Related
Hi,
as i wrote in another thread, i purchased a bricked A101.
There's no response from the system so i decided to start investigation on the hardware .
A101it chipset information:
Processor
• Ti OMAP3630 (515-pin CBB/P BGA package) ARM Cortex A8 at 1 GHz with DSP
• POWERVR SGX530 Graphic accelerator: 3D OpenGL ES 2.0
Memory
• 256MB LPDDR SDRAM (168-pin PoP BGA package) soldered on top of OMAP3630
• 8/16GB eMMC (169-pin BGA package) connected to OMAP3630 internal mmc2 interface
Interfaces
• USB slave 2.0 (OMAP3630 internal interface, MicroUSB connector)
• USB host interface (TPS65921 host interface, TYP A connector)
• Micro SD slot (OMAP3630 internal mmc1 interface, SDHC compatible)
Display subsystem
• ChiMei 10.1" TFT-Display N101L6-L02 (18Bit-LVDS interface)
• Ti SN75LVDS83B LVDS transmitter (56-pin BGA package)
Touchscreen subsystem
• Pixcir capacitiv touchscreen unit (TR16C0 controller, USB interface)
• Ti TUSB2551A USB transceiver (16-pin QFN package)
HDMI subsystem
• NXP TDA19989AET 24-Bit HDMI transmitter
• HDMI output (19-pin Mini HDMI connector)
Communication
• Ti WL1270/1 WiFi (802.11 b/g/n)
• Ti WL1270/1 Bluetooth 2.1 EDR
Miscellaneous
• Built-in speaker
• Built-in Microphone
• Freescale MMA7660FC G-sensor
• Omnivison OV7675 VGA camera (0.3M)
Power source
• Ti TPS65921 power management chip
• Intersil ISL9220 LiPo charger
• Internal: Lithium Polymer battery
• External: 5V/1A Power adapter/charger
To get some detailed informations about these chips, i made a sweet datasheet collection.
Grab the zip-file here.
TBC...
EDIT: The brick issue is solved.
The platform did not boot up due to a broken connection to onboard RAM.
This thread will present various hacks and other stuff a geek might have fun with
Read on for some more information.
So here's my first result:
I successfully located the sys_boot signals of the OMAP3630.
I made a first test by changing the default boot mode.
With sys_boot5 pulled high the boot order changes to peripheral boot first.
In other words you may use this tool to directly access the OMAP memory (e.g. RAM).
In theory it should alos be possible to boot the device form external microSD as well, but at factory default the microSD slot is covered by power management. In other words, power is switched off at boot time.
This could be hacked as well
My attempt will be to un-brick my device by using external boot mechanism.
Maybe i'll need some help at a later point!
EDIT: Peripheral boot modes had successfully been verifed.
It definitely works on the Archos 101. Perhaps this may be useful for some open bootloader project.
Aynway, i already discovered some other things, that might be helpful for hardware hackers. So if you are kind leave a comment or ask some questions.
Stay tuned!
scholbert
Oh, that's interesting ... I don't know anything about hardware hacking but I'd like to learn hope you will show us ... keep on the good effort ... and I'll keep an eye on this tread .... might come handy ... jejeje
sounds great, keep on rolling
peripheral boot
Hi,
thanks for your replies.
So as expected using peripheral boot over USB/UART is working (sys_boot5 pulled high).
At least the ASIC ID is send correctly and the initial communication starts.
See the screenshot attached.
Flash V1.6 also got a eMMC driver included.
So this could be the way .
Right now there's an error message:
Code:
Unknown status message 'dKAYd 2nd stdrted?' during peripheral boot (waiting for 2nd)
I guess the response should be: OKAY! 2nd started?
EDIT:
MMMh strange... i'll have to find out who is generating this message.
If it is comming from OMAP the SDRAM setup should be verified.
Seems that the LSB byte stuck @ 0x64.
Code:
dKAYd 2nd stdrted?
ascii = dKAY -> hex = 0x59414b64 (msb..lsb)
ascii = d 2n -> hex = 0x6e322064
ascii = d st -> hex = 0x74732064
ascii = drte -> hex = 0x65747264
ascii = d? -> hex = 0x00003F64
See the session log file for more details!
Anyway i justed started to play around... maybe some tweaks in the configuration are needed
Have fun!
scholbert
Pretty Cool
Thanks for attesting coolness
Made some further tests... though my time is really limited right now.
I found out that the message is send from 2nd loader which is used for Ti's Flash tool.
So this might indicate that there's something wrong with my memory or memory bus.
I re-checked the RAM setup sripts for the Ti tool again but could not find any error. Reduced the timing as well. Still got that message...
It's very strange that the pattern really seems to stick, which is unusual for damaged memory... i will report further findings.
Anyway this is open discussion, feel free to post
Cheers,
scholbert
Nice try. Can you tell us about the RAM, it's built in the mainboard or changable?
We already know that, it's built-in ^^
(some have opened their Archos before ^^)
trungvn1988 said:
Nice try. Can you tell us about the RAM, it's built in the mainboard or changable?
Click to expand...
Click to collapse
http://forum.archosfans.com/viewtopic.php?f=74&t=42806
Soldered on, not changable by anyone with home soldering tools. Very small ball soldering. I gave it an attempt, even got a replacement 1GB RAM module as a test piece... Didn't work out well for me.
I'll definitely be keeping an eye on this topic, seems like some good information might come of it.
.............yippie yeah it's working out!!!!
Thanks for the feedback
First i'll have to quote myself:
It's very strange that the pattern really seems to stick, which is unusual for damaged memory... i will report further findings.
Click to expand...
Click to collapse
Guess what...... it's fixed!!!!!
I really go crazy. See attached log file.
External boot over USB and 2nd loader started up successfully, using the Ti tool.
So RAM is working now!
This definitely saved my day...
What happened exactly?
As i pointed out, the data on memory bus stucked at 0x64, so i assumed there was an issue with DQM/DQS signals on PoP memory.
See some related documents about the function of these signals on RAM chips.
The DQM/DQS where not toggled in the right way because of bad soldering at the PoP memory chip.
See the attached pic for the excact position of these signals (marked in red).
The chip itself is soldered on top of the OMAP3630.
In the end i used a hot-air solder gun and soem soldering flux and fixed the broken connection. In fact i used this "technique" some time ago to fix a "No GSM" issue on HTC Hermes.
Though i'm very excited right know, i'll have to make a break for today, because i have a date
Harfainx said:
I'll definitely be keeping an eye on this topic, seems like some good information might come of it.
Click to expand...
Click to collapse
Yes i'll try my very best
Kind regards,
scholbert
Guy, it's so nice! Keep up the good work!
datasheet collection
Hey,
i was lucky last week. My device is up and running.
Fortunately the eMMC data structure was O.K. In the end my device refused to boot, because of that broken connection to the RAM.
So there'd been no need to fiddle around with eMMC for now.
Maybe i'll do some investigation at a later point.
Feel free to set up your device for peripheral boot and try the Ti Flash tool debugging possibilities.
Right now i decided to re-assemble the device and use it for a while.
I must assume that i know nothing about the internal structure of the firmware. So it would be essential to get some insights
I got some additional information about the eMMC/microSD data lines.
If there's some interest i might post further pics.
To get some background about the chips on the A101 mainboard, i collected some datasheets of the main components.
Grab the zip-file here.
Most of them are easy to find other's are not
Anyway, saves your time i guess.
BTW, is there any tool to unpack gen8 AOS files?
Regards,
scholbert
yes it would be great if we could find one, maybe we could find a way to get inside and change some things
scholbert said:
...
Most of them are easy to find other's are not
Anyway, saves your time i guess.
BTW, is there any tool to unpack gen8 AOS files?
Regards,
scholbert
Click to expand...
Click to collapse
As far as i know we can't extract aos files since they are encrrypted and we don't have they proper KEY - its saved inside the device somewhere
But good luck with going on! Rly sounds interesting who knows what it's good for in future
good news - check out:
http://forum.xda-developers.com/showthread.php?t=1214674
seems we got a way to extract soon
..... uuuh great!!!
FrEcP said:
good news - check out:
http://forum.xda-developers.com/showthread.php?t=1214674
seems we got a way to extract soon
Click to expand...
Click to collapse
Yupp, that's awesome. I just joined that thread.
In the meantime i disassembled my device again, because i want to spent some more time on research.
I found out some more details about the chips and the design in general.
The A101 seems a pretty neat device for extensive hacking, because archos did a good job and made a very clear design.
I started to prepare a pin map by looking at the kernel sources again.
Maybe i'll be able to find some other useful testpoints on the mainboard (e.g. UART2)
As you might know, the touchscreen is connected to USB using OHCI mode.
To attach it to the OMAP ports they also used a chip from Ti.
See this datasheet for more information:
http://focus.ti.com/docs/prod/folders/print/tusb2551a.html
If i'll find some time i'll try to make kind of a floor plan from the mainboard and post some pics as well.
P.S.: If someone knows the manufaturer of the speaker drivers, please tell me! The parts are marked as 8JAM892 and are located near the soldering points for the speaker.
Keep on hackin'
scholbert
What I would like to find out is what component it is that dies when the USB port fails (and it stops sleeping as well). Maybe it's replaceable (if you can do SMD soldering).
pbarrett said:
What I would like to find out is what component it is that dies when the USB port fails (and it stops sleeping as well). Maybe it's replaceable (if you can do SMD soldering).
Click to expand...
Click to collapse
Mmmh... without being affected by this issue it's hard to tell.
If the port dies, there could be many reasons of course.
Maybe the 5V power supply for Vbus is dying on these devices, due to "over-current" issue. I have not identified that part right now.
The signal lines itself usually won't be harmed... apart from injecting ESD pulses right to the connector.
The USB host port is directly connected to data lines of the USB PHY inside TPS65921 (Power Management chip).
OMAP3630 itself uses ULPI mode to connect to this part.
That's all i could say for now.
Regards,
scholbert
FrEcP said:
good news - check out:
http://forum.xda-developers.com/showthread.php?t=1214674
seems we got a way to extract soon
Click to expand...
Click to collapse
If we can't extract those AOS files - how are custom ROM builders such as $auron getting their hands on the upper layer of the firmware? I know I am not expressing myself technically correct, but what I understand is that for instance $auron's UrukDroid is a custom Linux kernel etc. with on top of it the modules, GUI etc of the official Archos packages...
you don't need to extract the aos file to get the filesystem of the archos android. you simply have to root your device or just install angstrom (which comes with SDE) and then you can copy the squashfs file to your computer so you can extract whatever you need. it's not encrypted but signed, you only have to skip the first 256 bytes (if I remember correctly) of the file to get a valid squashfs image.
The Samsung Anyway Jig
Summary: Some information and pictures of the mysterious Samsung Anyway Jig
Skill Level: Medium
==================================================
Do NOT post questions/requests on how to obtain one, they
will not be answered. (Because I have no idea, since its
Samsung proprietary test equipment!)
Do NOT post links to commercial jigs, unless you also post
the internal schematics, in such a way that it can be easily
constructed at home.
If you already have a working home-made multifunction jig
that you would like to share, please remember:
- a picture of the device
- a picture of the schematics
- a detailed parts list
- the phone/models it applies to
- any other relevant features to make it work
==================================================
Purpose
As custom ROM flashing become more and more popular, the XDA-forums are
continuously bombarded with questions and answers on how to debrick their
devices, often using (what used to be) professional hardware analysis and
debugging equipment, like vendor provided JTAG, JIG and software flashing
tools. These tools used to be only available to certified technical repair and
support centers, closely connected with the various phone vendors. However,
this scenario is rapidly changing as more people are getting higher technical
skills, while using these devices and tools on their phones.
One particular such device, provided by Samsung, has been used for years to
program, customize, repair, debug and unbrick essentially all available
Samsung phones. This blue box is called the "Samsung Anyway Jig", and somehow
Samsung has managed to hide it from public scrutiny and analysis, which have
elevated this device to an almost mythical status. At least for the common
person wishing to repair or modify his phone. Probably because Samsung have
realized that there is a great profit to be made, by having their customer
sending their phones in for repair, rather than letting them in on the simple
secret on how to do this kind of repairs themselves. This behavior have also
been a great joy for the few professional service centers that actually have
access to this device (or similar devices) or who were able to figure out how
it works, making it into a million dollar industry, and obviously without
sharing their knowledge to the public.
Thanks to great community oriented websites and forums like XDA and others,
the public awareness have increased to such a level, that today anyone (with
minimal soldering skills) can build a multifunction and debricking JIG. And
because of the increasingly better standardization among mobile phone
manufacturers, very few modifications are needed for this device to be working
with essentially any modern mobile-phone on the market.
This thread is an attempt to better understand the Samsung Anyway Jig, such
that one can build his/her own Jig, with the information contained herein,
together with many other publicly available documents. It shall be noted that
I do not have access to this device, and I have neither factual data, nor
info, on how this thing actually works. But I do have a very good idea!
Close inspection, of the only 3 (!) images found, as obtained by Google Image
Search (which I am growing increasingly unhappy with), provide a good start
for what is going on in that device.
The Anyway Versions
The Anyway Jig come in slightly different versions. And since I only have access
to 4 pictures, I cannot tell what other versions are available. However, I
noticed the following:
Code:
[SIZE=2]Version PartNumber Variation/Note
-------------------------------------------------------------------------------
S100 Doesn't have "EMP" Solution
S101 GH99-36900A Has "EMP" solution. Is used with GT-S7230 (Bada OS)
S102[/SIZE][SIZE=2] GH99-36900B [/SIZE][SIZE=2]1.2A High-Current version for Tabs & Tablets
[/SIZE]
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
So let me first reproduce the text as seen on the photo of this box:
Code:
[SIZE=2]
| Function
-------------------------------------------------------------------------------
No Solution | Mode OFF ON
-------------------------------------------------------------------------------
1 Agere TC | Boot Low High
2 Hp, Vision, Infineon | SDS O X
3 NXP Sysol | USB O X
4 NXP Swift Broadcom | DBG X O
5 UMTS (Qualcomm) | M-USB Use Not Use
6 EMP | ID type UART USB
7 - | ID-BOOT Boot-On Boot-Off
8 - | - - -
9 - | SDS TRX - Loop
10 - | DBG TRX - Loop
-------------------------------------------------------------------------------
| O = Connect, X = Disconnect
[/SIZE]
"The Solution"
The first thing to notice, is that the "Solution" column is completely
independent of the "Function" column. The "Solution" column seem to refer to
the manufacturer of the modem hardware used in the device, usually the
cellular/baseband processor (CP/BP) used by your phone or the modem chip in
routers etc. You can find out what you have by using the methods I have
outlined in the thread: "Phone/Modem Hardware Cross Reference List".
Once you know what you have, you use the 10-pole (BCD?) rotary micro-switch,
as shown in the picture below, to set it to the number corresponding to your
phone modem. (The settings in that picture, corresponds to a Samsung Wave
[GT-S7230] which has a Broadcom BP and thus the rotary-switch is set to #4.)
But according to this document, for attaching a [GT-I9000], you need to set
it to #2 (for Infineon).
It is unclear at this point whether or not this setting is actually changed
much when using various modern phones. It is more likely that this is used for
backward compatibility to older phones that use older connectors, and that new
phones all use the same setting since most of them, now use micro-USB
connectors. Otherwise it simply wouldn't make sense to use a
micro-rotary-switch, especially considering the vast number of modems chips
available today, while the uUSB standard connectors doesn't allow other
signals.
"The Function"
As you have already noticed, next to the rotary switch, there is a 10-pole DIL
switch, that is used to set the Jigs "Function", or behavior. The table above
show the various functional options available, that you can use for the JIG.
Although it is unclear what all these functions actually does, without access
to a box or manual, we are free to make some educated guesses.
Here we make the following (rather wild) guesses as what the various modes does:
Code:
[SIZE=2]DILpos Mode Typical What Description-Guess
-------------------------------------------------------------------------------
1 Boot 0 Low ??
2 SDS 1 X ??
3 USB 0 O ?Enable/disable USB pass trough: [target]--->[JIG]--->[PC]
4 DBG 0 X ?Enable/disable debug by "port":
5 M-USB 0 Use ?Enable/disable modem USB connection
6 ID type 1 USB ?"Interface Dongle" output-side selection (wheter to use the USB or UART to connect to PC)
7 ID-BOOT 0 Boot-on ?Determines if the device should bootup/start when connected to the JIG.
8 - - - -
9 SDS TRX 0 - ?Enable/disable Loopback on this interface
10 DBG TRX 0 - ?Enable/disable Loopback on this interface
-------------------------------------------------------------------------------
where (0==OFF, 1=ON) of the 10-pol DIL switch,
while "O" is connect and "X" disconnect.[/SIZE]
If you have any knowledge of what these does, please let us know. For example,
I like to know what the "SDS" refers to and what it is/was used for?
Then What?
So how interesting is this, for our modern Android based and micro-USB
connected phones, on a scale from 1-10? Probably not much more than 3.
Because most of the device magic happens inside the phone, determined by
various internal multiplexers (MUX), resistance/capacitance detectors, the
Power Management IC (PMIC) and related device drivers.
The most important thing to understand, is that today there are very specific
standards regarding what functionality is offered and expected, given certain
conditions on the micro-USB signals. For example, shorting the D+ and D- USB
signals, tells your phone to start charging, using the VBUS and GND lines.
While a resitive short between the micro-USB lines ID_CON (pin 4) and GND
(pin-5), allows and selects a wide range of functionality from remote control,
debug mode, download mode, audio/video transfer and everything else you may
want to do. These are some of the things we would like to focus on here.
