Database Users

[HOW-TO]Set up a Captivate for Samsung Bootloader Development

OK, there's been quite a few unanswered questions on bootloader development.. I didn't want to clutter the Make your Own Bootloader thread with hardware stuff. I didn't want to clutter up the UnBrickable Mod thread with Bootloader development setup stuff. UnBrickable mod will be a one-stop shop thread for the Captivate eventually.
Introduction
This thread will get you started with bootloader development speciffic to the captivate, however the same techniques work on all GalaxyS devices with an adjustment to the RX/TX locations
We need to delve into the hardware, remove a resistor, attach a wire, and bring two wires outside of the phone. This is quite a bit more difficult then the typical UART over USB connection which we have used in the past. For bootloader development the UART Output described in this video will not work..
The external UART output with a 619Kohm jig between pins 4 and 5, monitoring 115200 8N1 serial output between pins 2 and 3 will not work because the USB hardware is initialised by the bootloaders. In order to test the bootloaders you are developing, you must go to a lower level.
Note:While the UART output in the video will not work for Bootloader development, itis absolutely unbeatable for Kernel level debug on nearly all Samsung devices.
Getting Started
You will need:
1. UnBrickable modded captivate (or other device)
2. A UART device (Android Acessory Development kit or Arduino Mega or a Bus Pirate or any other UART device)
3. A Soldering Iron
4. Flux
5. Solid core wire
6. A relay (For the wire contained within)
7. A Linux computer (get Ubuntu here and dual boot, or run in a virtual machine)
Instructions
1. Apply the UnBrickable Mod to your Samsung Captivate. See Here: http://forum.xda-developers.com/showthread.php?t=1206216
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
2. Next we need to connect a relay wire to the internal JTAG UART points. We cannot use the external UART via USB as we have seen in the past for writing bootloaders because the chip which handles switching for UART has not been initialized yet. We need to go directly to the source off of the processor. You can connect to the internal JTAG UART RX and TX lines here on the JTAG pads:
Using the JTAG header, you can connect to these points using this header: http://www.mouser.com/ProductDetail/Panasonic/AXT612124/?qs=2rFUEsTwVNwSdqVM5XnLHw==
and this Receptical: http://www.mouser.com/ProductDetail/Panasonic/AXT512124/?qs=2rFUEsTwVNy9TGVyeT43Dg==
They can be connected directly, or you can use a board from a guy named "K-WW" on the Hackaday.com forums
Here is a picture of my JTAG connector... This is optional and you will likely want to run wires directly for this project.
Alternately you can get these same points here, next to the processor:
3. Once you have the wires connected to the board, technically you're done and you can now connect up to your Android using your UART Device of choice. I decided to go the extra step and run those small wires to some solid core wire I bent and melted into the phone's case.
The further one is RX and the closer one is TX. Using this low point allows me to close up the device properly and I can still use my SDCard slot.
4. To do some debugging you can connect your Arduino at 8N1 using the same code from the video above...
Code:
void setup() {
// initialize both serial ports:
Serial.begin(115200);
Serial1.begin(115200);
}
void loop() {
// read from port 1, send to port 0:
if (Serial1.available()) {
int inByte = Serial1.read();
Serial.print(inByte, BYTE);
}
// read from port 0, send to port 1:
if (Serial.available()) {
int inByte = Serial.read();
Serial1.print(inByte, BYTE);
}
}
Or connect the Bus Pirate up to the device using the following options in a terminal:
Code:
HiZ>m
1. HiZ
2. 1-WIRE
3. UART
4. I2C
5. SPI
6. 2WIRE
7. 3WIRE
8. LCD
9. DIO
x. exit(without change)
(1)>3
Set serial port speed: (bps)
1. 300
2. 1200
3. 2400
4. 4800
5. 9600
6. 19200
7. 38400
8. 57600
9. 115200
10. BRG raw value
(1)>9
Data bits and parity:
1. 8, NONE *default
2. 8, EVEN
3. 8, ODD
4. 9, NONE
(1)>1
Stop bits:
1. 1 *default
2. 2
(1)>1
Receive polarity:
1. Idle 1 *default
2. Idle 0
(1)>1
Select output type:
1. Open drain (H=Hi-Z, L=GND)
2. Normal (H=3.3V, L=GND)
(1)>2
Ready
UART>
4. Next you need some firmware. There is firmware in the Captivate Development Platform thread, and there is some in the Create Your Own bootloaders thread You can create your own.
5. In order to debug the firmware it has to be uploaded. You can use the SMDK Download tool attached in this post. Uncompress to your desktop
6. To prepare the phone for debug, remove the battery, insert the battery attach USB and run the following program in a new terminal (not the one you are monitoring USB Output)
Upon plugging in the USB, you should see
Code:
�����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������
Uart negotiation Error
Then you execute this in a new window
Code:
sudo ~/Desktop/dltool/smdk-usbdl -f ~/Desktop/dltool/s5pc110_test/s5pc110_sbl_loader.bin -a D0020000
you will see this in the same window
Code:
SMDK42XX,S3C64XX USB Download Tool
Version 0.20 (c) 2004,2005,2006 Ben Dooks <[email protected]>
S3C64XX Detected!
=> found device: bus 002, dev 011
=> loaded 24576 bytes from /home/adam/Desktop/dltool/s5pc110_test/s5pc110_sbl_loader.bin
=> Downloading 24586 bytes to 0xd0020000
=> Data checksum ffb7
=> usb_bulk_write() returned 24586
[email protected]:~$
And upon upload of the primitive bootloader, you will see this in the UART window
Code:
Welcome to the S5PC110 resurrector by Rebellos!
Calling SGS IBL Stage2, pray so it wont hang...
DONE!
Testing if BL3 area is R/W
DONE!
Please prepare USB dltool with BL3 (SBL)
Starting downloader in...
9
8
7
6
5
4
3
2
1
0
7. Unplug the USB cable. As soon as the USB cable is removed all executing commands stop and the device awaits you to push the power on button.
Some notes:
PBL execution automatically occurs at 0xD002000 (this is with a 0x10 signature in front so the actual code begins at 0xD002010)
SBL is in DRAM at 0x40244000
Conclusion
So, there you have it. This is how to set up your Captivate to be a bootloader development kit. You don't have to develop a bootloader to load it up using this method.. You can simply stop at step 1 of this guide, UnBrickable mod, and be able to test results without UART output.
If anyone would like to give me one of the following devices' mainboard I will make a UnBrickable Mod/Development Platform for each device.
Samsung Devices: I9000 S8500, S8530, SGH-897, SGH-i896, SGH-i997, T959, SGH-T849, GT-P1000, GT-i9010, GT-i8350, GT-I917
Google Nexus S, Odroid T,
Apple iPhone4
Any new Samsung WP7
Further reading
Create your own bootloader: http://forum.xda-developers.com/showthread.php?t=1233273
The Captivate Development Platform: http://forum.xda-developers.com/showthread.php?t=1206216
Lets save some bricks: http://forum.xda-developers.com/showthread.php?t=1018862

