Attend XDA's Second Annual Developer Conference, XDA:DevCon 2014!
5,729,384 Members 43,044 Now Online
XDA Developers Android and Mobile Development Forum

Reverse engineering the Blu Studio 5.3 dock port

Tip us?
 
lvnr00tddrd
Old
(Last edited by lvnr00tddrd; 23rd April 2012 at 12:32 AM.) Reason: More pics
#1  
Junior Member - OP
Thanks Meter 8
Posts: 22
Join Date: Mar 2012
Default Reverse engineering the Blu Studio 5.3 dock port

Okay. It seems that Blu Products isn't going to explain anything about the dock port on their Studio 5.3, so I am embarking on a project to reverse engineer it. I'll update my progress here.

Pictures of the dock port:






Pictures of the plug that fits it. It's the same 30-pin plug as found on the iPod and a bunch of other devices.







(Last 3 images from https://www.sparkfun.com/products/8295)


What I just ordered to work on this project:




(Again from https://www.sparkfun.com/products/8295)


Here's what I've figured out so far.

The cable from my iPod Nano 6th gen has pins 1, 15, 16, 23, 25 and 27. All others are missing. I haven't had time to analyze it all yet, but according to allpinouts.org, 1 is a ground, 15 and 16 are grounds and are tied together (internally on the iPod motherboard), 23 is USB +5v, and 25/27 are USB Data+/- OR, alternately, they are resistor-to-ground value-based signals.

My theory so far is that there is some internal resistance between the pins in this cable and other pins or ground; because plugging just the cable in--with it not being plugged into the USB port--disables the Blu's touchscreen and automatic screen rotation features and locks the screen in whatever position it's in when you plug in the cable. (Although interestingly, if you plug it in in landscape mode, you can use the screen rotation lock hardware button to put it back to portrait mode.) Plugging the other end of the cable into a USB port brings up the Recent Apps display (the thing that comes up when you hold the touchscreen home button down) and the phone says it's charging, but the touchscreen is still disabled. Not sure if it's actually charging or not; I'm gonna leave it plugged in for awhile and see. The phone does not show up as a new USB device when this (iPod) cable is plugged into the dock port.

Once I get the breakout board I'm gonna take the phone apart and see if I can trace where the pins in this dock port go. I'm also going to wire up a USB cable to the breakout board and see if I can get the phone to enumerate.

Hopefully I never toast my phone.

Edit for more pics from teardown:











Notice that this ribbon cable is 3 layers; those are little pieces of a paperclip holding them apart to show the layers.
The Following 3 Users Say Thank You to lvnr00tddrd For This Useful Post: [ Click to Expand ]
 
HeliumX10
Old
#2  
HeliumX10's Avatar
Senior Member
Thanks Meter 112
Posts: 302
Join Date: Apr 2011
Location: Psáry, Czech Republic
It really looks like PDMI connector


ROM: CyanogenMod 9.1 by Scritch007 - ICS 4.0.4 - version 6
KERNEL: 2.6.29. by ScritchOO7 - version 5
BOOTLOADER: unlocked
ROOTED: yes



All done from Linux !!!
 
lvnr00tddrd
Old
#3  
Junior Member - OP
Thanks Meter 8
Posts: 22
Join Date: Mar 2012
If it IS a PDMI connector, would getting a usb-to-pdmi cable work to connect to the phone? I've never used pdmi. I know the Dell Streak has a pdmi port though.
 
E:V:A
Old
#4  
E:V:A's Avatar
Recognized Developer
Thanks Meter 1696
Posts: 1,297
Join Date: Dec 2011
Location: -∇ϕ
You should open it to see what chips are used in that thing. That will help you a LOT to figure out what is going on...
MSM8960 Info, Architecture and Bootloader(s)
El Grande Partition Table Reference
How to talk to the Modem with AT commands

[REF][ServiceMode] How to make your Samsung perform dog tricks
[REF|R&D|RF] RF/Radio properties of Samsung ServiceMode

Want to know when your phone is getting tracked or tapped?

Help us develop the IMSI Catcher / Spy Detector!
(To be part of the EFF & The Guardian Project toolsets.)
_______________________________
If you like what I do, just click THANKS!
Everything I do is free, altruism is the way!
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ
I do not answer support related PM's.

 
warboat
Old
#5  
Member
Thanks Meter 22
Posts: 73
Join Date: Dec 2005
Location: Melbourne
Quote:
Originally Posted by lvnr00tddrd View Post
If it IS a PDMI connector, would getting a usb-to-pdmi cable work to connect to the phone? I've never used pdmi. I know the Dell Streak has a pdmi port though.
I have both Dell Streak 5 and Blu Studio 5.3 and I can comfirm that the pdmi cable for the Streak does not fit in the Studio 5.3.
The ports on both are the same width and same number of pins but the Streak's pins are arranged on 2 wedges, for lack of a better term, whereas the Studio and ipods are 2 rows of pins on both sides of a single wedge. It's like the Streak has a female type port and the Studio/ipods have male type ports.
 
puppeto
Old
#6  
Junior Member
Thanks Meter 0
Posts: 6
Join Date: Apr 2012
This could be some kind of dock connector that Blu has not released for our version. I've been doing some research on this phone to find the original recovery firmware and found that this exact phone is being sold under the following names:
  • Blu Studio 5.3
  • Texet TM-5200
  • Umeox X-Land / X-5
  • Pearl Simvalley SPX-5

On every "rebranded" listing I found they all had this port so it isn't just unique to the Blu. Also might try seeing if anything can be found for the MTK6573 chipset that would include this port. More info on this chipset here mediatek.com /en/Products/ featured_content.php?sn=2 {will have to copy / paste too new to post links yet}.

I've also found other indications through russian and chinese sites that this thing is being pushed in some countries as an iPhone knockoff with a custom "iOS" skin / launcher. Hard to tell for sure due to some things being lost in translation.

So to wrap it all up I would almost go for a crazy guess that this might be used on some of the "iPhone" knockoffs to fake as a 30-pin connector that may or may not actually work or only work for charging.
 
chrismotto
Old
#7  
Junior Member
Thanks Meter 1
Posts: 27
Join Date: Nov 2009
Its seems like its a docking port for a keyboard. I found this for Pearl Simvalley SPX-5 site found at http://www.pearl.de/a-PX3502-4072.shtml.
The Following User Says Thank You to chrismotto For This Useful Post: [ Click to Expand ]
 
puppeto
Old
#8  
Junior Member
Thanks Meter 0
Posts: 6
Join Date: Apr 2012
Now we know. I think I may import one of these to see if it works on the Blu as well. Might be disabled in the firmware though....
 
lvnr00tddrd
Old
#9  
Junior Member - OP
Thanks Meter 8
Posts: 22
Join Date: Mar 2012
Just got the PodBreakout board. To the soldering station I go. Send good karma my way.

I took the entire thing apart. Everything is under full-board metal shields as can be seen from the recent post-op pic. (You can also see the breakout board.) My phone still works, so I'm not prepared to go pulling the shields off just to see what's under them. I think that the only things would be the MediaTek CPU and some RAM and Flash chips anyway. Everything else is pretty tightly integrated.

Puppeto if you get ahold of one of those keyboards please keep us updated.

Behold the wonders of voiding your warranty:

The Following User Says Thank You to lvnr00tddrd For This Useful Post: [ Click to Expand ]
 
lvnr00tddrd
Old
(Last edited by lvnr00tddrd; 6th May 2012 at 08:29 AM.) Reason: Updated to reflect further audio line discoveries
#10  
Junior Member - OP
Thanks Meter 8
Posts: 22
Join Date: Mar 2012
Ok here's what I've figured out so far.

1. Make sure if you take your phone apart that you reconnect all the connectors inside the phone, or else you'll spend an hour trying to figure out why the dock port won't work at all before realizing what you did.

2. Onward to real research, here's what's been found so far.

Connecting pin 15 to 16 disables the touchscreen, but there is a threshold that must be met that I haven't found yet. If the 2 pins are directly tied together the touchscreen is disabled, and if there's a 3k resistor between them it is, too. But if there's a 100k resistor inline it doesn't disable the touchscreen.

Pin 1 appears to be a ground pin.
Pin 16 is USB ground
Pin 23 is USB +5 volts
It DOES charge when just Pins 16 and 23 are connected. My next step is to find which pins are the USB Data +/-. As can be seen below, it's non-standard.

Connecting Pin 27 to ground presses the hardware multifunction button (bottom middle of the front panel)
Pin 6 to ground presses hardware power key
Pin 29 to ground presses hardware volume down key
Pin 28 to ground is an oddball. Connecting it to ground through a 10k resistor seems to start the music player AND press the hardware volume up key
Connecting pin 9 to ground with a resistor less than 4k causes a white screen followed by a black screen and the phone freezing until the battery is removed.

Audio
Pin 3 - Audio Ground
Pin 4 - Audio Right
Pin 5 - Audio Left
The audio pins appear to be connected to the same lines as the headphone jack, only they don't have the hardware external speaker disable (or if they do I haven't found it yet). Apparently, the headphone hardware triggers a software signal of some kind that disables the external speaker. I confirmed that this is the case by plugging in a set of headphones, in which case these lines still give the audio output but the external speaker is disabled. Apparently this is something that can be controlled from within Android, because there were some bug reports awhile back about the external speaker not disabling when headphones were plugged in. So we need to find (or maybe someone can write?) an app that does nothing but disable the external speaker while leaving the headphone line active.

No luck yet on getting USB working. Still hoping someone here can help me out with knowing how to monitor what's going on by using adb?

The Following 2 Users Say Thank You to lvnr00tddrd For This Useful Post: [ Click to Expand ]
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes