Dismantle 605 Wifi 30G
Posted: Mon Dec 24, 2007 12:00 am
I consider this as the first step to hack into a 605 wifi, and my ultimate goal is to run my programs in 605 just as many others wanted to do.
Why
According to my experience in a company that develops complicated circuit boards and Linux systems, there is usually a serial port connected to the CPU, in this case it's the DaVinci chip, for debugging purpose. If this serial port is available, we can login to the system and control the Linux.
After I examined the DaVinci EVM found at
http://c6000.spectrumdigital.com/davinc ... ematic.pdf,
I found a RS232 schematic on page 20. The UART0 comes out from DaVinci 6446 pin C5 and D5, and connects to a MAX3221, then to RS232 out. Hey, this is very promising. It's likely that 605 wifi also has a serial port.
Now the questions are,
1. What type of DaVinci 605 wifi 30G uses?
2. Does it have serial port?
3. Where is the serial port?
To answer these questions, I need to open its case and take a look inside.
How
Step 1, remove the back cover for the battery. There are 5 screws, 3 on the side and 2 fasten the stand. After it's removed, it's like this:
www.ece.ubc.ca/~dingyil/605wifi/1-back-cover.JPG
Step 2, remove the screen. There are a couple screws under the hard drive, but only 2 needs to be removed:
www.ece.ubc.ca/~dingyil/605wifi/2-screen-1.JPG
www.ece.ubc.ca/~dingyil/605wifi/2-screen-2.JPG
On the earphone jack side, there are 2:
www.ece.ubc.ca/~dingyil/605wifi/2-screen-3.JPG
On the top, there is another 1:
www.ece.ubc.ca/~dingyil/605wifi/2-screen-4.JPG
After the screen is removed (wire is still connected), it's like this:
www.ece.ubc.ca/~dingyil/605wifi/3-glimpseInside-1.jpg
This screen side of the PCB doesn't have DaVinci, but we can still see some chips and the USB and the docking port.
(TI) 430F2111 6AK HK JV E
www.ece.ubc.ca/~dingyil/605wifi/3-glimpseInside-2.JPG
(could be a micro controller)
WM8985G 72ABNP6
(Intel) F160C8BD A6467A71 Z472035N (not sure)
LC4032ZC 75NM6 B702RR26 (not sure)
BBO 6AW M420
www.ece.ubc.ca/~dingyil/605wifi/3-glimpseInside-3.JPG
www.ece.ubc.ca/~dingyil/605wifi/3-glimpseInside-4.JPG
www.ece.ubc.ca/~dingyil/605wifi/3-glimpseInside-5.JPG
www.ece.ubc.ca/~dingyil/605wifi/3-glimpseInside-6.JPG
The other end:
www.ece.ubc.ca/~dingyil/605wifi/3-glimpseInside-7.JPG
The hard drive:
www.ece.ubc.ca/~dingyil/605wifi/4-harddrive.JPG
Step 3: detach the PCB. The DaVinci is hidden under the metal cover on the hard drive side of the PCB.
There are 3 screws on the hard drive side of the PCB:
www.ece.ubc.ca/~dingyil/605wifi/5-PCB-1.JPG
www.ece.ubc.ca/~dingyil/605wifi/5-PCB-2.JPG
There are another 2 on the other side:
www.ece.ubc.ca/~dingyil/605wifi/3-glimpseInside-3.JPG
After the PCB is detached, it's like this:
www.ece.ubc.ca/~dingyil/605wifi/5-PCB-3.JPG
If you see a mysterious part like this:
www.ece.ubc.ca/~dingyil/605wifi/6-mysteriousPart-1.JPG
It belongs here:
www.ece.ubc.ca/~dingyil/605wifi/5-PCB-1.JPG
You can then carefully remove the metal cover:
www.ece.ubc.ca/~dingyil/605wifi/7-metalCover.JPG
Now you can see the DaVinci chip:
DAVINCI $NC-6AA8CLW TMS320 DM6441 (can't see the last string)
www.ece.ubc.ca/~dingyil/605wifi/8-DaVinci-1.JPG
And some other chips:
3 of 6CA1KHJ WF245
www.ece.ubc.ca/~dingyil/605wifi/8-Davnici-2.JPG
2 of 7ED22 D9GKW c788
www.ece.ubc.ca/~dingyil/605wifi/9-otherChips-1.JPG
www.ece.ubc.ca/~dingyil/605wifi/9-otherChips-2.JPG
(TI) WE245 68K A2HY, I cut the frame and see this:
www.ece.ubc.ca/~dingyil/605wifi/9-otherChips-3.JPG
LCGY J829 611, also need to cut the frame.
www.ece.ubc.ca/~dingyil/605wifi/9-otherChips-4.JPG
That's all what I can see.
Now what?
Since 6441 may not be the same as 6446 in the EVM, I looked at the 6441 document:
focus.ti.com/docs/prod/folders/print/tms320dm6441.html
focus.ti.com/lit/ds/symlink/tms320dm6441.pdf
Gladly I found that 6441 also has UART0, and it also comes out from C5 and D5 pin. However I didn't see a MAX3221 RS232 chip.
So, is it possible that some of the chips above already provide the RS232 function? I haven't figure out what those chips are for, yet.
Because the UART0 is duplexed with GPIO, is it possible that the UART0 is already connected to the docking port?
Finally I put everything back into the case. Luckily it still work
So if anyone has any information, pls post. And if you would like to open your 605 to do some experiment, I encourage you to go ahead
Why
According to my experience in a company that develops complicated circuit boards and Linux systems, there is usually a serial port connected to the CPU, in this case it's the DaVinci chip, for debugging purpose. If this serial port is available, we can login to the system and control the Linux.
After I examined the DaVinci EVM found at
http://c6000.spectrumdigital.com/davinc ... ematic.pdf,
I found a RS232 schematic on page 20. The UART0 comes out from DaVinci 6446 pin C5 and D5, and connects to a MAX3221, then to RS232 out. Hey, this is very promising. It's likely that 605 wifi also has a serial port.
Now the questions are,
1. What type of DaVinci 605 wifi 30G uses?
2. Does it have serial port?
3. Where is the serial port?
To answer these questions, I need to open its case and take a look inside.
How
Step 1, remove the back cover for the battery. There are 5 screws, 3 on the side and 2 fasten the stand. After it's removed, it's like this:
www.ece.ubc.ca/~dingyil/605wifi/1-back-cover.JPG
Step 2, remove the screen. There are a couple screws under the hard drive, but only 2 needs to be removed:
www.ece.ubc.ca/~dingyil/605wifi/2-screen-1.JPG
www.ece.ubc.ca/~dingyil/605wifi/2-screen-2.JPG
On the earphone jack side, there are 2:
www.ece.ubc.ca/~dingyil/605wifi/2-screen-3.JPG
On the top, there is another 1:
www.ece.ubc.ca/~dingyil/605wifi/2-screen-4.JPG
After the screen is removed (wire is still connected), it's like this:
www.ece.ubc.ca/~dingyil/605wifi/3-glimpseInside-1.jpg
This screen side of the PCB doesn't have DaVinci, but we can still see some chips and the USB and the docking port.
(TI) 430F2111 6AK HK JV E
www.ece.ubc.ca/~dingyil/605wifi/3-glimpseInside-2.JPG
(could be a micro controller)
WM8985G 72ABNP6
(Intel) F160C8BD A6467A71 Z472035N (not sure)
LC4032ZC 75NM6 B702RR26 (not sure)
BBO 6AW M420
www.ece.ubc.ca/~dingyil/605wifi/3-glimpseInside-3.JPG
www.ece.ubc.ca/~dingyil/605wifi/3-glimpseInside-4.JPG
www.ece.ubc.ca/~dingyil/605wifi/3-glimpseInside-5.JPG
www.ece.ubc.ca/~dingyil/605wifi/3-glimpseInside-6.JPG
The other end:
www.ece.ubc.ca/~dingyil/605wifi/3-glimpseInside-7.JPG
The hard drive:
www.ece.ubc.ca/~dingyil/605wifi/4-harddrive.JPG
Step 3: detach the PCB. The DaVinci is hidden under the metal cover on the hard drive side of the PCB.
There are 3 screws on the hard drive side of the PCB:
www.ece.ubc.ca/~dingyil/605wifi/5-PCB-1.JPG
www.ece.ubc.ca/~dingyil/605wifi/5-PCB-2.JPG
There are another 2 on the other side:
www.ece.ubc.ca/~dingyil/605wifi/3-glimpseInside-3.JPG
After the PCB is detached, it's like this:
www.ece.ubc.ca/~dingyil/605wifi/5-PCB-3.JPG
If you see a mysterious part like this:
www.ece.ubc.ca/~dingyil/605wifi/6-mysteriousPart-1.JPG
It belongs here:
www.ece.ubc.ca/~dingyil/605wifi/5-PCB-1.JPG
You can then carefully remove the metal cover:
www.ece.ubc.ca/~dingyil/605wifi/7-metalCover.JPG
Now you can see the DaVinci chip:
DAVINCI $NC-6AA8CLW TMS320 DM6441 (can't see the last string)
www.ece.ubc.ca/~dingyil/605wifi/8-DaVinci-1.JPG
And some other chips:
3 of 6CA1KHJ WF245
www.ece.ubc.ca/~dingyil/605wifi/8-Davnici-2.JPG
2 of 7ED22 D9GKW c788
www.ece.ubc.ca/~dingyil/605wifi/9-otherChips-1.JPG
www.ece.ubc.ca/~dingyil/605wifi/9-otherChips-2.JPG
(TI) WE245 68K A2HY, I cut the frame and see this:
www.ece.ubc.ca/~dingyil/605wifi/9-otherChips-3.JPG
LCGY J829 611, also need to cut the frame.
www.ece.ubc.ca/~dingyil/605wifi/9-otherChips-4.JPG
That's all what I can see.
Now what?
Since 6441 may not be the same as 6446 in the EVM, I looked at the 6441 document:
focus.ti.com/docs/prod/folders/print/tms320dm6441.html
focus.ti.com/lit/ds/symlink/tms320dm6441.pdf
Gladly I found that 6441 also has UART0, and it also comes out from C5 and D5 pin. However I didn't see a MAX3221 RS232 chip.
So, is it possible that some of the chips above already provide the RS232 function? I haven't figure out what those chips are for, yet.
Because the UART0 is duplexed with GPIO, is it possible that the UART0 is already connected to the docking port?
Finally I put everything back into the case. Luckily it still work
So if anyone has any information, pls post. And if you would like to open your 605 to do some experiment, I encourage you to go ahead