Samsung Infuse (SGH-i997) Owners:
We've got it much easier when it comes to the JTAG header. As you can see in the picture below, the header is already attached to the PCB, and all we need is the connector board from "K-WW".
The large metallic thing on the left is the SIM card slot. The connector for the display (at the bottom of the picture) might be in the way. If it isn't we'll be able to connect to the JTAG and UART2 ports without doing any soldering or even disconnecting a single cable on the device.
We need someone to donate an Infuse to AdamOutler. He needs to remove the processor from the PCB to be able to find the xOM5 pad. This means destroying the phone, so it doesn't matter what the condition is. If it's bricked with a smashed screen and water damage, it doesn't matter! If you can help us with this, please speak up on this thead: http://forum.xda-developers.com/showthread.php?t=1221064

You don't NEED the board. The receptical itself with wires attached will attach to the header and you could close up the device with it attached. With the socket breakout board, the device would need to remain open. I would be searching for alternate UART points as well so the JTAG header would remain available.
Like I said.... I need device mainboards... they need not work. I'm not gaining anything directly from this except fruits of firmware development.... alternate OSs and open source bootloaders

Or, try to find 5 OM resistors while phone is being powered up.
3 should be 100.3kOhm resistance and connected to GND
2 should be ~10.1kOhm resistance and connected to VCC PDA (most likely exactly 2.8V, but 1.8V and similiar is also possible option)
These should be in row, or close to itselves. Then all whats left is guessing which one of the 3 is OM5. By some dangerous tests most likely, but with much smaller risk of damaging the board, comparing to complete CPU teardown.

aww dude, that's awesome....will try to do some of it on my cappy ; )

Rebellos said:
Or, try to find 5 OM resistors while phone is being powered up.
3 should be 100.3kOhm resistance and connected to GND
2 should be ~10.1kOhm resistance and connected to VCC PDA (most likely exactly 2.8V, but 1.8V and similiar is also possible option)
These should be in row, or close to itselves. Then all whats left is guessing which one of the 3 is OM5. By some dangerous tests most likely, but with much smaller risk of damaging the board, comparing to complete CPU teardown.
Click to expand...
Click to collapse
On my device, all resistors are 100.3kohm.

how to send the MB or how to fix my bricked phone GT-i8350

Adam,
I've been staring at this document, the picture of the infuse and the sgh-t959v pictures from ifixit for a while and finally got the gumption to try finding the internal uart. Big thanks for this picture:
AdamOutler said:
You can connect to the internal JTAG UART RX and TX lines here on the JTAG pads:
Click to expand...
Click to collapse
SGH-T959V Internal Uart thread.
Thanks again for all you do for the community!
-Bryan

3/4g internal modem.

I'm looking to start a thread about turning an a500 into a a501. I've done a teardown of the a500 and it has the capability of potentially being able to support an internal card. It has the space/slot and screw mounts.
Before I start ordering and soldering parts to the circuit board I'd like to get a few facts straight.
1. The firmware (kernel) between the a501 and a500 are the same? I've heard that it is, and that it isn't
2. Drivers- obviously drivers will need to written. No way of getting around that.
3. PCIe Riser extender - As you can see from these pictures, the plastic bracket is missing/not included. You can see on each side there is two holes for mounting the bracket. I'd recommend the extended below, as it will allow me the needed length between the two.
http://www.amazon.com/PCI-Express-Riser-Flexible-Cable/dp/B0054CIL46
The reason I'm picking this is because I can solder this
Here is the empty space:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Now here is the space with a pcie wlan card
You can see from the last picture that there is a space issue that needs to be addressed.
I would need to use riser with an extended back end inorder to align up this the screw mounts.
this picture is just of the screw mounts.
I've seen a few threads now about the idea of this , nothing really taking liftoff, so I thought I'd be the first to start.
Also, is there a command for listing hardware/chips in android , using android terminal emulator. Something like lspci (linux command)
**********************************************************
On to pcie 4g/3g cards.
Here is the 4g card I found:
http://www.ebay.com/itm/Intel-5150-...135?pt=LH_DefaultDomain_0&hash=item43a38d57f7
I'd rather have one with the major cellular provides, but I can't seem to find any. Clear has a basic 200mb (holy hell) for $20. Not bad for 4g coverage.
3g Card
http://www.ebay.com/itm/Inspiron-15...118?pt=LH_DefaultDomain_0&hash=item5645ae677e
This one is cheap, and from verizon.
$30 /2gb plan from verizon.
-------------------------------------------------------------------------
Let me know what you think. If you have anything to add please feel free to let me know

Make a video when you got it running.

Johnny0906 said:
Make a video when you got it running.
Click to expand...
Click to collapse
Still learning basic programming.I've taken a programming fundamentals and half of programming structures. Teacher was Indian and had us read from a book. If someone wouldbwrite the driver I would jump into it

wow .. really interesting ..
now u know what would be even better ?
to have this module external.
to be able to connect it to the a500.
anyway ..
sure hope u get something..

fxandrei said:
wow .. really interesting ..
now u know what would be even better ?
to have this module external.
to be able to connect it to the a500.
anyway ..
sure hope u get something..
Click to expand...
Click to collapse
I agree!! Your average XDA user is open minded when it comes to flashing roms, kernels and different types of software mods but they aren't that open minded to cracking their device open and screwing around with things internally. A usb type of module would be great!! I KNOW you're properly thinking like "WOW, do you want it to clean your house too" BUT T'll put my wallet where my mouth is and will donate 75 dollars if you can get this thing working via usb or provide some sort of brick-proof way of doing this.
I'm really excited to the idea of possibly having 4G on this tablet!!
Good Luck!!
Sent from inside my house using XDA Premium

It looks like its missing one of these..
Mouser is a great source for parts like this. It will involve soldering a connector and possibly writing a driver.
Once you find out the parts requirement, any electronics repair shop can handle it.
http://www.mouser.com/Interconnects/Memory-Card-Connectors/_/N-72bz7/
I can't help anymore then this, I don't own one of these devices. However, kernel=drivers. You've got two issues. Kernel support and Hardware. Once you've got the physical connection done, search for some linux devices which uses similar hardware and grab the kernel modules built for your kernel. If you're lucky, you can just insmod them into the device. If you're not lucky, you'll need to build from source.

Would a kernel dump or source from an A501 do the trick? I don't have one, just throwing around ideas...

A little background: I'm an electronic engineer with some experience of teardown work.
I agree with Adam that you need a socket rather than trying to solder a flexy on.
Do you have any teardown information on the A501, or would someone with an A501 be willing to get photographs. I think the key hardware things to find out are 1) what socket is used for the card and 2) what card is used.
If you get a 3g card with the same chipset on, then wouldn't it be as simple as hacking in A501 firmware for the driver?

I-S said:
A little background: I'm an electronic engineer with some experience of teardown work.
I agree with Adam that you need a socket rather than trying to solder a flexy on.
Do you have any teardown information on the A501, or would someone with an A501 be willing to get photographs. I think the key hardware things to find out are 1) what socket is used for the card and 2) what card is used.
If you get a 3g card with the same chipset on, then wouldn't it be as simple as hacking in A501 firmware for the driver?
Click to expand...
Click to collapse
That one itself would be the ideal. But that makes sense.

The story doesn't end at installing the card mount, but also needs other components to work. Instead you can tear down a 2 port USB hub, tear down your 3G modem and Stick it in an empty place do some soldering so that the end result should be as follows........
1. The socket which generates USB inside the case, should be fed to the USB hub,
2. One output of the hub should go to the USB dongle we earlier ripped out
3. The other output of the hub should be the cable that extends to the outside USB port.. after all we need this USB also for external USB for attaching keyboards, flash drives etc..
I hope I gave a unique idea here

You need to see a real 3g version to know if other thing missing like transistor on board neer pci card, or usb its more sure
Look for version 3g before investigate pciMe 3g and pciMe connector also sim connector of course
---------- Post added at 11:26 AM ---------- Previous post was at 11:20 AM ----------
superhotluv said:
The story doesn't end at installing the card mount, but also needs other components to work. Instead you can tear down a 2 port USB hub, tear down your 3G modem and Stick it in an empty place do some soldering so that the end result should be as follows........
1. The socket which generates USB inside the case, should be fed to the USB hub,
2. One output of the hub should go to the USB dongle we earlier ripped out
3. The other output of the hub should be the cable that extends to the outside USB port.. after all we need this USB also for external USB for attaching keyboards, flash drives etc..
I hope I gave a unique idea here
Click to expand...
Click to collapse
Yes this one what i do it cause you can found mini usb 3g and open it to integrated on board

This was attempted once before and was proven that the boards of the A500 and A501 have differences! Somewhere here in the forum was a thread and there were diagrams and photos of the tho devices! There are many missing components on the A500 that will have to be mounted and it will surely be cheaper (better working) to sell the A500 and get an A501 if you so much desire 3G!

superhotluv said:
The story doesn't end at installing the card mount, but also needs other components to work. Instead you can tear down a 2 port USB hub, tear down your 3G modem and Stick it in an empty place do some soldering so that the end result should be as follows........
1. The socket which generates USB inside the case, should be fed to the USB hub,
2. One output of the hub should go to the USB dongle we earlier ripped out
3. The other output of the hub should be the cable that extends to the outside USB port.. after all we need this USB also for external USB for attaching keyboards, flash drives etc..
I hope I gave a unique idea here
Click to expand...
Click to collapse
It is nice idea, but you should know that the hub as well as the dongle need power. If the USB output on the device itself is not giving enough power for both of them then it will not work or not work reliably.
Of course the battery will also be drained much faster as all the power saving measures do not affect the hub and the dongle.
And as for the pci connector: maybe you could compare the A500 with the A501 model and see if there are other parts missing. Usually not only the connector is left out but also some other parts on the board itself. So it may be much more soldering and work as you originally though of.

well that's depressing to know. that brscket in the fifth post was what I'm looking for.
can someone post a link to that thread with the pictures if the two teardowns?

BlackICE said:
It is nice idea, but you should know that the hub as well as the dongle need power. If the USB output on the device itself is not giving enough power for both of them then it will not work or not work reliably.
Of course the battery will also be drained much faster as all the power saving measures do not affect the hub and the dongle.
And as for the pci connector: maybe you could compare the A500 with the A501 model and see if there are other parts missing. Usually not only the connector is left out but also some other parts on the board itself. So it may be much more soldering and work as you originally though of.
Click to expand...
Click to collapse
Goood you understood what I meant with. Definitely the USB out port of the Tablet can handle both. you should buy a two port low power hub and try on
I also did the analysis of power usage, and found that the power used by the hub is really miniscule, and can be used with ease. You must appreciate that the Max power is drawn by the screen rather than the other hardware components, and inevitably the power consumption will increase once you add a 3G module in the tablet, as in A501. So the total power consumption is well within the limits.
I did the practical experiment of leaving the data ON on the tablet, overnight, and I find no extra power usage than without, in the sleep mode.
The only challenge in both the cases is that you have to change the Rom. Either the stock 501 Rom or one of the marvellous custom Roms. I am personally using Virtuous Galaxy 1.0.5 , with an overclock and code for 3G modem, that works seamless.
Once I do this activity I would post a video , or at least a set of pictures.

Sorry i dont know much about these devices but I am not sure what usb has to do with it??? looks like a mini pci e slot to me... (correct me if i am wrong) it cant harm to try soldering the points together.. swap the kernel from the 501 over as long as its got the same build and you have r/w to the system partition and see what happens...

anarchyuk said:
Sorry i dont know much about these devices but I am not sure what usb has to do with it??? looks like a mini pci e slot to me... (correct me if i am wrong) it cant harm to try soldering the points together.. swap the kernel from the 501 over as long as its got the same build and you have r/w to the system partition and see what happens...
Click to expand...
Click to collapse
Did you read all posts? I don't think so.
it does not harm to solder a socket there but it will not work as there are for sure other components for that pcie slot missing.
As for the USB solution read the earlier posts as this is a solution, which would work.

Another type of wimax card for clear is the one inside their Rover puck wifi point. no one talks about it or i have seen a picture online but i got one that just works fine, its a half size pci-e mini card so you would have more space to move it around and the antennas come with it, just find one with broken usb port and open it to get the card.
As for driver info i will post with pic of card, it uses the same driver as their clear 4g stick,(grey and black color)

I know it's a bit 'off topic', but.. Since the Iconia has this 'slot', do you think it would be possible with the xoom too??
Check this out: http://guide-images.ifixit.net/igi/5oVhXNLhi3U1AZRy.huge
Step 8 from iFixit --> At first glance, this appears to be a Wi-Fi board, but wait: there are no chips on it! It appears to be just a mini-PCI interconnect board for the antennas. This board is probably just a place holder for when the 4G upgrade becomes available.
Back on topic:
The Iconia A501 has the Qualcomm MDM6600 chip on one of it's boards or it's just a modem? I ask that because by seeing the Xoom 3G teardown we find the said chip. It seems that the chip is missing on the Xoom WiFi according to some here: http://www.ifixit.com/Answers/View/45910/Wifi+Only+Xoom+upgradable+to+4G+LTE
So, if you are missing some key parts of the system, I don't think it would be possible to just add a modem to the list of bills to make it 3G/4G unless it's just a software lock?

Uhuhu said:
I know it's a bit 'off topic', but.. Since the Iconia has this 'slot', do you think it would be possible with the xoom too??
Check this out: http://guide-images.ifixit.net/igi/5oVhXNLhi3U1AZRy.huge
Step 8 from iFixit --> At first glance, this appears to be a Wi-Fi board, but wait: there are no chips on it! It appears to be just a mini-PCI interconnect board for the antennas. This board is probably just a place holder for when the 4G upgrade becomes available.
Back on topic:
The Iconia A501 has the Qualcomm MDM6600 chip on one of it's boards or it's just a modem? I ask that because by seeing the Xoom 3G teardown we find the said chip. It seems that the chip is missing on the Xoom WiFi according to some here: http://www.ifixit.com/Answers/View/45910/Wifi+Only+Xoom+upgradable+to+4G+LTE
So, if you are missing some key parts of the system, I don't think it would be possible to just add a modem to the list of bills to make it 3G/4G unless it's just a software lock?
Click to expand...
Click to collapse
Maybe there is the empty space on other tablets with the same chipset too
http://pdadb.net/index.php?m=pdamaster&posted=1&cpu=a2250nvt
So you can (if it works) pimp every moto or acer tab to 4g

Thinking of performing a hardware mod for USB hosted microsd/bluetooth(Kindle Fire)

Ok, so i'm ordering a replacement digitizer and I figure this would be a good time to try this out.
As you all know, we Kindle Fire owners have neither expandable storage or bluetooth. Hashcode's new 3.0 kernel has the proper kernel modules/support for USB hosting. Instead of having to plug things in every time I need/want extra storage I figure that i'll try and hook up the stuff inside.
So here's what I figure i'll do when I get all the materials:
I already have a mini bluetooth USB dongle that i've disassembled.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
And i'll be getting a mini USB microsd adapter that I can tear apart down to the same type of thing as the bluetooth dongle.
Now, the easy part is finding space to put them, there are a few gaps/spaces that I found for the bluetooth dongle, and placing the microsd adapter should be just as easy.
The hard part is getting the wiring all wired up on the inside, and this is where I need advice/input. Trying to solder the wires to the pins on the charge/USB port would be too hard and risky since they're so close.
I took apart a mini-b USB cable to use the pins to try and hook them up like that some way, but I don't have everything I need yet, so it's just a thought.
Ideas, advice, thoughts and/or comments?
Also, I will be documenting what i'm doing so that I can post a tutorial if I succeed.
I've also posted this in the Kindle Fire general forums. http://forum.xda-developers.com/showthread.php?p=25212300

Main problem with the SD adapter is that many USB SD readers behave badly if you insert the SD when the adapter is live - you need to insert the SD THEN plug the reader into a PC.

Entropy512 said:
Main problem with the SD adapter is that many USB SD readers behave badly if you insert the SD when the adapter is live - you need to insert the SD THEN plug the reader into a PC.
Click to expand...
Click to collapse
Hmmm, thanks for bringing that up, I didn't think of that. I'll have to see about putting a small switch in somewhere if I run into that issue.

Have you looked for another USB pinout on the board?
There might be one, if you can post an hi-res picture of the PCB I can try to find something useful

AraKs said:
Have you looked for another USB pinout on the board?
There might be one, if you can post an hi-res picture of the PCB I can try to find something useful
Click to expand...
Click to collapse
I was going to try and do that myself, but I couldn't find anything. Right now I ended up scraping off some of the black plastic around the pins at the point that they're going up and i'm trying to solder them alternating the top and bottom.
If you can find other places though that would be great. It might help me out, and it would def help others out if I succeed and write a tutorial.
Here are some hi-res shots from ifixit, unfortunately my real camera has a broken lens at the moment.
http://guide-images.ifixit.net/igi/BWbx2gTOKoo2SInC.huge
http://guide-images.ifixit.net/igi/SejZs5a65UTRcAYv.huge

There's something I don't understand here; won't doing this render the USB port unusable? Don't you need a hub if connecting more than one USB device? Can the USB port provide enough power for these additional devices?
Sent from my SGH-I777 using Tapatalk 2

scidon37 said:
There's something I don't understand here; won't doing this render the USB port unusable? Don't you need a hub if connecting more than one USB device? Can the USB port provide enough power for these additional devices?
Sent from my SGH-I777 using Tapatalk 2
Click to expand...
Click to collapse
You need the USB hub for power from what I understand. The microsd adapter doesn't require any power and i'm not sure how much the bluetooth takes, but since the other takes none it might work out. If they don't work together then it doesn't really matter to me cause I don't need bluetooth.
Also, about it making the USB port unusable, yes and no. If you look at this pinout diagram here http://www.kineteka.com/microusb-b.aspx you'll see that there are 5 pins. On a USB cable only 4 are used. On a USB otg cable pins 4 and 5 ar econnected telling the device that it's a host and not a slave. When pins 4 and 5 are connected are connected USB will not work at all(So no adb or file transfers, etc.) because the cable is being told it's a host device. Once those two wires are separated then USB will work again because it will see itself as a slave device.

I searched info trought the TI OMAP 4430 documentation about the USB implementation.
(i have to "hide" the link or i won't be able to post!)
Here you can find a block diagram of a reference USB implementation:
h_t_t_p://w!w!w.ti.com/pdfs /wtbu/OMAP4430_ES2.x_DM_Public_Book_V_D .pdf
Section
A.4.4.2 USBA0 PHY Implementation Example
Also, Section
2.1 Terminal Assignments
Shows the pinout of the processor
Table
Table 2-1. Ball Characteristics
Shows the chip connections
The document lists also USB0, USB1 and USB2 but i can only see ball pinouts for "usba0_*" and anything like "usba1_*" or "usba2_*".
So i think that there's only one USB connection and you'll have to solder a USB HUB somewhere between the CPU and the USB connector.

AraKs said:
I searched info trought the TI OMAP 4430 documentation about the USB implementation.
(i have to "hide" the link or i won't be able to post!)
Here you can find a block diagram of a reference USB implementation:
h_t_t_p://w!w!w.ti.com/pdfs /wtbu/OMAP4430_ES2.x_DM_Public_Book_V_D .pdf
Section
A.4.4.2 USBA0 PHY Implementation Example
Also, Section
2.1 Terminal Assignments
Shows the pinout of the processor
Table
Table 2-1. Ball Characteristics
Shows the chip connections
The document lists also USB0, USB1 and USB2 but i can only see ball pinouts for "usba0_*" and anything like "usba1_*" or "usba2_*".
So i think that there's only one USB connection and you'll have to solder a USB HUB somewhere between the CPU and the USB connector.
Click to expand...
Click to collapse
Thanks for the help, but how am I going to solder directly to the processor?
And if I could get the correct pins anyways there would be no need to use USB I could just hook the microsd up directly since the 4430 already has those.
If there was a data sheet somewhere out there for this specific board something like what you're suggesting might be possible, but it's not really the way it is now.
And i've never used USB host capabilities before, but from the videos i've watched people on other devices don't use a hub unless they hook up more than one device.

I see. You are right!
Anyway, i came up with another solution for the bluetooth connectivity: it requires a bit of soldering and a couple of kernel modules (or a custom-built kernel).
You can solder some wires from the serial port of the kindle fire:
http://forum.xda-developers.com/showthread.php?t=1525439
to a UART bluetooth module:
h_ttp://w_w.tdvdesign(dot)com/BluetoothModule/
Then write a script the brings up the bluetooth interface at boot.
In Linux should be feasible, in Android i don't know... maybe there's a praticular framework that needs specific drivers...
---------- Post added at 04:53 PM ---------- Previous post was at 04:23 PM ----------
Enable kernel bluetooth+UART HCI:
ht_tp://docs.blackfin.uclinux(dot)org/doku.php?id=bluetooth_over_uart

AraKs said:
I see. You are right!
Anyway, i came up with another solution for the bluetooth connectivity: it requires a bit of soldering and a couple of kernel modules (or a custom-built kernel).
You can solder some wires from the serial port of the kindle fire:
http://forum.xda-developers.com/showthread.php?t=1525439
to a UART bluetooth module:
h_ttp://w_w.tdvdesign(dot)com/BluetoothModule/
Then write a script the brings up the bluetooth interface at boot.
In Linux should be feasible, in Android i don't know... maybe there's a praticular framework that needs specific drivers...
---------- Post added at 04:53 PM ---------- Previous post was at 04:23 PM ----------
Enable kernel bluetooth+UART HCI:
ht_tp://docs.blackfin.uclinux(dot)org/doku.php?id=bluetooth_over_uart
Click to expand...
Click to collapse
**Disregard**This could help with bluetooth if I can't get USB host to work, but that still leaves no solution for the sdcard, which is my primary concern. I've actually gotten all the wires soldered onto the correct pins on the usb port, but I can't get USB host to work for any device, with or without the correct modules.**Disregard**
You got me thinking though, I could probably add a UART sdcard and GPS module on like that. Awesomeness, thanks for the idea. I'll try that out if I can't get USB host to work.

aaricchavez said:
You got me thinking though, I could probably add a UART sdcard and GPS module on like that. Awesomeness, thanks for the idea. I'll try that out if I can't get USB host to work.
Click to expand...
Click to collapse
I've also seen a lot of hardware mods that connected sdcards to gpio lines. That could be an option too.
For the sdcard over UART it's possible, but i'm concerned about the performances...
At 115200bps baud rate you get 14.0625KBps!!!

AraKs said:
I've also seen a lot of hardware mods that connected sdcards to gpio lines. That could be an option too.
For the sdcard over UART it's possible, but i'm concerned about the performances...
At 115200bps baud rate you get 14.0625KBps!!!
Click to expand...
Click to collapse
True, true. You seem to have more experience then I do at this. I'll prob buy a GPS UART module and do that. I have the wires soldered onto the USB pins on my Kindle, but I haven't had time to do anything more then that yet.

Thank you
A GPS module will be very useful.
A 7" tab it's portable enough to be carried around and used with a simple car mount...
I'll look for the needed kernel modules asap
Sent from my Nexus S using XDA

This is interesting:
ht__tp://wiki_openpilot_org/plugins/viewsource/viewpagesrc.action?pageId=950326

BUMP

webstas said:
BUMP
Click to expand...
Click to collapse
I'm just waiting for some stuff I need that I ordered offa ebay. The digitizer should be here tomorrow and the other stuff some time this week. I'll update when I get the stuff and start working on it again.

I don't really understand why using the usb-port should be a Problem. Just solder your what-ever-you-want-device to the original usb pinout, it's big enough. Solder a rly small switch (taken from an old mobile Phone for example) between pin 4 and 5 to change host and normal mode. Finally, if u need more power there of course is a battery inside the Kindle, get it from there
I'll receive my Kindle in a few days i hope (u can't buy it regularly in germany...), will play a bit with this stuff

Deehee3 said:
I don't really understand why using the usb-port should be a Problem. Just solder your what-ever-you-want-device to the original usb pinout, it's big enough. Solder a rly small switch (taken from an old mobile Phone for example) between pin 4 and 5 to change host and normal mode. Finally, if u need more power there of course is a battery inside the Kindle, get it from there
I'll receive my Kindle in a few days i hope (u can't buy it regularly in germany...), will play a bit with this stuff
Click to expand...
Click to collapse
I've already got the wires soldered to the pins, I just wasn't able to get USB host working. And there's no room for a switch right on the pins, but I thought of a good solution. Reed switches!
Other thread was created here, just want to keep all the threads up to date: http://forum.xda-developers.com/showthread.php?t=1632277
aaricchavez said:
The UART modules are only an idea, the main problem with going that direction instead of USB host is the drivers the modules would need(They all usually come with generic ones, but they would need to be customized for Android). I have very limited code/coding knowledge so I would need alot of help or soeone to do that part completely. I was going to pm Hashcode for help if I decided to try out the UART modules. Also, i'm unsure if more than one module can be used at the same time.
Like I just posted in the thread i'm still waiting on some stuff to arrive to actually get started on the USB host attempt. I have the wires soldered to the USB/Charge port pins, but since I don't have the microsd adapter or any more spare cords to rip apart I can't go further. I ordered about 10 different mini microsd adapters to take apart and see which works out the best.
Other people have USB host working, so shouldn't be difficult. I've just never used USB host before so i'm not real sure of what to expect.
The only downside is that there needs to be a switch of some sort somewhere to disable USB host so that adb/storage will work. I'm trying to think of something a little more elegant that having a huge hole in the case with a switch protruding out of the side. I'm going to go searching for some solutions and a super small switch.
All the UART GPS modules I found when searching "uart gps module" on Google are mostly from India and are between $30-50ish, the receivers look to be about the size of a quarter.
*http://robokits.co.in/shop/index.php?main_page=product_info&products_id=289
*http://robosapiensindia.com/robomar...n=com_virtuemart&Itemid=64&vmcchk=1&Itemid=64
*http://robosapiensindia.com/robosap...ategory_id=27&option=com_virtuemart&Itemid=64
I decided to look on Sparkfun and adafruit and i'm glad I did, it looks like they both have some modules, but I haven't looked around and dug through them yet.
*http://www.sparkfun.com/categories/4
*http://www.adafruit.com/category/35_58
All the optimism aside i'm not all too sure that we could get the GPS UART module to work. From what I see (First picture: http://forum.xda-developers.com/showthread.php?t=1471813) the UART output that Hashcode put into use only has two GNDs a TX and RX. The modules that I found all look like they need 8 connections. Adafruit has a nice pic of the connections labeled here: http://www.adafruit.com/products/746
If you're talking about microsd UART modules, as mentioned in the thread I created, someone made the point that it wouldn't make much sense because speeds would be way too low.
Click to expand...
Click to collapse
aaricchavez said:
I hate to double post, but I found the perfect solution for the switch. A reed switch or two plus a small magnet will work wonders
http://www.sparkfun.com/products/8642
Edit: Here are the switches that I am buying, they're the cheapest spdt reed switches I could find: http://www.newark.com/hamlin/mdrr-dt-15-20-f/switch-reed-spdt-co-1-5a-175vdc/dp/24C6463
This will allow USB host to be activated constantly and then deactivated easily with a neodymium magnet to use adb, USB storage and whatnot.
I'm pleased that I found such an elegant solution, no need to mess up the housing to put in a switch
Click to expand...
Click to collapse

Just curious about the status of your progress.....

Asus T100 hardware tear down

Since I can't post anywhere else for some reason, here goes my hardware tear down for the Asus T100 (T100TA for experts ):
Visible chips on the T100TA mainboard Rev 2.0:
Amtel MXT1664TXES-C2U 1330B TW QLG9F (Touchscreen controls)
Broadcom BCM43241SFKFFBG TN1322 P24 294688 P3T (WiFi)
Phison PS2251-68-5 UO1329C D75J0.11AA (USB3.0 controller)
Realtek ALC5642 D2L87HI GD13F (Audio)
Winbond 250(Q)64FW1G 1329 6236 QP30003 (BIOS/UEFI)
Intel Q326A657 SR1M5 02962 '12 (the main cpu Z3740)
M F20 P02 CFQ0589 (No idea)
ITE IT8568VG 1331-AXO ZC0P1A (No idea)
SANDISK 9.15 XC4*00 SanDisk32G (The eMMC storage unit, 32GB version)
Camera module:
HannStar J 94V-0 E89382 1335 MV-4
Unnused connector J601 can be found on the camera module. Seems to be an USB connector.
Pictures of the hardware/inside: [NOT ALLOWED]
Got the hi-res versions stored locally, can't find a good place that doesn't rape the resolution / jpeg compression rate. Now, I was thinking the Winbond chip is most likely the PLL, isn't it? Should open the doors for some FSB tweaking. Another thing I couldn't find was the recovery USB storage... 7GB according to the hardware manager of Windows 8.1 . Unfortunately it uses 'current read-only state: true' which makes it impossible to use it as extra storage (try it with diskpart for yourselves).
Also, for other Dutch users, this is my main Dutch thread on Tweakers: [NOT ALLOWED].
If people can help out with identifying the chips / giving additional information it would be greatly appreciated

thanks for the teardown...
un-hidden links:
http://gathering.tweakers.net/forum/list_messages/1567250/2
http://imgur.com/a/u6Uni
wouldn't mind rehosting the higher-quality image links .. feel free to PM to me
KoeWaffle said:
Amtel MXT1664TXES-C2U 1330B TW QLG9F <- touchscreen controller
Broadcom BCM43241SFKFFBG TN1322 P24 294688 P3T (WiFi) <- mounted via SDIO, is linux-kernel supported
Phison PS2251-68-5 UO1329C D75J0.11AA (No idea) <- USB 3.0 to flash microcontroller... probably for eMMC
Realtek ALC5642 D2L87HI GD13F (Audio)
Winbond 250(Q)64FW1G 1329 6236 QP30003 (PLL?)
Intel Q326A657 SR1M5 02962 '12 (the main cpu Z3740)
M F20 P02 CFQ0589 (No idea)
ITE IT8568VG 1331-AXO ZC0P1A (No idea)
SANDISK 9.15 XC4*00 SanDisk32G (The eMMC storage unit, 32GB version)
Camera module:
HannStar J 94V-0 E89382 1335 MV-4 <- think it's a Sony IMX 175 senor. need to check. maybe a Aptina mt9m114 instead
Unnused connector J601 can be found on the camera module. Seems to be an USB connector.
Click to expand...
Click to collapse
cm3218x capella micro light sensor
unused connector would be nice. I have a small microSDXC USB reader, looking through your pics to see if there's any space to fit it there
would like to see the battery model number. C12N1320 ?

paperWastage said:
would like to see the battery model number. C12N1320 ?
Click to expand...
Click to collapse
C12N1320 Yes, or CL12NL320, but I am pretty sure they would use "L" instead of "l" then. As you probably have seen, it has two batteries connected to each other. How exactly I don't know, didn't want to remove the black cover sticker. :silly:

KoeWaffle said:
C12N1320 Yes, or CL12NL320, but I am pretty sure they would use "L" instead of "l" then. As you probably have seen, it has two batteries connected to each other. How exactly I don't know, didn't want to remove the black cover sticker. :silly:
Click to expand...
Click to collapse
thanks for the info
how did you take apart the tablet? guitar pick around the screen? do I see some free space on the bottom right corner?
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

Is the RAM socketed or is it non-removable as my only issue is the 2Gb (1.89Gb usable) RAM available.

Starfury said:
Is the RAM socketed or is it non-removable as my only issue is the 2Gb (1.89Gb usable) RAM available.
Click to expand...
Click to collapse
Take a look at the pics, there's no sockets.

paperWastage said:
How did you take apart the tablet? guitar pick around the screen? do I see some free space on the bottom right corner?
Click to expand...
Click to collapse
I used some tools that were leftovers of my HTC Leo / HD2 days. Pretty much a guitar pick, but it might be a little thinner. I recommend starting on top, it goes the easiest loose there. The screen side is hooked to the backside, so best to pull the backplate a little outwards when removing, it will snap the hooks loose. For the dock, I will upload hires pictures soon of its contents, I did pull it apart before but my phone doesn't make great photos: imgur dot com slash a slash NQdTb http://imgur.com/a/NQdTb

SANDISK parts
Hi, I would like to know the appropriate part no. of Sandisk 32G. Could you pls see and let me know it ?
I may help you to identify of the specification in detail.
Thanks, Ricky:laugh:

Ricky0817 said:
Hi, I would like to know the appropriate part no. of Sandisk 32G. Could you pls see and let me know it ?
I may help you to identify of the specification in detail.
Thanks, Ricky:laugh:
Click to expand...
Click to collapse
I'd like to know this too if anyone knows. Is it soldered into the board or is it a microSD?

Its a Sandisk SEM64G or 32G if you have the 32gb. Just reflashed mine from the stock bios to 220 and now everything is working great and no more bsod while using adobe flash or gaming in d3d. Thanks for those pictures they have saved me the hassle of looking to see if a ram upgrade to 4gb is possible and its not. No matter around october 2014 there should be something better to trade up to with hopefully 4gb and 128gb ssd minimum.

gallahad2000 said:
Take a look at the pics, there's no sockets.
Click to expand...
Click to collapse
Pretty sure the t100 uses the version of the processor which is limited to 2GB of RAM

KoeWaffle said:
. Another thing I couldn't find was the recovery USB storage... 7GB according to the hardware manager of Windows 8.1 . Unfortunately it uses 'current read-only state: true' which makes it impossible to use it as extra storage
If people can help out with identifying the chips / giving additional information it would be greatly appreciated
Click to expand...
Click to collapse
Thank you very much for your information.I think that recovery USB storage is located here (marked on the attached picture). Can you please make the pictures of this area and connector J601 with higher resolution
Phison PS2251-68-5 is a controller usb 2.0 is used in flash drives. i think it is a controller for recovery USB storage

KoeWaffle said:
I used some tools that were leftovers of my HTC Leo / HD2 days. Pretty much a guitar pick, but it might be a little thinner. I recommend starting on top, it goes the easiest loose there. The screen side is hooked to the backside, so best to pull the backplate a little outwards when removing, it will snap the hooks loose. For the dock, I will upload hires pictures soon of its contents, I did pull it apart before but my phone doesn't make great photos: imgur dot com slash a slash NQdTb http://imgur.com/a/NQdTb
Click to expand...
Click to collapse
It seems there is a non USA model of this T100TA that has a 500GB hard drive inside the dock. Would a mod be possible for the USA version?

snoozii said:
It seems there is a non USA model of this T100TA that has a 500GB hard drive inside the dock. Would a mod be possible for the USA version?
Click to expand...
Click to collapse
I think so. They could have soldered it to the board though... I haven't seen a teardown of a 500GB model, would love to see what is inside too! Maybe it can even help us Europeans to mod ours to have the same capabilities :good:.

