Database Users

FM Radio - Another approach

In my Captivate I noticed a kernel module with name Si4709_driver.ko
Si4709 is a FM radio receiver www .silabs. com /products/audiovideo/fmreceivers/Pages/Si470809.aspx (sorry, I can't post URL)
By default it is not loaded, but when I tried to load it, it did. Now we need to know what API is used for user mode programs.
It would also help if those who put i9000 ROM into Captivate (but have stock kernel) tried load module and then run FM radio app.
# cd /lib
# ls
modules
# cd modules
# ls
dpram.ko
rfs_glue.ko
j4fs.ko
multipdp.ko
param.ko
vibrator.ko
Si4709_driver.ko
dhd.ko
rfs_fat.ko
stgloc
s3c_bc.ko
pvrsrvkm.ko
scsi_wait_scan.ko
fsr.ko
drop_caches.ko
fsr_stl.ko
s3c_lcd.ko
# insmod /lib/modules/Si4709_driver.ko
# lsmod
Si4709_driver 15744 0 - Live 0xbf195000
vibrator 6744 2 - Live 0xbf191000
s3c_bc 2880 0 - Live 0xbf18b000
s3c_lcd 5060 0 - Live 0xbf184000
pvrsrvkm 205996 48 s3c_bc,s3c_lcd, Live 0xbf14c000
multipdp 30968 1 - Live 0xbf13f000
dpram 194152 10 multipdp, Live 0xbf10a000
param 10132 0 - Live 0xbf105000 (P)
j4fs 65604 1 - Live 0xbf0ef000 (P)
rfs_fat 235456 5 - Live 0xbf0b0000 (P)
rfs_glue 74328 1 rfs_fat, Live 0xbf098000 (P)
fsr_stl 248012 6 j4fs, Live 0xbf056000 (P)
fsr 328428 3 dpram,fsr_stl, Live 0xbf000000 (P)
#

Nice find. This may turn into something.

With the module loaded the FM radio app no longer has the error 'Unable to turn on FM radio." However, the FM app has no sound and cannot seek for channels.

dalingrin said:
With the module loaded the FM radio app no longer has the error 'Unable to turn on FM radio." However, the FM app has no sound and cannot seek for channels.
Click to expand...
Click to collapse
Looks like the hardware may be there after all, you were using the headphones right? If so then maybe the antenna isn't wired to the headset port.

Another note: Its is possible that hardware is not there. I found another tool that seems to test FM Radio
# ./si4709_test -h
How to control FM Radio (Si4709) .........
================================================================
Usage: ./si4709_test [controls] [value]
-p power, up|down si4709 power control
-s search, up|down|auto seek channel
-rstate, show si4709 radio state
-rssi, show si4709 rssi status
-r, on|off RDS/RBDS Enable/Disable
-rds, show Show RDS/RBDS data
e.g) si4709_test -p (up/down)
================================================================
# ./si4709_test -p up
# ./si4709_test -rstate
[FM RADIO] Radio State
================================================================
Power State = 0
Seek State = 0
================================================================
I tried to do the same on my wife's I9000 and it reported "Power State = 1"
So we may be out of luck with Captivate.

Not judging anyone but why worry about an FM radio when we have apps that do it all, about 4 of my local stations are on iheartradio and another 20 are from immediate areas around me.
When I used FM on my Nokia it was a battery drain more so than 3G.

I tied to run test with headphones connected. Attempt to power up device results in reboot.
Below is kernel log related to loading driver and connecting headphones:
<7>[ 197.626426] device: 'fmradio': device_add
<7>[ 197.628218] PM: Adding info for No Bus:fmradio
<7>[ 197.635228] bus: 'i2c': add driver Si4709_driver
<7>[ 197.665086] i2c-adapter i2c-8: NAK from device addr 0x10 msg #0
<6>[ 204.231953] [ JACK_DRIVER (jack_type_detect_change,404) ] 3 pole headset or TV-out attatched : adc = 46
I also noticed that after I load driver, I see device file called /dev/fmradio. It disappers when I unload driver. It looks like /dev/fmradio is a control device for radio chip (i found string /dev/fmradio inside si4709_test tool).

oh noes! I want the fm radio function.

for_ap1 said:
I tied to run test with headphones connected. Attempt to power up device results in reboot.
Below is kernel log related to loading driver and connecting headphones:
<7>[ 197.626426] device: 'fmradio': device_add
<7>[ 197.628218] PM: Adding info for No Bus:fmradio
<7>[ 197.635228] bus: 'i2c': add driver Si4709_driver
<7>[ 197.665086] i2c-adapter i2c-8: NAK from device addr 0x10 msg #0
<6>[ 204.231953] [ JACK_DRIVER (jack_type_detect_change,404) ] 3 pole headset or TV-out attatched : adc = 46
I also noticed that after I load driver, I see device file called /dev/fmradio. It disappers when I unload driver. It looks like /dev/fmradio is a control device for radio chip (i found string /dev/fmradio inside si4709_test tool).
Click to expand...
Click to collapse
Any way to compare pics of the Captivate mainboard with a Galaxy S? In the general Captivate forum there are pics of the board. Compare chip numbers and see if there are any unmatching chips.
zerosource said:
oh noes! I want the fm radio function.
Click to expand...
Click to collapse
lol I can see the use for it in a natural disaster, during Katrina the radio was all we really had but all the good channels were on the AM side.

decepticon said:
Any way to compare pics of the Captivate mainboard with a Galaxy S? In the general Captivate forum there are pics of the board. Compare chip numbers and see if there are any unmatching chips.
Click to expand...
Click to collapse
I looked at these photos and also at photos from FCC site, but resolution is too low to read chip markings. FM chip is very small in size, so it is really hard to find it.
It seems that receiver talks via I2S bus and also needs few GPIO lines to work. If I understand correctly, I2S bus has no explicit acknowledgment, so driver might not now that device is not present on the bus. I couldn't find detailed application notes for the chip, just brief description is available. I need to look at driver sources to understand how it works. Hopefully Samsung releases it.

