board use around 350C (always ramping up the temp), very important to use kapton tape around the surroundings to reduce heat stress. Personally I use the following temperatures: (do not use any nozzle with the heat gun as the chip is large and you need the heat to dispersed all over the chip)
1st min 180C full air
2nd min 280C full air
4th min 350C full air until the surrounding components turn silverish and are easy to lift, at that time get a very sharp needle and gently (very gently) start to pry up with ease the chip from one side, until it is fully lifted.
Then you'll need to clean the board, basically put flux and with a fine tip soldering iron clean the pads gently until all underfilled glue is no more remaining and the pads are nice and shiny and set the board aside.
If you'll buy a new eMMC chip most probably you'll have it reballed from the supplier. If not pre reballed, you ll need to reball it using a reballing stencil and solder paste.
Finally align back the eMMC chip over the board in the correct way, always note where is pin A1 and solder it back by ramping up heat again, same process as removing the chip.
The last process is all based on software, basically you'll have to copy the bootloader from a good working S3 phone to this one, as the new eMMC chip is empty of data, and obviously without the bootloader so the phone wouldn't be able to switch on.There is a process somewhere on the net how this is exactly done.
Ryan

Ryan,
Thanks a million for setting me on the right path. I'll let you know what happens.
Yiannos

Data recovery - Siemens A31
Hello everyone,
this thread seems to be what I've been looking for. My Siemens A31 got some water from a torrential rain while it was on. When I got to removing the battery, the phone was already off. I dried all accessible parts but I did not have the necessary torx screwdriver, so some water stayed inside. It was Friday evening and I got the screwdriver no earlier than on Monday. There was some corrosion in the phone, of course. It could not be turned on and subsequent cleaning with alcohol and even ultrasound improved only the look of the main board, but not its behavior. The only sign of life was that it seemingly recharged the battery while connected to the charger.
I have asked several repair services and people and I am quite confused whether it is possible to recover the data by soldering the memory chip into another A31, a functioning one of course. Last time, I asked a laptop service and I was told it is impossible, not just because of the difficulty of soldering a BGA chip. They told me it would not work because the phone would get blocked due to IMEI mismatch! This was surprising for me. If it is true, it implies that the IMEI is stored in both the flash memory and some other chip. I was unable to find any evidence for such a claim on the Internet.
Can anyone tell me if the target phone with replaced flash memory will actually work, assuming the memory is functioning? The video referred to by yiannos50 suggests it may really work. Anyone else has tried it? Two people in this discussion were about to do so.

RFC / Feeler: AOSP custom car radio

We are in the process of developing a *Mezzanine* board for 96boards CE SBCs. The purpose of this board is to implement the complete interface between the standardized SBC, and pretty much any car.
*Note: This is not a feature discussion thread, the features are set, the prototypes are built, painstakingly by hand over many hours.
The mezzanine board has the following (primary) features;
Quad-stereo ADC,
2 stereo DAC with programmable DSP (also has a header for up to 2 more DACs for up to 8 channel audio),
AMFM Radio,
OEM-style class AB automotive amplifier (4x52 watt @ 4 ohm, 4x85 watt @ 2 ohm),
ATSAMD21 microcontroller for SWI, fan control (fan is not mandatory), backlight control, etc.,
Physical interface to a conventional vehicle specific automotive pigtail.
This would be the additional component recommendation (and we are also considering a KIT):
1) 96boards CE SBC. We have a current working prototype using a Hikey960 (4xA73 + 4xA53, 4 GB), and are in the process of obtaining a Dragonboard 820C (2x Kryo big + 2x Kryo little, 3 GB). Note that some CE SBCs may not have full compatibility due to lacking the optional digital audio input pin. These two I've mentioned have *FULL* compatibility, and we are providing software support.
2) An HDMI monitor with USB touchscreen. There are tons of options for these, including ones packed in a DDIN chassis.
3) A USB GPS (you can get really good ones for as little as $10). Note that the dragonboard 820c has a built-in GPS, although I haven't tested its performance.
4) A pigtail (sometimes called a "wiring harness") for your specific vehicle.
** you can also add a USB HUB and any number of UVC cameras for dashcam and/or parking assistance.
96boards is a specification for SBCs developed by Linaro. Linaro is one of the big promoters and developers of Linux based operating systems, including Android/AOSP. So what you get with this, is the ability to build the complete operating system for your car radio **from source**. Hikey960's device repository is hosted by Google and is listed as an official "Reference Board". The Dragonboard 820C's device tree is in heavy development and is not quite ready to merge, but is available on Linaro's repositories, and from what I'm told, is functionally in a very good state.
In addition, since we are interfacing with SBCs having a standardized interface, when the boards we are currently working with become dated (as everything eventually does), you can easily replace the SBC with a new one that is completely up to date, while retaining the Mezzanine that actually interfaces with the car.
We have also developed additions to the Hikey960 kernel and Android device tree for supporting our mezzanine board and enabling the Automotive features of AOSP. And yes, our additions are all open source, which means that you can build it all yourself.
We have not yet set a price point for the board, but I can tell you that it will not come cheap. The component and manufacturing cost is quite extensive. Our objective, however, is to provide two things to make up for that, which you simply can't get anywhere else;
1) A "high end" experience that is significantly higher than the expensive mainstream car radios (kenwood, pioneer, etc.)
2) Full control over the software, including complete source code. No locks on the hardware. No or minimal blobs. The Hikey960 runs on a single blob for the Mali GPU. The Dragonboard 820C runs on NO blobs -- it uses the Freedreno graphics driver.
Features of our prototypes;
1) Navigation. Uses Google Maps / Waze or any other nav software.
2) Hands free calling.
3) AMFM Radio.
4) Bluetooth music.
5) Dashcam.
6) Its running AOSP 8.1 -- the sky is the limit.
Also worth mentioning:
*** Designed in Canada.
*** Made in Canada or USA. Depends on how the pricing works out.
So, who is interested? What would you pay?

No support for lvds for the LCD? That would eliminate needing an HDMI converter.
It's also seems off that as designers you did not ask for input from the one community who this is targeted to, XDA...the point is to dig into the market currently dominated by the poor quality ODMs of Chinese head units.
Pricing...if it works well $300 to $500for the mezz and hikey as a bundle??? The dragon board is not interesting....you can't even run android on that. The hikey960 and 970 is a better choice, especially the 970 once things get going since it has GPS!

gtxaspec said:
No support for lvds for the LCD? That would eliminate needing an HDMI converter.
It's also seems off that as designers you did not ask for input from the one community who this is targeted to, XDA...the point is to dig into the market currently dominated by the poor quality ODMs of Chinese head units.
Pricing...if it works well $300 to $500for the mezz and hikey as a bundle???
Click to expand...
Click to collapse
LVDS is really not a viable option, because every different display will require extensive work to support, as well as, in many cases, a custom physical interface. If the goal was a single fixed product in a black box, then I would consider LVDS.
As a developer, I built it because I enjoy working on it. If I can sell it, so much the better.

96carboard said:
LVDS is really not a viable option, because every different display will require extensive work to support, as well as, in many cases, a custom physical interface. If the goal was a single fixed product in a black box, then I would consider LVDS.
As a developer, I built it because I enjoy working on it. If I can sell it, so much the better.
Click to expand...
Click to collapse
Makes sense! Well, great work anyways. Are we going to see any pictures anytime soon??? I have some empty 2 din cases,and A hikey960 I would love to try this on

gtxaspec said:
Makes sense! Well, great work anyways. Are we going to see any pictures anytime soon??? I have some empty 2 din cases,and A hikey960 I would love to try this on
Click to expand...
Click to collapse
I should have my next batch of prototypes (bare circuit boards) late next week or early the week after. I can post pics of the bare board, but if you're asking for pics of an assembled prototype, I'd rather not post pics of the currently running one on account of it really *looking* like a prototype (there are a few "corrections" on it).
Maybe what I'll do, is take pictures of one as I'm assembling it. I'm sure that some people would find it fascinating.

96carboard said:
I should have my next batch of prototypes (bare circuit boards) late next week or early the week after. I can post pics of the bare board, but if you're asking for pics of an assembled prototype, I'd rather not post pics of the currently running one on account of it really *looking* like a prototype (there are a few "corrections" on it).
Maybe what I'll do, is take pictures of one as I'm assembling it. I'm sure that some people would find it fascinating.
Click to expand...
Click to collapse
Very cool! If you need someone to test, always willing! I currently work on some ROMs for the Chinese based unita, but an opensource aosp unit has always been the goal (*_*)

So. Ils possible use stock screen from golf mk7 facelift with your headunit?

I'm very interested. It's something that i'm looking for a while now and will be willing to pay high-end price for high-end performance.
But it also need to be high-end "experience"... Meaning it requires a good looking radio app, physical volume control etc.
I would be also interested the hear about the display option that you found and how "high-end" this could be in term of screen quality but also dash integration?
Anyway, the mezzanine itself would be a huge step forward and I will frequently follow the 96boards website to see when it will be available.
A huge thanks for all the work you already did!

ti-b said:
I'm very interested. It's something that i'm looking for a while now and will be willing to pay high-end price for high-end performance.
But it also need to be high-end "experience"... Meaning it requires a good looking radio app, physical volume control etc.
I would be also interested the hear about the display option that you found and how "high-end" this could be in term of screen quality but also dash integration?
Anyway, the mezzanine itself would be a huge step forward and I will frequently follow the 96boards website to see when it will be available.
A huge thanks for all the work you already did!
Click to expand...
Click to collapse
The radio application is the AOSP automotive radio application https://android.googlesource.com/platform/packages/apps/Car/Radio/. How it looks really is between you and google. The objective, as far as software is concerned, is to change as little as possible with respect to AOSP. As far as physical volume controls go, the buttons on your steering wheel will work, or any other buttons, knobs, switches, or whatever else you might want to hook up.

First Assembly photo
Since I've got the software into a pretty good state now for running the previous board revision, I've now begun assembling my "V1.0". This revision is "very close" to what I will be shipping.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
This board measures 123x78mm (under 5x3 inches).
U101 is a 3.3v very low dropout linear voltage regulator. It is used for powering all of the 3.3v components on the board, notably, the analog sides of all of the audio chips, which require a very clean and stable power supply, which is why its an LDO and not a buck.
Q101 is an N-FET, which controls the inhibit pin of the LDO. It takes input from either the microcontroller or the ignition signal. If they *both* switch off, then the LDO also switches off. D101 is a diode that prevents the microcontroller's output pin that drives Q101 from feeding to its input pin that reads the ignition signal.
U102,3,4 are optocouplers, used to read input signals from the car, which can vary within the range of 8-18 volts (though typically will be in the range of 11-15) and convert them into signals that are safe for the microcontroller and/or CPU. All three feed input pins to the CPU, U102 also feeds an input to the microcontroller.
The differences between this board and the final shipping board will be these;
1) There will be a 5th pin at J101, which will be connected to the "switched 12V output" of U203.
2) There will be two 3A diodes between the power input pins and J101.
** Together, these two changes will allow the board to be setup in a mode that allows the CPU and/or microcontroller to control power-off. J101 is a jumper block that allows the user to choose the mode of powering the system.
3) R203/204 are removed, since they are unnecessary.
4) The Anode of D701 is changed from 1.8v to 3.3v. This is to improve i2c performance of U701 (real time clock) and increase the charge on C701 (to increase the time the RTC can run for before the supercapacitor drains).
5) A zener diode is connected from the PWM pin of the fan plug to GND. This is to protect the microcontroller from excessive voltage that may be output by poor quality or incompatible fans. A good quality 5V PWM fan (like a Noctua) will pull the PWM pin up to no more than 3.3v. In fact, I checked with Noctua, and they pull it up to 2.5v. A low quality (cheap) fan may save a resistor by pulling it up to 5v, or a 12v fan could pull it up to anywhere between 3.3 and 12v. A 12v fan should not be used, but I'm sure that someone will plug one in anyway.

