It is happened that I needed to obtain UART access on Galaxy S7. I tried Google search, apparently. I have found several threads on XDA dedicated to this question; however, they all are a bit outdated (2012-2013 years), containing information about an old loader.
Moreover, they are describing information in a very limited way, mostly telling the reader only about how to use UART with loader and do not going deeper into details.
Finally, despired to find any valuable piece of information, I performed my own research and here I will structure all the information I gathered and discovered.
To begin with, there is an USB multiplexing unit between USB-connector and USB-controller, aimed to measure the value of resistance between ID and GND, and setup a USB controller mode in dependance of that. That is not a new thing: the same way works, for instance, USB OTG.
But there exist other work modes which are hidden from the normal user. These work modes are utilized by a special device which is used by Samsung engineers. One can order a device like this on Ebay, but I do not se any reason for. Source codes of the mobile phone kernel are available for download and include a multiplexing unit driver.
The S7's MUIC name is MAX77854, which comes with lack of documentation, but we have a driver, which, obviously, has source codes which are available here: drivers/muic/max77854-muic.c. Going through the sources, I found an actual table of the resistance values and work modes for this device:
I have no idea what the listed most modes mean, but I see one very interesting mode JIG_UART_ON, which has been researched a bit and which allowes us to connect a device through USB-UART adapter and get a SBOOT boot log. I was inspired by an article about SBOOT where a guy researched the possibility of hijacking the boot loader and discovered a way how to change boot parameters including kernel boot parameters.
First of all, we need to build a JIG(UART) adapter. For that purpose we need to have any USB-UART adapter (I used FT232) and resistance unit for 619kOm (I have purchased one for 620kOm in the shop next to my house). Then we need to get them together as on the scheme:
The newly created adapter we need to plug in to the computer and wait for a new device name (on my system it set as /dev/ttyUSB0), then connect to this device through a terminal application (I used minicom).
I am not sure what settings will you have for your terminal application, that's why I highly recommend you to set up your port settings and disable the hardware flow control setting. After all things done, you have to plug a mobile phone to this adapter and turn it on using the key combo: Vol-(Volume Down) + Power.
As symbols on the screen start displaying, you need to quickly press Enter key as minimum as 3 times until we see the command line. Congratulations! We are in the SBOOT console! Run the following command:
After its execution complete, press and hold Vol-(Volume Down) (if the above mentioned key has not been pressed, SBOOT will not print anything in the console) and enter the command into the SBOOT console:
The device will reboot and we will see a SBOOT boot log and a part of kernel boot log. Why only a part? Because as of my research, a small bug is located in the kernel sources, I give you a patch for it below:
After it has been applied, we will be able to see all the kernel boot log; however, we will break the GSM component of the mobile device. This UART port is used be system to communicate with a GSM modem. At this stage we can use it for kernel debugging, but it wasn't our goal.
Now let's get mobile device console access through UART, using the information received above.
To achieve this, we have to install TWRP on our device and using it, get root access. Then we have to install busibox, which includes getty application and that is the only its difference from the original. Afterwards, we boot our device, install a terminal emulator and switch the device to the airplane mode.
Now start the emulator and enter the following commands:
Useful links:
Moreover, they are describing information in a very limited way, mostly telling the reader only about how to use UART with loader and do not going deeper into details.
Finally, despired to find any valuable piece of information, I performed my own research and here I will structure all the information I gathered and discovered.
To begin with, there is an USB multiplexing unit between USB-connector and USB-controller, aimed to measure the value of resistance between ID and GND, and setup a USB controller mode in dependance of that. That is not a new thing: the same way works, for instance, USB OTG.
But there exist other work modes which are hidden from the normal user. These work modes are utilized by a special device which is used by Samsung engineers. One can order a device like this on Ebay, but I do not se any reason for. Source codes of the mobile phone kernel are available for download and include a multiplexing unit driver.
The S7's MUIC name is MAX77854, which comes with lack of documentation, but we have a driver, which, obviously, has source codes which are available here: drivers/muic/max77854-muic.c. Going through the sources, I found an actual table of the resistance values and work modes for this device:
I have no idea what the listed most modes mean, but I see one very interesting mode JIG_UART_ON, which has been researched a bit and which allowes us to connect a device through USB-UART adapter and get a SBOOT boot log. I was inspired by an article about SBOOT where a guy researched the possibility of hijacking the boot loader and discovered a way how to change boot parameters including kernel boot parameters.
First of all, we need to build a JIG(UART) adapter. For that purpose we need to have any USB-UART adapter (I used FT232) and resistance unit for 619kOm (I have purchased one for 620kOm in the shop next to my house). Then we need to get them together as on the scheme:
The newly created adapter we need to plug in to the computer and wait for a new device name (on my system it set as /dev/ttyUSB0), then connect to this device through a terminal application (I used minicom).
Code:
sudo minicom -D /dev/ttyUSB0I am not sure what settings will you have for your terminal application, that's why I highly recommend you to set up your port settings and disable the hardware flow control setting. After all things done, you have to plug a mobile phone to this adapter and turn it on using the key combo: Vol-(Volume Down) + Power.
As symbols on the screen start displaying, you need to quickly press Enter key as minimum as 3 times until we see the command line. Congratulations! We are in the SBOOT console! Run the following command:
Code:
setenv CMDLINE console=ttySAC4,115200 loglevel=4
saveenvAfter its execution complete, press and hold Vol-(Volume Down) (if the above mentioned key has not been pressed, SBOOT will not print anything in the console) and enter the command into the SBOOT console:
Code:
resetThe device will reboot and we will see a SBOOT boot log and a part of kernel boot log. Why only a part? Because as of my research, a small bug is located in the kernel sources, I give you a patch for it below:
Code:
diff --git a/drivers/muic/universal/muic_apis.c b/drivers/muic/universal/muic_apis.c
index 342bc51..5af193c 100755
--- a/drivers/muic/universal/muic_apis.c
+++ b/drivers/muic/universal/muic_apis.c
@@ -796,7 +796,7 @@ int detach_jig_uart_boot_off(muic_data_t *pmuic)
*/
int attach_jig_uart_boot_on(muic_data_t *pmuic, muic_attached_dev_t new_dev)
{
- int com_index = COM_OPEN;
+ int com_index = COM_UART_AP;
int ret = 0;
pr_info("%s:%s JIG UART BOOT-ON(0x%x)\n",After it has been applied, we will be able to see all the kernel boot log; however, we will break the GSM component of the mobile device. This UART port is used be system to communicate with a GSM modem. At this stage we can use it for kernel debugging, but it wasn't our goal.
Now let's get mobile device console access through UART, using the information received above.
To achieve this, we have to install TWRP on our device and using it, get root access. Then we have to install busibox, which includes getty application and that is the only its difference from the original. Afterwards, we boot our device, install a terminal emulator and switch the device to the airplane mode.
Now start the emulator and enter the following commands:
Code:
su
echo 1 > /sys/devices/virtual/sec/switch/uart_en
echo AP > /sys/devices/virtual/sec/switch/uart_sel #на этом этапе должен появиться лог ядра
su root -c "getty -n -L -l /system/bin/sh 115200 ttySAC4 vt102"Useful links:
Last edited:
