[MOD]UART Debugging Connection

Search This thread

AdamOutler

Retired Senior Recognized Developer
Feb 18, 2011
5,224
9,809
Miami, Fl̨̞̲̟̦̀̈̃͛҃҅͟orida
Introduction
Why is UART useful? It's a debugging tool. During the boot sequence on most computers, you see a splash screen. On most computers, you can hit 'ESC' to see the diagnostics in the background and then press a key like 'F2' to jump into the BIOS and make changes. On our devices we don't have that option.

On the Nook we have U-Boot which functions as a BIOS. We press 'Space Bar' to get into the U-Boot options. UART allows you to get into the U-Boot and make changes, as well as view the logs as they are generated. See the following code block for an example output
Code:
Texas Instruments X-Loader 1.41 (Oct 21 2011 - 14:00:05)
Start not on PWRON, skipping power button check.
Starting OS Bootloader from EMMC ...


U-Boot 1.1.4-acclaim1.4_1.4.0.1029^{} (Nov 11 2011 - 12:34:20)

Load address: 0x80e80000
DRAM:  1024 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
hw_status 0x23 vbus_status 0x80
mmc read: Invalid size
mmc read: Invalid size

2 bytes read
MAX17042+UBOOT: battery type=LG
MAX17042+UBOOT: gas gauge detected (0x0000)
MAX17042_STATUS (00h) is 0x0000
MAX17042+UBOOT:  BATTERY      Detected!
MAX17042+UBOOT:WARM BOOT    
mmc read: Invalid size
mmc read: Invalid size

40 bytes read
 Valid max17042 init data is loaded into memory 
 0x1234
 0x215b
 0x00d6
 0x2037
 0x0000
 0x0100
 0x007e
 0x3670
 0x078f
 0x0000
 0x0000
 0x6435
 0x2f2c
 0x0140
 0x7d5a
 0x87a4
 0x1400
 0x205c
 0x205c
 0x6046
 verify if mem loaded: FullcapNom was saved as 2037
uboot verify: 1d CONFIG is 2210 ; should be 2210 & 0xFDFB
uboot verify: 2a RELAXCFG is 083b ; should be 083b
uboot verify: 29 FILTERCFG is 87a4 ; should be 87a4
uboot verify: 28 LEARNCFG is 2466 ; should be 2406 & 0xFF0F
uboot verify: 18 DesignCap is 205c ; should be 205c
uboot verify: 12 Vempty is 7d5a ; should be 7d5a
uboot verify: 25 TEMPLIM is 2305 ; should be 2305
uboot verify: 2b MiscCFG is 0810 ; should be 0810 & cc1f
uboot verify: 2c TGAIN is e3e1 ; should be e3e1
uboot verify: 2d TOFF is 290e ; should be 290e
uboot verify: 2e CGAIN is 4000 ; should be 4000
uboot verify: 2f COFF is 0000 ; should be 0000
uboot verify: 37 FCTC is 05e0 ; should be 05e0
MAX17042+UBOOT: warm config is okay
SOC 90%, booting.
Board revision PVT
mmc read: Invalid size
mmc read: Invalid size

16 bytes read
ptn 0 name='xloader' start=256 len=131072
ptn 1 name='bootloader' start=512 len=262144
ptn 2 name='recovery' start=1024 len=15728640
ptn 3 name='boot' start=32768 len=16777216
ptn 4 name='rom' start=65536 len=50331648
ptn 5 name='bootdata' start=163840 len=50331648
ptn 6 name='factory' start=262144 len=387973120
ptn 7 name='system' start=1019904 len=641728512
ptn 8 name='cache' start=2273280 len=446693376
ptn 9 name='media' start=3145728 len=1073741824
ptn 10 name='userdata' start=5242880 len=64991232
mmc read: Invalid size

1088 bytes read
BCB found, checking...

** Unable to use mmc 0:1 for fatload **

** Unable to use mmc 0:1 for fatload **

** Unable to use mmc 0:1 for fatload **
Booting into Android
mmc read: Invalid size
mmc read: Invalid size

4 bytes read
BootCnt 2

1 bytes written
Autobooting in 0 seconds, press <SPACE> to stop...
kernel   @ 80088120 (2682952)
ramdisk  @ 81080000 (157153)
 Initrd start : 81080000 , Initrd end : 810a64c1Acclaim Board.

