The all-in-one Galaxy S2 Hack Pack

Search This thread
By:
Advanced…
AdamOutler

AdamOutler

Retired Senior Recognized Developer
Feb 18, 2011
5,224
9,827
Miami, Fl̨̞̲̟̦̀̈̃͛҃҅͟orida
I've been compiling information for UnBrickable mod on the various versions of the Galaxy S2 device. This generation is by-far the most decentralized "model" I've ever heard of. Some of the devices contain Exynos processors, some Qualcomm and others have OMAP.

We've conducted research on this generation of device in the following threads:
AT&T GS2 UART/bootloader hacking: http://xdaforums.com/showthread.php?t=1313588
Epic 4G Touch information gathering: http://xdaforums.com/showthread.php?t=1262081
Galaxy Nexus UnBrickable Mod development: http://xdaforums.com/showthread.php?t=1310865

But you're here for the Galaxy S2 Hack Pack. This Hack Pack is designed to help out those looking for information on modifying and/or repairing their expensive devices. This package contains:

Reading Material
GT-i9100 official service manual - service manual which applies to most GS2 devices
Exynos 4120 public datasheet -datasheet explaining internal workings of the chip
Origenboard documentation -Exynos based development board
OMAP 4430 datasheets -datasheet explaining internal workings of the chip
FSA9280A datasheet -USB Switch chip which responds to resistors and routes communications around the phone
-(no information on qualcomm processors is available)-
model speciffic
AT&T SGS2 uart -UART output logs
i9100 IROM -memory dumps
i9100T bootrom -memory dumps
Epic 4G Touch pictures-pictures of internals
Galaxy Nexus specs -models of chips used in Galaxy Nexus
Android Binaries
bash - the best scriptable shell ever
i2cdetect -i2c address detector
i2cdump -i2c bus dumper
i2cget -i2c information grabber
i2cset -i2c information sender
tcpdump - monitors network traffic
viewmem - allows memory dumps
apps
smdk-tools - a set of linux development tools designed for direct communciation with the Exynos processor.

Download The Galaxy S2 Hack Pack

Please note, none of the contained information is my own original work. This has been compiled over the last month of researching this device. All information in this Hack Pack is available on the Internet from various sources.

Credits:
Samsung- i9100 service manuals and other tools.
SuperCurio- Model Numbers of the chips in the device were discovered by SuperCurio from a Voodoo Report sent from a Hong Kong conference.

Please let me know if there's anything I should add to this pack.
 
Last edited:
  • Like
Reactions: davidcsv, tukara, DanFragoso and 39 others
N

netchip

Senior Member
Sep 2, 2011
1,154
630
Maybe someone can help us, we have used this toolchains: arm2009-q3, AOSP 4.4.0, Linaro 4.6, Linaro 4.5.
It all doesnt work, so if someone knows the solution: help us!
Source: github.com/Dawn-Kernel-Team/dawn-update3-kernel
 
N

NRGman

Member
Apr 22, 2011
43
4
Perth, WA
any chance of adding s frequency band selector? to one could set the bands that your provider uses and disable the rest?
 
hailmary

hailmary

Senior Member
Jan 10, 2009
813
133
47
manila
www.facebook.com
there is a baseband/frequency selector-deselector that was developed by some chinese hackers in our thread in moto defy...
its called the "defy baseband switcher"-maybe you can modify it & make it applicable to your device.
 
M

mavr15

Member
Jan 12, 2011
10
0
Ariel
Thanks for the package. Where I can read how to use i2c tools prom package? I have few SGS2 with camera problem, small work, big- not) I want get dump i2c from camera in working phone and not working. Thanks.
 
J

justforfunfun

New member
Mar 30, 2012
3
0
About nexus s

AdamOutler said:
I've been compiling information for UnBrickable mod on the various versions of the Galaxy S2 device. This generation is by-far the most decentralized "model" I've ever heard of. Some of the devices contain Exynos processors, some Qualcomm and others have OMAP.

We've conducted research on this generation of device in the following threads:
AT&T GS2 UART/bootloader hacking: http://xdaforums.com/showthread.php?t=1313588
Epic 4G Touch information gathering: http://xdaforums.com/showthread.php?t=1262081
Galaxy Nexus UnBrickable Mod development: http://xdaforums.com/showthread.php?t=1310865

But you're here for the Galaxy S2 Hack Pack. This Hack Pack is designed to help out those looking for information on modifying and/or repairing their expensive devices. This package contains:

Reading Material
GT-i9100 official service manual - service manual which applies to most GS2 devices
Exynos 4120 public datasheet -datasheet explaining internal workings of the chip
Origenboard documentation -Exynos based development board
OMAP 4430 datasheets -datasheet explaining internal workings of the chip
FSA9280A datasheet -USB Switch chip which responds to resistors and routes communications around the phone
-(no information on qualcomm processors is available)-
model speciffic
AT&T SGS2 uart -UART output logs
i9100 IROM -memory dumps
i9100T bootrom -memory dumps
Epic 4G Touch pictures-pictures of internals
Galaxy Nexus specs -models of chips used in Galaxy Nexus
Android Binaries
bash - the best scriptable shell ever
i2cdetect -i2c address detector
i2cdump -i2c bus dumper
i2cget -i2c information grabber
i2cset -i2c information sender
tcpdump - monitors network traffic
viewmem - allows memory dumps
apps
smdk-tools - a set of linux development tools designed for direct communciation with the Exynos processor.

Download The Galaxy S2 Hack Pack

Please note, none of the contained information is my own original work. This has been compiled over the last month of researching this device. All information in this Hack Pack is available on the Internet from various sources.

Credits:
Samsung- i9100 service manuals and other tools.
SuperCurio- Model Numbers of the chips in the device were discovered by SuperCurio from a Voodoo Report sent from a Hong Kong conference.

Please let me know if there's anything I should add to this pack.
Click to expand...
Click to collapse

Do you have any documents about controlling nexus s baseband? or about xg616 development information?
 
E:V:A

E:V:A

Inactive Recognized Developer
Dec 6, 2011
1,447
2,222
-∇ϕ
Time for SGS2 Hack-Pack Update?

Some updates to the GT-I9100 Hack-Pack...

NOTE: The internal wiring of the (Sprint Epic Touch 4G) SPH-D710 is completely different from this!

I have painstakingly tried to trace down and document all chips related to the micro-usb connector on the i9100. Since that phone may be incorrectly wired as suggested, but not proved, by AdamOutler, we need to understand exactly how all the various multiplexers are affecting the USB connections. In addition, since all useful and "fun to develop for", hardware is kept secret by the manufacturing bastards, I have tried my best, with what little moldy breadcrumbs we have for documentation, to recreate and understand how that darn thing is wired.

Here are a few of my most recent findings and results.

MHL/MUX-1: FSA3200UMX (Service Manual: "U709", page 90 [Section: 8-64])
Code: 
[SIZE=2]Type:           2-port HS-USB2 Switch with MHL [/SIZE]
[SIZE=2]Package:        UMLP-16[/SIZE]
[SIZE=2]Label:          [/SIZE]
[SIZE=2]Link:           [/SIZE]
[SIZE=2]Data (brief):   [/SIZE]
[SIZE=2]Data (full):    http://www.fairchildsemi.com/ds/FS/FSA3200.pdf[/SIZE]
[SIZE=2]Picture:        http://images.anandtech.com/galleries/1362/SGS2-4198.jpg[/SIZE]

[SIZE=2]Description:    [/SIZE]

[SIZE=2]This chip is used to connect the phone with an MHL (Mobile High definition Link)[/SIZE]
[SIZE=2]cable, for full HD audio/video. [/SIZE]

[SIZE=2]-------------------------------------------------------------------------------[/SIZE]
[SIZE=2]pin     signal  i/o     uUSB?   svc_manual_name         chip/connector?[/SIZE]
[SIZE=2]-------------------------------------------------------------------------------[/SIZE]
[SIZE=2]1       GND[/SIZE]
[SIZE=2]2       D+      io      *?      USB_DP_SUB_CON          (HDC703)[/SIZE]
[SIZE=2]3       D-      io      *?      USB_DM_SUB_CON          (HDC703)[/SIZE]
[SIZE=2]4       PSO     %               GND[/SIZE]
[SIZE=2]5       SEL1    i               = SEL2 = MHL_SEL[/SIZE]
[SIZE=2]6       USB-    o               PMIC_DM                 U501:MAX8997:?[/SIZE]
[SIZE=2]7       USB+    i               PMIC_DP                 U501:MAX8997:?[/SIZE]
[SIZE=2]8       GND[/SIZE]
[SIZE=2]9       SEL2    i               = SEL1 = MHL_SEL[/SIZE]
[SIZE=2]10      MDV-    io              MHL_DM[/SIZE]
[SIZE=2]11      MDV+    io              MHL_DP[/SIZE]
[SIZE=2]12      ID_USB  i               PMIC_ID                 U501:MAX8997:?[/SIZE]
[SIZE=2]13      ID_MDV  i               MHL_ID[/SIZE]
[SIZE=2]14      ID_COM  i       *?      USB_ID_SUB_CON          (HDC703)[/SIZE]
[SIZE=2]15      VBUS    +       ?       USB_VBUS_AP_4.9V[/SIZE]
[SIZE=2]16      VCC[/SIZE]
[SIZE=2]-------------------------------------------------------------------------------[/SIZE]
[SIZE=2]Note: Here the signals for MDV are referred to as MHDI in service manual.[/SIZE]

[SIZE=2]Since SEL1=SEL2=:SEL are hardwired, we only have:[/SIZE]
[SIZE=2]SEL=00:         D+/- = USB+/-  and  ID_COM = ID_USB[/SIZE]
[SIZE=2]SEL=11:         D+/- = MDV+/-  and  ID_COM = ID_MDV[/SIZE]
OTG MAX8627 (Service Manual: "U503", pg.92)
Code: 
[SIZE=2]Type:           OTG power-booster[/SIZE]
[SIZE=2]Package:        14-pin[/SIZE]
[SIZE=2]Label:          [/SIZE]
[SIZE=2]Link:           [/SIZE]
[SIZE=2]Data (brief):   [/SIZE]
[SIZE=2]Data (full):    http://datasheets.maxim-ic.com/en/ds/MAX8627.pdf[/SIZE]
[SIZE=2]Picture:        [/SIZE]
[SIZE=2]Description:    [/SIZE]

[SIZE=2]This chip is responsible for providing enough power (up 1A) to OTG devices,[/SIZE]
[SIZE=2]using the phone battery, once it receives a high on the "ON" pin-3.[/SIZE]

[SIZE=2]"The MAX8627 step-up converter is a high-efficiency, low-quiescent current, [/SIZE]
[SIZE=2]synchronous boost converter with True Shutdown™ and inrush current limiting. [/SIZE]
[SIZE=2]The MAX8627 generates any boosted output voltage from 3V to 5V from either a [/SIZE]
[SIZE=2]2-cell NiMH/NiCd or a single-cell Li+/Li polymer battery.[/SIZE]

[SIZE=2]Quiescent current is only 20µA (typ), and at light loads the converter pulses [/SIZE]
[SIZE=2]only as needed for best efficiency. At higher loads, PWM mode maintains fixed [/SIZE]
[SIZE=2]1MHz operation for lowest noise and ripple.[/SIZE]

[SIZE=2]The MAX8627 includes an internal soft-start to limit inrush current to a [/SIZE]
[SIZE=2]maximum of 500mA. Additional features include True Shutdown, internal [/SIZE]
[SIZE=2]compensation, and adjustable current limit. The MAX8627 is available in a tiny [/SIZE]
[SIZE=2]3mm x 3mm TDFN package and is ideal for use in handheld devices such as DSCs, [/SIZE]
[SIZE=2]PDAs, and smartphones."[/SIZE]

[SIZE=2]-------------------------------------------------------------------------------[/SIZE]
[SIZE=2]pin     signal  i/o     chip/connector?[/SIZE]
[SIZE=2]-------------------------------------------------------------------------------[/SIZE]
[SIZE=2]1       GND             PGND[/SIZE]
[SIZE=2]2       FB              %       [/SIZE]
[SIZE=2]3       ON              USB_OTG_EN                      [/SIZE]
[SIZE=2]4       BATT            V_BAT[/SIZE]
[SIZE=2]5       BATT            V_BAT   [/SIZE]
[SIZE=2]6       POUT            V_BUS_5V        [/SIZE]
[SIZE=2]7       POUT            V_BUS_5V        [/SIZE]

[SIZE=2]8       LX              V_BAT[/SIZE]
[SIZE=2]9       LX              V_BAT[/SIZE]
[SIZE=2]10      PG              PGND[/SIZE]
[SIZE=2]11      PG              PGND[/SIZE]
[SIZE=2]12      AGND            GND[/SIZE]
[SIZE=2]13      ILIM            %               [/SIZE]
[SIZE=2]14      OUTS            V_BUS_5V[/SIZE]
Charger: ? (Service Manual: "U504", Service Manual, pg.37)
Code: 
[SIZE=2]Type:           Charging chip[/SIZE]
[SIZE=2]Package:        10 pin[/SIZE]
[SIZE=2]Label:          "ADDO T**" (18?)[/SIZE]

[SIZE=2]Some kind of charging or boost chip.... Perhaps MAX 17042 ??[/SIZE]
[SIZE=2]https://github.com/coolbho3k/android-omap-tuna/blob/android-omap-tuna-3.0-mr0/drivers/power/max17042_battery.c[/SIZE]

[SIZE=2]-------------------------------------------------------------------------------[/SIZE]
[SIZE=2]pin     name    i/o     path/connection[/SIZE]
[SIZE=2]-------------------------------------------------------------------------------[/SIZE]
[SIZE=2]1       VIN             [/SIZE]
[SIZE=2]2       ISET    o       CHG_CUR_M[/SIZE]
[SIZE=2]3       GND             [/SIZE]
[SIZE=2]4       LDO             V_BUS_LDO_5V[/SIZE]
[SIZE=2]5       IEOC            GND[/SIZE]
[SIZE=2]6       EN|SET  i       CHG_EN  ("Q500")[/SIZE]

[SIZE=2]7       GND             [/SIZE]
[SIZE=2]8       CHGSB   o       CHG_ING_IN[/SIZE]
[SIZE=2]9       PGB     o       TA_nCONNECTED[/SIZE]
[SIZE=2]10      BATT            V_BAT[/SIZE]
[SIZE=2]11      GND             [/SIZE]
[SIZE=2]12      ???             [/SIZE]
And here is the Silicon Image MHL Transmitter chip, so now you can soon build your own MHL, mUSB-to-HDMI cable! (Just hook it up to a SiI9292.)

MHL: SiI9244B0 (Service Manual: "U708", Service Manual, pg.90,99)
Code: 
[SIZE=2]Type:           MHL transmitter for HD Audio/Video[/SIZE]
[SIZE=2]Package:        49-ball VFBGA  (3.5 mm x 3.5 mm)[/SIZE]
[SIZE=2]Label:          ~"9244B0"[/SIZE]
[SIZE=2]Link:           http://www.siliconimage.com/docs/SiI9244%20PB_02-23-2011%20FINAL.3.pdf[/SIZE]
[SIZE=2]Data (brief):   http://www.semiconductorstore.com/pdf/newsite/SiliconImage/SiI9244_DB.pdf[/SIZE]
[SIZE=2]Data (full):    [/SIZE]

[SIZE=2]Derscription:   http://www.siliconimage.com/news/releasedetails.aspx?id=617[/SIZE]

[SIZE=2]This is the MHL Transmitter, that is used to transmit HD (1080p) Audio/Video[/SIZE]
[SIZE=2]through the mUSB port. [/SIZE]

[SIZE=2]"The SiI9244 is an MHL transmitter for HD video and audio designed for [/SIZE]
[SIZE=2]power-sensitive consumer electronics devices such as mobile phones, digital [/SIZE]
[SIZE=2]cameras, portable media players and HD camcorders.  Eliminating the need for an [/SIZE]
[SIZE=2]extra connector, the SiI9244 enables a cost-effective, low-pin count [/SIZE]
[SIZE=2]connectivity solution for the delivery of HD content."[/SIZE]

[SIZE=2]Pictures:[/SIZE]

[SIZE=2]SGS2 details:[/SIZE]
[SIZE=2]http://www.anandtech.com/print/4686[/SIZE]

[SIZE=2]For other chips on the SGS2 (Sprint Epic Touch 4G) SPH-D710:[/SIZE]
[SIZE=2]http://www.techrepublic.com/blog/itdojo/galaxy-s-ii-sprint-epic-4g-touch-teardown-samsung-exynos-processor-and-no-nfc/2945[/SIZE]
[SIZE=2]Silicon Image 9244 MHL transmitter:[/SIZE]
[SIZE=2]http://www.techrepublic.com/photos/cracking-open-the-samsung-galaxy-s-ii-sprint-epic-4g-touch/6305124?seq=54[/SIZE]


[SIZE=2]-------------------------------------------------------------------------------[/SIZE]
[SIZE=2]Ball    Name    io      Function                Connection[/SIZE]
[SIZE=2]-------------------------------------------------------------------------------[/SIZE]
[SIZE=2]A1      RSVDL                                   [/SIZE]
[SIZE=2]A2      VDDQ            GND             [/SIZE]
[SIZE=2]A3      MHL_D   io      MHL:Data ??             U709:FSA3200:10 MHL_DM[/SIZE]
[SIZE=2]A4      MHL_DB  io      MHL:Data ??             U709:FSA3200:11 MHL_DP [/SIZE]
[SIZE=2]A5      -               [/SIZE]
[SIZE=2]A6      -               [/SIZE]
[SIZE=2]A7      CBUS_ID i       MHL:BUS_ID(CEC||chip)?  ?? U709:FSA3200:13 MHL_ID [/SIZE]

[SIZE=2]B1      RSVDL           [/SIZE]
[SIZE=2]B2      RSVDL           [/SIZE]
[SIZE=2]B3      RSVDL           [/SIZE]
[SIZE=2]B4      GND             [/SIZE]
[SIZE=2]B5      AVCC33          Vcc 3.3V[/SIZE]
[SIZE=2]B6      USB_ID  io      USB_ID                  ?? U709:FSA3200:9 MHL_SEL  [/SIZE]
[SIZE=2]B7      RSVDL           [/SIZE]

[SIZE=2]C1      CSCL    i       chip:SCL (CEC)          [/SIZE]
[SIZE=2]C2      RSVDL           [/SIZE]
[SIZE=2]C3      WAKE_UP i       MHL:WAKE-UP                     [/SIZE]
[SIZE=2]C4      AVCC12          Vcc 1.2V[/SIZE]
[SIZE=2]C5      GND[/SIZE]
[SIZE=2]C6      V_SENSE i       MHL:VSENSE              [/SIZE]
[SIZE=2]C7      INT     o       chip:INT                [/SIZE]

[SIZE=2]D1      CSDA    io      chip:SDA (CEC)          [/SIZE]
[SIZE=2]D2      RSVDL           [/SIZE]
[SIZE=2]D3      GND[/SIZE]
[SIZE=2]D4      IOVCC18         Vcc 1.8V[/SIZE]
[SIZE=2]D5      CVCC12          Vcc 1.2V[/SIZE]
[SIZE=2]D6      CI2CA   i       chip:I2C (audio)                [/SIZE]
[SIZE=2]D7      RESET_N i       chip:RESET_N            [/SIZE]

[SIZE=2]E1      DSDA    io      HDMI:SDA (DDC)          [/SIZE]
[SIZE=2]E2      GND[/SIZE]
[SIZE=2]E3      IO_VCC18        Vcc 1.8V[/SIZE]
[SIZE=2]E4      CVCC12          Vcc 1.2V[/SIZE]
[SIZE=2]E5      AVCC33          Vcc 3.3V[/SIZE]
[SIZE=2]E6      AVCC12          Vcc 1.2V[/SIZE]
[SIZE=2]E7      GND[/SIZE]

[SIZE=2]F1      RX2_P   i       HDMI#2 +                HD_TX2+[/SIZE]
[SIZE=2]F2      GND[/SIZE]
[SIZE=2]F3      RPWR    i       HDMI:POWER              [/SIZE]
[SIZE=2]F4      DSCL    i       HDMI:SCL (DDC)          [/SIZE]
[SIZE=2]F5      AVCC12          Vcc 1.2V[/SIZE]
[SIZE=2]F6      GND[/SIZE]
[SIZE=2]F7      HPD     o       HDMI:PD (?power down?)          [/SIZE]

[SIZE=2]G1      RX2_N   i       HDMI#2 -                HD_TX2-[/SIZE]
[SIZE=2]G2      RX1_P   i       HDMI#1 +                HD_TX1+[/SIZE]
[SIZE=2]G3      RX1_N   i       HDMI#1 -                HD_TX1-[/SIZE]
[SIZE=2]G4      RX0_P   i       HDMI#0 +                HD_TX0+[/SIZE]
[SIZE=2]G5      RX0_N   i       HDMI#0 -                HD_TX0-[/SIZE]
[SIZE=2]G6      RXC_P   i       HDMI:Clock? +           HD_TXC+ [/SIZE]
[SIZE=2]G7      RXC_N   i       HDMI:Clock? -           HD_TXC-[/SIZE]
[SIZE=2]-------------------------------------------------------------------------------[/SIZE]
[SIZE=2]RXn = HDMI Data Channel n (+/-)[/SIZE]
[SIZE=2]RSVDL = Reserved Low (tie to ground)[/SIZE]
[SIZE=2]RSVDH = Reserved Hi[/SIZE]

[SIZE=2]SCL = I2C Serial Clock                          [/SIZE]
[SIZE=2]SDA = I2C Serial Data Line                      [/SIZE]
[SIZE=2]CEC = Consumer Electronics Control (Anynet/AV.link)     http://en.wikipedia.org/wiki/HDMI#CEC[/SIZE]
[SIZE=2]DCC = Display Control Channel                           http://en.wikipedia.org/wiki/Display_Control_Channel[/SIZE]
[SIZE=2]DDC = Display Data Channel                              http://en.wikipedia.org/wiki/Display_Data_Channel[/SIZE]

[SIZE=2]NOTE-1: A name prefixed with "A*" is for audio, while "C*" is for chip/control.[/SIZE]
[SIZE=2]-------------------------------------------------------------------------------[/SIZE]
PMIC: MAX8997 (Service Manual: "U501", pg.95)
Code: 
[SIZE=2]Type:           Power Management IC[/SIZE]
[SIZE=2]Package:        169-bump WLP[/SIZE]
[SIZE=2]Label:          [/SIZE]
[SIZE=2]Link:           http://para.maxim-ic.com/en/results.mvp?fam=pmic[/SIZE]
[SIZE=2]Data (brief):   [/SIZE]
[SIZE=2]Data (full):    [/SIZE]
[SIZE=2]Closest Match:  MAX8958[/SIZE]

[SIZE=2]Derscription:   [/SIZE]

[SIZE=2]"The PMIC solution MAX8997 integrates seven highly efficient step-down [/SIZE]
[SIZE=2]converters, 21 low-dropout linear regulators (LDOs), battery charger, micro [/SIZE]
[SIZE=2]USB interface, real-time clock (RTC) with alarms, tactile-feedback motor [/SIZE]
[SIZE=2]driver, camera flash LED driver, 12 general-purpose I/Os (GPIOs), and I2C [/SIZE]
[SIZE=2]interface for programming. It also includes Maxim’s proprietary ModelGauge™ [/SIZE]
[SIZE=2]power-management technology (MAX17040–MAX17043)."[/SIZE]

[SIZE=2]The signals we are interested in are:[/SIZE]

[SIZE=2]Modem UPC300:[/SIZE]
[SIZE=2]T2      USIF1_RXD_MRST          i       AP_FLM_TXD      --> PMIC:K3(18T2)       -[?]-> AP_FLM_TXD_2.8V (XUTXD_3:A27) --> UART3: XXnn (check!)[/SIZE]
[SIZE=2]T3      USIF1_TXD_MTSR          o       AP_FLM_RXD      --> PMIC:J4(18R1)       -[?]-> AP_FLM_RXD_2.8V (XURXD_3:H27) --> UART3: XXnn (check!)[/SIZE]

[SIZE=2]M14     MIPI_HSI_RX_FLG         i       CP_RXD_1.8V     --> PMIC:G3(18TNC2)     -[?]-> AP:CP_RXD (?:?) --> UART3?: XXnn (check!)[/SIZE]
[SIZE=2]N13     MIPI_HSI_RX_DATA        o       CP_TXD_1.8V     --> PMIC:G5(18RNC1)     -[?]-> AP:CP_TXD (?:?) --> UART3?: XXnn (check!)[/SIZE]


[SIZE=2]A few of the MAX8997 pins are:[/SIZE]
[SIZE=2]-------------------------------------------------------------------------------[/SIZE]
[SIZE=2]Ball    Name            io      Function        svc_man_name            Path/Connection[/SIZE]
[SIZE=2]-------------------------------------------------------------------------------[/SIZE]
[SIZE=2]J4      18R1            i                       AP_FLM_RXD              (BP)[/SIZE]
[SIZE=2]K3      18T2            o                       AP_FLM_TXD              (BP)[/SIZE]
[SIZE=2]G4      28T1            o                       AP_FLM_RXD_2.8V         (AP)?[/SIZE]
[SIZE=2]L4      28R2            i                       AP_FLM_TXD_2.8V         (AP)?[/SIZE]

[SIZE=2]G5      18RNC1          i                       CP_TXD_1.8V             (BP)[/SIZE]
[SIZE=2]G3      18TNC2          o                       CP_RXD_1.8V             (BP)[/SIZE]
[SIZE=2]H4      28TNO2          o                       ??CP_TXD                (AP) UART3??[/SIZE]
[SIZE=2]H6      28RNO1          ?                       ??CP_RXD                (AP) UART3??[/SIZE]

[SIZE=2]?       ?       A/S1    o                       AP_RXD                  (AP) UART2      mysterious, perhaps doesn't exsist[/SIZE]
[SIZE=2]?       ?       A/S1    i                       AP_TXD                  (AP) UART2      mysterious, perhaps doesn't exsist[/SIZE]
[SIZE=2]K4      28RCOM2 A/S1    i                       IF_RXD                  MUX[/SIZE]
[SIZE=2]H5      28TCOM1 A/S1    o                       IF_TXD                  MUX[/SIZE]

[SIZE=2]G1      DN1             io                      PMIC_DP                 U709:FSA3200:7[/SIZE]
[SIZE=2]H1      DP2             io                      PMIC_DM                 U709:FSA3200:6[/SIZE]
[SIZE=2]L1/L2?  ?               ?                       PMIC_ID                 U709:FSA3200:12[/SIZE]