So what is more interesting, is how we can build a JIG that is much more
modern and useful than this old dinosaur, that can provide us with a fully
controlled set of the functions mentioned above. So if you still dream about
getting one, forget it and build your own! Below I will link to a list of DIY
multifunction JIGs. That means I only list serious JIGs that contain a little
more functionality, than just a resistor. Post if you have something worth
showing.
Useful Resources
*Fun with resistors (home/car dock mode + more)
Lets Save Some Bricks
*The Captivate Development Platform mod AKA UnBrickable Mod
Set up a Captivate for Samsung Bootloader Development
The Vibrant Development Platform AKA UnBrickable Mod
USB Jig FAQ (Frequently Asked Questions) [4/4/2012] ICS bootloader added
Galaxy S UART JIG & Debugging Connector
Complete USB2.0 Specifications (>13 MB, 30 files, main: 650 pages)
USB Battery Charging Specifications 1.2 (71 pages)
FSA9280A Datasheet (Used in SGS1)
FSA9285 censored Datasheet ()
FSA9485 censored Datasheet ()
FSA3200 Datasheet (Used in SGS2)
---------------------------------------
* Strongly recommended reading
Let me know of any dead links.
Here is an internal photo of the original Anyway S100.
Keywords: jig, samsung, anyway, resistors, multiplex
UPDATE: 2012-10-24
Anyway Software, Drivers and Manuals for:
Anyway D100 (8 port factory jig)
Anyway S100 (1 port factory jig)
Can be found for download in Post#67 ...
Building your own multifunction JIG
The first thing you need to know, when building your own jig, is how various
resistor values determine the behavior of your phone. Below is a list of
resistor values used in the FSA9280A multiplexer chip. These values have been
become a bit of a standard for new Samsung phones and are thus likely to
remain true also for new models and many other devices running AOS. In
post #3 we use these values to build our Resistor Banks.
FSA9280A/88A Resistor Value Functionality
ID_CON Accessory Detection Table (ID_CON resistance to GND):
Code:
[SIZE=2]ADC-reg Min Typ Max Attn Accessory Detected
-------------------------------------------------------------------------------
00000 GND [COLOR=Red]GND [/COLOR]GND ! Host Mode / OTG (On-The-Go)
00001 1.9K 2K 2.1K Audio Send/End Button
00010 2.47K 2.604K 2.73K Audio Remote S1 Button
00011 3.05K 3.208K 3.37K Audio Remote S2 Button
00100 3.81K 4.014K 4.21K Audio Remote S3 Button
00101 4.58K 4.82K 5.06K Audio Remote S4 Button
00110 5.73K 6.03K 6.33K Audio Remote S5 Button
00111 7.63K 8.03K 8.43K Audio Remote S6 Button
01000 9.53K 10.03K 10.53K Audio Remote S7 Button
01001 11.43K 12.03K 12.63K Audio Remote S8 Button
01010 13.74K 14.46K 15.18K Audio Remote S9 Button
01011 16.4K 17.26K 18.12K Audio Remote S10 Button
01100 19.48K 20.5K 21.53K Audio Remote S11 Button
01101 22.87K 24.07K 25.27K Audio Remote S12 Button
01110 27.27K 28.7K 30.14K Reserved Accessory #1
01111 32.3K 34K 35.7K Reserved Accessory #2
10000 38.19K 40.2K 42.21K Reserved Accessory #3
10001 47.41K 49.9K 52.4 K Reserved Accessory #4
10010 61.66K 64.9K 68.15K Reserved Accessory #5
10011 76.1K [COLOR=Red]80.7K[/COLOR] 84.1K ! Audio Device Type-2
10100 96.9K [COLOR=Red]102K[/COLOR] 107.1K ! Phone Powered Device
10101 115K 121K 127K TTY Converter
10110 143K 150K 157K UART Cable
10111 190K 200K 210K Type-1 Car Kit Charger*
11000 242K 255K 268K Factory Mode Boot OFF-USB
11001 292K 301K 316K Factory Mode Boot ON-USB
11010 347K [COLOR=Red]365K[/COLOR] 383K ! Audio/Video MHL Cable**
11011 420K 442K 464K Type-2 Car Kit Charger*
11100 507K 523K 549K Factory Mode Boot OFF-UART
11101 588K 619K 650K Factory Mode Boot ON-UART
11110 750K 1000/2K 1050K Audio Device Type-1 with Remote
11111 - Open - Slave Mode / Charger Mode***
-------------------------------------------------------------------------------
* USB Car Kit specification: ANSI/CEA-936-A.
** USB MHL (Mobile High definition Link)
! Attention, when these values are used, all pin functions
changes. Having the wrong device connected in this mode, may
short and brick interior phone chips.
-------------------------------------------------------------------------------
[/SIZE]
There is a good reason why some resistor values are marked as "DO NOT USE", in
the original FSA9280A datasheet. That reason is because these values trigger a
signal path switch (by cascading multiplexers), in such a way that the
original 2-5 USB (cable) signals no longer exists as such. If this occurs,
when you have another type of device connected, than what was intended for
that function, you risk short-circuiting and bricking the relevant internal
chip that is driving that function. The best example is the MHL function. When
MHL is activated, all mUSB pins become part of MHL signal lines. If during you
happen to have a dedicated charger connected instead of a dedicated
mUSB-to-HDMI cable, you will for sure burn out your MHL Transmitter chip (or
possibly any other chip using those signals in that path). Why? Because a
dedicated charger has D+ and D- pins shorted, while its trying to provide +5V
(@1.2A) on pin-1. This at the same time the MHL chip is trying to provide
various output signals on all 5 pins!