96carboard said:
Since I've got the software into a pretty good state now for running the previous board revision, I've now begun assembling my "V1.0". This revision is "very close" to what I will be shipping.
This board measures 123x78mm (under 5x3 inches).
U101 is a 3.3v very low dropout linear voltage regulator. It is used for powering all of the 3.3v components on the board, notably, the analog sides of all of the audio chips, which require a very clean and stable power supply, which is why its an LDO and not a buck.
Q101 is an N-FET, which controls the inhibit pin of the LDO. It takes input from either the microcontroller or the ignition signal. If they *both* switch off, then the LDO also switches off. D101 is a diode that prevents the microcontroller's output pin that drives Q101 from feeding to its input pin that reads the ignition signal.
U102,3,4 are optocouplers, used to read input signals from the car, which can vary within the range of 8-18 volts (though typically will be in the range of 11-15) and convert them into signals that are safe for the microcontroller and/or CPU. All three feed input pins to the CPU, U102 also feeds an input to the microcontroller.
The differences between this board and the final shipping board will be these;
1) There will be a 5th pin at J101, which will be connected to the "switched 12V output" of U203.
2) There will be two 3A diodes between the power input pins and J101.
** Together, these two changes will allow the board to be setup in a mode that allows the CPU and/or microcontroller to control power-off. J101 is a jumper block that allows the user to choose the mode of powering the system.
3) R203/204 are removed, since they are unnecessary.
4) The Anode of D701 is changed from 1.8v to 3.3v. This is to improve i2c performance of U701 (real time clock) and increase the charge on C701 (to increase the time the RTC can run for before the supercapacitor drains).
5) A zener diode is connected from the PWM pin of the fan plug to GND. This is to protect the microcontroller from excessive voltage that may be output by poor quality or incompatible fans. A good quality 5V PWM fan (like a Noctua) will pull the PWM pin up to no more than 3.3v. In fact, I checked with Noctua, and they pull it up to 2.5v. A low quality (cheap) fan may save a resistor by pulling it up to 5v, or a 12v fan could pull it up to anywhere between 3.3 and 12v. A 12v fan should not be used, but I'm sure that someone will plug one in anyway.
Click to expand...
Click to collapse
This looks exciting. Lot's of effort resulting in an Android system that is put together the way it should be. Many kudos.
If you are looking at making some changes you could save some cash by dropping the optocouplers. I know that it sounds like the craziest idea ever but I swear all you need to protect a MCU pin from the outside automotive world is a 220k resistor and a 100nF cap. Cap is on the side of the pin, resistor connects to the outside world. When I first started work at an automotive dev company I saw this arrangement and nearly fell off my seat. Turns out that almost every single MCU/CPU/device with an IO pin out there has a very simple protection cct on each pin which consists of two internal diodes per pin. Anode on the pin with cathode to VCC for the high side protection, anode on 0V and cathode on the pin for the low side protection. Some manufacturers just used a single zener with the anode on 0v and the cathode on the pin and this offered both high and low side protection. By putting the signal from the car through the 220k you technically are driving the pin such that the protection circuit is coming into play but the energy that you are driving into the circuit is SO low that the diode easily handles it and the VCC rail just sinks the tiny current elsewhere. The cap is there to protect against induced noise and very low energy but high voltage spikes that may appear on the input line. I was skeptical until I learned that this had been used on a high seller that was installed into over 3 million vehicles... After working there for 8 years I had designed it into every product I worked on and swore by it. Maybe give it a try. I swear it won't disappoint.
By far the largest killers of products that I found was overshoot caused by jump starting and installers making silly mistakes. Installers would often connect outputs directly to the items they were meant to drive instead of going through a relay first. Ever tried driving a horn with a FET? We ended up using some pretty neat protected FETs to solve this but they were costly. Another common installer error is incorrect polarity on the power lines or on the IGN/ACC line. Simply solved by putting diodes in series with the VCC and IGN/ACC inputs. The jump start issue was more tricky to solve. At first we were using a MOV based circuit to try and absorb the energy from the spike and it would often work but it was costly and too "soft" in the turn on conditions which led to it sometimes not working as desired. We eventually moved across to a solution which was dirt cheap but absolutely brilliant in how well it worked. It was just a BJT, a FET and a few passives around them. As soon as the input voltage exceeded a certain rate of change (early warnings of a large incoming spike) or a certain voltage then it would completely cut power to the rest of the board for the duration of the spike. In the end the only limit to the level of spike it could handle was the reverse voltage of the FET body diode. The circuit passed all OEM load dump tests and is operating in several hundred thousand cars today. The only downside to it was that your product would lose vehicle power during a load dump condition and need to rely on an internal battery to continue operating. Since jump starting or any load dump condition is very infrequent this was not much of a negative for our applications.

looxonline said:
This looks exciting. Lot's of effort resulting in an Android system that is put together the way it should be. Many kudos.
If you are looking at making some changes you could save some cash by dropping the optocouplers. I know that it sounds like the craziest idea ever but I swear all you need to protect a MCU pin from the outside automotive world is a 220k resistor and a 100nF cap. Cap is on the side of the pin, resistor connects to the outside world. When I first started work at an automotive dev company I saw this arrangement and nearly fell off my seat. Turns out that almost every single MCU/CPU/device with an IO pin out there has a very simple protection cct on each pin which consists of two internal diodes per pin. Anode on the pin with cathode to VCC for the high side protection, anode on 0V and cathode on the pin for the low side protection. Some manufacturers just used a single zener with the anode on 0v and the cathode on the pin and this offered both high and low side protection. By putting the signal from the car through the 220k you technically are driving the pin such that the protection circuit is coming into play but the energy that you are driving into the circuit is SO low that the diode easily handles it and the VCC rail just sinks the tiny current elsewhere. The cap is there to protect against induced noise and very low energy but high voltage spikes that may appear on the input line. I was skeptical until I learned that this had been used on a high seller that was installed into over 3 million vehicles... After working there for 8 years I had designed it into every product I worked on and swore by it. Maybe give it a try. I swear it won't disappoint.
By far the largest killers of products that I found was overshoot caused by jump starting and installers making silly mistakes. Installers would often connect outputs directly to the items they were meant to drive instead of going through a relay first. Ever tried driving a horn with a FET? We ended up using some pretty neat protected FETs to solve this but they were costly. Another common installer error is incorrect polarity on the power lines or on the IGN/ACC line. Simply solved by putting diodes in series with the VCC and IGN/ACC inputs. The jump start issue was more tricky to solve. At first we were using a MOV based circuit to try and absorb the energy from the spike and it would often work but it was costly and too "soft" in the turn on conditions which led to it sometimes not working as desired. We eventually moved across to a solution which was dirt cheap but absolutely brilliant in how well it worked. It was just a BJT, a FET and a few passives around them. As soon as the input voltage exceeded a certain rate of change (early warnings of a large incoming spike) or a certain voltage then it would completely cut power to the rest of the board for the duration of the spike. In the end the only limit to the level of spike it could handle was the reverse voltage of the FET body diode. The circuit passed all OEM load dump tests and is operating in several hundred thousand cars today. The only downside to it was that your product would lose vehicle power during a load dump condition and need to rely on an internal battery to continue operating. Since jump starting or any load dump condition is very infrequent this was not much of a negative for our applications.
Click to expand...
Click to collapse
It sound like you're describing the ESD diodes. Some might consider it slightly abusive to apply them in this manner, but I can definitely appreciate the application.
While I do know that the SAMD has this sort of arrangement on its input pins, I'm not sure whether this arrangement is present on the SoC or not -- my guess is probably NOT, and even if it is, I definitely can NOT trust that all 96boards SBCs will be equally protected. Only one of the optocouplers is even connected to the SAMD (the bottom one, IGN), all 3 optocouplers are connected to the SoC. If you will notice, there are two voltage dividers on the output of the bottom optocoupler -- R104/107 divides 5 volts down to 1.8 for the CPU, R113/114 divides 5 volts down to 3.3 for the microcontroller.

think widely
I suggest you to take a look at taho screen they don't replace the stereo they add a box that work as android with the oem stereo see youtube most of the new cars now a days comes with touch screen think widely take a look of the possibilities good luck
I will become a locale official vendor (if it has a affordable price and a excellent android support)

najaray said:
I suggest you to take a look at taho screen they don't replace the stereo they add a box that work as android with the oem stereo see youtube most of the new cars now a days comes with touch screen think widely take a look of the possibilities good luck
I will become a locale official vendor (if it has a affordable price and a excellent android support)
Click to expand...
Click to collapse
There would be nothing stopping you from using a built-in screen with this, as long as the built-in screen has an HDMI input -- which frankly, is quite unlikely, so I wouldn't get my hopes up.
In any case, that decision is outside of the scope of my project. The selection of display device would be up to whoever is installing it.

96carboard said:
There would be nothing stopping you from using a built-in screen with this, as long as the built-in screen has an HDMI input -- which frankly, is quite unlikely, so I wouldn't get my hopes up.
In any case, that decision is outside of the scope of my project. The selection of display device would be up to whoever is installing it.
Click to expand...
Click to collapse
I see it means that some of the customer like tahoe for example cannot use this product at all can you verify the cars that your targitting
can it run two screens at the same time like screen 1 for the stereo and a screen 2 for the car dashboard

najaray said:
I see it means that some of the customer like tahoe for example cannot use this product at all can you verify the cars that your targitting
Click to expand...
Click to collapse
I don't know what you mean by "tahoe" or "taho" as per your previous spelling, but it sounds to me like your questions are off topic. If you wish to continue this, please do so via PM.

looxonline said:
The jump start issue was more tricky to solve. At first we were using a MOV based circuit to try and absorb the energy from the spike and it would often work but it was costly and too "soft" in the turn on conditions which led to it sometimes not working as desired. We eventually moved across to a solution which was dirt cheap but absolutely brilliant in how well it worked. It was just a BJT, a FET and a few passives around them. As soon as the input voltage exceeded a certain rate of change (early warnings of a large incoming spike) or a certain voltage then it would completely cut power to the rest of the board for the duration of the spike. In the end the only limit to the level of spike it could handle was the reverse voltage of the FET body diode. The circuit passed all OEM load dump tests and is operating in several hundred thousand cars today. The only downside to it was that your product would lose vehicle power during a load dump condition and need to rely on an internal battery to continue operating. Since jump starting or any load dump condition is very infrequent this was not much of a negative for our applications.
Click to expand...
Click to collapse
Wouldn't all of these problems be solved with a TVS diode?
https://www.littelfuse.com/~/media/...utomotive_tvs_diodes_application_note.pdf.pdf

96carboard said:
Wouldn't all of these problems be solved with a TVS diode?
https://www.littelfuse.com/~/media/...utomotive_tvs_diodes_application_note.pdf.pdf
Click to expand...
Click to collapse
Yup, that's similar to the MOV solution. The problem with this type of solution is that it can create the clamp but it can't absorb all of the energy from the load dump (some, yes but not all). It therefore requires somewhere to dump the energy and that somewhere is in the resistance within the alternator and in the leads to the product. Our products could be installed in any location within the vehicle and in a huge variety of vehicles. Controlling the resistance between the alternator and the MOV (in our case) was impossible and this is one of the reasons why the MOV solution was abandoned. Another reason was cost. For a MOV that could handle the variation in conditions that our products were exposed to we had to go for a relatively high power variant. These could cost upwards of $2 which was insanity when you are talking about designing that into a circuit that is selling in excess of 60k units per month. The cut off circuit cost a fraction of that and so we ran with it

Fully operational:

NO SOUND COMING FROM THIS BOARD, HELP ME FIX THAT

Hello, has anyone got this motherboard?
It is hard to find a replacement, board is CHS-503DSP v2 (ALPSFF5000-8227L chipset), motherboard is working well, aswell as Android, but has no sound coming from it to speakers.
I can't get it to work.
Please reply if anyone has solution how to fix no sound issue.
When unit is in car, Android starts , all apps and radio turns on but when out to speakers I hear only buzzing sound and noise.
Thanks.
(upper board is motherboard with core board attached to it, lower is lcd screen board)
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

You could try to output sound via usb soundcard to an external amplifier instead of a new mainboard.

blue_one said:
You could try to output sound via usb soundcard to an external amplifier instead of a new mainboard.
Click to expand...
Click to collapse
I would like to fix the motherboard but thanks for suggestion

Anton TNT said:
I would like to fix the motherboard but thanks for suggestion
Click to expand...
Click to collapse
What do you expect to get from the forum?
If you want to fix that, you need to have the right tools to measure that like an oscilloscope, and the knowledge to read the board pin-out.
You can solder out the amplifier module and put in the same (or at least a similar with the same pin-out as the one which is installed.
If that helps... no one knows, because even something else can be the reason for this failure.
At least you should test with a single tone, may be 400khz, to measure the in- and output of the amplifier module.
Famous words: Take it to someone who knows how to measure the electronics, like a TV-electronic repair shop, if you find someone who is willing to repair that unit. I fear no one will do that, not even for cash money.
Best tip: Take it and throw it into the bin.

It could be a lot of things, including software.
I think that I'd check the obvious things first.
Get the pinout of the amplifier IC. Check power, shutdown signal, mute signal.
See if you can even see any audio on the input pins or whether you can inject any signal with just a probe and your body noise.

Renate said:
It could be a lot of things, including software.
I think that I'd check the obvious things first.
Get the pinout of the amplifier IC. Check power, shutdown signal, mute signal.
See if you can even see any audio on the input pins or whether you can inject any signal with just a probe and your body noise.
Click to expand...
Click to collapse
I've tried all options so far with voltage multimeter. Voltages, rerouting directly on pins on amp (that goes on speakers) etc.
Sound is coming out but only noise , I mean noise like volume is up to max and you can hear buzzing sound, when antenna unpluged from device sound is distorted a starts to crackle.
That are the simptoms.
If anyone can help with their knowledge besides going to service shop thanks, if not it will go in trash bin.
Only damage I can see is one transistor in a middle of board that has burned, but I have soldered it and connected again with board.
It is giving voltage out and working.
Software isn't issue here as 8227L chipset works with variety of updates (installed and proved).

Replace capacitor c122 and resistor r33.
(,just kidding).
Sounds like audio processing/switch is dead Jim, but not as we know it.
Experience and the ability to reverse engineer is the key skill required to resolve this issue.
@rigattoni gives the best advice here. No one has a crystal ball.
Good luck, but it is a very big long shot asking people here to figure this out for you

Anton TNT said:
Only damage I can see is one transistor in a middle of board that has burned...
Click to expand...
Click to collapse
Now wait a minute.
You never mentioned anything about a transistor being fried.
You didn't indicate it in the photo either.
Edit: Also, it's might not be a transistor, it could be a LDO.

Renate said:
Now wait a minute.
You never mentioned anything about a transistor being fried.
You didn't indicate it in the photo either.
Edit: Also, it's might not be a transistor, it could be a LDO.
Click to expand...
Click to collapse
What is LDO Jim? beam me up Scotty (clarify)

(Low DropOut) voltage regulator.
Anton TNT said:
What is LDO Jim?
Click to expand...
Click to collapse
(Low DropOut) voltage regulator.

Renate said:
(Low DropOut) voltage regulator.
(Low DropOut) voltage regulator.
Click to expand...
Click to collapse
And where is that on board , what shape and figure

Anton TNT said:
And where is that on board , what shape and figure
Click to expand...
Click to collapse
Why don't you tell me?
You said that a "transistor" burned. Was it a LDO?
Both look the same. Read the numbers off it. Show a good photo of it.

Renate said:
Why don't you tell me?
You said that a "transistor" burned. Was it a LDO?
Both look the same. Read the numbers off it. Show a good photo of it.
Click to expand...
Click to collapse
Here it is.. but I noticed this burned transistor or what ever it is called later...
It is on central side of motherboard close to output chip TDA (look at first picture of motherboard)
I soldered some wire on other not burned side (after that it gives some voltage out like 1-3 Volts) but same result no sound.
I ordered a same little transistor (three leg) , will try to solder that on place when arrive.
The rest Android and all other stuff works well , JUST NO SOUND coming from device, but funny thing when I attach a USB audio output , Android turns to Headset mode and music plays, but only music no FM tuner / radio app.
Trying also with flashing of memory, to get ROOT, and then to clear cache of device from root directory, but my PC with WIN 10 doesn't recognize device and with all DA COM / ADB drivers installed and step by step video online.

Anton TNT said:
I soldered some wire on other not burned side...
Click to expand...
Click to collapse
Doing arbitrary things in a deterministic universe rarely yields results.
Why do you believe that to be a transistor?
What transistor did you order? And why?
First thing, get some 91% isopropyl alcohol and some cotton swabs (ear cleaners).
Clean up that board so you can see something.
Find the part number of the 20 pin IC there. Get the data sheet.
With the unit off check for continuity between the gold pad on the little photo to any of the pins on that IC.

On top... To burn this part, there is always a reason why it burned. Only exchange this part may not fix the radio. You need to find the reason and fix that first.
Sorry, but reading your postings in here, I fear that you will not be able to fix that by yourself.

rigattoni said:
On top... To burn this part, there is always a reason why it burned. Only exchange this part may not fix the radio. You need to find the reason and fix that first.
Sorry, but reading your postings in here, I fear that you will not be able to fix that by yourself.
Click to expand...
Click to collapse
There is not much people arround to fix Android head units, so I'm asking help here , please understand me, as I have a little knwledge of android boards, PC yes , Android no !
If you are feeling helpfull help in any way but not in a terms of critisicm.
Thanks.
I will fix that in any way I can. That includes fixing with a help of electronic engineer or someone that knows what to do. As I mentioned only buzzing sound is coming from this board and when transferred thru USB DAC chip sounds go out so problem is some joint or this blown chip / transistor. We will see...
But I agree only on one, It is hard to do anything with no diagrams of this board.

Renate said:
Doing arbitrary things in a deterministic universe rarely yields results.
Why do you believe that to be a transistor?
What transistor did you order? And why?
First thing, get some 91% isopropyl alcohol and some cotton swabs (ear cleaners).
Clean up that board so you can see something.
Find the part number of the 20 pin IC there. Get the data sheet.
With the unit off check for continuity between the gold pad on the little photo to any of the pins on that IC.
Click to expand...
Click to collapse
I have done that , and cleaned it and then soldered a piece of tungsten soldering wire on gold plates when joints are.
I'm surprised , I tought that you saw upper picture with cleaned spot and soldered wire, but obvously you have not. If you can't see open as attachment and zoom in.

Anton TNT said:
I'm surprised , I thought that you saw upper picture with cleaned spot and soldered wire, but obvously you have not.
Click to expand...
Click to collapse
As far as I can see you have posted 2 attached photos.
In your original post you have the large photo with motherboard and LCD.
In post #13 you show the burned spot.
If the photo in your first post shows a cleaned burnt spot then you have neglected to mention that in your first post.
Long distance repair is difficult enough without somebody not bothering to relate important information.

Renate said:
As far as I can see you have posted 2 attached photos.
In your original post you have the large photo with motherboard and LCD.
In post #13 you show the burned spot.
If the photo in your first post shows a cleaned burnt spot then you have neglected to mention that in your first post.
Long distance repair is difficult enough without somebody not bothering to relate important information.
Click to expand...
Click to collapse
READ THIS LINE , I HAVE WROTE THIS BEFORE :
"Here it is.. but I noticed this burned transistor or what ever it is called later...
It is on central side of motherboard close to output chip TDA (look at first picture of motherboard)​I soldered some wire on other not burned side (after that it gives some voltage out like 1-3 Volts) but same result no sound."

No matter , let's continue, happy New Year to you all and best wishes...
Yesterday I had a glimpse of success regarding sound and amplifier.
Maybe can anyone explain this...
After installing POWERAMP EQ app from playstore a few seconds of music played on main speakers, I could hear this, but in a sudden it stopped.