jtag, firmware hacking, dumps, homebrew - Hardware Hacking General

I'm a pretty smart guy and I pick up on things quickly, but how people can take a consumer device (xbox, ps3, iphone, router, photoframe, digital camera, etc) and figure out wires and resistors that appear random in many cases to build a jtag connection and then magically dump the firmware and develop their own tweaks or custom firmware just escapes me. I've built jtag connections before, modified or replaced countless firmwares, but every time someone else already did the leg work and supplied a step by step with either pictures or a video. You have guys like geohot who hacked the iphone at like age 19 and then the ps3 shortly after.
I have an aluratek photo frame and I all I want it to do is automatically start the slideshow when the frame is turned on. Something seemingly so simple yet I wouldnt even know where to begin. I imagine it has a feature to upgrade the firmware either by usb or sd card. But I would first need a copy of the OWF and then I would have to know what to change to enable the feature. Maybe it has a jtag connection, but which wires go where I could only guess. I dont see how or where people learn this kind of stuff. It's definitely more then just a google search,

1: about jtag pin :
finding Jtag pin is easy check what cpu inside your hardware and serach shematique now 90% of cpu schema can get from china books, than you need just trace lines to get good soldering point
2: about hacking
after reading flash use any disassembler, ida is very good and with same skill you can reverse what you want

Related

BRICKED - even the resistor trick doesn't work !

Hi all !
I'm writing here because i'm facing a problem with a "SAMSUNG Galaxy 3" // aka // "Samsung GT-I5800" ...
Someone gave it to me because it seems to have bricked the phone during a flash process.
I really don't know if it is electricaly dead or just if the BOOT part of the flash is corrupted.
What i tried :
{VOLUME DOWN} + {HOME} + {POWER}
{VOLUME UP} + {HOME} + {POWER}
301kOhms resistor trick on pins 4/5
I'm now wondering if the phone is dead or not ...
As the phone is quite new (!!!) i would have liked to test some things, like JTAG on the port reserved to it on the motherboard.
What i don't want is buying some kind of external JTAG devices like ORT or RIFF.
By the way, i have skills in programming ; electronics ; computers.
I have an arduino that could be used for interfacing the JTAG port to the PC serial port.
I'm not very sure about the JTAG pinout on the motherboard.
I found some informations at RIFF website about the JTAG PINOUT :
If someone can tell me how to use this JTAG port to inject the bootloader inside the flash, it would be very cool.
Thanks !
simkard said:
Hi all !
I'm writing here because i'm facing a problem with a "SAMSUNG Galaxy 3" // aka // "Samsung GT-I5800" ...
Someone gave it to me because it seems to have bricked the phone during a flash process.
I really don't know if it is electricaly dead or just if the BOOT part of the flash is corrupted.
What i tried :
{VOLUME DOWN} + {HOME} + {POWER}
{VOLUME UP} + {HOME} + {POWER}
301kOhms resistor trick on pins 4/5
I'm now wondering if the phone is dead or not ...
As the phone is quite new (!!!) i would have liked to test some things, like JTAG on the port reserved to it on the motherboard.
What i don't want is buying some kind of external JTAG devices like ORT or RIFF.
By the way, i have skills in programming ; electronics ; computers.
I have an arduino that could be used for interfacing the JTAG port to the PC serial port.
I'm not very sure about the JTAG pinout on the motherboard.
I found some informations at RIFF website about the JTAG PINOUT :
If someone can tell me how to use this JTAG port to inject the bootloader inside the flash, it would be very cool.
Thanks !
Click to expand...
Click to collapse
stop all those experiments. You will destroy your phone. Go to a Samsung Service Centre. It could help.
I can destroy the phone because i don't care about it, and, moreover, no one will cry if it burns/explodes/anything else.
I can do wathever i want on it.
By the way, by saying "whatever" i mean getting it back on its feet.
So i want to do it by myself.
I'm sure this is not much hard way to do it as there is already a JTAG port which can permits to talk directly with the CPU.
I found something from QUALCOMM : QPST (Qualcomm Product Support Tools) which is compatible QSC6270 CPU (inside the GT-I5800).
With that it is possible to flash firmware/bootloader etc directly inside the device !
simkard said:
I can destroy the phone because i don't care about it, and, moreover, no one will cry if it burns/explodes/anything else.
I can do wathever i want on it.
By the way, by saying "whatever" i mean getting it back on its feet.
So i want to do it by myself.
I'm sure this is not much hard way to do it as there is already a JTAG port which can permits to talk directly with the CPU.
I found something from QUALCOMM : QPST (Qualcomm Product Support Tools) which is compatible QSC6270 CPU (inside the GT-I5800).
With that it is possible to flash firmware/bootloader etc directly inside the device !
Click to expand...
Click to collapse
The phone is certainly dead. Bootloaders gone.
You have to buy a riffbox to do this as the bootloader repair files is contained by it. And I don t think you can get those anywhere else. Buy a Riffbox. Read the manual by which you can find out the pinout using voltage readings. You ll also get support on there wesite with the pinout. Once you get the pinout major problem is done.
Cool stuff this you are doing.
android.aimad said:
stop all those experiments. You will destroy your phone. Go to a Samsung Service Centre. It could help.
Click to expand...
Click to collapse
pls do not listen to the above post....
ur looking for somthing like this project -
http://forum.xda-developers.com/showthread.php?t=1000175
basicaly this is possible and can bring a brick of any form back to life...
i think u can achieve this! i also see some pins at the back of the phone
under the battery.....
i strongly advise you to read the FULL thread and search some more!!
if u achieve this we may even get an ubrickable mode!
u may need solderinng skills...
i dont know much but i will try to help!
dhirend_6d said:
The phone is certainly dead. Bootloaders gone.
You have to buy a riffbox to do this as the bootloader repair files is contained by it. And I don t think you can get those anywhere else. Buy a Riffbox. Read the manual by which you can find out the pinout using voltage readings. You ll also get support on there wesite with the pinout. Once you get the pinout major problem is done.
Cool stuff this you are doing.
Click to expand...
Click to collapse
In fact, i don't even know how to use JTAG port neither how to talk with the CPU by this port.
But, some people can manage to do it, i will ... !
I just need some people to help me with this, and after i will be able to release a software that can run on an arduino (for compliance with a lot of phone models) and, firstly, a flash program under windows that will use the COM port of the arduino to talk to the JTAG connected device.
simkard said:
and after i will be able to release a software that can run on an arduino (for compliance with a lot of phone models) and, firstly, a flash program under windows that will use the COM port of the arduino to talk to the JTAG connected device.
Click to expand...
Click to collapse
That will be awesome. For a start, you need to find out the voltages required so that you can access the ROM(PROM) of the bootloader to rebuild it. Will also need the varous voltages for the various pin outs. And I have absolutely no idea about that. Maybe someone with previous expierence and can help you. I doubt there are any in our G3 forum though. :/:/
dhirend_6d said:
That will be awesome. For a start, you need to find out the voltages required so that you can access the ROM(PROM) of the bootloader to rebuild it. Will also need the varous voltages for the various pin outs. And I have absolutely no idea about that. Maybe someone with previous expierence and can help you. I doubt there are any in our G3 forum though. :/:/
Click to expand...
Click to collapse
Ok, i know that the voltages seems to be based on +2.8V but someone managed to get it working fine on +3.3V (Arduino is able to deliver +3.3V, by the way, we can use a small component that allows conversion from one side +5V to another +3.3V (plugged by Vcc on the +3.3V of the arduino).
I must give it a try.
But, right now, i'm absolutely lost on JTAG way to talk on the lines.
Moreover, i just don't even know what can i do to flash something inside the CPU/FLASH (like bootloader only which will permit the phone to boots and enter download mode).
In fact, what i'm willing to do is :
Build a Serial RS232 (PC side) to JTAG (PHONE side) interface that permits to onl flash the BOOTLOADER part of the FLASH of the DEAD PHONE.
Perhaps it could be used directly on ODIN but i doubt that the flash software would talk the same way to the CPU/FLASH on a standard USB FLASH that it would talk directly connected thru the JTAG port on the PHONE MOTHERBOARD.
AdamOutler and his frnd did something similar like this for hummingbird devices
We talked and he said if he can get a diagram of g3 with the processor area enlarged would heli him determine - or you can just look it yourself - look at the pics he posted and compare
And yes they made a program to talk to the device and allow access to download mode - even on a fully bricked device - just needs a small mod - i hope you can do it - search for his thread for more info
The program is called Hummingbird Intercept BootLoader
I think it should work on our phones coz currently it works on s3c devices (samsung proccys only) so it must work with small mods on s5p
Good luck!
simkard said:
I can destroy the phone because i don't care about it, and, moreover, no one will cry if it burns/explodes/anything else.
I can do wathever i want on it.
By the way, by saying "whatever" i mean getting it back on its feet.
So i want to do it by myself.
I'm sure this is not much hard way to do it as there is already a JTAG port which can permits to talk directly with the CPU.
I found something from QUALCOMM : QPST (Qualcomm Product Support Tools) which is compatible QSC6270 CPU (inside the GT-I5800).
With that it is possible to flash firmware/bootloader etc directly inside the device !
Click to expand...
Click to collapse
ok if this is the case then I take my post back. I thought the one who gave you that wants it to be revived at any cost. If you can experiment anything with that then what you are doing is awesome. If you are able to inject a Bootloader you can make it to boot also.
But its risky, Still if you take chance you could bring up something new. By the way how this happend? Was the phone disconnected in download mode?
simkard said:
I can destroy the phone because i don't care about it, and, moreover, no one will cry if it burns/explodes/anything else.
I can do wathever i want on it.
By the way, by saying "whatever" i mean getting it back on its feet.
So i want to do it by myself.
I'm sure this is not much hard way to do it as there is already a JTAG port which can permits to talk directly with the CPU.
I found something from QUALCOMM : QPST (Qualcomm Product Support Tools) which is compatible QSC6270 CPU (inside the GT-I5800).
With that it is possible to flash firmware/bootloader etc directly inside the device !
Click to expand...
Click to collapse
good work but the qsc6270 is actualy only the call proccessor of the phone...
the cpu of the phone is s5p6442 which is a slight variation of s5p6440 which are
both made in-house by samsung....
---------- Post added at 12:25 PM ---------- Previous post was at 12:23 PM ----------
pls rename this thread and request to move it to the dev section!
this project belongs there!
android.aimad said:
ok if this is the case then I take my post back. I thought the one who gave you that wants it to be revived at any cost. If you can experiment anything with that then what you are doing is awesome. If you are able to inject a Bootloader you can make it to boot also.
But its risky, Still if you take chance you could bring up something new. By the way how this happend? Was the phone disconnected in download mode?
Click to expand...
Click to collapse
In fact, i don't know at all what happened to the phone.
I think it must have been injected by some kind of corrupted image.
As i don't know what happened directly to the phone, i know the guy who did the trick.
... And i know that he's a really mess up for electronics ... so i think he must has been using ODIN but he had used wrong files conducting the phone to be unbootable, and moreover : BOOTLOADER FAILED !!!
Everytime i flash a phone, the only thing i let on its place is the bootloader because if something happens during flash process : PROBLEM
And even if during flash process there is no problem, who knows if the bootloader injected is good ? perhaps it could be a dictionary page ?
I'm actually waiting for a part to come in my postbox.
This part is this thing : http://www.ort-jtag.com/shop.php?ID=32
With this, i will be able to connect myself (or anything other part of my body ) to the JTAG connector of the phone without destructing it by soldering like an old'parkinson guy !
But, i'm running into some kind of complexity with the flashing process because it seems that "AdamOutler and his friends" already worked on a similar case (different phone model // different CPU) and encountered an encryption problem.
I need the datasheet (detailed version) of the SAMSUNG Galaxy 3/Apollo CPU's for knowing if i'm running into some kind of problems ...
I hope that for uploading a bootloader there is no RSA keys needed.
If it is the case, then, i must say right now : it's dead.
Breaking RSA encryption is not the good way.
There are other ways (like bypassing code-signature) but i have to tell you guys that i'm not really expert in these techniques !
Will be back in a few days when i will receive the JTAG connector in my postbox...
---------- Post added at 09:27 AM ---------- Previous post was at 09:26 AM ----------
unreal3000 said:
good work but the qsc6270 is actualy only the call proccessor of the phone...
the cpu of the phone is s5p6442 which is a slight variation of s5p6440 which are
both made in-house by samsung....
---------- Post added at 12:25 PM ---------- Previous post was at 12:23 PM ----------
pls rename this thread and request to move it to the dev section!
this project belongs there!
Click to expand...
Click to collapse
Yes sorry, i made a mistake, what i really meant was the CPU.
So i must not had told you QSC6270 but instead : the famous S5P6442
simkard said:
In fact, i don't know at all what happened to the phone.
I think it must have been injected by some kind of corrupted image.
As i don't know what happened directly to the phone, i know the guy who did the trick.
... And i know that he's a really mess up for electronics ... so i think he must has been using ODIN but he had used wrong files conducting the phone to be unbootable, and moreover : BOOTLOADER FAILED !!!
Everytime i flash a phone, the only thing i let on its place is the bootloader because if something happens during flash process : PROBLEM
And even if during flash process there is no problem, who knows if the bootloader injected is good ? perhaps it could be a dictionary page ?
I'm actually waiting for a part to come in my postbox.
This part is this thing : http://www.ort-jtag.com/shop.php?ID=32
With this, i will be able to connect myself (or anything other part of my body ) to the JTAG connector of the phone without destructing it by soldering like an old'parkinson guy !
But, i'm running into some kind of complexity with the flashing process because it seems that "AdamOutler and his friends" already worked on a similar case (different phone model // different CPU) and encountered an encryption problem.
I need the datasheet (detailed version) of the SAMSUNG Galaxy 3/Apollo CPU's for knowing if i'm running into some kind of problems ...
I hope that for uploading a bootloader there is no RSA keys needed.
If it is the case, then, i must say right now : it's dead.
Breaking RSA encryption is not the good way.
There are other ways (like bypassing code-signature) but i have to tell you guys that i'm not really expert in these techniques !
Will be back in a few days when i will receive the JTAG connector in my postbox...
---------- Post added at 09:27 AM ---------- Previous post was at 09:26 AM ----------
Yes sorry, i made a mistake, what i really meant was the CPU.
So i must not had told you QSC6270 but instead : the famous S5P6442
Click to expand...
Click to collapse
this is what the cpu is based on -
http://www.samsung.com/global/busin...Info.do?fmly_id=835&partnum=S5P6440&xFmly_id=
they are both the mostly the same........
u can get the datasheet and user guide but u first have to request for it....
and if they say yes they u can get it...
simkard said:
I need the datasheet (detailed version) of the SAMSUNG Galaxy 3/Apollo CPU's for knowing if i'm running into some kind of problems ...
Click to expand...
Click to collapse
Many of us want datasheets of s5p6442.
You could have a look to s3c6410's Application Notes, the two chips seems to be "similar".
http://www.multiupload.com/SO87X4GKI7
marcellusbe said:
Many of us want datasheets of s5p6442.
You could have a look to s3c6410's Application Notes, the two chips seems to be "similar".
http://www.multiupload.com/SO87X4GKI7
Click to expand...
Click to collapse
seems there is a jtag debug port......
maybe we can find a similar one on ours?
Tried this?
http://forum.xda-developers.com/showthread.php?t=1119769
We all were wondering if it would work.. So.. Try and mention here quick.. We are waiting to be proud owners...
Alex664 said:
Tried this?
http://forum.xda-developers.com/showthread.php?t=1119769
We all were wondering if it would work.. So.. Try and mention here quick.. We are waiting to be proud owners...
Click to expand...
Click to collapse
Errr ... is it a just a bad joke or are you serious ?
pls people! that is only for softbrick!
btw any progress?
simkard said:
Errr ... is it a just a bad joke or are you serious ?
Click to expand...
Click to collapse
Uhh.. I'll take the answer as a NO...
Alex664 said:
Uhh.. I'll take the answer as a NO...
Click to expand...
Click to collapse
Sorry for my strict answer, but, i'm not part of people that asks dumb questions without searching first on forums/google.
So yes i tried it.
... And, as i'm really paranoid, i tried it another time this morning
But ... no luck, i've got a big black brick like new ... but "hard-bricked".
So i will try to make my way to the JTAG connector and deal with it.
The JTAG connector is coming by post right now.
What i have to prepare by the way should be the code for my arduino to be some kind of an "interface" between a serial port available on my PC and the JTAG connector of the CPU of the SAMSUNG Galaxy 3 (Apollo).
Scheme should be :
[PC]:USB.port <-> RS232:[ARDUINO]:JTAG.protocol <-> [SAMSUNG GALAXY 3]:CPU.jtag
What i don't know right know is : what the hell the communication looks like on the JTAG pins ?
What i understood right now is that there is 7 pins :
XjTRSTn - INPUT - TAP Controller Reset
XjTMS - INPUT - TAP Controller Mode Select
XjTCK - INPUT - TAP Controller Clock
XjRTCK - OUTPUT - TAP Controller Returned Clock
XjTDI - INPUT - TAP Controller Data Input
XjTDO - OUTPUT - TAP Controller Data Output
XjDBGSEL - INPUT - JTAG selection. 1: Peripherals JTAG, 0: ARM1176JZF-S Core JTAG
All of these works based on "IO Power" of VDDSYS.
Voltage must be : -0.5v < VDDSYS < 4.6v
The voltage which has to be used must be +3.3v.
On my Arduino; i can use some little circuit to BUFFER and ADAPT serial communication voltage from +5v to +3.3v. This shouldn't be a problem to do it.
I need someone to help me with communicating on a JTAG port/interface.
It seems that JTAG connectors are differents from one ARM version to another.
Moreover, i couldn't find any information to know the bits order, the clock, the mode, the returning clock, etc ...
I tried to have a look at the Linksys WRT54G/GS on which there was a great JTAG community for bricked devices.
Problem is that this kind of JTAG port is not standard.
No luck on this device !
But i found some precious information inside this PDF : http://www.jtagtest.com/downloads/viatap.pdf on page 7/15.
It talks about JTAG Waveforms ... which is what i'm exactly looking for !
Knowing this i can do some code on my arduino which will be able to create the waveform, establish the HIGH and LOW states on different pins.
For now, as i said, i have a lot of projects to work on, and, i must wait for the JTAG connector to come inside my postbox !
See you guys

SK4G Hacks

There are two hacks I want to do to my Sidekick 4g. First I want to swap the volume buttons and the charging port, cause its kind of a dumb layout and I end up hitting the volume buttons all the time. Also I would like to use docking stations and cant with the charger on the top of the phone. Second I want to add a flash to the camera. I don't know why they didn't include one it makes no sense. Any ideas? If there are any other interesting hacks you want to do or have done tell me about them. I will post pictures as soon as I get things all moved around.
I found a complete teardown of a SK4G on here so I'll use that as a atarting point. My dad knows electronics so he said he will give me a hand. I am currently searching Ebay for a second handset so I'm not tearing apart my daily driver for hacks. I will post all steps I take for everything, but I am still looking for advice from anyone who knows more about the SK4G.
Sent from my SGH-T839 using XDA
I think the flash is going to be really difficult. The flash I think uses a big cap to charge and then discharges it into the flash element. The problem is first getting the synchronization, too soon or too late and it is moot. Tying it to the button might work but you might need to insert a short delay (more electronics and room).
Moving connectors is probably the easiest to do. Really you need to remove the one from the board, solder some connections and run it to the new place. Routing the wire might be challenging because of the limited room but should be possible. The volume is going to be a comparable challenge, the buttons are likely on the board and very small but once you get them off all you have to do is wire them.
Thank you Giritrobbins! I didn't know that cell phones needed the flash cap too, I thought it was just an led. That will slow things down some but that saved me a unneeded headache.
Sent from my SGH-T839 using XDA
why i can not want to stop these hacks.

[Galaxy S] 3x Stratosphere, all broken screens; uses? Solderable TV-out?

So I had bought three Stratospheres for cheap (bundle auction), hoping that I'd be able to pick up another cheaply with a good screen or bad glass+good LCD. However, beings I've not taken one apart to that extreme I wasn't aware how hard it'd be to separate those pieces At any rate, they all work fine otherwise, I know at least 2 boot to Android since I eventually get the haptic vibration indicating it'd reached the unlock screen. I had also hoped that at the very least the Wiki would've been right about HDMI out, but it's hard to find out what all have full support (the Epic 4G [D700] I got instead for example has it mostly but no one's able to get it working).
New screens cost the same as a working Strat, and seeing as I already bought an Epic after finding that out, I'm wondering what to do with these. I love tinkering, so being able to solder in a Composite, VGA, DVI, HDMI video connector and use it as a self-powered Stick Computer would be seriously awesome.
I'll gladly take hi-res PCB photos, with a DSLR and ample (non reflecting) light, if folks want to help tackle this Hell, for that matter... if you've got the know-how and want give it a try, I will give you one of these Strats to see what you can figure out. These aren't like the Epic as far as PCB goes, either. That Epic is very tiny and a fraction of the phone's size, but these Strats are pretty much the full phone's length and width, so lots to play with lol
Anyways, hope someone knows a thing or two and we can figure a hack out!
Thanks.
EDIT: This just came to me...What about something like these, in conjunction with a ROM (preferably Odin flashable) that has USB Hub support?
http://www.monoprice.com/products/subdepartment.asp?c_id=101&cp_id=10114#1011403
Unfortunately it isn't driverless, BUT it does list Linux support, at least on the VGA model! More than I'd like to spend given the project, but we can call that Plan Y (Plan Z being: buy a new screen lol)
Ez way - how about flashing with some latest ROM and enabling tvout (with help of screenshots from DDMS)
Then you can connect any cheap stuff decoding pal/secam and maybe an otg keyboard/mouse + power chord through hub or straight to the batt slot.
The tryhard way - you could try to exploit screen flex slot. You should find 16/24bit rgb dpi'ish interfrace there + 2 i2c/spi busses and some gpios. Maybe utilising it as 16bit rgb going to sort of converting circuit could leave you with like ~15gpio pins for mostly any kind of stuff u want (spi, i2c, irqs). You need a good breakout for that and gotta consider high frequency layout (as rule of thumb, try to make wires between consecutive ICs as short as possible and equal length)
Capabilities and possibilities are unlimited. Just human's imagination and life is.
Id be careful with usb-dvi converters. Might work. Might not. Check with otg keyboard or smth first.
Rebellos said:
Ez way - how about flashing with some latest ROM and enabling tvout (with help of screenshots from DDMS)
Then you can connect any cheap stuff decoding pal/secam and maybe an otg keyboard/mouse + power chord through hub or straight to the batt slot.
The tryhard way - you could try to exploit screen flex slot. You should find 16/24bit rgb dpi'ish interfrace there + 2 i2c/spi busses and some gpios. Maybe utilising it as 16bit rgb going to sort of converting circuit could leave you with like ~15gpio pins for mostly any kind of stuff u want (spi, i2c, irqs). You need a good breakout for that and gotta consider high frequency layout (as rule of thumb, try to make wires between consecutive ICs as short as possible and equal length)
Capabilities and possibilities are unlimited. Just human's imagination and life is.
Id be careful with usb-dvi converters. Might work. Might not. Check with otg keyboard or smth first.
Click to expand...
Click to collapse
So TVOut on the does actually Stratosphere work? (with a custom ROM, I mean)
You happen to know where to find such a ROM? I know that XDA doesn't have a Strat subforum I've looked high and low, and can barely find custom ROMs, let alone one that's TVout lol Everything is still Gingerbread based, but I suspect that doesn't matter since the hardware is from that time.
As for the latter, I actually hadn't realized that without a screen, I'd be without a MOUSE haha I was totally focused on it having a slider keyboard and somehow missed I'd still need a mouse Nevertheless, doing it myself would be pretty hard :\ I don't know that much about the finer details of hardware, at least circuits of that complexity. Modding an analog audio circuit with new capacitors or an OpAmp is one thing, but that's straight forward In-Out, Power-Ground lol
That isn't to say I wouldn't attempt it but I'm not sure exactly what would be needed. If it's LVDS, I do have an older 15" laptop screen that'd be cool to hack a Strat to use :cyclops: That's adding a bit more complexity to things though, at least to start with right out of the gate.
Sadly I dont know where to get Strat ROM. But I assumed that its HW is pretty much the same as I9000, except the additional keyboard, so aries kernel with patches might/should/could work. There shouldnt be any major problems in porting it. I would get these crappy Sammy sources for I405 and I9000, diff them and try to apply diff on kernel_samsung_aries repo of CM.
About TVOut - it is matter of one or two gate ICs and a jack sensing onboard, as S5PC110 has built in tvout signal generator. So I would expect HW to support it.
Edit: There should be some tvout handling in original kernel sources if it is supported. Though, knowing Sammy, there might be aswell tvout driver enabled but HW not wired at all to support it.

Help to reprogramming of temperature data loggers - TempTale 4 USB

Foreigner here, please be kind =)
Hello everyone, good morning, good afternoon and good night!
Recently I have received some orders for laboratory supplies accompanied by a temperature Datalogger that performs the recording and storage of the temperature history for 11 days.
I've been researching the model and it is for single use and disposable (TempTale 4 USB - Dry Ice version by Sensitech)
I also discovered on some foreign websites that although there is software from the manufacturer to "unlock" the device for later reuse, the acquisition is not compensated due to the low value and the existence of other reusable models of the brand itself (Sensitech).
As this model came by surprise in my hands and no one has other uses for it, I decided to disassemble it and analyze its hardware. It has an Atmel controller that in my opinion could be reprogrammed to reset the programming or even unlock it for other uses.
If possible, I would like to count on the help of experts here on the forum for this. I believe I have come to the right place for this!
I leave some internal and external photos of the device for you guys
drive.google.com/drive/folders/1kON9AvEiRVNXjbIdCbus7JY8tHV3H36N?usp=sharing
It is worth mentioning that it has an interesting system that when connecting to the computer automatically generates a pdf report with all the data and graphs of the temperature record and another .ttx file that I still don't know what it is. Both are also in the drive folder for you to look at.
Hello there, your thread is kinda old by now but I am working on this myself.
Unfortunately I cannot provide you with the software for Sensitech dataloggers due to it being a bit risky, I do not want to get into legal trouble with Sensitech or getting fired for a hobby project. However even with the software you won't be able to reset one without somehow altering the chip contents. It will give you an error message that the dataloggers are meant for one time use only and cannot be reprogrammed.
The way to reset them is to manually erase the content of the ARM chip on the board, I don't know much about microchip programming but I have gotten it to work myself completely by accident. Probably by measuring each pin with an oscilloscope probe I have somehow corrupted/erased the programming on this chip. After that a red light started blinking and the word SET appeared on screen. After that I was able to reprogram them.
The TTX file is a more detailed database of the temperature logs, from which you can extract CSV files and do some sort of fancy graph displays and all that. The PDF is just for general overview.
You have a different model than the ones I get though. I have found that by shorting the Winbond chip and rebooting the device (shorting the battery connector briefly) it goes into some sort of error state. The screen will blink and every time you press Stop the actual temperature will be displayed on the screen. I do not know if your model has this too.
Is anyone still working on this? I have an interest in discussing repurposing a temp tale and would like to discuss

Question Question regarding refreshing a corporate laptop to remove requirement to login with corporate email on startup screen

I'm totally stuck. I have a work laptop that requires a corporate email to login to the laptop. I now want to use the laptop for my personal use and remove ALL corporate restrictions etc.
I have done everything I could think of (including a complete format, removing the battery CMOS and regular battery, and messing with the BIOS and other preboot configurations), but nothing works! Eventually, the computer goes back to the original windows startup screen requiring a corporate email to login.
It's almost as if there is some sort of hardware or hard coded programing that ensures the computer uses a corporate email to gain access to the laptop.
I almost feel like even if I buy a new HD and replace it, the problem will still exist.
Can anyone please provide some insight?
Is a Lenovo Carbon X1
Thank you....
You already answered your own question unfortunately my friend.
Hard-coded into the CMOS.
Google "short circuit SDA & SCL pins on security chip" for your EXACT make and model.
I had success with a ThinkPad p41 recently.
Failing that, you WILL have to talk to the sys admin from your job, as they have the unbinding protocol for every PC bound to their network.
That kinda security is EXTREMELY difficult, usually impossible, to circumvent without the unbinding protocol.
Best if luck, and post back if you are or are not successful, or have more questions.
Promise I'll answer WAY faster than 2 weeks next time, ok??
Oh, and buying a hard drive definitely won't help! Lol! Because again, it's hard-coded into a security chip right on the motherboard. A chip that contains non-volatile memory, meaning even if you remove the battery it's still there!
That's the reason the only POSSIBLE workaround (it's a hit or miss kinda thing...) without the unbinding protocol is shorting most two pins out.
Now I stated in bold letters EXACTLY your make and model, because not just Lenovo, but most companies tend to move those pins around on the security chip, from model to model, year to year, ON PURPOSE, because if you get the wrong ones The security chip will release a puff of the stinky magic smoke, and your motherboard is finished.
Just take your time you'll be okay, so long as you didn't drink a pot of coffee beforehand! Lol!

Categories

Resources