Anyone know where the WiFi antenna is?
I'm really impressed with how well this tablet hold on to my WiFi signal across the road. I have a Yagi and a panel antenna beaming through tree branches, a balcony and a brick wall. Despite all this it doesn't seem to struggle to hold on any worse than my laptop did which had two antenna. You would think this low power chip would perform much much worse.
Even speed wise considering this doesn't have MIMO so the link speed is down from 150Mbit to 64Mbit, real-world speed is not as much of a reduction as I thought it might be when I realised it didn't do MIMO.
I have even seen this thing get 20Mbit across the road where my laptop used to peak around 30Mbit, although on average I get nearer 5Mbit now whereas the laptop did 10-20Mbit more frequently.
I did try an external mini USB adapter on the T100, didn't work any better even though THAT was linked at 150Mbit and the built-in only does 64MBit.
As for the HDD model, I read on another forum that its definitely in the keyboard and a different board to the normal one. Its interesting though, makes you wonder if it uses a hub or are there actually spare connectors on the dock?
What I personally would like is a dock adapter you can use while still in tablet mode that just adds the USB 3.0 port. If we are REALLY lucky maybe someone will trace the dock connector?

Any hint of a connector for the HD in the dock?
Thanks for the teardown info. As far as I've found these are the only ones on the web so far.
Its hard for me to see from the pictures. Did you see any hint of what/where the HD would connect in the dock?
Thanks,
Eric

sarman_1998 said:
Thanks for the teardown info. As far as I've found these are the only ones on the web so far.
Its hard for me to see from the pictures. Did you see any hint of what/where the HD would connect in the dock?
Thanks,
Eric
Click to expand...
Click to collapse
The HDD dock keyboard has a different PCB to the normal keyboard. Below is the normal one taken from http://www.transformerforums.com/forum/asus-transformer-book-t100/39507-inside-t100-base.html:
What I'm curious about is if the whole dock runs off a single USB 3.0 port or does the dock connector have several ports?
It would seem unlikely that its run off a hub as many USB 3.0 devices have issues if not run directly from a native port and I notice my USB 3.0 HDD works fine.

Alex Atkin UK said:
The HDD dock keyboard has a different PCB to the normal keyboard. Below is the normal one taken from http://www.transformerforums.com/forum/asus-transformer-book-t100/39507-inside-t100-base.html:
...
What I'm curious about is if the whole dock runs off a single USB 3.0 port or does the dock connector have several ports?
It would seem unlikely that its run off a hub as many USB 3.0 devices have issues if not run directly from a native port and I notice my USB 3.0 HDD works fine.
Click to expand...
Click to collapse
I took a look on mine and windows doesn’t show any USB 3 hub between my USB 3 thumb drive and the Root Hub, so I’d say there isn’t a hub there. I also did a little digging to make sure there wasn’t an embedded hub in there which might show up differently. I looked at the xHCI extended capability values and the host controller is advertising 6 USB 2 ports and 1 USB 3 port. That makes me even more curious what protocol will be used to connect to the HD in the dock. Hope it’s not USB 2.0.
If you go into windows device manager, go to the view menu and change it to "view by connection" you can then browse the device tree in a hierarchical way that will show you what is connected to what.
In Windows 8/8.1, if you find your external HD in device manager BEFORE you switch to “View by Connection” then when you switch the tree will automatically expand to show it. Under the xHCI controller there will always be a Root Hub listed. If you HD shows connected directly to that then there is no hub.
What chips are on the pcb in the dock?
Eric

sarman_1998 said:
What chips are on the pcb in the dock?
Eric
Click to expand...
Click to collapse
I will ask the guy on the Transformer forum who took the photos as I don't want to take mine apart.

Is the wifi card a mini pcie? Or a different interface I may want to upgrade mine.

[GUIDE] Samsung Galaxy S7 UART

It is happened that I needed to obtain UART access on Galaxy S7. I tried Google search, apparently. I have found several threads on XDA dedicated to this question; however, they all are a bit outdated (2012-2013 years), containing information about an old loader.
Moreover, they are describing information in a very limited way, mostly telling the reader only about how to use UART with loader and do not going deeper into details.
Finally, despired to find any valuable piece of information, I performed my own research and here I will structure all the information I gathered and discovered.
To begin with, there is an USB multiplexing unit between USB-connector and USB-controller, aimed to measure the value of resistance between ID and GND, and setup a USB controller mode in dependance of that. That is not a new thing: the same way works, for instance, USB OTG.
But there exist other work modes which are hidden from the normal user. These work modes are utilized by a special device which is used by Samsung engineers. One can order a device like this on Ebay, but I do not se any reason for. Source codes of the mobile phone kernel are available for download and include a multiplexing unit driver.
The S7's MUIC name is MAX77854, which comes with lack of documentation, but we have a driver, which, obviously, has source codes which are available here: drivers/muic/max77854-muic.c. Going through the sources, I found an actual table of the resistance values and work modes for this device:
OTG =*GND
MHL = 1K
VZW_ACC = 28.7K
VZW_INCOMPATIBLE = 34K
RDU_TA = 40.2K
HMT = 49.9K
AUDIODOCK = 64.9K
USB_LANHUB = 80.07K
CHARGING_CABLE = 102K
GAMEPAD = 121K
TYPE1_CHG = 200K
JIG_USB_OFF = 255K
JIG_USB_ON = 301K
DESKDOCK = 365K
TYPE2_CHG = 442K
JIG_UART_OFF = 523K
JIG_UART_ON = 619K
TA = OPEN
USB = OPEN
CDP = OPEN
UNDEFINED_CHARGING =*UNDEFINED
ATTACHED_DEV_NUM = NUM
I have no idea what the listed most modes mean, but I see one very interesting mode JIG_UART_ON, which has been researched a bit and which allowes us to connect a device through USB-UART adapter and get a SBOOT boot log. I was inspired by an article about SBOOT where a guy researched the possibility of hijacking the boot loader and discovered a way how to change boot parameters including kernel boot parameters.
First of all, we need to build a JIG(UART) adapter. For that purpose we need to have any USB-UART adapter (I used FT232) and resistance unit for 619kOm (I have purchased one for 620kOm in the shop next to my house). Then we need to get them together as on the scheme:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
The newly created adapter we need to plug in to the computer and wait for a new device name (on my system it set as /dev/ttyUSB0), then connect to this device through a terminal application (I used minicom).
Code:
sudo minicom -D /dev/ttyUSB0
I am not sure what settings will you have for your terminal application, that's why I highly recommend you to set up your port settings and disable the hardware flow control setting. After all things done, you have to plug a mobile phone to this adapter and turn it on using the key combo: Vol-(Volume Down) + Power.
As symbols on the screen start displaying, you need to quickly press Enter key as minimum as 3 times until we see the command line. Congratulations! We are in the SBOOT console! Run the following command:
Code:
setenv CMDLINE console=ttySAC4,115200 loglevel=4
saveenv
After its execution complete, press and hold Vol-(Volume Down) (if the above mentioned key has not been pressed, SBOOT will not print anything in the console) and enter the command into the SBOOT console:
Code:
reset
The device will reboot and we will see a SBOOT boot log and a part of kernel boot log. Why only a part? Because as of my research, a small bug is located in the kernel sources, I give you a patch for it below:
Code:
diff --git a/drivers/muic/universal/muic_apis.c b/drivers/muic/universal/muic_apis.c
index 342bc51..5af193c 100755
--- a/drivers/muic/universal/muic_apis.c
+++ b/drivers/muic/universal/muic_apis.c
@@ -796,7 +796,7 @@ int detach_jig_uart_boot_off(muic_data_t *pmuic)
*/
int attach_jig_uart_boot_on(muic_data_t *pmuic, muic_attached_dev_t new_dev)
{
- int com_index = COM_OPEN;
+ int com_index = COM_UART_AP;
int ret = 0;
pr_info("%s:%s JIG UART BOOT-ON(0x%x)\n",
After it has been applied, we will be able to see all the kernel boot log; however, we will break the GSM component of the mobile device. This UART port is used be system to communicate with a GSM modem. At this stage we can use it for kernel debugging, but it wasn't our goal.
Now let's get mobile device console access through UART, using the information received above.
To achieve this, we have to install TWRP on our device and using it, get root access. Then we have to install busibox, which includes getty application and that is the only its difference from the original. Afterwards, we boot our device, install a terminal emulator and switch the device to the airplane mode.
Now start the emulator and enter the following commands:
Code:
su
echo 1 > /sys/devices/virtual/sec/switch/uart_en
echo AP > /sys/devices/virtual/sec/switch/uart_sel #на этом этапе должен появиться лог ядра
su root -c "getty -n -L -l /system/bin/sh 115200 ttySAC4 vt102"
Useful links:
xda old forum thread
SBOOT hacking

and you connected the 3.3v line -why- exactly? the samsung won't power your max232 (if it does, like with usb otg, it will supply 5v, not 3.3 or usb converter and 3.3v won't power the samsung. just txd rxd and gnd is enough. also the 301ohm one always turns on the phone and boots to factory 'odin' mode for mass deployment of new firmware. (normal usb tho). when using them with the rs232 resistor value they'll output some crap at 115k2 during the bootloader.

cb3rob said:
and you connected the 3.3v line -why- exactly? the samsung won't power your max232 (if it does, like with usb otg, it will supply 5v, not 3.3 or usb converter and 3.3v won't power the samsung. just txd rxd and gnd is enough. also the 301ohm one always turns on the phone and boots to factory 'odin' mode for mass deployment of new firmware. (normal usb tho). when using them with the rs232 resistor value they'll output some crap at 115k2 during the bootloader.
Click to expand...
Click to collapse
I connected 3.3v because it normal to connect this line and it works. Probably without this line it will work. Everything that I write was tested by me. If you see crap during bootloader check minicom config.

lSDriim said:
I connected 3.3v because it normal to connect this line and it works, ft232 won't power Samsung because it's not working like that. Everything that I write was tested by me. If you see crap during bootloader check minicom config.
Click to expand...
Click to collapse
connecting a 3.3v line to a 5v line (regardless of which way the power goes) doesn't seem very practical for long time use. at least for 'factory odin' mode the phone can be powered from the 5v usb side during the firmware deployment (as usually the batteries aren't all too full when we pull them out of the box anyway
nah not crap as in frame errors and random bytes crap. crap as in some status messages but nothing useful. could not find any way to stop it and drop into a machine language monitor, get any type of prompt, inject code to be booted, or anything else that would be useful from there. it literally just seems to be some debug messages of the bootloader(s)
1650 pages of leaked "samsung confidential" datasheet but finding how to actually -use- the things for anything 'not android' (as in registers, memory map instruction set)? nah. it's more work to figure out how samsung screwed things up and get rid of all their 'monopoly' code which they try to pass off as 'security' than to just design a new phone and order it into production
anyway, the age of the post of the resistor values doesn't matter. the values are the same for every samsung device i've tried (we only use s7's but i got boxes full of other models, including very old ones. the resistor cables work exactly the same way all of those - although the 'magic bytes' for samsungs 'modified' simg format are different for each model, as are obviously the partition sizes. and really old ones seem to use a different and incompatible version of the odin protocol alltogether). haven't tried it with those usb-c connectors on those j5/a5 or whatever those things are called, as i don't have usb-c male pcb connectors in stock, but most likely there too. it's also not very picky on the actual resistor value. 300 ohm instead of 301 is fine. as long as it's 'close enough' it'll go to the desired mode. (as their specified values are weird, you can't buy 301 ohm resistors (pretty much all of them do uart mode and turn on+odin factory mode)

cb3rob said:
connecting a 3.3v line to a 5v line (regardless of which way the power goes) doesn't seem very practical for long time use. at least for 'factory odin' mode the phone can be powered from the 5v usb side during the firmware deployment (as usually the batteries aren't all too full when we pull them out of the box anyway
nah not crap as in frame errors and random bytes crap. crap as in some status messages but nothing useful. could not find any way to stop it and drop into a machine language monitor, get any type of prompt, inject code to be booted, or anything else that would be useful from there. it literally just seems to be some debug messages of the bootloader(s)
1650 pages of leaked "samsung confidential" datasheet but finding how to actually -use- the things for anything 'not android' (as in registers, memory map instruction set)? nah. it's more work to figure out how samsung screwed things up and get rid of all their 'monopoly' code which they try to pass off as 'security' than to just design a new phone and order it into production
anyway, the age of the post of the resistor values doesn't matter. the values are the same for every samsung device i've tried (we only use s7's but i got boxes full of other models, including very old ones. the resistor cables work exactly the same way all of those - although the 'magic bytes' for samsungs 'modified' simg format are different for each model, as are obviously the partition sizes. and really old ones seem to use a different and incompatible version of the odin protocol alltogether). haven't tried it with those usb-c connectors on those j5/a5 or whatever those things are called, as i don't have usb-c male pcb connectors in stock, but most likely there too. it's also not very picky on the actual resistor value. 300 ohm instead of 301 is fine. as long as it's 'close enough' it'll go to the desired mode. (as their specified values are weird, you can't buy 301 ohm resistors (pretty much all of them do uart mode and turn on+odin factory mode)
Click to expand...
Click to collapse
I write from my phone, because I am on vacation now and can't write long messages(too lazy now). But in this guide I write how to get bootloader prompt and change kernel start command and you can change kernel and boot anything you want... I already do this to boot up normal linux. In links there are link to guy that tried to hack sboot, may be he can help you.