[SIZE=2]G6      CB                      USB select?[/SIZE]

[SIZE=2]J1      COMN1[/SIZE]
[SIZE=2]K1      COMP2                   Step-Up Compensation Node for OUT2 Step-Up Converter[/SIZE]
[SIZE=2]D5      COMP                    [/SIZE]

[SIZE=2]L1      UID                     [/SIZE]
[SIZE=2]L2      IDB                                             [/SIZE]
[SIZE=2]L3      BOOT                                                    [/SIZE]

[SIZE=2]H3      UT1                     [/SIZE]
[SIZE=2]J3      UR2                     [/SIZE]

[SIZE=2]H2      SL1             [/SIZE]
[SIZE=2]J2      SR2             [/SIZE]


[SIZE=2]E5      PWRON                   Baseband Wakeup ?[/SIZE]
[SIZE=2]E6      JIGON[/SIZE]
[SIZE=2]E7      SCL             i                       I2C SCL[/SIZE]
[SIZE=2]F7      SDA             i                       I2C SDA[/SIZE]

[SIZE=2]K2      MIC_USB[/SIZE]
However, there are a few questions I have not been able to resolve. I really need help with this! They are:

  1. Where is the other USB "switch" chip, as shown in the block diagram below?
  2. What is U504 doing?
  3. What are the other pins (not labelled above) on the PMIC (U501) doing?

GT-I9100_FSA3200_block.png
attachment.php


​
 

Attachments

  • GT-I9100_FSA3200_block.png
    GT-I9100_FSA3200_block.png
    22.9 KB · Views: 7,889
  • GT-I9100_U504_xxxx_connections.jpg
    GT-I9100_U504_xxxx_connections.jpg
    22 KB · Views: 1,362
  • GT-I9100_U709_FSA3200_connections.jpg
    GT-I9100_U709_FSA3200_connections.jpg
    29.2 KB · Views: 1,358
Last edited:
  • Like
Reactions: mirhl
You must log in or register to reply here.

Similar threads

AdamOutler
The All-In-One GalaxyS Hack Pack
Replies
29
Views
78K
DomZg
DomZg
E:V:A
[R&D] Hacking the Huawei E589 (4G LTE Mobile Router)
Replies
70
Views
310K
adrscu
adrscu
w0aS
[ALL DEVICES][UPDATED] Kali Linux NetHunter Installation
Replies
114
Views
238K
bdharry71
bdharry71
A
Hack Xiaomi Mijia Walkie Talkie
Replies
277
Views
110K
bela
bela
TRusselo
Samsung Galaxy Phone Rapid Charger Mod
Replies
132
Views
149K
M
miketho

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 42
    AdamOutler
    AdamOutler
    I've been compiling information for UnBrickable mod on the various versions of the Galaxy S2 device. This generation is by-far the most decentralized "model" I've ever heard of. Some of the devices contain Exynos processors, some Qualcomm and others have OMAP.

    We've conducted research on this generation of device in the following threads:
    AT&T GS2 UART/bootloader hacking: http://xdaforums.com/showthread.php?t=1313588
    Epic 4G Touch information gathering: http://xdaforums.com/showthread.php?t=1262081
    Galaxy Nexus UnBrickable Mod development: http://xdaforums.com/showthread.php?t=1310865

    But you're here for the Galaxy S2 Hack Pack. This Hack Pack is designed to help out those looking for information on modifying and/or repairing their expensive devices. This package contains:

    Reading Material
    GT-i9100 official service manual - service manual which applies to most GS2 devices
    Exynos 4120 public datasheet -datasheet explaining internal workings of the chip
    Origenboard documentation -Exynos based development board
    OMAP 4430 datasheets -datasheet explaining internal workings of the chip
    FSA9280A datasheet -USB Switch chip which responds to resistors and routes communications around the phone
    -(no information on qualcomm processors is available)-
    model speciffic
    AT&T SGS2 uart -UART output logs
    i9100 IROM -memory dumps
    i9100T bootrom -memory dumps
    Epic 4G Touch pictures-pictures of internals
    Galaxy Nexus specs -models of chips used in Galaxy Nexus
    Android Binaries
    bash - the best scriptable shell ever
    i2cdetect -i2c address detector
    i2cdump -i2c bus dumper
    i2cget -i2c information grabber
    i2cset -i2c information sender
    tcpdump - monitors network traffic
    viewmem - allows memory dumps
    apps
    smdk-tools - a set of linux development tools designed for direct communciation with the Exynos processor.

    Download The Galaxy S2 Hack Pack

    Please note, none of the contained information is my own original work. This has been compiled over the last month of researching this device. All information in this Hack Pack is available on the Internet from various sources.

    Credits:
    Samsung- i9100 service manuals and other tools.
    SuperCurio- Model Numbers of the chips in the device were discovered by SuperCurio from a Voodoo Report sent from a Hong Kong conference.

    Please let me know if there's anything I should add to this pack.
    View
    4
    R
    Rebellos
    Reserved post for additional CPU&booting sequence info. (coming soon)
    View
    4
    E:V:A
    E:V:A
    GT-I9100_HackPack_AddOn-1.2

    The GT-I9100 Hack Pack Add On -1.2

    UPDATED: 2012-05-23

    Change log:
    2012-05-23: Minor updates and added U504 datasheet.

    Download Here!
    (or here, compressed by 7-zip, 90 files, ~39 MB)

    This package contain Datasheets for more than 20 chips, including detailed pin-out and
    connections to those chips that do not have any publicly available datasheets.
    Included are also:

    • USB 2.0 specifications (~600 pages)
    • MHL Specifications and other documents
    • Battery Charging 1.1 specifications (models <= GT-I9100)
    • Battery Charging 1.2 specifications (models > GT-I9100)
    List of the included PDF data sheets:
    Code: 
    [SIZE=2]GT-I9100_U104_RFMD_RF6590DS.pdf
GT-I9100_U203_ONSemi_NLSX3012-D.pdf
GT-I9100_U205_SiliconLabs_Si4708-09-C.pdf
GT-I9100_U206_Micrel_MIC5365.pdf
GT-I9100_U300_Toshiba_TC7SG32AFS.pdf
GT-I9100_U400_Fairchild_FXLP34.pdf
GT-I9100_U502_Fairchild_FSUSB42.pdf
GT-I9100_U503_Maxim_MAX8627.pdf
GT-I9100_U504_Maxim_MAX8922L.pdf
GT-I9100_U600_Fairchild_FSA2259.pdf
GT-I9100_U601_Audience_A1026_ProdBrief_091511.pdf
GT-I9100_U603_Toshiba_TC75W56FK.pdf
GT-I9100_U606_probably_STMicro_LIS3DH.pdf
GT-I9100_U607_probably_STMicro_L3G4200D.pdf
GT-I9100_U608_AKM_AK8975.pdf
GT-I9100_U609-11_U703_11_20_Ricoh_RP103x.pdf
GT-I9100_U704_Ricoh_RP150Kx.pdf
GT-I9100_U706_Toshiba_TC75S56FE.pdf
GT-I9100_U707_Ricoh_RP100x.pdf
GT-I9100_U708_SiliconImage_SiI9244_brief.pdf
GT-I9100_U709_Fairchild_FSA3200.pdf
GT-I9100_U710_Micrel_MIC5335.pdf
GT-I9100_U718_STMicro_STOD13A.pdf
GT-I9100_Uxxx_Semtec_RClamp3654p.pdf
[/SIZE]
    There are also other PDF files for reference and a number of of high-resolution photos of the PCB.

    The Samsung Part Number and Chip Info cross-reference list:
    Code: 
    [SIZE=2]SecPartNo       Layout                          Component                                       Annotation
------------------------------------------------------------------------------------------------------------------
2910-000125     F100                            <na>                                     ???    Murata          "5162 c045"     RF FEM "DUPLEXER-SAW" combination 
4709-001987     MOD201                          W-LAN MODULE;Bluetooth Bluetooth 4.0 + H        Murata          KM1602021       Module encapsulation of Broadcom 4330 etc
1201-003217     PAM100                          IC-POWER AMP;RF6260,21P,8.0x6.0x1.015T,P        RFMD            RF6260          RF Quad-band 3G4G Power Amp 3G/4G
1201-003139     PAM200                          IC-GPS AMP;ALM-2712-SG1G,12P,3.0x2.5x1mm        Avago           ALM 2712        RF GPS front-end module (FEM)
1205-004195     U100                            IC-TRANSCEIVER;PMB5712,FBGA,138P,5x5.3mm        Infineon        SMARTi-UE2      RF DSP/tranceiver
2911-000166     U101                            DUPLEXER-ASM;2140MHz,1960MHz,2140MHz/0.9 ???                    "1EH 117 1.3"   Duplexer/Antenna Switch Module
1203-006802     U103                            IC-DC/DC CONVERTER;RF6560,24P,2.53X1.72X        RFMD            RF6560          RF Power Management IC
1203-006801     U104                            IC-DC/DC CONVERTER;RF6590,16P,1.730X1.70        RFMD            RF6590          RF Power Management IC
1204-003171     U202                            IC-GPS RECEIVER;GSD4T-9600B-TR,WLCSP,42P        SiRF            GSD4T           GPS chip
1003-002100     U203                            IC-LEVEL DRIVER;NLSX3012MUTAG,UDFN,8P,1.        ONSemi          NLSX3012        2x Level Translator
1204-003176     U205                            IC-TUNER;SI4709-C-GMR,QFN,16P,2.5x2.5x0.        Silicon Labs    Si4709          FM receiver
1203-005580     U206                            IC-POSI.FIXED REG.;MIC5365-1.8YMT,MLF,4P        Micrel          MIC5365         150mA LDO
0801-003024     U300                            IC-CMOS LOGIC;7SG32,OR GATE,SON,5P,1.0x0        Toshiba         TC7SG32AFS?     2-Input OR Gate
1203-006847    U303                          IC-MULTI    REG.;RP150K011B,PLP,8P,4x4x1.6m ???    Ricoh         RP150K011B    2x 300mA LDO Regulator
0801-003031     U400                            IC-CMOS LOGIC;FXLP34,Translator,Micropak        Fairchild       FXLP34          1-bit Uni-Dir Translator
1203-006851     U501                            IC-POWER SUPERVISOR;MAX8997EWW+T,WLP,169        Maxim           MAX8997EWW+T    PMIC
1001-001481     U502                            IC-ANALOG SWITCH;FSUSB42UMX,USB SWITCH,U        Fairchild       FSUSB42UMX      2-port HS USB2 UART Switch
1203-006794     U503                            IC-DC/DC CONVERTER,MAX8627ETD+T,TDFN,14P        Maxim           MAX8627ETD+T    OTG power-booster
1203-006884     U504                            IC-POWER SUPERVISOR;SS6000GQW,WLP,10P,3x ???            
1001-001635     U600                            IC-ANALOG SWITCH;FSA2259UMX,UMLP,10P,1.4        Fairchild       FSA2259UMX      
1204-003167     U601                            IC-AUDIO PROCESSOR;A1026A0F,WLCSP,40P,2.        Audience        A1026A          NC/Voice Processor
1205-004174     U602                            IC-CODEC;YMU823,WLCSP,67P,3.85x3.85mm,6.        Yamaha          YMU823          Audio Codec
1202-001118     U603                            IC-VOLTAGE COMP.;75W56,SSOP,8P,1.6x1.6mm        Toshiba         TC75W56FK       Dual Comparator
1209-002045     U606                            IC-SENSOR;K3DHTR,LGA,16P,3X3X1mm,-,3.6V,        STM             LIS3DH          3-axis Accelerometer 
1209-001997     U607                            IC-SENSOR;K3GTR,LGA,16P,4x4x1.1 mm,3.6V,        STM             L3G4200D        3-axis Gyroscope
1209-002041     U608                            IC-SENSOR;AK8975C,WL-CSP (BGA),14P,2.0*2        AKM             AK8975          Compass Sensor
1203-004819     U609-611,703,711,720            IC-POSI.FIXED REG.;RP103K,PLP,4P,1x1mm,2        Ricoh           RP103x          150mA LDO Regulator
1203-005574     U701                            IC-POSI.FIXED REG.;RP103K121D-TR,PLP1010        Ricoh           RP103x          150mA LDO Regulator
1203-005044     U702                            IC-POSI.FIXED REG.;RP103K151D-TR,PLP1010        Ricoh           RP103x          150mA LDO Regulator
1203-004339     U704                            IC-MULTI REG.;RP150K009A,PLP,8P,2x2mm,PL        Ricoh           RP150Kx         2x 300mA LDO Regulator
1202-001068     U706                            IC-VOLTAGE COMP.;TC75S56FE,SON,5P,1.6x1.        Toshiba         TC75W56FE       Single Comparator
1203-004802     U707                            IC-POSI.FIXED REG.;RP100,PLP,4P,1.6x1.2m        Ricoh           RP100x          200mA LDO Regulator
1205-004233     U708                            IC-TRANSMITTER;SII9244BO,VFBGA,49P,3.5X3        Silicon Image   SiI9442         MHL Transmitter
1001-001699     U709                            IC-ANALOG SWITCH,FSA3200UMX,UMLP,16P,1.8        Fairchild       FSA3200UMX      2-port HS-USB2 Switch with MHL
1203-005244     U710                            IC-MULTI REG.;MIC5335-SGYMT,TMLF,6P,1.6x        Micrel          MIC5335-SGYMT   2x 300mA microCap ULDO
1203-006651     U718                            IC-DC/DC CONVERTER;STOD13A,UDFN,12P,3x3m        STMicro         STOD13A         250mA DC-DC Converter (AMOLED)
1205-004213     UCP300                          IC-MODEM;PMB9811-B,NSP,221P,7.5x7.5x1.0m        Infineon        PMB9811         X-GOLD626 Baseband Processor
0908-002766     UCP400                          <na>                                            Samsung         S5PC210         Exynos 4210
1108-000424     UME300                          IC-MCP;KMVYL000LM-B503,16GB+512Mb,MoviNA        Samsung         KMVYL000LM-B503 MoviNAND
[/SIZE]
    (It was put together with help from the included data mining Perl script.)

    Finally there are a few chips that we would like to know much more about. They are:
    Code: 
    [SIZE=2]UPC300  Intel/Infineon          PMB9811         Baseband Processor: XMM6260-X-GOLD626   
U100    Intel/Infineon          PMB5712         RF-Transceiver: XMM6260-SMARTi-UE2 
U101                                            Duplexer/Antenna Switch Module
U103    RF Micro Devices        RF6560          RF Power Management IC
U501    Maxim                   MAX8997         Power Management IC
F100    Samsung:2910-000125 ?   ?               "DUPLEXER-SAW"                 [/SIZE]
    If you have any additional information about these, please let us know
    or send us a link to where they can be found. Any help would be very much
    appreciated! Here are some pictures that might help...


    ​
    View
    2
    E:V:A
    E:V:A
    rhyre said:
    My phone has similar problem and I desolder C565 element anyone know what is this element and know his value? i think is capilator but what is value?
    Click to expand...
    Click to collapse
    It is a Ceramic Capacitor, 22000 nF:
    Code: 
    2203-007781    C564,C565                    C-CER,CHIP;22000nF,20%,10V,X5R,TP,1608,0
    View
    2
    E:V:A
    E:V:A
    ^^ I think you should try to get some log messages and post them somewhere with links, so that we can look at them, since there's no telling in whats wrong from here. The SGS2 is known to run hot, but not crash because of it, AFAIK. Unfortunately I don't remember which log messages are preserved after system crash or reboot. Perhaps "kmsg"? There are also other ways... Ahh, try to run adb logcat <other cmd switches> from external command and keep on saving log files and wait for it to die...

    I don't recommend you to try to do this, unless you consider yourself a "re-balling pro"! (If you don't know what that means, it means that you should forget about it!) But if you feel like going ahead with this, I suggest you to start a new thread about this, as this is quite off topic.
    View

New posts