Starting kernel ...

Linux version 2.6.35.7 ([email protected]) (gcc version 4.4.1 (Sourcery G++ Lite 2010q1-202) ) #1 SMP PREEMPT Fri Nov 11 12:35:42 PST 2011
CPU: ARMv7 Processor [411fc093] revision 3 (ARMv7), cr=10c53c7f
CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
Machine: OMAP4430 ACCLAIM
Memory policy: ECC disabled, Data cache writealloc
On node 0 totalpages: 245760
free_area_init_node: node 0, pgdat c0587e00, node_mem_map c062a000
  Normal zone: 1536 pages used for memmap
  Normal zone: 0 pages reserved
  Normal zone: 178688 pages, LIFO batch:31
  HighMem zone: 512 pages used for memmap
  HighMem zone: 65024 pages, LIFO batch:15
***********************
OMAP4430 ES2.3 type(HS)
id-code  (6b95c02f)
Die-id   (5C360006-00000001-09111715-1601D00D)
Prod-id  (000DB95C-000600CC)
***********************
SRAM: Mapped pa 0x40300000 to va 0xfe400000 size: 0x100000
FIXME: omap44xx_sram_init not implemented
Reserving 33554432 bytes SDRAM for VRAM
SMC: Allocated workspace of 3M at (0x9c900000)
PERCPU: Embedded 7 pages/cpu @c0e37000 s5632 r8192 d14848 u65536
pcpu-alloc: s5632 r8192 d14848 u65536 alloc=16*4096
pcpu-alloc: [0] 0 [0] 1 
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 243712
Kernel command line: androidboot.console=ttyO0 console=ttyO0,115200n8 [email protected] [email protected] init=/init rootwait vram=32M,82000000 omapfb.vram=0:[email protected]
PID hash table entries: 4096 (order: 2, 16384 bytes)
Dentry cache hash table entries: 131072 (order: 7, 524288 bytes)
Inode-cache hash table entries: 65536 (order: 6, 262144 bytes)
Memory: 448MB 256MB 256MB = 960MB total
Memory: 935252k/935252k available, 47788k reserved, 262144K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    DMA     : 0xffc00000 - 0xffe00000   (   2 MB)
    vmalloc : 0xf0800000 - 0xf8000000   ( 120 MB)
    lowmem  : 0xc0000000 - 0xf0000000   ( 768 MB)
    pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
    modules : 0xbf000000 - 0xbfe00000   (  14 MB)
      .init : 0xc0008000 - 0xc003d000   ( 212 kB)
      .text : 0xc003d000 - 0xc053f000   (5128 kB)
      .data : 0xc0540000 - 0xc05888c0   ( 291 kB)
SLUB: Genslabs=11, HWalign=32, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
Hierarchical RCU implementation.
	RCU-based detection of stalled CPUs is disabled.
	Verbose stalled-CPUs detection is disabled.

You will need
In order to get started you will need some things. Here's what you will need.

  1. Torx T5 screw driver (the star kind)
  2. Soldering iron ( any soldering iron)
  3. Case opener tool ( or guitar pick or something small and plastic)
  4. 30-40 AWG wire (small wires)
  5. 1.8V UART to USB converter (Like The Bus Priate)
  6. Tweezers (Makes it easier to handle small things)
Most of the tools and parts used can be obtained at Lowes or Radio Shack

For a UART device, I recommend The Bus Pirate. The Bus Pirate is known as "The Hacker's Multi-tool" and it is useful for alot more than just UART. It is an Open-Source, Open-Hardware, community supported tool. You can get it from SeeedStudios.com for $27.15.

Instructions
There are several ways to set up UART. Here is how I set up mine.
Image 1:
1.jpg

Disassembly
  1. If you have an SDCard inserted, remove it.
  2. Remove two(2) T5 Torx screws securing the back cover to the unit
  3. Using the Case Opener tool, pry the rear cover off the unit. It is held on by small plastic hooks. They are fairly durable and I have not broken any in several removal and installations.
  4. Remove ten(10) T5 torx screws from the metal case which secure the front cover
    Image 2:
    2011-12-30%2014.09.50.jpg
  5. disconnect the battery and the volume control swich connections which are accessible through holes in the metal case.
  6. Remove the front cover using a case opener tool or your bare hands, whichever is more comfortable for you
  7. Remove the board and LCD from the metal case
    Modification
    Image 3:
    2011-12-30%2014.11.34.jpg
  8. Locate the UART RX and TX lines on the board shown in Image2.

