Apple TV3 JTAG points - Hardware Hacking General

1. I looked at ifixit internal images for the Apple TV and noticed that the board has test points, figured there may be a chance to JTAG it.
2. I wanted to check if Apple is using JTAG or SWD (serial wire debug) as ARM supports both. A quick search on jobs.apple.com reveals that Apple only uses JTAG/ICE and not Serial Wire Debug (no mention of it in the job descriptions). They talk about board level OS testing, so they do final testing in house after the board is fully manufactured. It seems they use cadence concept/allegro
3. I picked up ATV3 at Fry's this this morning and opened it, I did find space for two connectors
4. A 10 pin connector looks like ARM 10-PIN JTAG connector - (Mfgr: Don Connex P/N: C42 or Samtec P/N: SHF-105-01-L-D-TH). hxxp://xxx.samtec.com/ftppub/pdf/FTSH_SMT.PDF See attached picture: ATV3_J5101.jpg
5. A 30 pin FFC FPC ribbon cable connector. See attached picture: ATV3_J7301.jpg
I haven't traced the pins yet, but one them has to have JTAG. I will post my findings, but wanted to see if xda developers is the right forum or is there another place?
Another interest is that A5 is also in iphone 5. As the software bugs are patched, we may have only left with hardware hack to jailbreak. Hoping we can load a patched boot loader. Plus I am kinda old school developer hint: dms3/HU/S00/powersync

nice ur idea , is it apple will left their chip Jtag points opened ? get schematic and check if jtag is opened ..
early devices iDevices are all jtag closed like there :

Schematics? It's gonna be super hard to find those for the new devices
The difference between apple tv and iphone/ipod is that apple tv has PCB pads for actual connectors, the others only have test pads for board verification in the factory.
Based on my experience the solder pad lay out is a standard 30pin FPC.
Another thought is that the J7301 the 30pin connector could also be the standard IPOD connector as I have seen 30pin (single row ) connectors - but most of them have thru hole solder mounts. Anyone care to comment?

rgdeja said:
Schematics? It's gonna be super hard to find those for the new devices
The difference between apple tv and iphone/ipod is that apple tv has PCB pads for actual connectors, the others only have test pads for board verification in the factory.
Based on my experience the solder pad lay out is a standard 30pin FPC.
Another thought is that the J7301 the 30pin connector could also be the standard IPOD connector as I have seen 30pin (single row ) connectors - but most of them have thru hole solder mounts. Anyone care to comment?
Click to expand...
Click to collapse
On the J7301 connector why dont you compare the pinouts to see if the gnd matches up to the board one,
darkspr1te

darkspr1te said:
On the J7301 connector why dont you compare the pinouts to see if the gnd matches up to the board one,
darkspr1te
Click to expand...
Click to collapse
Already did, they dont match at all.

Booloader Discussion - Comments requested
Does any one know if Apple actually Rom Masked the bootrom on silicon of A5/A6 or just the keys and or key hash?
Based on my experience, some (usually dumb and to save on cost) chipset vendors will have an 'i2c like back door' and then load the ROM instead of actually MASKing it during fab. After the wafer is tested and passed verification, 'ROM MASK' is loaded then wafer is sent for packaging, If the left hand doesn't talk to the right hand, then these 'back door pads' on the wafer are wire bonded and the data sheet reflects as "reserved or test" PINs.
Also, the silicon is very expensive to have full ROM or public key to be masked in silicon.
Has anyone 'de-capped' an A5/A6 to find out unused pads on the silicon wafer?

Related

[Info]Making/Using a Factory Cable

There is a lot of information floating around about the factory cable but there doesn't seem to be a thread dedicated to the topic. I bricked my device today so I need to make a factory cable. I tried making a cable but I f'd up the soldering job so I am awaiting delivery of a breakout board. I just wanted to gather some information here on the topic because there seem to be a lot of bricks popping up around here. So for now I am going to post what I know and ask a few questions here and there so that I can get my cable done and hopefully help someone out along the way.
When I started messing around with soldering a jumper from pin 1 to pin 4 i melted the connector, blah, blah, anyway, I screwed it up. Hopefully I will have more luck with the breakout (see below).
From what I understand, using the cable is a simple a plugging it in so I guess that part is self explanatory for now.
I got most of my information about the cable and how to make it from here. Lots of good info with pics and diagrams.
Someone in these forums recomended using this breakout board. I ordered 2 of them today so I will let you guys know how it goes when they get here.
My one big question is about the the jumper from pin 1 to pin 4; I read that some people are using a resister and I am unclear as to where the resister is being used and the specs of the resister. Please enlighten me
I might add some pics to this thread just for fun. If you have built this cable please jump in a post any information that might help.
Thanks
BTW-You can buy a cable here but I have yet to see them listed as "in stock"
I'm interesting to how correctly build this cable...
I simply used a jumper wire. No resistor used. I hear a 1k can be used as a precaution, but is not necessary. Without the resistor, it works like a champ. I turned off the Kindle, Plugged in the "Factory cable", and it went directly into fastboot.
PIN out is as follows on the SparkFun Breakout board:
VCC: RED
D-: White
D+: Green
ID: Jumper RED
GND: Black
MayfairDROID said:
I simply used a jumper wire. No resistor used. I hear a 1k can be used as a precaution, but is not necessary. Without the resistor, it works like a champ. I turned off the Kindle, Plugged in the "Factory cable", and it went directly into fastboot.
PIN out is as follows on the SparkFun Breakout board:
VCC: RED
D-: White
D+: Green
ID: Jumper RED
GND: Black
Click to expand...
Click to collapse
Thanks a ton! I was looking confirmation that this wod work without a registered.
So I assume you fixed you device or accomplished whatever it was that you where trying to do?
Sent from my ADR6400L using Tapatalk
hahaha...Nope I didn't have anything wrong, but before I went modding, I wanted to be sure I could get into FastBoot if I messed something up. I have tested and made sure that I had Fastboot commands, so I know it works.
SikYou said:
There is a lot of information floating around about the factory cable but there doesn't seem to be a thread dedicated to the topic. I bricked my device today so I need to make a factory cable. I tried making a cable but I f'd up the soldering job so I am awaiting delivery of a breakout board. I just wanted to gather some information here on the topic because there seem to be a lot of bricks popping up around here. So for now I am going to post what I know and ask a few questions here and there so that I can get my cable done and hopefully help someone out along the way.
When I started messing around with soldering a jumper from pin 1 to pin 4 i melted the connector, blah, blah, anyway, I screwed it up. Hopefully I will have more luck with the breakout (see below).
From what I understand, using the cable is a simple a plugging it in so I guess that part is self explanatory for now.
I got most of my information about the cable and how to make it from here. Lots of good info with pics and diagrams.
Someone in these forums recomended using this breakout board. I ordered 2 of them today so I will let you guys know how it goes when they get here.
My one big question is about the the jumper from pin 1 to pin 4; I read that some people are using a resister and I am unclear as to where the resister is being used and the specs of the resister. Please enlighten me
I might add some pics to this thread just for fun. If you have built this cable please jump in a post any information that might help.
Thanks
BTW-You can buy a cable here but I have yet to see them listed as "in stock"
Click to expand...
Click to collapse
A resistor is the "safe" route. Mine doesn't have one at all and woks flawlessly. You just need a resistor large enough to simulate a short to the device. I imagine anything above 250k would be more than enough.
But as I said before I have used mine more than most people probably have while testing TWRP, I don't have a resistor and it works fine.
Sent from my SPH-D710 using xda premium
Was just thinking. If you used a female breakout board with a male breakout board you could essentially ground the male boards ground to the male boards vcc. And the female boards ground to the male boards ground as well.
This way you could leave vcc hanging (capped of course) from the female source (computer) side.
Aditionally you could put in a dual pole switch between ground from the the target (kindle side) and vcc on the target side that would toggle between ground on the target side and vcc on the source side. Essentially eliminating the need for two cables and letting you switch from a factory cable to a normal cable with the flip of a button.
Hope this sparks some good conversation .
Sent from my SPH-D710 using xda premium
I built one with the sparkfun breakout board. Piece of cake if you have some soldering skillz. You might melt something or make a mess if you haven't soldered anything before so I recommend practicing on something else first and/or watching some "how to solder" youtubes.
I configured mine with a female header in the pin 4 location, and a 400 ohm resistor coming off of pin 1. If I want to fastboot, I put the free end of the resistor into the female header. To use the cable like an ordinary USB cable, I just pull the free end back out. It's kinda nice to use the same cable for everything.
RE: resistor value. Since any value up to 1K ohm reportedly works, I thought I might as well use one vs just running a direct short. The higher the value of your resistor, the greater the chances that it won't work though. I used the one I did because it was less than 1K ohm, I had it on hand, and it's a higher wattage resistor with thicker wire that fits nicely in the female header.
FWIW, YMMV.
pyrostic said:
Was just thinking. If you used a female breakout board with a male breakout board you could essentially ground the male boards ground to the male boards vcc. And the female boards ground to the male boards ground as well.
This way you could leave vcc hanging (capped of course) from the female source (computer) side.
Hope this sparks some good conversation .
Sent from my SPH-D710 using xda premium
Click to expand...
Click to collapse
This will NOT work, as the female breakout boards from Sparkfun does NOT have a breakout trace for pin 4 present. Only the male breakout boards have all 5 pins/traces needed. I've purchased hundreds of both and sold thousands of download mode JIG's for Samsung phones, and was forced to modify the female breakout boards to include a pin 4 trace for special projects of mine. I do not know if they since added the trace or not and its been over a year now since I asked for this feature.
Is there even a market for these factory cables?
EDIT: I know this post used to be how to get a cable from me, but I ran out of the actual cables and never replaced them. With only about one request per week or month I decided to stop stocking the cables. I have everything else though (new micro ends etc) to build a professional one if you want to send a old cable to me.
SkOrPn said:
This will NOT work, as the female breakout boards from Sparkfun does NOT have a breakout trace for pin 4 present. Only the male breakout boards have all 5 pins/traces needed. I've purchased hundreds of both and sold over 1300 download mode JIG's for Samsung phones, and was forced to modify the female breakout boards to include a pin 4 trace for special projects of mine. I do not know if they since added the trace or not and its been over a year now since I asked for this feature.
On the other hand, if there was a market for it, I could manufacture special mini to micro data/charger adapters made specifically for this task. But the user would still need a standard mini usb data cable with all 5 pins/wires present (everyone should have one lying around somewhere).
Something like this could be purchased in bulk and then modified on demand. These are easily taken apart and reassembled. I do this daily 7 days a week so its easy for me.
http://www.alibaba.com/product-gs/394616755/Mini_USB_to_Micro_Adapter_Charger.html
Is there even a market for these though, is my question?
Click to expand...
Click to collapse
Probably not much of a market. I think most of us are attempting to make our own. I'm sure you could sell a few but I wouldn't quit your day job ;-)
Sent from my ADR6400L using Tapatalk
Deleted
SkOrPn said:
Not really concerned with making money as opposed to just helping. I sell JIG's at only $3.95 plus s&h which just barely covers my cost of materials, so I'm not in it for the money (it never even crossed my mind to try and make money off this stuff). Some people can not make things like this to save their lives, in fact most people can't and that's where a talented ex-electronics tech like myself comes in.
Below are the JIG's I make... Just to show how serious I get with quality and design. They are filled with SureBonder PDR glue, the worlds strongest hot glue according to the glue manufacturers, and I even went as far as logo them. I am thinking something along the lines of the same thing with the Factory Adapter (just without the lanyard). I could make 50 of them and list them on ebay for what I mentioned above and only $2 s&h. But, ONLY if I knew that they might sell. I'm willing to break even, but not lose money... And oh, I'm unemployed at the moment so I have plenty of time on my hands and every specialty tool you can think of...
I'm just bored and love helping people save their devices.... My ebay ratings can contest to that... ;-)
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Click to expand...
Click to collapse
I would buy 1
Sent from my ADR6400L using Tapatalk
Nice. Mine looks positively nasty (but it works). What I did was buy a cheap 8" usb micro male to usb micro female adapter, cut it in half, stripped the wires back, and twisted them back together. Then simply jumpered the two wires together and taped the whole mess up. The hardest part was getting a meter on the usb micro pins. Had to clip my meter leads to a needle to get to them. Had to wear my glasses too. They are really small and close together.
---------- Post added at 10:59 PM ---------- Previous post was at 10:53 PM ----------
Oh, and I forgot to point out that the reason for using the usb micro male to female cable is that you are insured of a wire on pin 4 with this approach, rather than an unsoldered pin to test your soldering skills. You will of course still need a micro to the normal usb cable to go from this to your pc, but I already had that on hand.
Considering the number of kindle fires that have sold, I bet you could easily sell 50 of those cables on ebay.
I'd probably buy one even though I've already made my own. Your's look really nice!
teookie said:
Considering the number of kindle fires that have sold, I bet you could easily sell 50 of those cables on ebay.
I'd probably buy one even though I've already made my own. Your's look really nice!
Click to expand...
Click to collapse
Thanks, but the pictures I posted are of my Samsung Download Mode JIG's, they are NOT Motorola Factory jig's, lol... I ONLY posted pics of my Samsung jig's to show how dedicated I am to making quality stuff for us device flashing junkies. Factory Adapters would not look anything like what I posted, they would just be a Mini to Micro usb adapter with the proper short from pin 1 to 4 (user would have to supply their own standard cable, which most people already have). I have NOT sourced any adapters yet, but I have sent emails to some of my suppliers asking about them. No replies as of yet... I did find a few cables but I do not like cutting products up, I instead like making something that looks like it was produced on a assembly line, lol. Doing the mod to an adapter just seems smarter, as the end result is a clean functional product without any visible damage.
1. I would need to source adapters that are either already un-assembled.
2. Or, can easily be un-assembled and re-assembled.
3. Fairly affordable, 35-50 cents each or something close to.
4. And, be purchased in really small quantities such as lots of 50 to start out with.
5. And most importantly, they must have all 5 pins/wires. MANY adapters do not have all 5 pins on the female side, as pin #4 is simply not needed for most functions. This is why I need to source them first so I can ask questions in regards to pin #4. If the supplier guarantees pin 4 is present on both sides of the adapter, then I can move forward on this product.
I have quite a few emails and PM's for this item already though. Still not convinced its worth it though. How many Kindle Fires have been sold? And how many people actually modify or flash them? lol
EDIT: Let me get this straight. If I try to flash my Kindle Fire and I brick it, I would need a factory cable in order to restore it to functional?
I'd definitely grab one! I don't think you'll have any problem selling out of 50.
Sent from my Kindle Fire using xda premium
SkOrPn said:
Thanks, but the pictures I posted are of my Samsung Download Mode JIG's, they are NOT Motorola Factory jig's, lol... I ONLY posted pics of my Samsung jig's to show how dedicated I am to making quality stuff for us device flashing junkies. Factory Adapters would not look anything like what I posted, they would just be a Mini to Micro usb adapter with the proper short from pin 1 to 4 (user would have to supply their own standard cable, which most people already have). I have NOT sourced any adapters yet, but I have sent emails to some of my suppliers asking about them. No replies as of yet... I did find a few cables but I do not like cutting products up, I instead like making something that looks like it was produced on a assembly line, lol. Doing the mod to an adapter just seems smarter, as the end result is a clean functional product without any visible damage.
1. I would need to source adapters that are either already un-assembled.
2. Or, can easily be un-assembled and re-assembled.
3. Fairly affordable, 35-50 cents each or something close to.
4. And, be purchased in really small quantities such as lots of 50 to start out with.
5. And most importantly, they must have all 5 pins/wires. MANY adapters do not have all 5 pins on the female side, as pin #4 is simply not needed for most functions. This is why I need to source them first so I can ask questions in regards to pin #4. If the supplier guarantees pin 4 is present on both sides of the adapter, then I can move forward on this product.
I have quite a few emails and PM's for this item already though. Still not convinced its worth it though. How many Kindle Fires have been sold? And how many people actually modify or flash them? lol
EDIT: Let me get this straight. If I try to flash my Kindle Fire and I brick it, I would need a factory cable in order to restore it to functional?
Click to expand...
Click to collapse
In many cases people are able to restore a bricked kindle because the Factory cable allows one to boot in to fastboot and repair the system or do a factory reset or whatever needs to be done based on what the brick was caused by.
Sent from my ADR6400L using Tapatalk
SkOrPn said:
But, ONLY if I knew that they might sell.
Click to expand...
Click to collapse
I'd buy one.
I feel confused. Typical someone says factory to describe an item that comes with a product when you buy it vs. aftermarket. Are you saying that the cable that comes with the fire is somehow special and different from a regular micro USB cable?
Sent from my HTC Flyer P512 using Tapatalk
bsoplinger said:
I feel confused. Typical someone says factory to describe an item that comes with a product when you buy it vs. aftermarket. Are you saying that the cable that comes with the fire is somehow special and different from a regular micro USB cable?
Click to expand...
Click to collapse
This is a special cable that puts the device into fastboot mode when the device is otherwise locked up. It is not a normal cable you would get or use that would come with the device or be orderable from the company. It has only one purpose and would not be used again.

Resistors on D pins

I'm working on an advanced dockstation that's almost completed.
Problem is that I want to use the deskdockmode and I'm not sure if the 365K resistor (as with i9000) would work on the Note.
http://forum.xda-developers.com/showthread.php?t=820275
Is it still deskdockmode or something like "deskclockmode"?
My meter doesn't work so I can't measure the resistor inside the genuine samsung dockstation which I will asap when my new meter arrives.
Apparently there is a PCB board in the genuine samsung dock (EU model).
Mixture of both resistors and capacitors.
Will look further into it later.
KurdX said:
Apparently there is a PCB board in the genuine samsung dock (EU model).
Mixture of both resistors and capacitors.
Will look further into it later.
Click to expand...
Click to collapse
I am interested in this too. Please update with what you find. Would be curious to know what is Cardock resistance as well.
david

Long standalone MicroUSB connector for DIY dock?

Does anyone sell a long MicroUSB adapter kit for DIY docking stations?
Something that can be assembled onto a fiberglass or wood dock.
As in, a connector that doesn't have the molded end with cable already attached.
But wht exacty u need? Micro/mini usb cable? Usb male/female pin/plug? Give some mor details.
HD2 HYPERDROID EXTREME EDITION V6.0.1 @ FIKERT KERNAL.
Most micro USB connectors come apart pretty easily.
There are usually 3 tack solder contacts on one side and 2 on the other.
Get yourself a few $3 cables and a razor blade to try out.
You can strip the shells off, route a hole in your stand and insert it.
I think by "long" microUSB he mean really those longer ones, with ~16 additional pins, like one we can find in Nook Tablet.
Rebellos said:
I think by "long" microUSB he mean really those longer ones, with ~16 additional pins, like one we can find in Nook Tablet.
Click to expand...
Click to collapse
I disagree, he wants to make his own dock, and needs something a bit longer that will be easier to mount. I have thought about the same thing myself
I think one of these below should do the trick, as they can be taken apart, but obviously, you'll have to do your own soldering. It's a bit tricky, even with a 0.5mm pencil tip iron.
http://www.ebay.co.uk/itm/8pin-micr..._MobilePhoneDataCables_JN&hash=item43afbf91cb
Good luck!
you might want to check out parts sites. I did a quick search on mouser.com for micro usb and under interconnects i selected "USB connectors" you can see a picture of most of the options and even go with micro 3.0 if its better for you
Whoops, I forgot about this thread.
Thanks for all the great suggestions so far!
Yeah, I want the longer USB. Because right now, I have an OEM Samsung car dock that I use.
But when I have my phone in a TPU case, the USB isn't long enough anymore to properly insert all the way into the phone. Because the TPU case puts the phone about 1/4" further from the USB.
I like the idea of stipping a three dollar USB cable.
I think this will be a long term project that I'll work on here and there.
Looking into this myself but for a different reason. I can't find what I want but I did order two of these and I reckon they will work perfectly for you.
http://ie.farnell.com/hrs-hirose/zx80-b-5s/micro-usb-type-b-plug/dp/1719110?Ntt=171-9110
I think that's also Newark in the US. Probably the same part number there. There is at least an extra 5mm there to get you past the TPU case.

i9507 will not accept 11-pin microUSB, but 9505 does?

Hi Folks,
A friend gave me an unbranded MHL plug because it didn't work for him and he went out and got the Samsung authentic product which worked fine. Didn't take long to figure out the connector on the el-cheapo was of the 5 pin variety, it needed 11 pin - so I ordered a 11-to-5pin adapter for it and it also works fine - at least on his device - my friend's S4 model is 9505 (Apr 2013) and my S4 is 9507 (Nov 2013) - mine will not accept the 11-pin microUSB cable - it seems to have some physical depth issue so the the cable never actually connects - I can't make out any difference visually between the two and I can't see any differences in the specs yet there is a difference on how deep the 11pin connector goes in .
I thought it may have some obstruction like a lint buildup (pocket or bellybutton) but I have also tried this on a colleagues S4 which is also a 9505 and it works fine. I'm looking for someone else with a 9507 to try this out on but I'm quickly running out of resources so I figured I'd just get online and ask the pros.
Anyone experienced this problem of fitting an 11pin microUSB in their S4 device?
Thanks
*** SOLVED *** I found someone in the office who had the same model i9507 and the 11pin microUSB connector fitted albeit needing a fair bit of force and coaxing - it snapped into place. So we took photos of the ports using each others cameras and blew them up, didn't look much different except mine looked as if it was rusted if anything. I used a pin-board pin around the metal tab in the port and it yielded a bit of gunk and eventually a fair bit came loose from the underside (the narrow side) and that it seems was to inhibit the deeper 11pin connector path.
As many do, I carry my phone around in my pocket and undoubtedly the lint collection over the years is the source of the gunk. For the small amount of fluff that did come out of the port I'd estimate the obstruction was < 1mm - but enough to stop the connector's tabs from engaging - gives a fair indication of how little margin there is for this 11pin connector in the port.
Cheers

Connectors

Does anybody know the series of connectors used for the inputs and outputs on many of these head units? A manufacturer name and series code would allow me to look them up on RS Components and / or Element 14/Farnell/Newark in order to source more as sellers won't supply any more than what they get packaged with the units (and probably don't know what they are anyway). The ones I'm referring to are the small white multi-pin shells and their pins.
Amp connector? Subtype goes by pin spacing/size
Mouser Electronics
Unfortunately AMP make a huge range of connectors and unless you are certain that AMP made those it doesn't really help with the search. Many other manufacturers also make similar but likely incompatible connectors, I'm lookintg for actual knowledge not a guess since I obviously can't try all the available connectors to see if they match.
Also Mouser does not have a proper presence in NZ, nor does Digikey so I'm limited to RS components or Element 14
Mr.TT_NZ said:
Unfortunately AMP make a huge range of connectors and unless you are certain that AMP made those it doesn't really help with the search. Many other manufacturers also make similar but likely incompatible connectors, I'm lookintg for actual knowledge not a guess since I obviously can't try all the available connectors to see if they match.
Also Mouser does not have a proper presence in NZ, nor does Digikey so I'm limited to RS components or Element 14
Click to expand...
Click to collapse
Mouser or Digikey likely has them. Measure the exact dimensions, pin size and spacing; color is irrelevant. It isn't rocket science but it can be tedious.
Without the proper crimp tool it will be hard to get a good crimp... consider carefully soldering the wire to the pin.

Categories

Resources