Factory Mode Auto-Configuration Table (1% Resistors on ID_CON Pin):
Code:
[SIZE=2]Configuration Boot VBUS DP_CON DM_CON ID_CON BOOT JIG
-------------------------------------------------------------------------------
FactoryMode 0 (UART) On Open RxD TxD 619K HIGH LOW --> Triggers "Dock Mode" (Google Car Home)
FactoryMode 0 (UART) Off Open RxD TxD 523K LOW LOW -->
FactoryMode 1 (USB) On Closed DP_Host DM_Host 301K HIGH LOW --> Triggers "Download Mode" (aka "Debrick/Recovery JIG")
FactoryMode 1 (USB) Off Closed DP_Host DM_Host 255K LOW LOW -->
[/SIZE]
In addition to the above resistor values based on just that one chip, and mainly used by Samsung, there is an international standard specification for Battery Charging. In these spec's there are three additional values to consider.
Battery Charging 1.1 Specifications
(May need to be verified...)
Code:
[SIZE=2]DCP: USB Dedicated Charger Port RID_A = 124K
CDP: USB Charging Downstream Port RID_B = 68K
SDP: USB Standard Downstream Port RID_C = 36.5K
where RID = "Resistor Identification"[/SIZE]
List of DIY multifunction JIGs
UberPinguin's Multi-R Jig
Another nice I9100 UART JIG (chinese)
DHylands SGS2 Serial Adapter and Console
Recommended UART Cables
FTDI's "Chipi-X" USB-to-RS232 Cable
Good to Know
Android D2XX FTDI Driver
"Build your own Music dock" [Samsung]
The Dancing MyWay Jig
< here be dragons 2 >
Dude! excellent find. Holy Hack!
you may have seen this thread.. http://forum.gsmhosting.com/vbb/f200/who-used-samsung-anyway-jig-1347210/
that Duc guy may have some info.
someone also links to a user manual where you can see more of that puppy in action.. http://samfirmware.webs.com/I5801_Flash_Tutorial_English.pdf
enjoy. ciao.
^^ Yeah, thanks, but most of those links are dead and the "manual" is just an old standard flashing/service manual. In fact I got the above pictures from some other service manuals. Finally, I don't like having to register to a website, just so that I can see some images.
I do have a AnyWay S100 jig here that i got when samsung support left the place i work. I think i can get a hold of all the cables that they had for it. If i remember correct there was never a micro usb cable tho. But if you want i cna open that puppy up and provide pictures of the inside of the jig. also it could be nice if i could find a way to make a micro usb cable for it...
ParanoidDK said:
But if you want i cna open that puppy up and provide pictures of the inside of the jig.
Click to expand...
Click to collapse
Yes! We'd love to see what's inside! Chips, and wiring etc!
Do you happen to have any windows software drivers for the device? (Why? Because of this.)
Making a micro USB hack would be easy...if you have the right tools or a micro-USB breakout PCB. Just remember that most micro-USB to USB cables do not have the USB_ID line in the cable, but is immediately shorted inside micro-connector. You could get a micro-to-mini-USB cable, that should also include the USB_ID (aka ID_CON) line, but these are hard to find as they are not conforming to common USB cable standards.
Well the usb cable should be the least thing... And if i make one i might just as well make one from start with a micro usb plug, cable and the printer plug in the other end... I think i might be able to use the cable for one of the older samsung phones i have for the box as start point...
i have a print i need to make and then i will open up the box and start to take some pics with my SGS3 just so you can get a preview of the inside...
An anonymous and friendly contributor have come forward with a little bit more information, although not very useful.
1) The S102 model is modified to allow a higher current as used in Tablets.
2) The manual "Function" settings can now be made in software, and is no longer used. (Well then, how is it set in software?)
3) The "Solution" for Galaxy models should be set to "NXP Swift". (But this contradicts the Service Manual for the GT-I9100 and others! But is probably explained by the different BP's used in those devices.)
We need internal pictures! (or the schematics)
Here is some pictures of the internals from the S100 i have here. Proberly not the best ones but the best i can take with my cam... If i have to take better ones i will have to get my friend involved with his DSLR.
I had to upload them to my server as they was to large to upload to xda...
Internals Pictures of the AnyWay S100 Jig
-----EDIT----
I am going to see if i can find the last cables and the psu for the jig today in the bin... As it is now without the PSU windows dont even see the device...
ParanoidDK said:
Here is some pictures of the internals from the S100 i have here. Proberly not the best ones but the best i can take with my cam... If i have to take better ones i will have to get my friend involved with his DSLR.
I had to upload them to my server as they was to large to upload to xda...
Internals Pictures of the AnyWay S100 Jig
-----EDIT----
I am going to see if i can find the last cables and the psu for the jig today in the bin... As it is now without the PSU windows dont even see the device...
Click to expand...
Click to collapse
hi thanks to give all i need full box so can you help me ?
[email protected] said:
hi thanks to give all i need full box so can you help me ?
Click to expand...
Click to collapse
I am not going to part with the anyway jig i got so no... You will have to keep looking on ebay... I dont mind opening it up to let the world see the inside but am not going to sell it.
That's a whole lot of relays in that box.
I don't know if anyone has stated which connector is for what,
but I'd guess that the 25 pin connector goes to a model-specific resistor assembly.
Too much of the relay wiring goes out there.
The big "printer port" is the port for the phone connections that i know... i have a cable for a older samsung phone with the box... and that might be a problem because it might use diffrent pins for diffrent phone models... so without seeing both ends of the micro usb cable naked it will be hard to make a cable...
If you guys need more pics let me know... i can also strip that samsung cable i allready got...
Sent from my GT-I9300 using xda premium
ParanoidDK said:
Here is some pictures of the internals from the S100 i have here... I am going to see if i can find the last cables and the psu for the jig today in the bin... As it is now without the PSU windows dont even see the device...
Click to expand...
Click to collapse
Wow! This thing was (any?) way more complicated inside than what I could have imagined! Containing several relays, a PIC16F876A, and who knows what all those other chips are doing.
This is kind of bad news, as then it will be nearly impossible to build anything like it. At least without the firmware for the PIC and the drivers used. However, I believe that most of its functionality is for switching purposes in order to be able to use it on a broad spectrum of devices. So if we can limit ourselves to the most recent smart phones with micro-USB connectors, much of the internal electronic can be ignored.
So don't worry about the PSU (Power Supply Unit?). It would be much more useful if you have the drivers...
This is how it looks:
<I seem to have some upload problems!! >
(Not sure if its an XDA issue or not...)
EDIT: Now it worked...3 days later!
Could you take apart the shell on the 25 pin adapter cable for the old cell phone model?
I'll bet that there are some precision resistors in there.
Thanks.
I dont have the drivers... and i do worry about the psu because without that the unit dont work....
I will open the cable and upload some pictures of that today....
Sent from my GT-I9300 using xda premium
no comment
You sure have some problems with that image E:V:A
But here it is (I hope):
Did just open the cable i got ant it is a S20 cable.
http://www.samsung.com/us/mobile/cell-phones-accessories/APCBS10UBEBSTD
There is no resistors it is just a 25 pins to S20 cable... Will upload some pics here in a bit... And now i really have to check to see if there are more cables just to check the 25 pins end..
---EDIT----
Link to pictures of the naked cable: http://blog.moonman.dk/files/Anyway_S20_cable.zip
Are you sure that this jig does anything for current cell phones?
It seems to me that this device has nothing to do with the semi-standard today
of 5 pin micro USB connectors with resistance coding on the 5th ID pin.
I am looking for something specific, but don't know what … maybe you guys can help me out.
Let me provide some background first. There are special controllers for espresso machines available which act as a PID controller for temperature regulation. To simplify things: They read the temperature of the water and regulate the heating element to a specific temperature with much greater precision than the integrated "mechanical" thermostat is able to.
Today there are kits for various espresso machines available, but they are rather expensive. So I was thinking: Well, what about some homebrew stuff (no pun intended)? I could fit more functionality in there and – here comes the interesting part for the XDA community – connect the controller to my Galaxy Nexus!
My first idea was grabbing some development platform (e.g. Arduino or IOIO), but I'm not sure if this is the right approach. Let me explain what the perfect board can do:
- read two or three temperature probes
- read a water level sensor
- read and control four switches
- provide some kind of CPU for acting as a controller
- provide a clock to "wake" the machine in the morning
- provide a USB connection for controlling from Android and programming/flashing from OS X
- optional: Bluetooth functionality for wireless Android control
I can figure out how to wire the stuff together and how to write some PID software. But the most interesting part will be the Android connectivity, but I have no idea what platform I can use …
It would be awesome to plug a USB cable in (or connect via Bluetooth) and read the live temperature data, start/stop the brewing process and so on. The PID has to regulate the machine without the phone – depending on the switch state (i.e. "pull a shot" or "make steam") the heating element would be regulated.
Of course there are even more interesting applications, like sending a tweet ("I just brewed a coffee!") or a pressure readout …
As far as I understand, I just have to look for a single-board microcontroller with some analogue and digital inputs, some digital outputs and a USB connection. Is this possible with something like an Arduino? Or do I need something more complex?
Hey! Nice to see another homebrewer! They sell chips like that already. People have converted freezers to kegerators, and the chip manages the temp, turning on the freezer around 55 degrees F.
Sent from my SCH-I535 using xda premium
I would suggest you toying with Android ADK
This is a board you could use is: arduino.cc/en/Main/ArduinoBoardADK it's a bit pain in the ass to set it up for the first time but once you get used to it it's pretty simple
Freezer? 55 degrees? I'm talking about brewing espresso … The problem there is temperature stability within 1° Celsius.
I already learned more about the Arduino platform and I think it is the right idea for my small project.
As far as I know a bluetooth connection via Android can be established, too.
You should definitely check out a book called;
"Programming Your Home: Automate with Arduino, Android and Your Computer"
Author is Mike Riley.
Publisher is The Pragmatic Bookshelf, Dallas Texas - Raleigh, North Carolina.
I'm pretty sure it's available as an e-book and is full of projects combining these technologies.
The first project has a ball float incorporated in it so I think it's perfect for your idea.
I'm working on a sous-vide immersion circulator at the moment, but it isn't too complex.
A PID controller does all the hard work.
PS
No barista in their right mind would let a machine steam milk!
---------- Post added at 05:48 PM ---------- Previous post was at 05:41 PM ----------
...almost forgot - ISBN-13: 978-1-93435-690-6
You can pretty much do everything including put the PID into the Arduino. You though will need to create the shield board with the extra sensors you need. Once that is available talking to the Arduino from Nexus is a cake walk. The USB Host and well as USB Accessory mode API is pretty straight forward and you can use either depending on how you want to interface the two. If you use some other microcontroller board other than Arduino then you will probably not be able to use Accessory mode but will have to use the USB Host with the microcontroller board exposed as a CDC class device using the USB as virtual serial port (Atmel, MicroChip controllers provide this interface). Also you will need to hack your Nexus to provide additional power supply (probably using Pogo pins) as USB port will be powering your controller board.
Best of luck!
pankaj013 said:
You can pretty much do everything including put the PID into the Arduino. You though will need to create the shield board with the extra sensors you need. Once that is available talking to the Arduino from Nexus is a cake walk. The USB Host and well as USB Accessory mode API is pretty straight forward and you can use either depending on how you want to interface the two. If you use some other microcontroller board other than Arduino then you will probably not be able to use Accessory mode but will have to use the USB Host with the microcontroller board exposed as a CDC class device using the USB as virtual serial port (Atmel, MicroChip controllers provide this interface). Also you will need to hack your Nexus to provide additional power supply (probably using Pogo pins) as USB port will be powering your controller board.
Best of luck!
Click to expand...
Click to collapse
If you have a device that supports OTG/USB Host, a USB-enabled microcontroller is MUCH cheaper than ADK (which requires the accessory to act as a host).
ADK should be described as "DDK" - Dock Development Kit. The requirement for the "accessory" to act as a host and to provide power makes it limited to dock-style devices. True accessories should be powerable from the device.
Adafruit's ATMega32U4 board is a great one to work with - https://www.adafruit.com/products/296
Another option, much more expensive but allows your device to be network-enabled easily (built-in Ethernet) is the BeagleBone. Lots of GPIOs on 0.1" headers and Ethernet.
I would tend to lean towards arduino. It is certainly powerful enough. All the research I have done makes conecting bluetooth really easy. Although serial to android seems a bit more difficult. For the task you are trying to do I would expect a standard arduino (or clone) and a bluetooth module off of ebay (make sure you choose one that can handle 5v) should be a good starting point.
I have only every made diy arduino buy purchasing the usbisp cable and pl-2303 style usb>serial ttl adaptors. If you search on ebay some of them have the dtr line on one of the pins making auto reset easy. They are a bit more rare, but are worth searching for and paying a few dollars more.
I have never done brewing, but fiddle with arduino (atmega8 atmega168 atmega328 atmega644p atmega1284p). Feel free to ask questions.
arjag said:
I would tend to lean towards arduino. It is certainly powerful enough. All the research I have done makes conecting bluetooth really easy. Although serial to android seems a bit more difficult. For the task you are trying to do I would expect a standard arduino (or clone) and a bluetooth module off of ebay (make sure you choose one that can handle 5v) should be a good starting point.
I have only every made diy arduino buy purchasing the usbisp cable and pl-2303 style usb>serial ttl adaptors. If you search on ebay some of them have the dtr line on one of the pins making auto reset easy. They are a bit more rare, but are worth searching for and paying a few dollars more.
I have never done brewing, but fiddle with arduino (atmega8 atmega168 atmega328 atmega644p atmega1284p). Feel free to ask questions.
Click to expand...
Click to collapse
I will have to agree on that one, but only by experience.
those chips are a pleasure to deal with.
I even got my tablet talking to mine before I screwed it up!
Hit me up here or on #arduino on freenode (or anyone else there for that matter) if you want any hints or help if you decide to go that route, I'd be happy to help!
DW
You should try Arduino board, it's not that difficult to use and they're plenty of resources on the Internets.
Also, you could develop an Android app for controlling it. My team had successfully developed an Android controlled RC-car via Bluetooth.
You could find the source code of the Android app here on Github!
Another approach might be to get an ethernet shield for arduino and hook it up to your homw network. Then you could use a browser to control it, so you are not just limited to your Android device.
Ethernet setup is really simple, start with the demo code and modify to your needs.
Sent from my SAMSUNG-SGH-I747 using xda app-developers app
check out the andropod
Not 100% what you described, but this is absolutely rad nonetheless...
i just saw this the other day: http://www.ftdichip.com/Android.htm
with a standard UART to android usb host in one cable, you can do regular old RS232 or TTL-voltage RS232 comms with practically any of the simplest of the simple mcu's out there.
UART interfacing hardware with your phone? it'd be super easy to write java or shell interface wrappers to do tons of cool automation stuff, plus if you have an old beater phone lying around, it's a super robust DAQ unit in the making...
booooiiinnnniiiiiinnnnnggggg I want...
http://code.google.com/p/tc4-shield/
It's already got a four-channel ADC intended for thermocouple use, as well as GPIOs to drive the SSRs. People have already worked out zero-crossing detectors if you want finer control.
The water probe is a little problematic; I'd stick with the existing Gicar or equivalent.
I'm in the process of using it for thermocouple and power-relay interface to a Raspberry Pi to run a La Marzocco GS I'm restoring.
The Arduino is disappointing in its computational power. Its enough to run a PID, but can't really deal with a TCP stack and a webserver too.
Please note that Arduino can use Bluetooth connectivity to Android. It is easy on Arduino and very convenient.
Arduino can be battery powered for a long time if you program its sleep mode correctly.
http://tvwbb.com/showthread.php?35674-HeaterMeter-v4-0-for-RaspberyPi-Standalone
Shouldn't be a far leap from a fan/heating element to a water heating element. Plus: "HeaterMeter is also reportedly suitable for connecting to a solid state relay and controlling a sous vide heater if you prefer your food float around in fancy water instead of smoke and fire."
Arduino (or Msp430 Launchpad, or Microchip Pic or whatever) + a cheap, 6 dollar Bluetooth Serial adapter, + coding an app for android is all you need. Don't mess with usb or ethernet/wifi. Bluetooth Serial is all you need.
also use Android Suit
Hi all,
I already had an older post asking for what the unpopulated soldered line of pads close to the Samsung flash memory chip might be useful for. To me it's clear already that it has been used during development (e.g. from the kernel sources it looks like they used to connect an ethernet interface to those pins).
Yesterday I spent some time probing for signals with an oscilloscope. There's already good news to those who might think about extending flash memory size of the Kindle Fire: pads 1-4 are directly connected to the OMAP4's MCSPI1_{CLK,SOMI,SIMO,CS0}, pads 36-37 carry GND and pads 39-40 carry 4.2V (unregulated from battery I guess as it's also not switched off when KF is off). The MCSPI can be configured to 48MHz (according to the kernel sources) and we can start connecting SPI hardware to it. I did for fun with some tiny CAN controller I had lying around and that worked out of the box using the spidev and some generic CAN driver from the network section.
Luckily, most SDcards can also be accessed via SPI. I will also try that out soon. Transfer speeds will not exceed 6MByte/s, in practice probably only half of that, but it might be enough for those who dare to extend flash memory. While probing for signals, I also noticed that the Samsung chip seems to be accessed by a single wire only, too. I might be wrong on this, but it would certainly fit the picture as max. transfer speeds do exactly match the 208MBit/s for a 1-wire eMMC connection. Maybe someone else noticed the same already.
Unfortunately, I yet only found two other useful signals routed directly to those pads: DPM_EMU0/1 (pads 16-17). I suspect that 6 other JTAG signals are also routed there, but I can't probe for them as those pads can't be configured to be used as GPIOs.
More on this to come soon...
Best,
STYLON
I just realized that I should send out a quick warning to those that are a little less well equipped with electronics gear.
Most signals on that connector are connected directly to the OMAP4430 without any buffer. They're also from the 1.8 volt domain. That means you can't connect an SD card directly to those pins.
In order to connect an SD card you need at least a level shifter (like the SN74AVCH4T245 that is already somewhere on the board) to convert signals between 1.8v and 3.3v (that's what the SD cards expect). You may also need a 3.3v LDO and connect it to the unregulated battery voltage from that connector.
I'll do some experiments with that very soon, but just wanted to order an SD card slot (don't like to solder to SD card pads directly) and some other pieces before I go ahead.
Best,
STYLON
Okay so on my device I have two serial ports. One port is labeled J2 with 4 pin outs that I think is the UART. The seconded port labeled JPEEK3 has 6 pin outs that I think is the JTAG. Here's the problem, they aren't giving me UART and JTAG readings on my multimeter or logic analyzer.
J2 is reading like this.
3.28VGND3.28V3.28V
No data just straight to idling high.
As for JPEEK3 I'm reading this
GND.04V.04V2.95V2.95VGND
On this I'm getting data on all active pins. I tried hooking my JTAGulator up to the device to read it but every time I do the device it's stuck in reset mode.
Anyone got any idea of what these readings mean?
biomedguy said:
Okay so on my device I have two serial ports. One port is labeled J2 with 4 pin outs that I think is the UART. The seconded port labeled JPEEK3 has 6 pin outs that I think is the JTAG. Here's the problem, they aren't giving me UART and JTAG readings on my multimeter or logic analyzer.
J2 is reading like this.
3.28VGND3.28V3.28V
No data just straight to idling high.
As for JPEEK3 I'm reading this
GND.04V.04V2.95V2.95VGND
On this I'm getting data on all active pins. I tried hooking my JTAGulator up to the device to read it but every time I do the device it's stuck in reset mode.
Anyone got any idea of what these readings mean?
Click to expand...
Click to collapse
The voltage levels for the UART are OK.
UART "J2"
3.28V GND 3.28V 3.28V
It could match the signals:
VCC, GND, TxD, RxD
For UART you need to know the communication baud rate and other connection parameters. You also need to know the communication protocol at the UART layer.
The voltage levels for JTAG are OK.
JTAG "JPEEK3"
GND .04V .04V 2.95V 2.95V GND
It could match the signals:
GND, CLK, DIO, RST, VCC, GND
Which is JTAG in SWD mode.
Maybe "JPEEK3" is SWD?
For full JTAG you have this pins on "JPEEK3":
TDI, TCK, TMS, TDO, RST, VDD, GND
If RST is missing in JTAG, the problem is to get the target into debug mode if the targer has its own power supply.
Appreciate the help, never considered the pinouts for JPEEK3 to be SWD.
The board doesn't technically have it's own supply, the power comes from other boards that it's connected to, in order to power on. Should I figure out a way to power it on with a power bank in that case?
As for the UART, I have a DSLogic Plus, should I just test multiple baud rates and see what happens? I'm not sure what other protocols and communications to look for other then that.
biomedguy said:
Appreciate the help, never considered the pinouts for JPEEK3 to be SWD.
The board doesn't technically have it's own supply, the power comes from other boards that it's connected to, in order to power on. Should I figure out a way to power it on with a power bank in that case?
As for the UART, I have a DSLogic Plus, should I just test multiple baud rates and see what happens? I'm not sure what other protocols and communications to look for other then that.
Click to expand...
Click to collapse
It is a question of whether the board is powered from an external source or only from the JTAG programmer (SWD). For JTAG / SWD, it is better if the target is powered only from the JTAG programmer (SWD), unless it is required to power other peripherals and cover power requirements. For JTAG (SWD), there must be direct JTAG (SWD) programmer support for a specific target (MCU), debug mode, Flash write, and so on. Each MCU has a different protocol and must be directly supported by the JTAG (SWD) programmer or control software. For JTAG (SWD) communication, you can change the communication speed arbitrarily (it is not fixed), if it fails to connect to the target (MCU), you can reduce the communication speed.
For the UART, the communication speed (connection) is precisely determined in advance, you must know it or analyze the output data (timing of given bytes using DSLogic Plus ) if it is sent natively on the UART interface (boot log). The protocol on the UART interface also needs to be known if it is not a shell terminal output.
Well hot dog, that's a lot of solid info. Appreciate it, really.
I just got a flyswatter2 in the mail, hopefully that'll be compatible with the AT91 Atmel MCU on the board, apparently it's using an ARM7 processor. Good to know to not power on the board like I have been with the JTAGulator and DSLogic.
You wouldn't happen to know how to locate the configuration memory for the FPGA, now would you? I'm talking with my cousin whose an EE major, and he was asking for it. I'm not even sure how that'll help with getting into the JTAG.
biomedguy said:
Well hot dog, that's a lot of solid info. Appreciate it, really.
I just got a flyswatter2 in the mail, hopefully that'll be compatible with the AT91 Atmel MCU on the board, apparently it's using an ARM7 processor. Good to know to not power on the board like I have been with the JTAGulator and DSLogic.
You wouldn't happen to know how to locate the configuration memory for the FPGA, now would you? I'm talking with my cousin whose an EE major, and he was asking for it. I'm not even sure how that'll help with getting into the JTAG.
Click to expand...
Click to collapse
Atmel AT91 MCU is supported by OpenOCD. Flyswatter2 works with OpenOCD. From the FT2232H chip used by Flyswatter2, I made a programmer for SPI EEPROM [https://geekdoing.com/threads/unbrick-mi-band-3-with-without-nfc.700/]
I have never used Field Programmable Gate Arrays (FPGA), always only MCUs, I will not advise you in this area. Unfortunately. FPGA arrays have configuration memory as an external memory chip.
The JTAG programming interface is also used for FPGA arrays. FPGA and MCU are completely different technologies. Custom MCUs can also be created using an FPGA array.