    You can hook your UART device to this directly, RX to TX and TX to RX, or keep reading and I'll show you how I set mine up. so..

    Stop here and use UART or continue on for a cleaner method
  9. run 40 awg wire to a piece of perf-board, about 8 holes wide.
  10. Using 20 awg wire, make a loop on the perf-board which joins two holes in two spots on the small piece of perf-board
  11. attach the UART RX
    Image 4:
    2011-12-30%2023.17.49.jpg
  12. Route the wires along the board and tape them down
  13. Use epoxy to mount the perfboard. It should be mounted at a very slight downward angle. Set something under the board while it dries. This gives room for the case to close.
  14. Reassemble the unit, Assembly is reverse of Disassembly.
    Image 5:
    2011-12-31%2009.18.08.jpg
  15. Hook up RX, TX to your perf-board hooks and connect ground to the metal case.
    Image 6:
    2011-12-31%2010.04.16.jpg

You will now be able to talk to your UART device using
Baud: 115200
Bits: 8
Parity: None
Stop Bits: 1
Voltage: 1.8 (open drain)

For the Bus Pirate, get it working in a termianal and use the following settings:
Code:
HiZ>m
1. HiZ
2. 1-WIRE
3. UART
4. I2C
5. SPI
6. 2WIRE
7. 3WIRE
8. LCD
9. DIO
x. exit(without change)

(1)>3
Set serial port speed: (bps)
 1. 300
 2. 1200
 3. 2400
 4. 4800
 5. 9600
 6. 19200
 7. 38400
 8. 57600
 9. 115200
10. BRG raw value

(1)>9
Data bits and parity:
 1. 8, NONE *default 
 2. 8, EVEN 
 3. 8, ODD 
 4. 9, NONE
(1)>1
Stop bits:
 1. 1 *default
 2. 2
(1)>1
Receive polarity:
 1. Idle 1 *default
 2. Idle 0
(1)>1
Select output type:
 1. Open drain (H=Hi-Z, L=GND)
 2. Normal (H=3.3V, L=GND)

(1)>1
Ready
UART>(3)

Conclusion
For those of you helping with security bypass methods, this will surely be useful as it will tell you when a secure failure is encountered. For those of you who want to experiment with U-Boot or a cool electronics project, I'd encourage you to try this. There's not alot that can go wrong because the board is well built and fairly heat resistant and the tools/parts used in this mod are available from several sources.

I hope this was informative and/or interesting for you to read.

Thanks to pokey9000 for pointing me to the right area.
 
Last edited:

HMG10

Senior Member
Nov 29, 2011
210
48
A few lines before the kernal starts loading, it has bootcnt 2. What does this mean and what happens if it is modified? Or is any modification break the secure CHAIN?

Also, what would happen if it didn't autoboot in 0 seconds and you could hit the spacebar?

Sent from my BNTV250 using Tapatalk
 

AdamOutler

Retired Senior Recognized Developer
Feb 18, 2011
5,224
9,809
Miami, Fl̨̞̲̟̦̀̈̃͛҃҅͟orida
A few lines before the kernal starts loading, it has bootcnt 2. What does this mean and what happens if it is modified? Or is any modification break the secure CHAIN?

Sent from my BNTV250 using Tapatalk

That's the number of boots since the counter was reset. After 8 failed boots, the device will go into recovery and restore all firmware.
 

AdamOutler

Retired Senior Recognized Developer
Feb 18, 2011
5,224
9,809
Miami, Fl̨̞̲̟̦̀̈̃͛҃҅͟orida
I changed up my UART connection. I feel this is much cleaner and runs less wire through the nook. This makes it into a really good development device.

