Attend XDA's Second Annual Developer Conference, XDA:DevCon 2014!
5,778,176 Members 51,300 Now Online
XDA Developers Android and Mobile Development Forum

How to hack hardware binary and bend it to your will

Tip us?
 
AdamOutler
Old
(Last edited by AdamOutler; 8th November 2011 at 06:52 PM.)
#1  
AdamOutler's Avatar
Recognized Developer - OP
Thanks Meter 9598
Posts: 5,191
Join Date: Feb 2011
Location: Louisiana

 
DONATE TO ME
Default How to hack hardware binary and bend it to your will

Before you start on actually modifying your hardware, you must know what it is you're after. Don't just go using your finely tuned soldering iron without doing some research first... http://twitpic.com/75maxq

I wanted to share some tricks I use when locating UnBrickable Mod on various devices because it has been requested many times. Overall, the methods I'm going to talk about can be called "reverse engineering", "hacking", or "circuit bending".

Each device is different so different methods may be used. I'll start with what I feel is the best method to use and move my way on through less accurate and more destructive/difficult methods. The methods I'm using here can be used on nearly ANY device for nearly ANY purpose, not just locating boot modes. Using the techniques I'm laying out here, you can locate any physical memory register on any chip.

For the purposes of this familiarization guide, we will be locating the xOM5 resistor which changes the S5PC110 boot mode from "boot from OneNAND" to "Boot from USB, then OneNAND". Other modes are available such as booting from SDCard or MMC but these modes do not allow dual booting into the standard OneNAND boot so they are not practical unless you have a NAND failure.

By reading the S5PC110 processor manual, we can see on page 6-8, this is achieved by setting the xOM bits to 101001 (hex value 29). These binary values correspond to pins on the processor. These pins can be set high or low, and they ARE set high and low on the development board for the S5PC110 development boards. On other processors like OMAP4460, or Exynos, different pins are used but the functionality is the same.

With this knolwedge in hand, lets continue into HOW we can locate these pins.

how to locate the xOM resistor cluster
If you orient the S5PC110 processor with the PIN-0 dot at the lower left corner, you will find the xOM cluster at the lower right corner. These resistors will always be near this location because the pins on the board are near this location. It's never a good idea to have "runs" on a board longer than necessary. Therefore, these resistors will always be near this corner.

NOTE: You need not remove the processor. This is only for illustration.


For other devices, see the pinouts on the processor manual.


Methods for locating modificaton

Monitoring memory locations in real-time

You will need:
viewmem installed in /system/bin
bash installed in /system/bin
Market App: QuickSSHD allows you to terminal into the device.

1. we locate the xOM registers on the device. According to the processor manual
Quote:
OM_STAT 0xE010_E100 R OM status register 0x0000_0000
the OM registers are at 0xE010E100. So we know where to look in memory to monitor changes.

2. ssh into your device. See QuickSSHD for more information. Once you are in, assume super-user, get into a bash terminal, and use the viewmem utility.

Code:
$ su
# bash
bash-4.1#viewmem 0xE010E100 0x4|hexdump
[INFO] Reading 4 bytes at 0xe010e100...
0000000 0009 0000
0000004
3. Short and test. While shorting the high value to the active side, NOT THE VISIBLY GROUNDED SIDE, monitor output from the terminal.



The PullUp resistors are 10Kohm and the Pulldown resistors are 100Kohm. This means there's 10x more force behind a digital high than a digital low, in other words, you can short any low value high without a problem...
Code:
viewmem 0xE010E100 0x4|hexdump
[INFO] Reading 4 bytes at 0xe010e100...
0000000 0029 0000
0000004
the 29 signifies that the device is modded properly. A value of 0x9 is a standard production device. When you see 0029, you've located the proper resistor for the modification.


Using overlays
Take a picture of the board, then use an annotated pinout to locate the proper pins on the processor. This allows for a visual of the device as though the processor were removed.

here's a picture of my own annotated overlay. Use this and we'll walk through overlay logic.


Now, with a xOM value of 0x9, that's a binary value of 001001, use your calculator in "programmer" or "scientiffic" mode if you don't believe me.
Broken Down:
xOM5=0
xOM4=0
xOM3=1
xOM2=0
xOM1=0
xOM0=1

xOM 3 and 1 are both high values, all the rest are low. We can use this to our advantage. We can see that 4 resistors are connected to ground on one side and 2 are not. Those two are obviously xOM3 and xOM1.

If we look at the processor pinout, we can see that if xOM3 and xOM1 resistors were swapped, one would be very much longer than the other so there's only one logical solution.

Moving on to the shortest ones, xOM4 and xOM2 would obviously be closest to the top of the resistor cluster, and it's also obvious wich one would be which.

Now that leaves two resistors in the middle. One is high and one is low. by drawing it out you can see that if xOM5 were on the right, then xOM1 would be very much longer than xOM5, so xOM5 must be on the left.

So, we've located all xOM values with this method.


Using relative positioning
This method is not nearly as scientiffic... Since there are now 10 guides made for modifying xOM5 on different boards, a resistor may be picked and chosen as though it were from anothe board. See here for various modifications: http://forum.xda-developers.com/show....php?t=1236273

Verification from this method may be made using UART. you would be expecting an output like this over the UART on your device.
See here for info on UART: http://forum.xda-developers.com/show....php?t=1235219

If the modification was sucessful, UART will output a line which states OM=0x29.


Using a multimeter
You can remove the processor from a device and trace out the pins manually. This method is only appropriate for a broken device.


conclusion
So, these are my methods for hacking hardware and making it do what I want. I'd like to hear others. Lets hack up some hardware and talk about it here.
Flash with Odin on Windows, Linux and Mac. Use JOdin3, Available in a web browser or offline
Check out my developer pages. Add me to your circles on Google Plus.
Wanna see the longest Linux BASH script ever made? click here.
The Following 29 Users Say Thank You to AdamOutler For This Useful Post: [ Click to Expand ]
 
Rebellos
Old
(Last edited by Rebellos; 8th November 2011 at 06:40 PM.)
#2  
Senior Recognized Developer
Thanks Meter 3423
Posts: 1,339
Join Date: May 2009
Location: Gdańsk

 
DONATE TO ME
+1

Good that every chip component is configureable on lowest level by set of external passive elements - opens big possibilities to change any hardware into something different.

Worth to add - always think twice, or even once more before short circuiting anything. If between some V line and another there is positive voltage, like +1V, it still doesn't mean that second one is GND. First one can be +2V and second one +1V. READ carefully all datasheets and documentation. Don't connect any power line straight to another without resistor - this will cause high current go through some component and probably damage it.

Example of bad test - there are some capacitors on the left of Adam's needle when testing resistor. It's highly possible that these capacitors are ARM_CORE stabilisers, which is 1.2V and can handle up to about 1.4V. Adam is operating with 1.8 or 2.8V from other V line - accidentally touching the capacitor with needle can damage CPU core.

If you never been doing any hardware mods but feels like you want to start - prepare for some victims in your electronic devices. That's all of my experiences for now.

//Damn me and my bad habit of reserving posts in Adam's thread. Sorry. :d
The Following 4 Users Say Thank You to Rebellos For This Useful Post: [ Click to Expand ]
 
AllGamer
Old
#3  
AllGamer's Avatar
Retired Forum Moderator
Thanks Meter 1576
Posts: 11,521
Join Date: May 2008
Location: buried under loads of work IRL

 
DONATE TO ME
very informative

Donation is appreciated but not required, a cup of Coffee would suffice

Samsung i9000m: on CM10
Samsung Nexus S: on JB 4.2.2
Samsung Galaxy S II SGH-T989: on CM10
Samsung Galaxy NOTE SGH-i717r: on CM10
Samsung Galaxy NOTE 3 SM-N900W8: stock 4.3
 
Droidzone
Old
#4  
Droidzone's Avatar
Recognized Developer
Thanks Meter 2182
Posts: 5,466
Join Date: Sep 2010
Location: Kerala

 
DONATE TO ME
Excellent and authoritative article! Though I'm personally too scared to do anything like this on my phone!

