How to hack hardware binary and bend it to your will

5,224 posts
Thanks Meter: 9,894
By AdamOutler, Retired Senior Recognized Developer on 8th November 2011, 05:34 PM
Post Reply Email Thread
Before you start on actually modifying your hardware, you must know what it is you're after. Don't just go using your finely tuned soldering iron without doing some research first...

I wanted to share some tricks I use when locating UnBrickable Mod on various devices because it has been requested many times. Overall, the methods I'm going to talk about can be called "reverse engineering", "hacking", or "circuit bending".

Each device is different so different methods may be used. I'll start with what I feel is the best method to use and move my way on through less accurate and more destructive/difficult methods. The methods I'm using here can be used on nearly ANY device for nearly ANY purpose, not just locating boot modes. Using the techniques I'm laying out here, you can locate any physical memory register on any chip.

For the purposes of this familiarization guide, we will be locating the xOM5 resistor which changes the S5PC110 boot mode from "boot from OneNAND" to "Boot from USB, then OneNAND". Other modes are available such as booting from SDCard or MMC but these modes do not allow dual booting into the standard OneNAND boot so they are not practical unless you have a NAND failure.

By reading the S5PC110 processor manual, we can see on page 6-8, this is achieved by setting the xOM bits to 101001 (hex value 29). These binary values correspond to pins on the processor. These pins can be set high or low, and they ARE set high and low on the development board for the S5PC110 development boards. On other processors like OMAP4460, or Exynos, different pins are used but the functionality is the same.

With this knolwedge in hand, lets continue into HOW we can locate these pins.

how to locate the xOM resistor cluster
If you orient the S5PC110 processor with the PIN-0 dot at the lower left corner, you will find the xOM cluster at the lower right corner. These resistors will always be near this location because the pins on the board are near this location. It's never a good idea to have "runs" on a board longer than necessary. Therefore, these resistors will always be near this corner.

NOTE: You need not remove the processor. This is only for illustration.

For other devices, see the pinouts on the processor manual.

Methods for locating modificaton

Monitoring memory locations in real-time

You will need:
viewmem installed in /system/bin
bash installed in /system/bin
Market App: QuickSSHD allows you to terminal into the device.

1. we locate the xOM registers on the device. According to the processor manual

OM_STAT 0xE010_E100 R OM status register 0x0000_0000

the OM registers are at 0xE010E100. So we know where to look in memory to monitor changes.

2. ssh into your device. See QuickSSHD for more information. Once you are in, assume super-user, get into a bash terminal, and use the viewmem utility.

$ su
# bash
bash-4.1#viewmem 0xE010E100 0x4|hexdump
[INFO] Reading 4 bytes at 0xe010e100...
0000000 0009 0000
3. Short and test. While shorting the high value to the active side, NOT THE VISIBLY GROUNDED SIDE, monitor output from the terminal.

The PullUp resistors are 10Kohm and the Pulldown resistors are 100Kohm. This means there's 10x more force behind a digital high than a digital low, in other words, you can short any low value high without a problem...
viewmem 0xE010E100 0x4|hexdump
[INFO] Reading 4 bytes at 0xe010e100...
0000000 0029 0000
the 29 signifies that the device is modded properly. A value of 0x9 is a standard production device. When you see 0029, you've located the proper resistor for the modification.

Using overlays
Take a picture of the board, then use an annotated pinout to locate the proper pins on the processor. This allows for a visual of the device as though the processor were removed.

here's a picture of my own annotated overlay. Use this and we'll walk through overlay logic.

Now, with a xOM value of 0x9, that's a binary value of 001001, use your calculator in "programmer" or "scientiffic" mode if you don't believe me.
Broken Down:

xOM 3 and 1 are both high values, all the rest are low. We can use this to our advantage. We can see that 4 resistors are connected to ground on one side and 2 are not. Those two are obviously xOM3 and xOM1.

If we look at the processor pinout, we can see that if xOM3 and xOM1 resistors were swapped, one would be very much longer than the other so there's only one logical solution.

Moving on to the shortest ones, xOM4 and xOM2 would obviously be closest to the top of the resistor cluster, and it's also obvious wich one would be which.

Now that leaves two resistors in the middle. One is high and one is low. by drawing it out you can see that if xOM5 were on the right, then xOM1 would be very much longer than xOM5, so xOM5 must be on the left.

So, we've located all xOM values with this method.

Using relative positioning
This method is not nearly as scientiffic... Since there are now 10 guides made for modifying xOM5 on different boards, a resistor may be picked and chosen as though it were from anothe board. See here for various modifications:

Verification from this method may be made using UART. you would be expecting an output like this over the UART on your device.
See here for info on UART:

If the modification was sucessful, UART will output a line which states OM=0x29.

Using a multimeter
You can remove the processor from a device and trace out the pins manually. This method is only appropriate for a broken device.

So, these are my methods for hacking hardware and making it do what I want. I'd like to hear others. Lets hack up some hardware and talk about it here.
The Following 30 Users Say Thank You to AdamOutler For This Useful Post: [ View ] Gift AdamOutler Ad-Free
8th November 2011, 05:35 PM |#2  
Senior Recognized Developer
Flag Gdańsk
Thanks Meter: 3,469
Donate to Me

Good that every chip component is configureable on lowest level by set of external passive elements - opens big possibilities to change any hardware into something different.

Worth to add - always think twice, or even once more before short circuiting anything. If between some V line and another there is positive voltage, like +1V, it still doesn't mean that second one is GND. First one can be +2V and second one +1V. READ carefully all datasheets and documentation. Don't connect any power line straight to another without resistor - this will cause high current go through some component and probably damage it.

Example of bad test - there are some capacitors on the left of Adam's needle when testing resistor. It's highly possible that these capacitors are ARM_CORE stabilisers, which is 1.2V and can handle up to about 1.4V. Adam is operating with 1.8 or 2.8V from other V line - accidentally touching the capacitor with needle can damage CPU core.

If you never been doing any hardware mods but feels like you want to start - prepare for some victims in your electronic devices. That's all of my experiences for now.

//Damn me and my bad habit of reserving posts in Adam's thread. Sorry. :d
The Following 4 Users Say Thank You to Rebellos For This Useful Post: [ View ]
8th November 2011, 06:10 PM |#3  
AllGamer's Avatar
Retired Forum Moderator
Thanks Meter: 1,665
Donate to Me
very informative
10th November 2011, 04:51 AM |#4  
Droidzone's Avatar
Inactive Recognized Developer
Flag Kochi
Thanks Meter: 2,296
Donate to Me
Excellent and authoritative article! Though I'm personally too scared to do anything like this on my phone!
The Following User Says Thank You to Droidzone For This Useful Post: [ View ] Gift Droidzone Ad-Free
12th November 2011, 02:15 AM |#5  
Senior Member
Thanks Meter: 12
I've gotten replies from people that removing a BGA chip is almost impossible. A tutorial on how to unsolder one would be helpful for aspiring hardware hackers.
12th November 2011, 02:24 AM |#6  
Originally Posted by Master Melab

I've gotten replies from people that removing a BGA chip is almost impossible. A tutorial on how to unsolder one would be helpful for aspiring hardware hackers.

It IS almost impossible. It's rediculously difficult. You'll end up pulling a pad or two off the board. You must heat up the entire chip with a heat gun or a hot air station, then pull it off... Meaning you're heating up the entire chip to the point where the solder melts. It takes a multi-thousand dollar professional setup in order to make sure no damage is done. I use a digital temperature controlled heat gun. It works, but it's not accurate.
12th November 2011, 02:29 AM |#7  
Senior Member
Thanks Meter: 12
If you could replace the pads with a socket or something like that you'll be set to go.
12th November 2011, 03:45 AM |#9  
Originally Posted by elmanortega

we need to get you a better camera

HAHHAHHAHHA. funny story about that...

You see, my 6 year old tried to do unbrickable mod on that today..

I no longer have a dedicated camera
14th November 2011, 12:16 PM |#10  
cdesai's Avatar
Inactive Recognized Developer
Thanks Meter: 4,125
Donate to Me
I wish i could try it, but i am sure i wont be able to, lol
22nd November 2011, 03:48 PM |#11  
ShadowReaperGR's Avatar
Thanks Meter: 2
Thank you very much for this guide.
Could you also describe what tools (soldering iron etc) do you use?
Post Reply Subscribe to Thread

Guest Quick Reply (no urls or BBcode)
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes