Database Develop

Images of the G1's motherboard in HQ?

Hey everyone,
I have a strong backing in electronics, and I have a G1. I don't dare open it because it's my only phone and I'm a college student, however, I want to study the circuit board to see how we can exploit the device.
My first idea I want to investigate is just building a chip flasher to flash the ROM. There's no way they could block that. I see the threads on working with the JTAG, however, I'm not familiar in that area. Wouldn't it make more sense to build a solderless chip flasher?
Regardless, does anybody have some high-res images of the board, front and back?

Wrong section, and I don't think many users will hold the high res pictures you are looking for...I could be wrong =)

protomanez said:
Wrong section, and I don't think many users will hold the high res pictures you are looking for...I could be wrong =)
Click to expand...
Click to collapse
I wasn't sure whether to put this in Q&A or not, as I wanted to discuss development of the chips once identified.

http://mikechannon.net/PDF Manuals/HTC Dream SM (A04).pdf
Does this help any? It has complete disassembly/assemby instructions, and lots of pictures

Moved as not Android Development.

Sent Move Request

mejorguille said:
http://mikechannon.net/PDF Manuals/HTC Dream SM (A04).pdf
Does this help any? It has complete disassembly/assemby instructions, and lots of pictures
Click to expand...
Click to collapse
I looked through it, unfortunately, it did not detail the main board. I really would like to just study the traces on the board. Does anybody have a front and back picture of the main board?

mejorguille said:
http://mikechannon.net/PDF Manuals/HTC Dream SM (A04).pdf
Does this help any? It has complete disassembly/assemby instructions, and lots of pictures
Click to expand...
Click to collapse
That'll probably help him all the way down to the bottom.
EDIT:
http://forum.xda-developers.com/showthread.php?t=591048
That should help you ;]

XBrav said:
Hey everyone,
I have a strong backing in electronics, and I have a G1. I don't dare open it because it's my only phone and I'm a college student, however, I want to study the circuit board to see how we can exploit the device.
My first idea I want to investigate is just building a chip flasher to flash the ROM. There's no way they could block that. I see the threads on working with the JTAG, however, I'm not familiar in that area. Wouldn't it make more sense to build a solderless chip flasher?
Regardless, does anybody have some high-res images of the board, front and back?
Click to expand...
Click to collapse
Look in the debricking JTAG testpoint thread in development. First post has some good pictures of the top (side that faces the inside part, toward the screen side) part of the board. I had mine open the other day but I didn't take any pics, sorry

Signature Checks on Boot

Just so everyone is aware, the kernel and the recovery partition signatures are checked on each boot, changing those will leave you with a brick, until we have proper firmware to recovery with.
I found out the hard way.
On my second Atrix now.

Casualty of war

Taking one for the team

Well that sucks..
any free partitions that we can "steal"? and basically pull a haret where it loads partially from legit bootloader and kernel, then shuffles off to a different partition we CAN write for the real kernel, unloads all that other stuff and then launches the new kernel partiion we've modified?

designgears said:
Just so everyone is aware, the kernel and the recovery partition signatures are checked on each boot, changing those will leave you with a brick, until we have proper firmware to recovery with.
I found out the hard way.
On my second Atrix now.
Click to expand...
Click to collapse
I guess that when we told you this, you just had to find out for yourself. The recovery should only be checked when you attempt to access it, but the kernel is checked on every boot. I hope you did not return to store as defective.

DG, thank you for putting yourself out there, and putting together roms along with the dev work.
Its nice to see some progress being done along side all the people on here saying what we shouldnt be doing/trying with our phones.

Athailias said:
DG, thank you for putting yourself out there, and putting together roms along with the dev work.
Its nice to see some progress being done along side all the people on here saying what we shouldnt be doing/trying with our phones.
Click to expand...
Click to collapse
Don't thank him for repeating something which had been confirmed.

jimmydafish said:
I guess that when we told you this, you just had to find out for yourself. The recovery should only be checked when you attempt to access it, but the kernel is checked on every boot. I hope you did not return to store as defective.
Click to expand...
Click to collapse
So you told me it was checked every boot (first bold), but it should only be checked when you access it (second bold)? Confused, on drugs or what?
I just found out the hard way for you, it's checked every boot accessed or not.
If you want to be elitist and not post up a FAQ about what you know (do you even have an atrix), please stop posting in here, you've done nothing but spout off what you know about other moto devices, it is clear they tightened things down a bit more.
jimmypopulous said:
Don't thank him for repeating something which had been confirmed.
Click to expand...
Click to collapse
everything you guys say, along with others says it SHOULD be checked when accessed, which means I should have been able to boot normally and fail when I boot recovery.
You guys keep saying its CONFIRMED, where is it documented for the atrix. Tests performed with document results as proof.

designgears said:
So you told me it was checked every boot (first bold), but it should only be checked when you access it (second bold)? Confused, on drugs or what?
I just found out the hard way for you, it's checked every boot accessed or not.
If you want to be elitist and not post up a FAQ about what you know (do you even have an atrix), please stop posting in here, you've done nothing but spout off what you know about other moto devices, it is clear they tightened things down a bit more.
everything you guys say, along with others says it SHOULD be checked when accessed, which means I should have been able to boot normally and fail when I boot recovery.
You guys keep saying its CONFIRMED, where is it documented for the atrix. Tests performed with document results as proof.
Click to expand...
Click to collapse
What is being elitist by my statement? That before you started playing with your shiny new toy, we advised that doing certain things with your phone without proper firmware to restore your phone, WOULD result in a "soft brick".
I do not have a motorola ATRIX, never said I did, but I can read the firmware pretty well. If your offended by my post I assume it is because offered up my standard line of "hope you did not return it as defective", because nothing else in that statement should lead you behave like a child.
Here how about this for a Facts, my rom was the first to safely remove Blur from the Droid series of phones safely, after reading the firmware from your phone, and your deodexed version of the firmware there are many portions you could remove safely.
If you have questions you could ask and get the answers, but as it stands right now, we are just trying to help you save yourselves. Many people will enter these forums, and while each person is responsible for their own device, they will try to follow what you have done and they too will soft brick their phone. I'm not sure of your ethical and moral makeup but too many people return their manipulated device to the provider as defective causing every to pay for their mistake.
I just hope you bought another Atrix outright and did not scam ATT/Motorola.

designgears said:
So you told me it was checked every boot (first bold), but it should only be checked when you access it (second bold)? Confused, on drugs or what?
I just found out the hard way for you, it's checked every boot accessed or not.
If you want to be elitist and not post up a FAQ about what you know (do you even have an atrix), please stop posting in here, you've done nothing but spout off what you know about other moto devices, it is clear they tightened things down a bit more.
everything you guys say, along with others says it SHOULD be checked when accessed, which means I should have been able to boot normally and fail when I boot recovery.
Click to expand...
Click to collapse
DesignGears,
Please don't let a claim-to-know-it-all self-righteous Prick like jimmydafish discourage your efforts.
As far as I'm concerned (and probably the majority of people who mash the refresh button on this subforum multiple times a day would agree) it's people like you (people who have actively contributed to the users here at XDA in the past (all your captivate work)), that make me feel lucky to own the same type of device that you and other dedicated devs like yourself own.
Its hard to imagine how someone who probably played a very small part on a team -- a team that, as far as I can tell, has never managed to actually produce any real results on the DX -- can know so much about a device he doesn't even own.
And if reading this post encourages members of any such team to get their panties in a wad and start talking about how they are not going to contribute here now, well then to that I say: good riddance. For every one small tip you may provide it seams like you offer two holier-than-thou-doughe-bag-comments that frankly this section of this forum could do without.
But again, thank you DesginGears and Devs like you

mburris said:
DesignGears,
Please don't let a claim-to-know-it-all self-righteous Prick like jimmydafish discourage your efforts.
As far as I'm concerned (and probably the majority of people who mash the refresh button on this subforum multiple times a day would agree) it's people like you (people who have actively contributed to the users here at XDA in the past (all your captivate work)), that make me feel lucky to own the same type of device that you and other dedicated devs like yourself own.
Its hard to imagine how someone who probably played a very small part on a team -- a team that, as far as I can tell, has never managed to actually produce any real results on the DX -- can know so much about a device he doesn't even own.
And if reading this post encourages members of any such team to get their panties in a wad and start talking about how they are not going to contribute here now, well then to that I say: good riddance. For every one small tip you may provide it seams like you offer two holier-than-thou-doughe-bag-comments that frankly this section of this forum could do without.
But again, thank you DesginGears and Devs like you
Click to expand...
Click to collapse
I can assure you I am not, glad to have support.
--
Jimmy, no hard feelins, sorry I wanted try something and learn from it, sorry you told me two opposing things in the same post(this is what I am *****ing about if you would read you would know that), sorry I act like a child, I guess calling it how I see it is childish. From all the PM's about you I just got and mburris reply, you have made my block list, have fun in there with rafy.

jimmydafish said:
I just hope you bought another Atrix outright and did not scam ATT/Motorola.
Click to expand...
Click to collapse
Maybe if more people softbricked and returned phones that have locked down bootloaders, oems and carriers might finally realize that when someone buys a piece of technology, they own it, and would like to use it as such.
That includes:
1. Not having some POS skin on top of stock android (Blur)
2. Not being locked into paying twice for the data we already pay for (tethering)
3. Not being allowed to easily install non-market apps that we develop without jumping through hoops (slide loading)
4. Not having to wait for the carrier or oem mfg to release an update before we can have a current version of Android.
Call it a Brick-n-Return Protest

mburris said:
Maybe if more people softbricked and returned phones that have locked down bootloaders, oems and carriers might finally realize that when someone buys a piece of technology, they own it, and would like to use it as such.
That includes:
1. Not having some POS skin on top of stock android (Blur)
2. Not being locked into paying twice for the data we already pay for (tethering)
3. Not being allowed to easily install non-market apps that we develop without jumping through hoops (slide loading)
4. Not having to wait for the carrier or oem mfg to release an update before we can have a current version of Android.
Call it a Brick-n-Return Protest
Click to expand...
Click to collapse
LOL, that would surely cause some grief over at at&t, and a good laugh.
They would probably start leasing the phones so you can't say you own them.

Closed by OP request as this is an informational thread stating results of testing.

Anyone got a busted phone?

I'm looking for a busted captivate for research. I belive we may be able to boot from a micro SD card.
I have to remove the processor and reverse engineer the board in order to find the power supply to the line called XOM5 in the processor manual. Once this line is found, it may be as simple as shorting, slicing the line, or popping a resistor off the board.
Repairing the phone afterwards would be beyond my capabilities.. I can't perform ball soldering. That takes some highly specialized tools. You would be doing a great service to everyone with a GalaxyS phone.
The phone does not need to work, and can be in horrible condition. It can be water damaged or physically broken. The only thing I need is the main board inside the phone.

bump......

Sorry man only got my every day phone. Ill keep an eye out in the island see if i can help with your project.

hey i have a 1008 phone. screen busted. possibly stuck in bootloop. its in a couple peices.

bulletproof1013 said:
hey i have a 1008 phone. screen busted. possibly stuck in bootloop. its in a couple peices.
Click to expand...
Click to collapse
can i just send you the main board?

Yes! that's all I need. I'll send you a PM.

AdamOutler said:
I'm looking for a busted captivate for research. I belive we may be able to boot from a micro SD card.
I have to remove the processor and reverse engineer the board in order to find the power supply to the line called XOM5 in the processor manual. Once this line is found, it may be as simple as shorting, slicing the line, or popping a resistor off the board.
Repairing the phone afterwards would be beyond my capabilities.. I can't perform ball soldering. That takes some highly specialized tools. You would be doing a great service to everyone with a GalaxyS phone.
The phone does not need to work, and can be in horrible condition. It can be water damaged or physically broken. The only thing I need is the main board inside the phone.
Click to expand...
Click to collapse
I would like to learn more how a CB works and how to trace certain things on a board as well as other parts. Any books or reference guides besides schematics that could help me? PM me if you will. Infact anyone that knows anything could help me, please PM. Thanks.

Jmurph3 said:
I would like to learn more how a CB works and how to trace certain things on a board as well as other parts. Any books or reference guides besides schematics that could help me? PM me if you will. Infact anyone that knows anything could help me, please PM. Thanks.
Click to expand...
Click to collapse
A better place for a newbie to start would be circuit bending... hopping electricity from one point on a circuit board to another to alter the operating state. This would be a great place to start... http://hackaday.com/2011/01/11/intro-to-circuit-bending/
Once you get familiar with how things work on a circuit board, start examining the individual components in greater detail. There's some datasheets in here http://forum.xda-developers.com/showthread.php?t=1111866 which you could use to understand how a couple of the major players on our phone works. Speciffically, the USB controller (FSA9480) and the Processor (S5PC110). It really takes some additional education to start reading processor manuals....
You could always start with something simpler like Arduino platform. The Arduino platform allows you to create a basic program which runs on a microprocessor and take inputs and outputs from it. I like the Arduino because it's so darn quick to pick up.
here's some of the stuff I programmed on the Arduino
Contest entry http://www.hyundaiaftermarket.org/f...utlers-hackaday-santa-pede-competition-entry/
Silly candle http://www.hyundaiaftermarket.org/forum/blog/3/entry-27-digital-candle/
This one would be a great first project. http://www.hyundaiaftermarket.org/forum/blog/3/entry-26-arduino-ef-meter/
If you really want to understand how a circuit board works, the best way is to go to school, or start playing with one... You could get started pretty cheap http://www.google.com/search?client...gc.r_pw.&fp=d4257c808144b93c&biw=1333&bih=651 or you can get a better one like in the Android Open Acessory Kit (it's actually an Arduino Mega with additional sensors) http://www.google.com/search?client...gc.r_pw.&fp=d4257c808144b93c&biw=1333&bih=651
So yeah... Learning electronics is reading, playing and doing.

AdamOutler said:
A better place for a newbie to start would be circuit bending... hopping electricity from one point on a circuit board to another to alter the operating state. This would be a great place to start... http://hackaday.com/2011/01/11/intro-to-circuit-bending/
Once you get familiar with how things work on a circuit board, start examining the individual components in greater detail. There's some datasheets in here http://forum.xda-developers.com/showthread.php?t=1111866 which you could use to understand how a couple of the major players on our phone works. Speciffically, the USB controller (FSA9480) and the Processor (S5PC110). It really takes some additional education to start reading processor manuals....
You could always start with something simpler like Arduino platform. The Arduino platform allows you to create a basic program which runs on a microprocessor and take inputs and outputs from it. I like the Arduino because it's so darn quick to pick up.
here's some of the stuff I programmed on the Arduino
Contest entry http://www.hyundaiaftermarket.org/f...utlers-hackaday-santa-pede-competition-entry/
Silly candle http://www.hyundaiaftermarket.org/forum/blog/3/entry-27-digital-candle/
This one would be a great first project. http://www.hyundaiaftermarket.org/forum/blog/3/entry-26-arduino-ef-meter/
If you really want to understand how a circuit board works, the best way is to go to school, or start playing with one... You could get started pretty cheap http://www.google.com/search?client...gc.r_pw.&fp=d4257c808144b93c&biw=1333&bih=651 or you can get a better one like in the Android Open Acessory Kit (it's actually an Arduino Mega with additional sensors) http://www.google.com/search?client...gc.r_pw.&fp=d4257c808144b93c&biw=1333&bih=651
So yeah... Learning electronics is reading, playing and doing.
Click to expand...
Click to collapse
Hey, thanks a lot. I'm sure I'll be able to get something out of it. Hopefully this will help with my job some too!

Hey , when and If your able to boot from micro sd...will this method be like the nook color?

bulletproof1013 said:
Hey , when and If your able to boot from micro sd...will this method be like the nook color?
Click to expand...
Click to collapse
Basically. that's the idea. perform a slight hardware modification, then boot from SDCard from then on. Of course, first, I'll be focusing on just recovering a bricked phone by providing the phone a PBL/SBL/SBL2 on a MMC card.

Any progress?

crispy1805 said:
Any progress?
Click to expand...
Click to collapse
Yes. the project is completed. Thank you Bulletproof1013.
See here: http://forum.xda-developers.com/showthread.php?t=1242466

Trusted boot jumper?

Not wanting to open up old threads and discussions about booting the atrix 4g, but i was just browsing the schematics i found on xda, and noticed what looks like a 'trusted boot' jumper. I don't know much about trust technology in these platforms but someone here may know more.
Brief searches show intel's trusted platform technology, I'm not sure the atrix contains something similar.
but if it does, would this jumper - if changed, allow us to boot anything perhaps?
I've attached a photo of the schematic (i found this trying to follow the good old 'FM radio not working' thread as well).
so yeah, thoughts from those more in the guts of trusted platforms?
please feel free to shut this thread down if I'm just total out of the ball park, but if this is a lead, all be it a hardware mod(depending where this jumper is and how easy it is to change its state on the board), it may be a way to unbrick perhaps.
I'm also aware the atrix 4G is getting a little older now, and interest maybe being depleted given other options in the market these days.
thanks

glegge said:
Not wanting to open up old threads and discussions about booting the atrix 4g, but i was just browsing the schematics i found on xda, and noticed what looks like a 'trusted boot' jumper. I don't know much about trust technology in these platforms but someone here may know more.
Brief searches show intel's trusted platform technology, I'm not sure the atrix contains something similar.
but if it does, would this jumper - if changed, allow us to boot anything perhaps?
I've attached a photo of the schematic (i found this trying to follow the good old 'FM radio not working' thread as well).
so yeah, thoughts from those more in the guts of trusted platforms?
please feel free to shut this thread down if I'm just total out of the ball park, but if this is a lead, all be it a hardware mod(depending where this jumper is and how easy it is to change its state on the board), it may be a way to unbrick perhaps.
I'm also aware the atrix 4G is getting a little older now, and interest maybe being depleted given other options in the market these days.
thanks
Click to expand...
Click to collapse
i have a question. why didnt u write this to a trusted dev for atrix?? because its not very useful to write this without 100% knowledge so it would have been the best to write it to a hardware dev that can proof this and test it.
thanks it was meant good, but still write this to a dev that know how to work with this.

Hai_Duong said:
i have a question. why didnt u write this to a trusted dev for atrix?? because its not very useful to write this without 100% knowledge so it would have been the best to write it to a hardware dev that can proof this and test it.
thanks it was meant good, but still write this to a dev that know how to work with this.
Click to expand...
Click to collapse
Understood, I'm all good intentions and thumbs and fingers.
could you suggest a dev to IM this too?
many thanks

glegge said:
Understood, I'm all good intentions and thumbs and fingers.
could you suggest a dev to IM this too?
many thanks
Click to expand...
Click to collapse
http://forum.xda-developers.com/showthread.php?t=2016837
here these guys are the hope for ics kernel just write them if its useful they will reply.

Calling car guys that code (BMW specific)

Just curious if there are any BMW guys that are devs here? This is SUPER random but since 2007 people have been trying to hack the Transmission Control Unit (TCU) on BMWs with very little success. It's becoming more interesting recently since more and more people are making 600+ hp and being able to control the line pressure will help hold the power. Figured I'd check to see since the best devs I know of are on here.

loudaccord said:
Just curious if there are any BMW guys that are devs here? This is SUPER random but since 2007 people have been trying to hack the Transmission Control Unit (TCU) on BMWs with very little success. It's becoming more interesting recently since more and more people are making 600+ hp and being able to control the line pressure will help hold the power. Figured I'd check to see since the best devs I know of are on here.
Click to expand...
Click to collapse
Bump.
What we need is someone to 'look very closely' at the rom files for the TCU. The rom files are protected with what I believe is 1024bit RSA signatures and we need to find a weakness in the bootloader or something in order to upload modified files. The 335i ECU had a security hole which allows for tricking the ECU into verifying the same signature twice, opening up the important part of the file for modifications. There were three sections, the BAF, PAF and DAF. BAF verified the PAF and BAF verified the DAF. We got the BAF to verify the PAF signature twice.
I think the TCU works on something of a similar system most likely, but nobody has really taken a good look. I think someone has cracked it once before for the M3 which uses the same TCU but different ROM files, but they aren't telling.

Bump. I'm sure there could be some good money raised too if a developer needs some incentive.

doublespaces said:
.
ROM files,
Click to expand...
Click to collapse
You said ROM, so we just need SU right?
I agree with nguyenvn - could end up with some $$$ as there is quite the demand.

At the moment the community at e90post is trying to find a way, but after months and a steep learning curve, we're stuck with the signature problem.... the thread is called "Transmission remap - Lets do it ourselves"