Will Samsung or AT&T tell us if there is an FM chip in there or not?

cesierra said:
Will Samsung or AT&T tell us if there is an FM chip in there or not?
Click to expand...
Click to collapse
Maybe a brave soul, will tear the phone apart and finally give us a straight answer
wont be me though

In the source code for the captivate, there's is a folder called fm_si4709 containing many files pertaining to that radio. Perhaps someone astute w/ kernel stuff could work the magic and enable the HW if it is there...

Well, I looked at sources of the driver (i9000 and I897 are the same). It does not do anything with hardware on driver init. So successfully loaded driver does not mean that hardware is present. I need to find a way to compile driver with debug mode on. Another option will be to build a tool that probes I2C bus (i2cdump and i2cdetect) from shell.

Ok, I was able to build modules using Samsung sources and toolchain from Sourcery. I do not know if I can use it with stock kernel though. Will try to play with it, if I have spare time on weekend.

I just built the kernel using the sourcery toolchain: http://www.codesourcery.com/sgpp/lite/arm/portal/release1033
I enabled the debug flag for the FM radio driver (uncomment #define Si4709_DEBUG in kernel/modules/fm_si4709/Si4709_common.h)
I did an insmod of the compiled module (Si4709_driver.ko). Note the last few lines from dmesg (i2c_read failed & Si4709_dev_init failed) . Doesn't look promising.
<2>[277139.763458] --------Si4709_driver_init called
<7>[277139.766871] device: 'fmradio': device_add
<7>[277139.768313] PM: Adding info for No Bus:fmradio
<2>[277139.774798] --------Si4709_driver_init request_irq success 192
<2>[277139.779520] --------Si4709 i2c driver Si4709_i2c_driver_init called
<7>[277139.785779] bus: 'i2c': add driver Si4709_driver
<4>[277139.799406] ----- si4709_i2c_probe 94
<7>[277139.801782] device: '8-0010': device_add
<7>[277139.801979] bus: 'i2c': add device 8-0010
<7>[277139.802269] PM: Adding info for i2c:8-0010
<7>[277139.802442] driver: '8-0010': driver_bound: bound to device 'Si4709_driver'
<2>[277139.802555] --------Si4709 i2c driver Si4709_probe called
<2>[277139.807314] --------Si4709_dev_init called
<7>[277139.847935] i2c-adapter i2c-8: NAK from device addr 0x10 msg #0
<2>[277139.848866] --------i2c_read failed
<2>[277139.851148] --------Si4709_dev_init call over
<2>[277139.855568] --------Si4709_dev_init failed
<2>[277139.859757] --------Si4709_driver_init successful

Damn that sucks :-(. Wish we knew what the chip looked like so we could just see if its on the phone.

why would they put the drivers in, if there is no chip? This is just a hope.

I was think the same thing. I don't know much about kernel building but I would imagine if I was the guy at Samsung making it I wouldn't add sh!t that was useless

They didn't add a potentially useless driver, they just didn't remove it. Big difference

[Q] audio out via USB?

Wondering if this is possible with android builds on our HD2? I've read that CM9 allows it on some phones. Want to bypass internal amp circuitry for better sound quality. So from HD2 USB -> portable amp -> IEM's. Thanks!

quick bump

Ok so found out after reading around that ICS was supposed to enable true line out (bypassing the internal DAC) but the standard usb audio driver doesn't appear to be in the kernel.
Vote here: http://code.google.com/p/android/is...rs&colspec=ID Type Status Owner Summary Stars
and if it gets implemented let's ask tytung nicely to put it in his kernel

I would like to use it in an audiophile system.
pollenised said:
Ok so found out after reading around that ICS was supposed to enable true line out (bypassing the internal DAC) but the standard usb audio driver doesn't appear to be in the kernel.
Vote here: http://code.google.com/p/android/is...rs&colspec=ID Type Status Owner Summary Stars
and if it gets implemented let's ask tytung nicely to put it in his kernel
Click to expand...
Click to collapse
If it will bypassing the internal DAC we will need the external DAC with usb in, to convert 001011001010110 into high fidelity music.
Big SD card full of flacks and we will be able to use our hd2 with hi-end dedicated audio systems instead of usb out of noisy computers or laptops.

pollenised said:
Ok so found out after reading around that ICS was supposed to enable true line out (bypassing the internal DAC) but the standard usb audio driver doesn't appear to be in the kernel.
Vote here: http://code.google.com/p/android/is...rs&colspec=ID Type Status Owner Summary Stars
and if it gets implemented let's ask tytung nicely to put it in his kernel
Click to expand...
Click to collapse
This^
Bumping for momentum