The Following User Says Thank You to Droidzone For This Useful Post: [ Click to Expand ]
 
Master Melab
Old
#5  
Senior Member
Thanks Meter 10
Posts: 284
Join Date: Jan 2011
I've gotten replies from people that removing a BGA chip is almost impossible. A tutorial on how to unsolder one would be helpful for aspiring hardware hackers.
I'm a crypto-maniac.
I may use words differently than you.
My terminology
signed: When any data, file, or message has a digital signature. Does not mean that something is checked for a digital signature.
boot ROM: Code physically etched on to a chip that loads modifiable code.
bootloader: Software that starts/loads the kernel. It is erasable.
locked bootloader: A bootloader that will only boot a kernel that has a valid digital signature.
 
AdamOutler
Old
#6  
AdamOutler's Avatar
Recognized Developer - OP
Thanks Meter 9598
Posts: 5,191
Join Date: Feb 2011
Location: Louisiana

 
DONATE TO ME
Quote:
Originally Posted by Master Melab View Post
I've gotten replies from people that removing a BGA chip is almost impossible. A tutorial on how to unsolder one would be helpful for aspiring hardware hackers.
It IS almost impossible. It's rediculously difficult. You'll end up pulling a pad or two off the board. You must heat up the entire chip with a heat gun or a hot air station, then pull it off... Meaning you're heating up the entire chip to the point where the solder melts. It takes a multi-thousand dollar professional setup in order to make sure no damage is done. I use a digital temperature controlled heat gun. It works, but it's not accurate.
Flash with Odin on Windows, Linux and Mac. Use JOdin3, Available in a web browser or offline
Check out my developer pages. Add me to your circles on Google Plus.
Wanna see the longest Linux BASH script ever made? click here.
 
Master Melab
Old
#7  
Senior Member
Thanks Meter 10
Posts: 284
Join Date: Jan 2011
If you could replace the pads with a socket or something like that you'll be set to go.
I'm a crypto-maniac.
I may use words differently than you.
My terminology
signed: When any data, file, or message has a digital signature. Does not mean that something is checked for a digital signature.
boot ROM: Code physically etched on to a chip that loads modifiable code.
bootloader: Software that starts/loads the kernel. It is erasable.
locked bootloader: A bootloader that will only boot a kernel that has a valid digital signature.
 
elmanortega
Old
#8  
elmanortega's Avatar
Senior Member
Thanks Meter 128
Posts: 1,462
Join Date: Aug 2009
Location: perez zeledon

 
DONATE TO ME
we need to get you a better camera
The Following User Says Thank You to elmanortega For This Useful Post: [ Click to Expand ]
 
AdamOutler
Old
#9  
AdamOutler's Avatar
Recognized Developer - OP
Thanks Meter 9598
Posts: 5,191
Join Date: Feb 2011
Location: Louisiana

 
DONATE TO ME
Quote:
Originally Posted by elmanortega View Post
we need to get you a better camera
HAHHAHHAHHA. funny story about that...

You see, my 6 year old tried to do unbrickable mod on that today..


I no longer have a dedicated camera
Flash with Odin on Windows, Linux and Mac. Use JOdin3, Available in a web browser or offline
Check out my developer pages. Add me to your circles on Google Plus.
Wanna see the longest Linux BASH script ever made? click here.
 
cdesai
Old
#10  
cdesai's Avatar
Recognized Developer
Thanks Meter 3992
Posts: 2,277
Join Date: Jan 2011
Location: IN YOUR HEAD

 
DONATE TO ME
I wish i could try it, but i am sure i wont be able to, lol
CyanogenMod Maintainer | SGT7 | TeamBBQ

 
BBQLinux - An Arch based Linux distribution for Android developers
Website: http://www.bbqlinux.org | Downloads: [url]http://sourceforge.net/projects/bbqlinux/files//url]
IRC: #bbqlinux on freenode

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes