Activating UART mode - Xiaomi Mi 5 Questions & Answers

Bit of a long shot but hey, this is XDA
I purchased a soft-bricked Mi 5, the FDD-LTE variant. It had a functioning fastboot mode that worked every single time, but no official ROM liked to flash stating that phone is locked. (At the time I did not know of Xiaomi PC Suite to try.) So I went down the EDL rabbit hole: found the testpoints, successfully flashed 7.7.20 china development ROM with MiFlash and... have not seen anything on the screen since.
Tried vol+ with vol- with power for 30s.
Tried to leave phone on the charger for a day and the above combo again.
Tried flashing with Qualcomm Flash Image Loader v2.0.1.1.
Tried flashing 6.12.8 china, 7.7.20 china, 7.7.20 global, 8.5.24 china, 8.8.9 china, 7.2.4.0 global, 9.6.1.0 china with no errors in MiFlash / QFIL.
It is either bad luck and PMI8994 got fried at the exact same time as I flashed or... something else. I don't believe in bad luck so hoping for the "something else" part To discover what could the problem be I was hoping to hook up a UART console to the board. Unfortunately I found no accounts of someone doing this on the Mi 5 and hence this post.
From Mi 5 PCB schematics it seems that on this phone UART console is connected to the ISL54062 analog switch and then output via the headphone jack (think Nexus 4) if enabled. The "enabled" bit is tricky – according to ISL54062 datasheet, both IN1 and IN2 need to have a logic state of "1" for TX/RX to be enabled. These are supposedly routed directly from MSM8996 as AUDIO_SWITCH_EN on pin BE49. This is as far as I got so far.
Has any of you heard of someone tracing down these lines? Does anyone know the conditions that would trigger AUDIO_SWITCH_EN to "1"? (On the Nexus 4 it was voltage comparison on some jack pins, on some phones it is resistance, etc.) Would prefer not to desolder the ISL54062 as it is a tiny µTQFN package (1.8 x 1.4mm) unless absolutely necessary.
Would love to get this board up and running and am prepared to ruin it for science since it does not boot anyway. If we do discover something, however, it seems that it will also be applicable to other Xiaomi phones – I fould the exact same circuitry on Mi 2 schematics. Perhaps there is some trigger that works on many/most Qualcomm SoCs?
EDIT: some more info confirming what I wrote above. According to kernel sources for MSM8996, the SoC's GPIO_4 and GPIO_5 are indeed configured for UART console. The interesting bit is the analog switch enablement pin, GPIO_49. According to kernel sources, GPIO_49, GPIO_50, GPIO_51 and GPIO_52 are a classic SPI MOSI, MISO, CS, CLK configuration for an interface referred to as "SPI9". Only on the Mi 5 they are marked as AUDIO_SWITCH_EN, FP_SPI_RST, TYPEC_I2C_SDA and TYPEC_I2C_SCL, where the last three go to the bottom fpc connector. Hmm... shame I do not have a proper microscope yet!
EDIT 2: Since the original post I also went through a list of all Mi 5 test points and while some look interesting in general phone diagnostic (PMI8994), none seem to have anything to do with UART enablement analogous to the way TP1204 and TP1205 force EDL mode.
EDIT 3: Out of curiosity I went through the Xiaomi kernel code drop for the Mi5 looking for ways they might be detecting voltage on the mic line and/or controlling the ISL54062 audio switch via AUDIO_SWITCH_EN. Nothing out of interest really. Shame we do not have a leaked Xiaomi bootloader code somewhere
EDIT 4: Yup, still going. Had a few spare minutes with a scope today and tried the Nexus 4 way of feeding the phone +3.3V on the mic line, hoping that as Xiaomi was copying other bits from other manufacturers they also copied that trick. Didn't do a thing unfortunately. Next step: look for and desolder ISL54062 to get to the data lines underneath.
EDIT 5: Had a hotair gun handy so went ahead with checking whether ISL54062 is hiding beneath RF shielding (as I hoped) or not (as the PCB layout from the schematics shows). Unfortunately it seems the schematic, showing that the final PCB design omits the audio switch IC, won. As you can see in the attachment, there is space and pads but they are not populated. One last thing to try is to solder a thin wire to the relevant pad to see if perhaps MSM8996 does still transmit stuff but is "only" no longer able to re-route this communication via the audio jack or if they also removed all relevant print lines from PBL/SBL source/build. Stay tuned

So I had some more time to play and to my/our luck it seems that the relevant pin is indeed still wired to MSM8996 and moreover, that debug messages were not disabled and are still emitted by PBL. If you facy a go, you will need to:
Remove an RF shield using a hot air gun.
Solder a wire to pad 5 (MSM8996 TX) where ISL54062 would normally be.
Solder a wire to pad 8 (MSM8996 RX) where ISL54062 would normally be. (Only needed if you want to send it commands.)
Solder a ground wire somewhere.
Use a logic level converter to go from 1.8V signalling to 5V understood by most USB-to-UART converters (can be skipped if you have eg. BS101P and you select the 1.8V level).
Run your favourite terminal software and set it to 115200 baud rate, 8 data bits, 1 stop bit, no parity, no flow control.
Check attachment for help in locating the TX pad and a sample log (Mi5 connected to a charger without battery). This seems to conclude my investigation Hope this can be a starting point for someone interested in some more tinkering!

thanks for the info!
Because of the by-pass resistors in the schematic, I already feared the mux would not be populated, and, sadly, you have confirmed my fear.
I might attempt to remove the bypass resistors and add that mux myself, or do what you did and add a bunch of wires

I believe if you wanted to add the mux you'd have to either hope that the code that activates UART passthrough is still present in Xiaomi sources or try to drive the mux yourself

It is fairly easy to drive the GPIO over /sys/class/gpio if you have a booted system, or you can edit the DTB to turn GPIO49 high.
I want to attempt to get a newer version of linux working on the gemini (preferably mainline), in that undertaking (that I"m prolly not qualified to do, but whatever ) driving a single GPIO should be a minor detail

Ha, in that case indeed this is tiny compared to what you hope to achieve Fingers crossed for you!

davidcie said:
Ha, in that case indeed this is tiny compared to what you hope to achieve Fingers crossed for you!
Click to expand...
Click to collapse
I failed at removing the RF shield, and don't want to kill my phone, so I'll have to make do without uart for now

Flux? You can also try diluting the lead-free solder with good old SnPb using a fine iron tip in order to lower the melting point for your hot air later on.

Related

Serial - what happens if you tie +5v to rs232_txd (pin 8)..?

Hi there, this is my first stupid question on xda-developers! In essence, does tying the rs232_txd pin high do any damage to the driver or device itself?
That may sound like a dumb question, but I am having no end of trouble with running a serial GPS mouse with a car holder/cradle I bought for my XDA IIs (unbranded, silver plastic eBay job with a speaker), read on if you can stand to!
The cradle takes power from the ciggie lighter socket and has a mini-usb type connector to drive the gps mouse. I could sometimes communicate with the gps, but not always and not often for more than 30 mins.
I took the cradle apart and found that only the XDA's rxd pin was connected to the gps, no txd and decided that looked iffy enough to alter.
Fortunately, we have a tiny baby ( ) so I was a bit too tired to do this right, and after tracing all the connections meticulously, wired txd to the +5v vcc feed. Not realising exactly what I had done (really, really tired - it made sense at the time!) I hooked all up to a dc psu and got rock solid gps connectivity. Nothing could shake it, it always worked... (Investigated with CommLog, WinFast Navigator, GPS Info & TomTom GPS software).
Further thought with a clearer head made me drop my towel! I don't seem to have done any harm (I left it running like that for a while) and everything else works ok so I don't think I've killed anything, but should I be doing this?!
It basically means putting a short from v_adp to txd... In the olden days of 'proper' rs232 (mumble into beard, slurp pint of bitter), that would have been a 'bad thing' as far as I understand, but I have no idea if it is a good idea or not with a Blue Angel...
To make matters more interesting, I noticed that the rxd connection that was in place originally was connected to the gps mouse's tx pin (according to the globalsat pinout I have) in the first place.
In the interest of discovery, I connected the rx and tx properly (nothing happens except the cradle led changes to indicate no gps connected) and swapped rx and tx (with exactly the same results).
If I slap +5v on TXD, it all works, but even the big friendly letters on the front cover don't calm me...
Help? Please? :lol:
I have just converted a digitraveller gps for use with xda 1 and I used pins 5-ground and 8 and 10 for rx and tx, I have no idea why you should get better performance and connectivity by adding 5volts onto the tx line unless power is fed through that pin for that particular mouse. There is no way that I would have tried it in the first place so fair play to you for the abberrant thought process that brought you a positive result. Check this link, it mentions tying voltage to the rxd to wake up the gps.
http://www.grundlgasse.at/thomas/digitraveler/
Hiya cruisin-thru, thanks for the fast follow up and link (love the microTrak those Floridians made, I'll need one for our daughter in a few years!)! It's interesting, he is talking about tying the gps mouse's rxd pin high (so, presumably, the PDA's txd pin too) which is basically what I did by mistake. My grasp of the physical side of these things isn't too hot - am I right in thinking that that is what he means?
Aberrant thought processes just about sums it up tho... It was one of those days when you carefully trace the connection all the way through all 4 pairs of interfaces, making careful notes, then painstakingly hook up the wrong connector. :roll:
I guess it all comes down to my concern about the XDA's ability to handle 5v on the txd pin over long periods of time... If anyone has any experience of this I'd be really grateful to hear about it!
So. The RS232 spec says that each pin should be able to cope happily with a voltage applied to it equal to the maximum operating voltage of the device hosting the connector. That means that if HTC makes them to spec, I haven't done any permanent damage!
It also means that tying txd high should be a feasible solution although I'm not going to do it. The cradle I was trying to fix is now fixed and can be thrown away with my conscience clear - it's one of those with an external speaker and the rf generated noise is getting to me...
Thought I ought to tidy up after myself and close the thread!

Bricked Captivate Assistance

Hi team. I've searched the forums for answers and even though I've read a thousand excellent posts, none (of course) fit my situation specifically. I'll try to be as brief as I can.
My AT&T-branded, Chinese imported Captivate was only three weeks old when I first soft-bricked it trying to do an update using Kies (thanks Samsung!) and then because it would only go into download mode, I tried using Odin to reflash back to where I was. The flash didn't take and I was left with nothing; no charging icon, no computer recognition (Windows 7 Ultimate 32-bit using the generic Samsung Android phone drivers downloaded from somewhere on XDA) and no boot/download mode; in other words, hard-bricked and nothing working.
I bought myself a riffbox and spent a long time reading various forum posts about using it; I own a computer repair company and have flashed a million motherboard, modem, router and other firmwares over the past 15 years and have even done a Samsung S2 and a Galaxy Pad in the last week so am reasonably comfortable with the process, even though I'm not hugely experiences yet with the riffbox.
Anyway, I imported and soldered the recommended panasonic socket to the JTAG point and made myself some PCB adapters to fit and break out the Riffbox cables. That's all done and dusted and today I used the Riffbox on my Captivate for the first time, apparently detecting the 'dead body' and flashing the ROM successfully (the box and software would soon tell me if something wasn't right). While I hoped it would, I didn't expect my phone to boot straight away, but did expect it to go into download mode, as suggested in the JTAG literature with the Riffbox. This is where it all gets bent out of shape.
I always get into download mode with my Captivate by dropping the battery and then replugging with the Vol + and - buttons held. I have tried all methodfs I can find on XDA but all either don't work or do the same thing, that is, my phone enters download mode for about ten seconds, then drops out again. During that time, all USB devices 'hang' while the computer tries to fathom what the hell is connected there and Andy just holds his shovel and laughs at me before disappearing once again into the inky blackness of a dead screen. The device manager shows an unknown device detected before letting it go again and mouse and keyboard control resumes. Weird. I thought it might be a flat battery but I've charged that so it has plenty of juice. When plugged via USB, there is 4 volts at the battery terminals (measured with the battery out) so it would charge when plugged in (wall wart or USB cable) even though no icon shows.
Like any good tech I went back and reflashed using both the recommended ROM and 'last resort' option in the Riffbox (Clone Gremlin Zone flash) and the phone still does the same thing; enters download mode then off. I made up a USB dongle/jig using exactly 301 kilohms of resistance (measured digitally) across pins 4 and 5 and followed the various videos/explanations to get into download mode that way but this does not work on my phone, leading me to think something else is broken.
Bottom line is that it seems the phone doesn't have to be connected via USB to enter download mode but if Windows cannot load the phone, then I cannot use Odin or Heimdall to reflash it. I don't think it is drivers because it worked OK before the brick (well, not perfectly but it did connect and I had USB drive support etc.) and besides, I have tried reinstalling drivers to no avail. Can anyone suggest anything I can try (shipping it to some guy in the USA is not the answer I'm going for here so please don't waste your time or mine). As far as I can see, I have done everything the people here suggest and the JTAG/Riffbox instructions to the letter but it just does not want to happen. I'd rather not lose the phone and since I eventually want to offer this sort of service in my business, I want to get it to work on my own phone for my own pride and knowledge.
Cheers from Christchurch New Zealand.
Follow up.
davenz said:
Hi team. I've searched the forums for answers and even though I've read a thousand excellent posts, none (of course) fit my situation specifically. I'll try to be as brief as I can.
My AT&T-branded, Chinese imported Captivate was only three weeks old when I first soft-bricked it trying to do an update using Kies (thanks Samsung!) and then because it would only go into download mode, I tried using Odin to reflash back to where I was. The flash didn't take and I was left with nothing; no charging icon, no computer recognition (Windows 7 Ultimate 32-bit using the generic Samsung Android phone drivers downloaded from somewhere on XDA) and no boot/download mode; in other words, hard-bricked and nothing working.
I bought myself a riffbox and spent a long time reading various forum posts about using it; I own a computer repair company and have flashed a million motherboard, modem, router and other firmwares over the past 15 years and have even done a Samsung S2 and a Galaxy Pad in the last week so am reasonably comfortable with the process, even though I'm not hugely experiences yet with the riffbox.
Anyway, I imported and soldered the recommended panasonic socket to the JTAG point and made myself some PCB adapters to fit and break out the Riffbox cables. That's all done and dusted and today I used the Riffbox on my Captivate for the first time, apparently detecting the 'dead body' and flashing the ROM successfully (the box and software would soon tell me if something wasn't right). While I hoped it would, I didn't expect my phone to boot straight away, but did expect it to go into download mode, as suggested in the JTAG literature with the Riffbox. This is where it all gets bent out of shape.
I always get into download mode with my Captivate by dropping the battery and then replugging with the Vol + and - buttons held. I have tried all methodfs I can find on XDA but all either don't work or do the same thing, that is, my phone enters download mode for about ten seconds, then drops out again. During that time, all USB devices 'hang' while the computer tries to fathom what the hell is connected there and Andy just holds his shovel and laughs at me before disappearing once again into the inky blackness of a dead screen. The device manager shows an unknown device detected before letting it go again and mouse and keyboard control resumes. Weird. I thought it might be a flat battery but I've charged that so it has plenty of juice. When plugged via USB, there is 4 volts at the battery terminals (measured with the battery out) so it would charge when plugged in (wall wart or USB cable) even though no icon shows.
Like any good tech I went back and reflashed using both the recommended ROM and 'last resort' option in the Riffbox (Clone Gremlin Zone flash) and the phone still does the same thing; enters download mode then off. I made up a USB dongle/jig using exactly 301 kilohms of resistance (measured digitally) across pins 4 and 5 and followed the various videos/explanations to get into download mode that way but this does not work on my phone, leading me to think something else is broken.
Bottom line is that it seems the phone doesn't have to be connected via USB to enter download mode but if Windows cannot load the phone, then I cannot use Odin or Heimdall to reflash it. I don't think it is drivers because it worked OK before the brick (well, not perfectly but it did connect and I had USB drive support etc.) and besides, I have tried reinstalling drivers to no avail. Can anyone suggest anything I can try (shipping it to some guy in the USA is not the answer I'm going for here so please don't waste your time or mine). As far as I can see, I have done everything the people here suggest and the JTAG/Riffbox instructions to the letter but it just does not want to happen. I'd rather not lose the phone and since I eventually want to offer this sort of service in my business, I want to get it to work on my own phone for my own pride and knowledge.
Cheers from Christchurch New Zealand.
Click to expand...
Click to collapse
Since none of the gurus here bothered to respond I'll do it myself in case someone else finds the same issue.
Turns out the battery was faulty; I replaced it and succeeded in getting the phone into download mode with both the jig and the usual methods. Then the computer would not recognize the phone, the dreaded 'unknown device' in the device manager. I was using the factory cable that came with the phone but tried a third-party one I had for a Chicom HTC copy I had lying around and this allowed the phone to be recognized by Windows (go figure). I used Odin to unbrick/reflash and it is all go now, interestingly both cables now work for the phone within Windows so it is always worth trying something even though it makes no real sense to do so.
Darn, that is exactly what I was going to say to do!
Next time, try a rotating disc nebulizer, which you can redesign with respect to the principle parameters that determine its analytical performance. The flow pattern of the aerosols you will attain can be optimized by altering the shape of the inner chamber for optimum aerodynamic characteristics. Furthermore, the optimum angle of impact needs to be established using particle size distribution and mass transport efficiency as criteria. Any analytical characteristics you determine will be through monitoring the emission signal from an aqueous standard. The accuracy has to be assessed by using reference steel and iridium samples.
It is easy to construct, and the fundamental component is a rotating disc onto which a liquid sample is introduced. It should require no additional spray chamber and be easy to operate effectively. Once in operation it should produce aerosols with mean droplet diameters of approximately 0.50 µm.
You may then utilize inductively coupled plasma optical emission spectrometry to determine the defect.:good:
^
ROFLMAO !!!!
Sent from my SGH-I897 using xda premium
Rotating Disc Nebulizer
-SGA- said:
Darn, that is exactly what I was going to say to do!
Next time, try a rotating disc nebulizer, which you can redesign with respect to the principle parameters that determine its analytical performance. The flow pattern of the aerosols you will attain can be optimized by altering the shape of the inner chamber for optimum aerodynamic characteristics. Furthermore, the optimum angle of impact needs to be established using particle size distribution and mass transport efficiency as criteria. Any analytical characteristics you determine will be through monitoring the emission signal from an aqueous standard. The accuracy has to be assessed by using reference steel and iridium samples.
It is easy to construct, and the fundamental component is a rotating disc onto which a liquid sample is introduced. It should require no additional spray chamber and be easy to operate effectively. Once in operation it should produce aerosols with mean droplet diameters of approximately 0.50 µm.
You may then utilize inductively coupled plasma optical emission spectrometry to determine the defect.:good:
Click to expand...
Click to collapse
This is excellent advice and ordinarily I would agree 110%, however I have found that the later model Rotating Disc Nebulisers have an inherent fault in the flange valve regulator, which in turn affects the lead mercury ratio and results in even harder bricking of susceptible devices. If, however, you feather an older nebulizer with the updated underhead/overhang mod then even the nastiest conflibulator inversion is easily bypassed. Just for information's sake...
davenz said:
This is excellent advice and ordinarily I would agree 110%, however I have found that the later model Rotating Disc Nebulisers have an inherent fault in the flange valve regulator, which in turn affects the lead mercury ratio and results in even harder bricking of susceptible devices. If, however, you feather an older nebulizer with the updated underhead/overhang mod then even the nastiest conflibulator inversion is easily bypassed. Just for information's sake...
Click to expand...
Click to collapse
OMG, that was some seriously original stuff! Anyone try Googling "conflibulator inversion"? This is the only result, lol!
Glad to hear your flashing worked out, I think the process you followed is a lot more in depth than many of us would ever undertake...
-SGA- said:
OMG, that was some seriously original stuff! Anyone try Googling "conflibulator inversion"? This is the only result, lol!
Glad to hear your flashing worked out, I think the process you followed is a lot more in depth than many of us would ever undertake...
Click to expand...
Click to collapse
Well, I wasn't about to throw away 350 bucks (our money, which is worth about three chickens and a bag of salt in anyone else's currency) and since I pride myself in being able to fix anything, the challenge was set in motion when I discovered (via this excellent resource) that the Captivate was a) hard to brick (I found it pretty easy to be honest) and b) the hardest to unbrick.One poster claimed that if you can unbrick a Captivate you can unbrick anything, so I had to give it a go. After all, what did I have to lose?
As I mentioned, I intend to diversify my computer repair business into mobile gadget repairs anyway and I can think of nothing more noble than unbricking phones. I learned an incredible amount on the way through the whole process and while just having the tools doesn't make me an expert, I'm happy to work my way toward that goal and if I help others on the way, well, it's a win/win.
Thanks for the entertaining posts and cheers from Christchurch, New Zealand.
I sure hope you tried locating the flux capacitor before going through all that work. Could have saved you from having to go through the whole "Seismic Declan Brown Eyed Goose" process.
Glad to hear you are de-worse-ifying your biz.
You should add the left-handed skyhook-bipolar-transmogifier-probe to your tools. I am told its use dramatically improves GPS performance, and provides immediate position locks to some position, however distant from where you thought you were.
-written whilst sipping high temperature psychoactive botanical filtrate in my ceramic gravitational containment vessel with plalangeal bracket (aka coffee in my mug).
Sent from my SAMSUNG-SGH-I897 using xda app-developers app
Thanks
wwcjr91 said:
I sure hope you tried locating the flux capacitor before going through all that work. Could have saved you from having to go through the whole "Seismic Declan Brown Eyed Goose" process.
Click to expand...
Click to collapse
Now you tell me! The entire Seismic Declan Brown Eyed Goose scenario had me stumped there for a while but after referencing 'Nocturnal Urinary Releases and other Stories', the famous Declan-decoding text by I. P. Nightly, a liberal application of lubricating gel in all the right places had the whole thing well in hand...
And as for the left-handed skyhook-bipolar-transmogifier-probe, that's again where I went wrong with a newbie mistake. Sadly I ordered the right-handed skyhook-bipolar-transmogifier-probe and of course it didn't moglify the selindicular quadronizer at all. In fact, it broke it off at the chalisticator and left me up the paddle without a creek, so to speak. Nevertheless, a little old-fashioned luck and a tap with the old thorificating polookanizer soon had things back on track.
Now all I need is another Speckled Jim for the halitosinifer (do you REALLY want to know?) and all will be well in my world (which is not like other worlds if posts on XDA are anything to go by...)
Thanks all for your excellent input, it has been a journey through the looking glass!
well i really liked the "brilliantly" thought of posts about the legendary tools mentioned... hehe
i was really looking forward to more comments to lighten up the mood
pls keep posting
3 cheers
btw i am also stuck at dead hard brick on my cappy
regards
alot of youtube videos provide help on unbricking
...'last resort' option in the Riffbox (Clone Gremlin Zone flash)
Click to expand...
Click to collapse
Please.
Someone know what Gremlin Zone exactly is?
Location in OneNAND ? Or somewhere else?
Maybe adresses or dump of Gremlin Zone would be nice.
Thanx in advance.
Best Regards
adfree said:
Please.
Someone know what Gremlin Zone exactly is?
Location in OneNAND ? Or somewhere else?
Maybe adresses or dump of Gremlin Zone would be nice.
Thanx in advance.
Best Regards
Click to expand...
Click to collapse
I think the person to ask would be AdamOutler. You're asking for some deep knowledge in general

[Q] Headless Mobo data retrieval.

Hey guys bout to beat my head against a wall on this one.
A buddy of mine "tired" to replace his front glass on his Moto X and ended up destroying it. Apparently he cooked it pretty well with a hair dryer on high in the process of trying to the glass off and fried the LCD and digitizer and possibly more. Anyway he brought me over a bag of parts and asked if i could retrieve his data. He was running unrooted stock with a locked bootloader and I'm assuming debugging turned off but not sure.
So this is the part i start hitting my head against the wall. After reassembling it without the LCD/digitizer assembly pluged in, I pluged it in via USB and it installs it's self as a MOTOROLA PHONE, and seams to be using the USB INPUT and HID Compliant Vendor Defined Device drivers. I cant for the life of me get it to use the right drivers. I've installed Motorola's driver/device manager and run the Motorola driver installer but nothing is working.
Really don't know that much about the Moto X as I don't own one myself but i'd assume that it should install as a specific device and not a generic MOTOROLA PHONE as well as using MTP drivers instead of USB INPUT
Basically though, short of the driver issues, my main question is. Is there anyway of pulling data from a headless, bootloader locked, ADB disabled device? I personally don't think there is but just in case i thought i'd ask.
Would rather not buy a new LCD/Digitizer assembly for $70 if the main board got fried from the heat of the hairdryer, but might have to if there's no other way, at least then I could see what going on.
Have checked though the forms and didn't see any other similar topics on this, so if I missed it please link it.
Thanks ahead of time.
~Ninjaboy837
Ninjaboy837 said:
Hey guys bout to beat my head against a wall on this one.
A buddy of mine "tired" to replace his front glass on his Moto X and ended up destroying it. Apparently he cooked it pretty well with a hair dryer on high in the process of trying to the glass off and fried the LCD and digitizer and possibly more. Anyway he brought me over a bag of parts and asked if i could retrieve his data. He was running unrooted stock with a locked bootloader and I'm assuming debugging turned off but not sure.
So this is the part i start hitting my head against the wall. After reassembling it without the LCD/digitizer assembly pluged in, I pluged it in via USB and it installs it's self as a MOTOROLA PHONE, and seams to be using the USB INPUT and HID Compliant Vendor Defined Device drivers. I cant for the life of me get it to use the right drivers. I've installed Motorola's driver/device manager and run the Motorola driver installer but nothing is working.
Really don't know that much about the Moto X as I don't own one myself but i'd assume that it should install as a specific device and not a generic MOTOROLA PHONE as well as using MTP drivers instead of USB INPUT
Basically though, short of the driver issues, my main question is. Is there anyway of pulling data from a headless, bootloader locked, ADB disabled device? I personally don't think there is but just in case i thought i'd ask.
Would rather not buy a new LCD/Digitizer assembly for $70 if the main board got fried from the heat of the hairdryer, but might have to if there's no other way, at least then I could see what going on.
Have checked though the forms and didn't see any other similar topics on this, so if I missed it please link it.
Thanks ahead of time.
~Ninjaboy837
Click to expand...
Click to collapse
Now , I'm not a hardware specialist or anything ,but , do you suppose you could somehow "Directly" access data from the NAND chip ?
Ref: " https://www.ifixit.com/Teardown/Motorola+Moto+X+Teardown/16867 "
I did a little research on the NAND chip, unfortunately there is an NDA in place, so you probably won't be able to find out what the pins are to access it. I have been wrong before. Problem with using the hair dryer on high is that heat=energy in motion, which can cause electron flow.
If your friend didn't take appropriate precautions, ie grounding himself, ESD pad, dry hands, it is possible he shorted the entire assembly, and all his data is destroyed, especially if he didn't disconnect the battery.
Finally, the bag of parts=sensitive electrical components in a heavily charged static bag. Chances are that could've killed any chance of getting data.
The reason that your computer is recognizing the device as a Motorola Phone and that is it is as a failsafe, the processor isn't completely dead and is doing what it can to help you, by trolling you.
Good Luck!
I picked up a 4.4.2 Moto X with a bad battery and a bad (broken panel, no display) screen assembly. It did the same as what you're describing when hooked up via USB. After installing a good battery and plugging in a working screen it booted right up without any trouble. Before the parts the phone would light a green LED in the earpiece when plugged into the charger. Unless he really super baked the crap out of it you can probably get it working with a screen and possibly a battery.
If you do need a screen I was looking at the $52 dollar option on ebay myself before I found another option, it's auction number 251892071870 .
I'd suggest trying this http://forum.xda-developers.com/showthread.php?t=2786395
You'd be able to run the recovery by pressing all three buttons when the device is off to get to the bootloader. Then when you guess that its loaded press volume down once, then volume up once. Then wait 10-30 seconds for recovery to load
tormin said:
I picked up a 4.4.2 Moto X with a bad battery and a bad (broken panel, no display) screen assembly. It did the same as what you're describing when hooked up via USB. After installing a good battery and plugging in a working screen it booted right up without any trouble. Before the parts the phone would light a green LED in the earpiece when plugged into the charger. Unless he really super baked the crap out of it you can probably get it working with a screen and possibly a battery.
If you do need a screen I was looking at the $52 dollar option on ebay myself before I found another option, it's auction number 251892071870 .
Click to expand...
Click to collapse
I might just have to try that, i did notice with the battery out and connected via USB the phone shows up as a USB INPUT, but as soon as you plug in the battery and the X8 computing system then it switches to MOTOROLA PHONE.
mrmidnight said:
I did a little research on the NAND chip, unfortunately there is an NDA in place, so you probably won't be able to find out what the pins are to access it. I have been wrong before. Problem with using the hair dryer on high is that heat=energy in motion, which can cause electron flow.
If your friend didn't take appropriate precautions, ie grounding himself, ESD pad, dry hands, it is possible he shorted the entire assembly, and all his data is destroyed, especially if he didn't disconnect the battery.
Finally, the bag of parts=sensitive electrical components in a heavily charged static bag. Chances are that could've killed any chance of getting data.
The reason that your computer is recognizing the device as a Motorola Phone and that is it is as a failsafe, the processor isn't completely dead and is doing what it can to help you, by trolling you.
Good Luck!
Click to expand...
Click to collapse
Yea, some people don't realize the big affects of not following little precautions.
Found a article on hackaday about reading NAND chips in place on the pcb might give that a try if all else fails.
http://hackaday.com/2010/12/24/reading-nand-flash-chips-without-removing-them/
http://www.uchobby.com/index.php/2007/05/05/read-embedded-flash-chips/
raddacle said:
I'd suggest trying this http://forum.xda-developers.com/showthread.php?t=2786395
You'd be able to run the recovery by pressing all three buttons when the device is off to get to the bootloader. Then when you guess that its loaded press volume down once, then volume up once. Then wait 10-30 seconds for recovery to load
Click to expand...
Click to collapse
When booting in to the Moto X's recovery does it start ADB? I'm not sure if ADB is enabled or not, but it's worth a shot. I've gotten spoiled with My TWRP recovery auto enabling ADB on recovery boot.
ooo just saw this, there might be hope after all
Ricky Divjakovski said:
for people who dont have adb enabled, i suggest you contact a kernel developer to automatically enable it in the default.prop and sideload the kernel in recovery!
i broke my S3 on stock so nothing was enabled.
i enabled adb via the default.prop and compiled the kernel and flashed in recovery(sideload).
now i have full control over the device.
Click to expand...
Click to collapse
Ninjaboy837 said:
When booting in to the Moto X's recovery does it start ADB? I'm not sure if ADB is enabled or not, but it's worth a shot. I've gotten spoiled with My TWRP recovery auto enabling ADB on recovery boot.
ooo just saw this, there might be hope after all
Click to expand...
Click to collapse
Hmm you know what, you're right. It seems Nexus devices have adb on stock recovery- Moto's don't. Though what you found might be gold, I hope you can bust out a modified kernel- or know someone who does.
EDIT: Though I don't know how you're going to get the Update.zip on the phone to flash it. Worse comes to worse you could plug a mouse into the phone and play a guessing game of what you're clicking on

note 5 hardware question.

Hello, my note 5 screen broke. Can I take the motherboard out and stick it in another note 5 to recover my files? Also the usb port is broken too, Going to use wifi if I can swap the boards. Thanks for any info on this.
neotank28 said:
Hello, my note 5 screen broke. Can I take the motherboard out and stick it in another note 5 to recover my files? Also the usb port is broken too, Going to use wifi if I can swap the boards. Thanks for any info on this.
Click to expand...
Click to collapse
it's possible. But might be hard.
neotank28 said:
Hello, my note 5 screen broke. Can I take the motherboard out and stick it in another note 5 to recover my files? Also the usb port is broken too, Going to use wifi if I can swap the boards. Thanks for any info on this.
Click to expand...
Click to collapse
It is hard, but possible. But perhaps you can try to copy the files and migrate to a new Samsung device instead with Samsung's Smartswitch app. If your screen is totally broken to the point you can't operate the phone, use Sidesync app on both your PC and phone, then control it from there to use the Smartswitch app.
Yes. This is 100% possible and relatively easy.
Step 1: Use a heat gun to soften the adhesive behind back glass (hairdryer on HIGH works as well). Then SLOWLY AND CAREFULLY use a razor blade to separate the back glass from device.
Step 2: Remove all 19 screws from the back of the device.
Step 3: While gripping the frame of the phone, gently apply pressure to the bottom of the battery below the wireless charging pad. This will allow the motherboard and screen assembly to separate from the frame.
Step 4: Separate the motherboard from the charge port flex cable. (Start at the top of the motherboard and work your way down.)
Step 5: Repeat process in reverse for assembly into host device.
Please note:
If you want cellular capabilities to function properly, you will need the EXACT SAME model number Note 5. The cellular antennas are connected to the charge port. Each carrier Note 5 has a different has a different set of antenna. (i.e. You cannot put an AT&T board into a Verizon device and then attempt to access the AT&T network. The antenna accept different bands of signal.)
I am a former Cell Phone Repair Technician with an extensive amount of experience. If you have any other questions, message me.
Thanks for all the info and replies.
Knowing that this will work, I'm going to search for another note5 on ebay that is beat up. I'll place my motherboard into it and try and get the files off.
Watched some youtube videos and while it looks fairly difficult I think i can do it. Will post results.

Help desperate situation. Note 9 audio dead

Note 9 Exynos Purchased in India.
But my audio has stopped working.
I spent days and nights trying to see if anybody else has faced a similar situation and could not find much info.
XDA gurus my last hope.
Samsung's support is bad. here. The less said the better.
I finally pulled the trigger and did a factory re-set. That too did not help.
Here is a funny thing.
I can shoot pictures but I can't shoot Video.
If I plug my headphones in nothing happens.
The only thing that works is blue tooth headset but not for calls.
If I can figure out what parts need changing I can order them. And try replacing them.
The only Part I could find is this.
https://shopee.com.my/Krcb-98512-Fo...CUD07XjfwNIQZ3inXJADNm-X84Ea9PHVLt7NMgOSL74Fo
Update:
I finally tracked the problem down to the latest update. Soon after the update. Phone started to get hot. And also charging took longer than normal. Audio slowly stoped working.
You can try the following diagnostic tools, if anything to confirm if you have a hardware issue:
1) Dial *#0*# on you dialler and you get Test Mode from where you can test various hardware, including audio
2) In Samsung Members app go to Phone Care and select Interactive Tests. There you can find another set of hardware diagnostics that you may find useful.
Good luck!
Sent from my SM-N960F using Tapatalk
Done sir.
Im pretty sure the Audio IC is blown.
Just need to confirm the part number to order.
kta said:
You can try the following diagnostic tools, if anything to confirm if you have a hardware issue:
1) Dial *#0*# on you dialler and you get Test Mode from where you can test various hardware, including audio
2) In Samsung Members app go to Phone Care and select Interactive Tests. There you can find another set of hardware diagnostics that you may find useful.
Good luck!
Sent from my SM-N960F using Tapatalk
Click to expand...
Click to collapse
Just in case somebody else has this problem I am sharing info as I find it.
It would seem the IC needed is MAX98512
And you can download the full Note 9 schematic from my google drive here.
https://drive.google.com/file/d/15MPFlmcnupHqU_4ZAkPOyWo5QeBj9XI-/view?usp=sharing
How do I figure out which IC to change. 98512 or 9896B
Could not find any info online. Other than 98512 is an audio amp and 9896B is audio IC.
Further reading & research seems to link this to the latest Android 10 update.
A lot of other people have faced similar problems on various phones. And 90% of the time the only solution is to have the mainboard replaced.
Just google android 10 updates broke my phone.
So far I have done 3 factory data re-sets. Each time trying something new like this time I did not update from backup. Still, my max98512 seems to be the problem.
I have placed an order for new chips from aliexpress.
Not being able to roll back really suck.
So I got this idea. To figure out if its a software issue or a hardware issue. Need to see if the device drivers are loading or not.
This info can be found by bootin up into recovery mode then view log. Open log last-kmsg
Its a pain to read. And I have not figured out a way to access the data via adb most of the instructions do not work on non rooted phones.
Can anybody with a working note see if the get this message in their log.
star-madera sound: Failed to parse codec DAI for uaif -517
@34%
max98512 6-0039 failed to read [0x0402][-121]
[max98512 _debug] max98512_i2c_probe: failed to read 0x402 [-121]
max98512: probe of 6-0039 failed with error -121
@56%
ALSA DEVICE LIST
no soundcards found
warning unable to open console
I need to know what is the text that shows up on the line after ALSA DEVICE LIST on a working phone.
The TWO ICS handling audio are max98512 and CS47L90 Ignore my earlier comments Indian Note 9 is different audio IC.
By this I can figure out if its a file corruption issue or a hardware failure issue.
RonChinoy said:
So I got this idea. To figure out if its a software issue or a hardware issue. Need to see if the device drivers are loading or not.
This info can be found by bootin up into recovery mode then view log. Open log last-kmsg
Its a pain to read. And I have not figured out a way to access the data via adb most of the instructions do not work on non rooted phones.
Can anybody with a working note see if the get this message in their log.
star-madera sound: Failed to parse codec DAI for uaif -517
@34%
max98512 6-0039 failed to read [0x0402][-121]
[max98512 _debug] max98512_i2c_probe: failed to read 0x402 [-121]
max98512: probe of 6-0039 failed with error -121
@56%
ALSA DEVICE LIST
no soundcards found
warning unable to open console
I need to know what is the text that shows up on the line after ALSA DEVICE LIST on a working phone.
The TWO ICS handling audio are max98512 and CS47L90 Ignore my earlier comments Indian Note 9 is different audio IC.
By this I can figure out if its a file corruption issue or a hardware failure issue.
Click to expand...
Click to collapse
Following here, my father Note 9 same problem and he think it very very bad work by Samsung to put out such devices to break after only 1.5 year of use, His old Nexus 4 is still working and running Android 9 custom ROM thanks to XDA Developer!
Samsung have done something bad, and it is to charge same amount to repair the phone as buying a new phone
So instead of repairing dead audio Note 9 at Samsung its better to do it unofficially I think :silly:
silvaBR said:
Following here, my father Note 9 same problem and he think it very very bad work by Samsung to put out such devices to break after only 1.5 year of use, His old Nexus 4 is still working and running Android 9 custom ROM thanks to XDA Developer!
Samsung have done something bad, and it is to charge same amount to repair the phone as buying a new phone
So instead of repairing dead audio Note 9 at Samsung its better to do it unofficially I think :silly:
Click to expand...
Click to collapse
How much did they quote because one guy was quoted 18,000 I was quoted 26,500,
Yes I agree we save up for years or take out 2-3 year EMI to pay for these phones and then they don't last even 2 years. Samsung can not even explain why it failed. My Water sensor is not tripped. Phone has never been dropped or has a single scratch on it.
Im now using a 5 year old one plus that saw my daughter thru school and collage and its still going strong. Even after multiple drops in water.
Anyway if your interested I am importing all the Audio ICs 10 of each and plan to repair it myself.
The problem with getting outside guys to work on it is they try to reball the existing IC. And if that does not work They put in used parts.
Lets see if this is a s/w issue or a hardware issue if we can get a last_kmesg log file from a working phone we should be good to go.
I found this in the log.
audio_hw_proxy_9810: fast_out-proxy_open_playback_stream: PCM Device is not ready with Sampling_Rate(48000) error(cannot open device '/dev/snd/pcmC0D2p': No such file or directory)!
I really want to go back to Android 9. I don't even mind triping my Knox now.
RonChinoy said:
So I got this idea. To figure out if its a software issue or a hardware issue. Need to see if the device drivers are loading or not.
This info can be found by bootin up into recovery mode then view log. Open log last-kmsg
Its a pain to read. And I have not figured out a way to access the data via adb most of the instructions do not work on non rooted phones.
Can anybody with a working note see if the get this message in their log.
star-madera sound: Failed to parse codec DAI for uaif -517
@34%
max98512 6-0039 failed to read [0x0402][-121]
[max98512 _debug] max98512_i2c_probe: failed to read 0x402 [-121]
max98512: probe of 6-0039 failed with error -121
@56%
ALSA DEVICE LIST
no soundcards found
warning unable to open console
I need to know what is the text that shows up on the line after ALSA DEVICE LIST on a working phone.
The TWO ICS handling audio are max98512 and CS47L90 Ignore my earlier comments Indian Note 9 is different audio IC.
By this I can figure out if its a file corruption issue or a hardware failure issue.
Click to expand...
Click to collapse
hi, please guide me how to read logs. I have note 9 SM-N960F on android Pie Indian firmware.
@34% it is showing some frequency logs and 56% about some gamma values and pannel .
---------- Post added at 11:25 AM ---------- Previous post was at 11:04 AM ----------
here i found this method on samsung website to dump the logs.
SysDump tool:
Launch the Phone app.
Enter *#9900# to launch the SysDump tool.
If the Debug Level is Disabled/LOW, tap to select MID. This restarts the device.
Reproduce the issue that you would like to troubleshoot.
Repeat steps 1 to 2 to launch the SysDump tool.
Tap Run dumpstate/logcat.
Tap Copy to sdcard. This copies a timestamped .log file to the folder /log, which you can access through My Files in your personal space.
You can send the file to Knox Support, using one of these methods:
well found max98512 6-0039
for "ALSA DEVICE LIST" please share pic, it may help to find it.
The way I got to see my last_Kmesg was to go into system recovery i.e. power on with 3 buttons pressed. You get the menu which allows you to re-set the phone or wipe cache partition in that screen there is an option to view logs. From there I read the log.
Its a tiny font and took me 2 hours lol.
But chk this out. Just google Just google android 10 mic fix or android 10 audio problems.
And you will see that a lot of phones have been hit by this.
Not just samsung. But many brands. Some have found solutions some have not.
I think the first step for us is to figure out how to go back to Android 9.
If even after doing that the problem is not resolved then we have to replace the Audio ICs.
I belive the problem was caused by the update. And then it gets bad to the point where it destroys the audio IC.
Pixel phones had a similar problem where the android 10 spoilt sensors at the hardware level.
I was not able to find a directory /log or any files following your steps.
When you google Note 9 audio IC you get this link.
https://www.deviceparts.com/9896b-audio-ic-for-samsung-galaxy-note-9-ori.html
I have placed the order for this along with Max98512 but I can not find any reference to the 9896b IC is any of the Samsung Service manuals.
Lets focus on how to roll back to android 9. Because I think there were some massive changes to how audio is handled in android 10 and that is what spoilt our phones.
Basically due to overheating after the update. It was a crapshoot to see which IC lost contact.
Some people lost on display IC and some on Audio.
My Max98512 IC has arrived.
As to Samsung Claiming offically in writing to me that there were no Audio related problems reported after the update.
Show the lying [email protected]#[email protected]@ this simple google link.
https://www.google.com/search?newwi...TIuMZgBAKABAaoBB2d3cy13aXrAAQE&sclient=psy-ab
Can we use this method to roll back to Android 9 ? I heard rollback is not possible. ?.
Can somebody clarify ?.
https://www.rprna.com/news/how-to-rollback-from-one-ui-2-0-beta-android-10-to-one-ui-1-1-android-9/
it only possible if you have beta version of andriod 10 installed in your phone. if you have updated to stable version of andriod 10 then it is not possible.
Munawar Mehmood said:
it only possible if you have beta version of andriod 10 installed in your phone. if you have updated to stable version of andriod 10 then it is not possible.
Click to expand...
Click to collapse
a. I hope the Deves on XDA can fix this problem and figure out a way for us to roll back.
b. We put enough pressure on Samsung to allow us to roll back. Which I doubt as so many failures suits their agenda of getting you to buy a new phone.
c. We just address the parts that have failed and hope that they last.
==========================
Latest Update:
I was able to get my back cover off. Without cracking the glass or scratching anything it took me an hour but I took it slow on purpose.
Right chuffed with myself. Next step is to chk the speakers with a Multi Meter Then extract the board and inspect it. Water sensors are ok they were not tripped.
The Fingerprint flex was a nightmare to get off in the end it popped off on its own. And the flex nearly tore but did not.
The next step is to try and extract the mainboard and do a physical inspection and look for any damaged parts and to try and locate the Max98512 and the Audio Codec chip.
Im struggling here without the schematics. But my suspicion was right there is heating up all over the board. At the audio and you can see where the solder paste balls have separated from components. I see it near the display chips and near the audio chips.
There are tiny balls of melted solder all over the board.
Everything from the main chips to small components like SMD caps and resistors have over heated and shed these tiny balls of lead all over the board.
Im working without a microscope using a plastic pocket scope we use to read plugs.
Plan is to clean out all these melted balls and then put some flux and re-flow the lead. The Max98512 I will have to lift to see what the heat has done to the pads below.
I can't see any conformal coating on the board. This means if you live in places like India were we see humidity off 80-90% it can wreak havoc with your phone without even tripping the water sensors.
Today's plan is to pull the main board off. Wash it in Iso. Then used compressed air to blow off all the tiny balls of lead. Then fresh flux and lead. And then if I can get it to work. To coat the complete mainboard in a moisture-proof conformal coating.
I can't imagine why they would not coat the boards.
If you open up a Honda ECU after 25 years you will find that the board is still shiny. The lead looks fresh. And the reason is that they use a conformal coating.
And the reason why the audio and display ICs are getting hit the worst is that they have zero heat sinks. Im no expert but why would you run an Audio Amplifier IC with no heat sink. Makes zero sense to me.
============================
If you have an audio problem and are working with the 98512 here are the other parts you will need around it. These are the supporting components.
SCH Part # Part Desc
C8004 2203-009859 / 22000nF,20%,10V,X5R,TP,1608,T (Damaged)
C8002 2203-009858 / 10000nF,20%,10V,X5R,TP,1005,T
L8002 2703-005505 / 1uH,20%,2016,T1,0.043Ohm,42
Top
R8052 2007-007741 / 10KOHM,1%,1/20W,TP,0603
C8006 2203-007796 / 1000NF/1uf,20%,10V,X5R,TP,0603,0.
C8014 2203-008860 / 1000NF,20%,16V,X5R,TP,0603,0.
Btm
C8000 2203-008097 / 100NF/0.1uf ,10%,25V,X5R,TP,0603,0.3
C8002 2203-009859 /22000nF /22uf,20%,10V,X5R,TP,1608,T
C8004*2203-009858 /10000nF / 10uf,20%,10V,X5R,TP,1005,T
C8077 2203-008466 / 0.033nF,5%,16V,C0G,TP,0402,0.
C8003 2203-007621 / 100nF,10%,6.3V,X5R,TP,0402,T0
Thanks guys I solved my problem.
Purchased a Microscope, a soldering station, and a Max98512 AMP IC.
It took me 3 months but I did it.
I did try taking it to a shop. He soldered the IC on so poorly that the phone stopped booting up. And one 10K resistor blew. So decided to do it myself. Samsung Service will not do board level repair. ANd those out there offering this service 90% are uneducated without the right tools for the job.

Categories

Resources