The Samsung Anyway Jig

The Samsung Anyway Jig
Summary: Some information and pictures of the mysterious Samsung Anyway Jig
Skill Level: Medium
==================================================
Do NOT post questions/requests on how to obtain one, they
will not be answered. (Because I have no idea, since its
Samsung proprietary test equipment!)
Do NOT post links to commercial jigs, unless you also post
the internal schematics, in such a way that it can be easily
constructed at home.
If you already have a working home-made multifunction jig
that you would like to share, please remember:
- a picture of the device
- a picture of the schematics
- a detailed parts list
- the phone/models it applies to
- any other relevant features to make it work
==================================================
Purpose
As custom ROM flashing become more and more popular, the XDA-forums are
continuously bombarded with questions and answers on how to debrick their
devices, often using (what used to be) professional hardware analysis and
debugging equipment, like vendor provided JTAG, JIG and software flashing
tools. These tools used to be only available to certified technical repair and
support centers, closely connected with the various phone vendors. However,
this scenario is rapidly changing as more people are getting higher technical
skills, while using these devices and tools on their phones.
One particular such device, provided by Samsung, has been used for years to
program, customize, repair, debug and unbrick essentially all available
Samsung phones. This blue box is called the "Samsung Anyway Jig", and somehow
Samsung has managed to hide it from public scrutiny and analysis, which have
elevated this device to an almost mythical status. At least for the common
person wishing to repair or modify his phone. Probably because Samsung have
realized that there is a great profit to be made, by having their customer
sending their phones in for repair, rather than letting them in on the simple
secret on how to do this kind of repairs themselves. This behavior have also
been a great joy for the few professional service centers that actually have
access to this device (or similar devices) or who were able to figure out how
it works, making it into a million dollar industry, and obviously without
sharing their knowledge to the public.
Thanks to great community oriented websites and forums like XDA and others,
the public awareness have increased to such a level, that today anyone (with
minimal soldering skills) can build a multifunction and debricking JIG. And
because of the increasingly better standardization among mobile phone
manufacturers, very few modifications are needed for this device to be working
with essentially any modern mobile-phone on the market.
This thread is an attempt to better understand the Samsung Anyway Jig, such
that one can build his/her own Jig, with the information contained herein,
together with many other publicly available documents. It shall be noted that
I do not have access to this device, and I have neither factual data, nor
info, on how this thing actually works. But I do have a very good idea!
Close inspection, of the only 3 (!) images found, as obtained by Google Image
Search (which I am growing increasingly unhappy with), provide a good start
for what is going on in that device.
The Anyway Versions
The Anyway Jig come in slightly different versions. And since I only have access
to 4 pictures, I cannot tell what other versions are available. However, I
noticed the following:
Code:
[SIZE=2]Version PartNumber Variation/Note
-------------------------------------------------------------------------------
S100 Doesn't have "EMP" Solution
S101 GH99-36900A Has "EMP" solution. Is used with GT-S7230 (Bada OS)
S102[/SIZE][SIZE=2] GH99-36900B [/SIZE][SIZE=2]1.2A High-Current version for Tabs & Tablets
[/SIZE]
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
So let me first reproduce the text as seen on the photo of this box:
Code:
[SIZE=2]
| Function
-------------------------------------------------------------------------------
No Solution | Mode OFF ON
-------------------------------------------------------------------------------
1 Agere TC | Boot Low High
2 Hp, Vision, Infineon | SDS O X
3 NXP Sysol | USB O X
4 NXP Swift Broadcom | DBG X O
5 UMTS (Qualcomm) | M-USB Use Not Use
6 EMP | ID type UART USB
7 - | ID-BOOT Boot-On Boot-Off
8 - | - - -
9 - | SDS TRX - Loop
10 - | DBG TRX - Loop
-------------------------------------------------------------------------------
| O = Connect, X = Disconnect
[/SIZE]
"The Solution"
The first thing to notice, is that the "Solution" column is completely
independent of the "Function" column. The "Solution" column seem to refer to
the manufacturer of the modem hardware used in the device, usually the
cellular/baseband processor (CP/BP) used by your phone or the modem chip in
routers etc. You can find out what you have by using the methods I have
outlined in the thread: "Phone/Modem Hardware Cross Reference List".
Once you know what you have, you use the 10-pole (BCD?) rotary micro-switch,
as shown in the picture below, to set it to the number corresponding to your
phone modem. (The settings in that picture, corresponds to a Samsung Wave
[GT-S7230] which has a Broadcom BP and thus the rotary-switch is set to #4.)
But according to this document, for attaching a [GT-I9000], you need to set
it to #2 (for Infineon).
It is unclear at this point whether or not this setting is actually changed
much when using various modern phones. It is more likely that this is used for
backward compatibility to older phones that use older connectors, and that new
phones all use the same setting since most of them, now use micro-USB
connectors. Otherwise it simply wouldn't make sense to use a
micro-rotary-switch, especially considering the vast number of modems chips
available today, while the uUSB standard connectors doesn't allow other
signals.
"The Function"
As you have already noticed, next to the rotary switch, there is a 10-pole DIL
switch, that is used to set the Jigs "Function", or behavior. The table above
show the various functional options available, that you can use for the JIG.
Although it is unclear what all these functions actually does, without access
to a box or manual, we are free to make some educated guesses.
Here we make the following (rather wild) guesses as what the various modes does:
Code:
[SIZE=2]DILpos Mode Typical What Description-Guess
-------------------------------------------------------------------------------
1 Boot 0 Low ??
2 SDS 1 X ??
3 USB 0 O ?Enable/disable USB pass trough: [target]--->[JIG]--->[PC]
4 DBG 0 X ?Enable/disable debug by "port":
5 M-USB 0 Use ?Enable/disable modem USB connection
6 ID type 1 USB ?"Interface Dongle" output-side selection (wheter to use the USB or UART to connect to PC)
7 ID-BOOT 0 Boot-on ?Determines if the device should bootup/start when connected to the JIG.
8 - - - -
9 SDS TRX 0 - ?Enable/disable Loopback on this interface
10 DBG TRX 0 - ?Enable/disable Loopback on this interface
-------------------------------------------------------------------------------
where (0==OFF, 1=ON) of the 10-pol DIL switch,
while "O" is connect and "X" disconnect.[/SIZE]
If you have any knowledge of what these does, please let us know. For example,
I like to know what the "SDS" refers to and what it is/was used for?
Then What?
So how interesting is this, for our modern Android based and micro-USB
connected phones, on a scale from 1-10? Probably not much more than 3.
Because most of the device magic happens inside the phone, determined by
various internal multiplexers (MUX), resistance/capacitance detectors, the
Power Management IC (PMIC) and related device drivers.
The most important thing to understand, is that today there are very specific
standards regarding what functionality is offered and expected, given certain
conditions on the micro-USB signals. For example, shorting the D+ and D- USB
signals, tells your phone to start charging, using the VBUS and GND lines.
While a resitive short between the micro-USB lines ID_CON (pin 4) and GND
(pin-5), allows and selects a wide range of functionality from remote control,
debug mode, download mode, audio/video transfer and everything else you may
want to do. These are some of the things we would like to focus on here.
So what is more interesting, is how we can build a JIG that is much more
modern and useful than this old dinosaur, that can provide us with a fully
controlled set of the functions mentioned above. So if you still dream about
getting one, forget it and build your own! Below I will link to a list of DIY
multifunction JIGs. That means I only list serious JIGs that contain a little
more functionality, than just a resistor. Post if you have something worth
showing.
Useful Resources
*Fun with resistors (home/car dock mode + more)
Lets Save Some Bricks
*The Captivate Development Platform mod AKA UnBrickable Mod
Set up a Captivate for Samsung Bootloader Development
The Vibrant Development Platform AKA UnBrickable Mod
USB Jig FAQ (Frequently Asked Questions) [4/4/2012] ICS bootloader added
Galaxy S UART JIG & Debugging Connector
Complete USB2.0 Specifications (>13 MB, 30 files, main: 650 pages)
USB Battery Charging Specifications 1.2 (71 pages)
FSA9280A Datasheet (Used in SGS1)
FSA9285 censored Datasheet ()
FSA9485 censored Datasheet ()
FSA3200 Datasheet (Used in SGS2)
---------------------------------------
* Strongly recommended reading
Let me know of any dead links.
Here is an internal photo of the original Anyway S100.
Keywords: jig, samsung, anyway, resistors, multiplex
​
UPDATE: 2012-10-24
Anyway Software, Drivers and Manuals for:
Anyway D100 (8 port factory jig)
Anyway S100 (1 port factory jig)
Can be found for download in Post#67 ...
​

Building your own multifunction JIG
The first thing you need to know, when building your own jig, is how various
resistor values determine the behavior of your phone. Below is a list of
resistor values used in the FSA9280A multiplexer chip. These values have been
become a bit of a standard for new Samsung phones and are thus likely to
remain true also for new models and many other devices running AOS. In
post #3 we use these values to build our Resistor Banks.
FSA9280A/88A Resistor Value Functionality
ID_CON Accessory Detection Table (ID_CON resistance to GND):
Code:
[SIZE=2]ADC-reg Min Typ Max Attn Accessory Detected
-------------------------------------------------------------------------------
00000 GND [COLOR=Red]GND [/COLOR]GND ! Host Mode / OTG (On-The-Go)
00001 1.9K 2K 2.1K Audio Send/End Button
00010 2.47K 2.604K 2.73K Audio Remote S1 Button
00011 3.05K 3.208K 3.37K Audio Remote S2 Button
00100 3.81K 4.014K 4.21K Audio Remote S3 Button
00101 4.58K 4.82K 5.06K Audio Remote S4 Button
00110 5.73K 6.03K 6.33K Audio Remote S5 Button
00111 7.63K 8.03K 8.43K Audio Remote S6 Button
01000 9.53K 10.03K 10.53K Audio Remote S7 Button
01001 11.43K 12.03K 12.63K Audio Remote S8 Button
01010 13.74K 14.46K 15.18K Audio Remote S9 Button
01011 16.4K 17.26K 18.12K Audio Remote S10 Button
01100 19.48K 20.5K 21.53K Audio Remote S11 Button
01101 22.87K 24.07K 25.27K Audio Remote S12 Button
01110 27.27K 28.7K 30.14K Reserved Accessory #1
01111 32.3K 34K 35.7K Reserved Accessory #2
10000 38.19K 40.2K 42.21K Reserved Accessory #3
10001 47.41K 49.9K 52.4 K Reserved Accessory #4
10010 61.66K 64.9K 68.15K Reserved Accessory #5
10011 76.1K [COLOR=Red]80.7K[/COLOR] 84.1K ! Audio Device Type-2
10100 96.9K [COLOR=Red]102K[/COLOR] 107.1K ! Phone Powered Device
10101 115K 121K 127K TTY Converter
10110 143K 150K 157K UART Cable
10111 190K 200K 210K Type-1 Car Kit Charger*
11000 242K 255K 268K Factory Mode Boot OFF-USB
11001 292K 301K 316K Factory Mode Boot ON-USB
11010 347K [COLOR=Red]365K[/COLOR] 383K ! Audio/Video MHL Cable**
11011 420K 442K 464K Type-2 Car Kit Charger*
11100 507K 523K 549K Factory Mode Boot OFF-UART
11101 588K 619K 650K Factory Mode Boot ON-UART
11110 750K 1000/2K 1050K Audio Device Type-1 with Remote
11111 - Open - Slave Mode / Charger Mode***
-------------------------------------------------------------------------------
* USB Car Kit specification: ANSI/CEA-936-A.
** USB MHL (Mobile High definition Link)
! Attention, when these values are used, all pin functions
changes. Having the wrong device connected in this mode, may
short and brick interior phone chips.
-------------------------------------------------------------------------------
[/SIZE]
There is a good reason why some resistor values are marked as "DO NOT USE", in
the original FSA9280A datasheet. That reason is because these values trigger a
signal path switch (by cascading multiplexers), in such a way that the
original 2-5 USB (cable) signals no longer exists as such. If this occurs,
when you have another type of device connected, than what was intended for
that function, you risk short-circuiting and bricking the relevant internal
chip that is driving that function. The best example is the MHL function. When
MHL is activated, all mUSB pins become part of MHL signal lines. If during you
happen to have a dedicated charger connected instead of a dedicated
mUSB-to-HDMI cable, you will for sure burn out your MHL Transmitter chip (or
possibly any other chip using those signals in that path). Why? Because a
dedicated charger has D+ and D- pins shorted, while its trying to provide +5V
(@1.2A) on pin-1. This at the same time the MHL chip is trying to provide
various output signals on all 5 pins!
Factory Mode Auto-Configuration Table (1% Resistors on ID_CON Pin):
Code:
[SIZE=2]Configuration Boot VBUS DP_CON DM_CON ID_CON BOOT JIG
-------------------------------------------------------------------------------
FactoryMode 0 (UART) On Open RxD TxD 619K HIGH LOW --> Triggers "Dock Mode" (Google Car Home)
FactoryMode 0 (UART) Off Open RxD TxD 523K LOW LOW -->
FactoryMode 1 (USB) On Closed DP_Host DM_Host 301K HIGH LOW --> Triggers "Download Mode" (aka "Debrick/Recovery JIG")
FactoryMode 1 (USB) Off Closed DP_Host DM_Host 255K LOW LOW -->
[/SIZE]
In addition to the above resistor values based on just that one chip, and mainly used by Samsung, there is an international standard specification for Battery Charging. In these spec's there are three additional values to consider.
Battery Charging 1.1 Specifications
(May need to be verified...)
Code:
[SIZE=2]DCP: USB Dedicated Charger Port RID_A = 124K
CDP: USB Charging Downstream Port RID_B = 68K
SDP: USB Standard Downstream Port RID_C = 36.5K
where RID = "Resistor Identification"[/SIZE]
List of DIY multifunction JIGs
UberPinguin's Multi-R Jig
Another nice I9100 UART JIG (chinese)
DHylands SGS2 Serial Adapter and Console
Recommended UART Cables
FTDI's "Chipi-X" USB-to-RS232 Cable
Good to Know
Android D2XX FTDI Driver
"Build your own Music dock" [Samsung]

The Dancing MyWay Jig
< here be dragons 2 >

Dude! excellent find. Holy Hack!
you may have seen this thread.. http://forum.gsmhosting.com/vbb/f200/who-used-samsung-anyway-jig-1347210/
that Duc guy may have some info.
someone also links to a user manual where you can see more of that puppy in action.. http://samfirmware.webs.com/I5801_Flash_Tutorial_English.pdf
enjoy. ciao.

^^ Yeah, thanks, but most of those links are dead and the "manual" is just an old standard flashing/service manual. In fact I got the above pictures from some other service manuals. Finally, I don't like having to register to a website, just so that I can see some images.

I do have a AnyWay S100 jig here that i got when samsung support left the place i work. I think i can get a hold of all the cables that they had for it. If i remember correct there was never a micro usb cable tho. But if you want i cna open that puppy up and provide pictures of the inside of the jig. also it could be nice if i could find a way to make a micro usb cable for it...

ParanoidDK said:
But if you want i cna open that puppy up and provide pictures of the inside of the jig.
Click to expand...
Click to collapse
Yes! We'd love to see what's inside! Chips, and wiring etc!
Do you happen to have any windows software drivers for the device? (Why? Because of this.)
Making a micro USB hack would be easy...if you have the right tools or a micro-USB breakout PCB. Just remember that most micro-USB to USB cables do not have the USB_ID line in the cable, but is immediately shorted inside micro-connector. You could get a micro-to-mini-USB cable, that should also include the USB_ID (aka ID_CON) line, but these are hard to find as they are not conforming to common USB cable standards.

Well the usb cable should be the least thing... And if i make one i might just as well make one from start with a micro usb plug, cable and the printer plug in the other end... I think i might be able to use the cable for one of the older samsung phones i have for the box as start point...
i have a print i need to make and then i will open up the box and start to take some pics with my SGS3 just so you can get a preview of the inside...

An anonymous and friendly contributor have come forward with a little bit more information, although not very useful.
1) The S102 model is modified to allow a higher current as used in Tablets.
2) The manual "Function" settings can now be made in software, and is no longer used. (Well then, how is it set in software?)
3) The "Solution" for Galaxy models should be set to "NXP Swift". (But this contradicts the Service Manual for the GT-I9100 and others! But is probably explained by the different BP's used in those devices.)
We need internal pictures! (or the schematics)

Here is some pictures of the internals from the S100 i have here. Proberly not the best ones but the best i can take with my cam... If i have to take better ones i will have to get my friend involved with his DSLR.
I had to upload them to my server as they was to large to upload to xda...
Internals Pictures of the AnyWay S100 Jig
-----EDIT----
I am going to see if i can find the last cables and the psu for the jig today in the bin... As it is now without the PSU windows dont even see the device...

ParanoidDK said:
Here is some pictures of the internals from the S100 i have here. Proberly not the best ones but the best i can take with my cam... If i have to take better ones i will have to get my friend involved with his DSLR.
I had to upload them to my server as they was to large to upload to xda...
Internals Pictures of the AnyWay S100 Jig
-----EDIT----
I am going to see if i can find the last cables and the psu for the jig today in the bin... As it is now without the PSU windows dont even see the device...
Click to expand...
Click to collapse
hi thanks to give all i need full box so can you help me ?

[email protected] said:
hi thanks to give all i need full box so can you help me ?
Click to expand...
Click to collapse
I am not going to part with the anyway jig i got so no... You will have to keep looking on ebay... I dont mind opening it up to let the world see the inside but am not going to sell it.

That's a whole lot of relays in that box.
I don't know if anyone has stated which connector is for what,
but I'd guess that the 25 pin connector goes to a model-specific resistor assembly.
Too much of the relay wiring goes out there.

The big "printer port" is the port for the phone connections that i know... i have a cable for a older samsung phone with the box... and that might be a problem because it might use diffrent pins for diffrent phone models... so without seeing both ends of the micro usb cable naked it will be hard to make a cable...
If you guys need more pics let me know... i can also strip that samsung cable i allready got...
Sent from my GT-I9300 using xda premium

ParanoidDK said:
Here is some pictures of the internals from the S100 i have here... I am going to see if i can find the last cables and the psu for the jig today in the bin... As it is now without the PSU windows dont even see the device...
Click to expand...
Click to collapse
Wow! This thing was (any?) way more complicated inside than what I could have imagined! Containing several relays, a PIC16F876A, and who knows what all those other chips are doing.
This is kind of bad news, as then it will be nearly impossible to build anything like it. At least without the firmware for the PIC and the drivers used. However, I believe that most of its functionality is for switching purposes in order to be able to use it on a broad spectrum of devices. So if we can limit ourselves to the most recent smart phones with micro-USB connectors, much of the internal electronic can be ignored.
So don't worry about the PSU (Power Supply Unit?). It would be much more useful if you have the drivers...
This is how it looks:
<I seem to have some upload problems!! >
(Not sure if its an XDA issue or not...)
EDIT: Now it worked...3 days later!

Could you take apart the shell on the 25 pin adapter cable for the old cell phone model?
I'll bet that there are some precision resistors in there.
Thanks.

I dont have the drivers... and i do worry about the psu because without that the unit dont work....
I will open the cable and upload some pictures of that today....
Sent from my GT-I9300 using xda premium

no comment

You sure have some problems with that image E:V:A
But here it is (I hope):
Did just open the cable i got ant it is a S20 cable.
http://www.samsung.com/us/mobile/cell-phones-accessories/APCBS10UBEBSTD
There is no resistors it is just a 25 pins to S20 cable... Will upload some pics here in a bit... And now i really have to check to see if there are more cables just to check the 25 pins end..
---EDIT----
Link to pictures of the naked cable: http://blog.moonman.dk/files/Anyway_S20_cable.zip

Are you sure that this jig does anything for current cell phones?
It seems to me that this device has nothing to do with the semi-standard today
of 5 pin micro USB connectors with resistance coding on the 5th ID pin.

Wireless Xbox 360 controller work on the Nexus 7?

Will plugging a wireless adapter for pc into the Nexus 7 allow me to use my xbox 360 controller with it? I was reading that ICS broke the ability to do this, so how about JB? Thanks.

Yes, you can. Wireless receiver plugged into an OTG cable. Just playing with it now.
X = Yes
B = Back
Start = Home
Orb/Back = Menu
Left stick = Movement
It hasn't worked successfully with any games I've tried so far.
Shadowgun and Dead Trigger recognises it as a gamepad but I haven't had any joy configuring the buttons to play it. The character just spins round in the spot, and all you can do is look up and down, and move strangely by using both sticks.
Does anyone know if I need an app to setup the controller properly for games?

I used my weird control today, dead Trigger, gta, shadowgun all work perfect...
Sent from my Nexus 7 using Tapatalk 2

karl0ss said:
I used my weird control today, dead Trigger, gta, shadowgun all work perfect...
Click to expand...
Click to collapse
Thanks, I've just tried it using my plug and charge lead but that didn't seem to work at all
Maybe my OTG cable isn't up to it. I wasn't able to get Stickmount to work with it either. (Yes I'm rooted)

Timbermill said:
Thanks, I've just tried it using my plug and charge lead but that didn't seem to work at all
Maybe my OTG cable isn't up to it. I wasn't able to get Stickmount to work with it either. (Yes I'm rooted)
Click to expand...
Click to collapse
The play and charge cable won't work. It only transmits power, not data. I had the same issue when I first started using my xbox controller with my computer.

GlacialFlames said:
Will plugging a wireless adapter for pc into the Nexus 7 allow me to use my xbox 360 controller with it? I was reading that ICS broke the ability to do this, so how about JB? Thanks.
Click to expand...
Click to collapse
I am also having trouble with a wireless 360 controller. I know my usb cable is good because it works on my Galaxy Nexus. I can't use any USB devices (mouses, keyboards, which work with the phone). I haven't found any fixes yet.

What the Problem is
werdnahman said:
I am also having trouble with a wireless 360 controller. I know my usb cable is good because it works on my Galaxy Nexus. I can't use any USB devices (mouses, keyboards, which work with the phone). I haven't found any fixes yet.
Click to expand...
Click to collapse
So I took a look at the Log for when you plug the controller in. This is what I'm getting.
--------------------
07-22 19:55:48.039 350 405 D EventHub: No input device configuration file found for device 'Xbox 360 Wireless Receiver'.
07-22 19:55:48.059 350 405 I EventHub: New device: id=4, fd=269, path='/dev/input/event3', name='
360 Wireless Receiver', classes=0x80000341, configuration='', keyLayout='/system/usr/keylayout/Generic.kl', keyCharacterMap='/system/usr/keychars/Generic.kcm', builtinKeyboard=false, usingSuspendBlockIoctl=true, usingClockIoctl=false
<6>[ 117.819812] usb 2-1: new full speed USB device number 2 using tegra-ehci
<6>[ 117.873142] usb 2-1: New USB device found, idVendor=045e, idProduct=0719
<6>[ 117.873219] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
<6>[ 117.873337] usb 2-1: Product: Xbox 360 Wireless Receiver for Windows
<6>[ 117.873403] usb 2-1: Manufacturer: ©Microsoft
<6>[ 117.873518] usb 2-1: SerialNumber: FE425DB0
-------------------
I tried creating an Xbox keylayout for the device using its Vendor and Product ID, but its still resorting to the Generic. I'm wondering if its the first part is the game (in this case dead trigger) that is setting the keypad based on the Device name and not its product id but not positive.
Another thing I tried is replacing the Generic.kl with the Xbox Wired Controller .kl and although the camera is no longer spinning and the joysticks somewhat work (you can only strafe not turn) not all the buttons work (it seems only the triggers do) . I haven't spent too much time, but thought I would share in case we have any other developers out there that want to try and take a swing at it. Hopefully will have time tonight to work on it.

sleeplessninja said:
So I took a look at the Log for when you plug the controller in. This is what I'm getting.
--------------------
07-22 19:55:48.039 350 405 D EventHub: No input device configuration file found for device 'Xbox 360 Wireless Receiver'.
07-22 19:55:48.059 350 405 I EventHub: New device: id=4, fd=269, path='/dev/input/event3', name='
360 Wireless Receiver', classes=0x80000341, configuration='', keyLayout='/system/usr/keylayout/Generic.kl', keyCharacterMap='/system/usr/keychars/Generic.kcm', builtinKeyboard=false, usingSuspendBlockIoctl=true, usingClockIoctl=false
<6>[ 117.819812] usb 2-1: new full speed USB device number 2 using tegra-ehci
<6>[ 117.873142] usb 2-1: New USB device found, idVendor=045e, idProduct=0719
<6>[ 117.873219] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
<6>[ 117.873337] usb 2-1: Product: Xbox 360 Wireless Receiver for Windows
<6>[ 117.873403] usb 2-1: Manufacturer: ©Microsoft
<6>[ 117.873518] usb 2-1: SerialNumber: FE425DB0
-------------------
I tried creating an Xbox keylayout for the device using its Vendor and Product ID, but its still resorting to the Generic. I'm wondering if its the first part is the game (in this case dead trigger) that is setting the keypad based on the Device name and not its product id but not positive.
Another thing I tried is replacing the Generic.kl with the Xbox Wired Controller .kl and although the camera is no longer spinning and the joysticks somewhat work (you can only strafe not turn) not all the buttons work (it seems only the triggers do) . I haven't spent too much time, but thought I would share in case we have any other developers out there that want to try and take a swing at it. Hopefully will have time tonight to work on it.
Click to expand...
Click to collapse
Alright figured it out. I was doing it right the first time I just needed to set the permissions for the file so that the System could read them. I will post an explanation video. But basically with root you can copy the controller mapping for a wired xbox 360 controller to create a wireless 360 controller. You need to accomplish this using the terminal to manage the file system, I did it all in terminal emulator for android app on the nexus 7. This is exactly what I entered to get it working .
su
cd /system/usr/keylayout/
mount -o remount,rw /system
cp Vendor_045e_Product_0291.kl Vendor_045e_Product_0719.kl
chmod 644 Vendor_045e_Product_0291.kl
chmod 644 Vendor_045e_Product_0719.kl
exit
exit
( Restart System and Enjoy!!!! )
Video showing the issue, solution, and controller working!!!
http://www.youtube.com/watch?v=9czISrLGXNI&hd=1

Thanks sleeplessninja, looking forward to getting this working.
The only problem I have is that Vendor_045e_Product_0291.kl isn't listed for me.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Is it possible to post a copy of the file?

karl0ss said:
I used my weird control today, dead Trigger, gta, shadowgun all work perfect...
Sent from my Nexus 7 using Tapatalk 2
Click to expand...
Click to collapse
how did you do it im using a wired controller and when i connect to the nexus my controller xbox button keeps flashing needing to pair but the control doesnt work or anything ???

I am interested in getting this working as well. I haven't had any luck finding Vendor_045e_Product_0291.kl so far though.

Sleep ninja has a thread with the file

Cybore said:
Sleep ninja has a thread with the file
Click to expand...
Click to collapse
I'll anyone get this fully working? Can't seem to configure the game pad in dead trigger or shadow gun using wired xbox controller. Do brands make a difference cause at first I tried a wired batman arkham city controller and it was unresponsive so I went to game stop and switched it out for a game stop branded one the games register the control but it is unplayable just spinning around wondering if that is normal till the game pad is configured correctly or should it work right out of the box or am I better off just buying a six axis ps3 controller? Any help would be appreciated

djnarcotics said:
how did you do it im using a wired controller and when i connect to the nexus my controller xbox button keeps flashing needing to pair but the control doesnt work or anything ???
Click to expand...
Click to collapse
My wired controller also flashes to pair. As you can see in the wireless video it has the similar thing. However the controller is usable. If for some reason the controller is not working, either you are not using an OTG or your nexus 7 does not have the file.
There is a thread I made with the file for the wired controller, you will need to place this file in your keylayout folder (this requires root access because it is a system file)
http://forum.xda-developers.com/showthread.php?t=1792531
---------- Post added at 01:48 AM ---------- Previous post was at 01:40 AM ----------
djnarcotics said:
I'll anyone get this fully working? Can't seem to configure the game pad in dead trigger or shadow gun using wired xbox controller. Do brands make a difference cause at first I tried a wired batman arkham city controller and it was unresponsive so I went to game stop and switched it out for a game stop branded one the games register the control but it is unplayable just spinning around wondering if that is normal till the game pad is configured correctly or should it work right out of the box or am I better off just buying a six axis ps3 controller? Any help would be appreciated
Click to expand...
Click to collapse
The brand does matter. For technical reasons that you can sort of see in my discussion of the issue. Each controller you plug in gives out a unique Product and Vendor ID. So your third party controllers give out a different ID. Since its meant for the xbox, the layout is the same, however when your nexus 7 is looking for the keylayout its looking for it under that particular product and vendor id. So you need to rename the file i attached in the other thread to the Vendor and Product ID of your controller. I don't know the different IDs for the third party controllers. All official Xbox controllers that are wired have the same IDs and all official wireless do. And I mention them in the thread.
If you want to find out if your Vendor and Product ID on your Nexus 7, you plug in your device and then print a system Logcat . You do this by pressing Power and Volume + and Volume - at the same time. This will open an attachment that you can then send to yourself or me. I showed in this thread the part of the log you are looking for. Once you identify the ID you just rename the file to match the IDs of your device and it should work.
Please if any of this is confusing, ask as many questions and I will try to be clearer. I apologize for an ambiguity. I want to make a video explanation to present this in a simpler way. Until then I hope this helps.

sleeplessninja said:
My wired controller also flashes to pair. As you can see in the wireless video it has the similar thing. However the controller is usable. If for some reason the controller is not working, either you are not using an OTG or your nexus 7 does not have the file.
There is a thread I made with the file for the wired controller, you will need to place this file in your keylayout folder (this requires root access because it is a system file)
http://forum.xda-developers.com/showthread.php?t=1792531
---------- Post added at 01:48 AM ---------- Previous post was at 01:40 AM ----------
The brand does matter. For technical reasons that you can sort of see in my discussion of the issue. Each controller you plug in gives out a unique Product and Vendor ID. So your third party controllers give out a different ID. Since its meant for the xbox, the layout is the same, however when your nexus 7 is looking for the keylayout its looking for it under that particular product and vendor id. So you need to rename the file i attached in the other thread to the Vendor and Product ID of your controller. I don't know the different IDs for the third party controllers. All official Xbox controllers that are wired have the same IDs and all official wireless do. And I mention them in the thread.
If you want to find out if your Vendor and Product ID on your Nexus 7, you plug in your device and then print a system Logcat . You do this by pressing Power and Volume + and Volume - at the same time. This will open an attachment that you can then send to yourself or me. I showed in this thread the part of the log you are looking for. Once you identify the ID you just rename the file to match the IDs of your device and it should work.
Please if any of this is confusing, ask as many questions and I will try to be clearer. I apologize for an ambiguity. I want to make a video explanation to present this in a simpler way. Until then I hope this helps.
Click to expand...
Click to collapse
well i just returned the controller and ordered an official xbox one from amazon so will deff try this when it comes in thanks

Hacking & Reverse Engineering of Tata Sky HD STB ( Technicolor : DSI729TAT )

I have a "Tata Sky HD" Set-top Box and I was about to throw this in garbage but before I want to know what is happening under the hood.
I search on internet and I found nothing except this. I'm noob so sorry for if say something silly.
I found this specifications.
Product : TATA SKY HD
Original Maker : Technicolor
Product Model Number : DSI729TAT
Chipset : STiH237 BHKB B3L
Type : ST40 -32 BIT
Architecture : RISC
RAM : 2GB [ SK Hynix H5TQ2G63FFR H9C
Storage : 1GB [ Spanison ML01G100
Power : 12v DC
Software: busybox 1.18.2 , mtdwrap, uclibc, Linux Kernel 2.6.32.59_stm24_0211, ST drivers: embx.ko, embxmailbox.ko, ics.ko, ics_user.ko, lxload.ko, mme.ko, mme_user.ko, LZO Decompression Library 2.03, Decompression Utility
PORTS : 1 HDMI 1.2/1.3/1.4, 1 USB 2.0, SAT-IN & 2 Audio 1 Video Out , 1 Optical S/PDIF (for Dolby Digital Plus Audio ), 1 Digi Card.
I Found 1 UART PORT Which would be used while extraction of Firmware.
AFTER SOME REASEARCH I FOUND THAT IT HAS SIMILAR TO ARM-CORTEX-A9 AND MALI-400 GPU. (MAYBE I'M WORNG)
IDEA : It has a a Good processor and ram which can run as raspberry-pi os.
so we can repurpose it as a Media Center, Gaming Console, NAS, Smart Home, Small Server or a Mini Computer.
storage is low so we have to add some storage. I'm not sure how this is possible. except swapping the NAND flash Chip.
GOAL 1 : Extract Firmware and Extract Paid Decryption key which is use to verify the sat-in signals. ( a stb which don't required subscription to watch any tv channel )
i think they modified the software which capture the unencrypted signal and if we have a signal receiver then we are good to go. but for big companies wants to earn money so they added these barriers which needs decryption. and if the satellite is sending encrypted signal then we need to find the key. ( i know it's hard that's why we are here. I'll love to hear you thoughts on these)
GOAL 2: Change the Firmware and install Linux.
Goal 3: Find a way to use it as media server with increased storage and add a wireless module for WIFI access.
I'm not sure it is possible or not. but i think its possible. just think about it a small hardware can collect signal from satellite and decrypt the signals in HD with Dolby HD audio. we just need to find a way to access this.
I SHARED MY IDEA AND I DON'T KNOW MUCH ABOUT THESE.
PROBLLY I'M GOING TO ACCESS THIS WITH UART INTERFACE AND TRYING TO ACCESS THE BOOTLOADER.
OR MAYBE DESIGN A CUSTOM KERNAL.
I'M SEARCHING FOR COMPATIBLE FIRMWARE WHICH I CAN MODIFY AS I NEED.
EXTRA : I FOUND A SIMILAR STB WHICH USED IN RUSSIA "NTV PLUS SET TOP BOX" HAS SIMILAR PROPERTIES LIKE TATASKY HD BUT WITH EXTRA I/O PORTS.
THANK YOU. IF YOU HAVE ANY ADDIONAL IDEA THEN I'LL LOVE TO HEAR THAT.
Links Used For Gathering Information
Chipset : https://www.st.com/en/digital-set-top-box-ics/stih237.html
RAM : https://www.electronicsdatasheets.com/manufacturers/sk-hynix/parts/h5tq2g63ffrh9c
OS information : https://www.technicolor.com/node/1899
Storage : https://www.qdatasheet.com/search.jsp?sWord=ML01G100&page=2&op=i
RISC BASED TOOLS AND APPS : https://www.riscosopen.org/content/downloads/common

This is probably the UART. You will most likely get a shell and U-Boot logs provided that it's not fused-off (ST microcontrollers can have debug interfaces fused off during flashing at the manufacturer)
How to find the pinout:
GND will have continuity with metallic parts of the board (heatsinks, HDMI ports, etc)
VCC will measure 1.8-5V DC depending on logic level
RX will not measure very much voltage
TX will go crazy during boot on an oscilliscope.
Try baudrate 115200 8n1

$cronos_ said:
This is probably the UART. You will most likely get a shell and U-Boot logs provided that it's not fused-off (ST microcontrollers can have debug interfaces fused off during flashing at the manufacturer)
View attachment 5877483
How to find the pinout:
GND will have continuity with metallic parts of the board (heatsinks, HDMI ports, etc)
VCC will measure 1.8-5V DC depending on logic level
RX will not measure very much voltage
TX will go crazy during boot on an oscilliscope.
Try baudrate 115200 8n1
Click to expand...
Click to collapse
Well i don't have oscilloscope yet, soon I will try your guide, thanks for guidance. I will try to update upcoming experiments.

dyal96 said:
IDEA : It has a a Good processor and ram which can run as raspberry-pi os.
so we can repurpose it as a Media Center, Gaming Console, NAS, Smart Home, Small Server or a Mini Computer.
storage is low so we have to add some storage. I'm not sure how this is possible. except swapping the NAND flash Chip.
GOAL 1 : Extract Firmware and Extract Paid Decryption key which is use to verify the sat-in signals. ( a stb which don't required subscription to watch any tv channel )
i think they modified the software which capture the unencrypted signal and if we have a signal receiver then we are good to go. but for big companies wants to earn money so they added these barriers which needs decryption. and if the satellite is sending encrypted signal then we need to find the key. ( i know it's hard that's why we are here. I'll love to hear you thoughts on these)
Click to expand...
Click to collapse
I think we can utilize the usb port on the back to add the external storage, as the usb port is used for storing the TV recording (as far as I can recall), and for the uart part, we can also use it for accessing root shell in the initial step, to figure out the operation method and framework.
I don't have any idea about the encryption keys, it would be cool if there's a way for that.
I have the same STB, would love to repurpose the old box, what's your progress on this so far ?

If you have a multimeter, you can check if the pins are for UART, RX voltage would be very low, TX voltage would be fluctuating upon boot, check continuity for GND with any grounded part like the HDMI port shield or the AV port silver port, VCC would be 3.3 or 5 volts