This new setup is made with a piece of perf-board from Radio Shack and it's held onto the nook using double-sided tape. Here are some pictures:

210f6nn.jpg



1z3cie0.jpg


The wires are routed through the crack in the back cover and run to the same points mentioned in the Original Post. The 3rd connection (middle) here is Ground. Ground is the point on the board closest to the edge and furthest from UART TX in the staggered group of pins..
 

AdamOutler

Retired Senior Recognized Developer
Feb 18, 2011
5,224
9,809
Miami, Fl̨̞̲̟̦̀̈̃͛҃҅͟orida
I thought I'd update this... I though I'd update this after a few weeks of working with it. The external connection works very well. It is easy to remove and replace if required with just 3 solder joints if required. The external perf-board is very unobtrusive, and does not interfere with operation.

I also found a case that works well with this modification. it's called "Mini Suit" for Nook Tablet.
12+-+1


If you go with this method and need a case, Mini Suit will suit you.
 

acruxksa

Senior Member
Aug 31, 2011
255
88
Anchorage, AK
Adam,

In picture 3 you have a diagram that shows the pinout for uart tx and rx on the nook tablet (appears to be the left two pins of the 4 in the diagram), but if you look closely at picture 4, the top wire appears to be soldered to the top right pin rather than the top left pin as show on the diagram in picture 3. Is this just an optical illusion?

Thanks Again for all you do on these forums.!
 

AdamOutler

Retired Senior Recognized Developer
Feb 18, 2011
5,224
9,809
Miami, Fl̨̞̲̟̦̀̈̃͛҃҅͟orida
Adam,

In picture 3 you have a diagram that shows the pinout for uart tx and rx on the nook tablet (appears to be the left two pins of the 4 in the diagram), but if you look closely at picture 4, the top wire appears to be soldered to the top right pin rather than the top left pin as show on the diagram in picture 3. Is this just an optical illusion?

Thanks Again for all you do on these forums.!

disregard picture 4. I took alot of pictures while setting things up and I chose the ones that gave the best idea of what was going on. Thanks.
 

chongns

Senior Member
Aug 1, 2011
917
426
Johor Bahru
Replacement for Bus Pirate

Hi Adam

Good day to you.
I would like to setup my own Uart devices for Samsung Phone, however, not able to locate the Bus Pirate devices as mention in your thread.
but i found a USB to RS232 converter as per attach PDF file.
would you please help to check on it? is it possible to setup the UART setup use on Samsung phone?

if can kindly help to give a detail guide connection setup from PC USB to Phone.

appreciate you help.

thanks
 

Attachments

  • DS_USB_RS232_PCB.pdf
    418.1 KB · Views: 95
  • Like
Reactions: Hetalk
Mar 7, 2012
42
4
Hi Adam

Good day to you.
I would like to setup my own Uart devices for Samsung Phone, however, not able to locate the Bus Pirate devices as mention in your thread.
but i found a USB to RS232 converter as per attach PDF file.
would you please help to check on it? is it possible to setup the UART setup use on Samsung phone?

if can kindly help to give a detail guide connection setup from PC USB to Phone.

appreciate you help.

thanks

This should really go into the Samsung forum for the phone you're trying to get to, however here is where you can buy a bus pirate.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 25
    Introduction
    Why is UART useful? It's a debugging tool. During the boot sequence on most computers, you see a splash screen. On most computers, you can hit 'ESC' to see the diagnostics in the background and then press a key like 'F2' to jump into the BIOS and make changes. On our devices we don't have that option.

    On the Nook we have U-Boot which functions as a BIOS. We press 'Space Bar' to get into the U-Boot options. UART allows you to get into the U-Boot and make changes, as well as view the logs as they are generated. See the following code block for an example output
    Code:
    Texas Instruments X-Loader 1.41 (Oct 21 2011 - 14:00:05)
    Start not on PWRON, skipping power button check.
    Starting OS Bootloader from EMMC ...
    
    
    U-Boot 1.1.4-acclaim1.4_1.4.0.1029^{} (Nov 11 2011 - 12:34:20)
    
    Load address: 0x80e80000
    DRAM:  1024 MB
    Using default environment
    
    In:    serial
    Out:   serial
    Err:   serial
    hw_status 0x23 vbus_status 0x80
    mmc read: Invalid size
    mmc read: Invalid size
    
    2 bytes read
    MAX17042+UBOOT: battery type=LG
    MAX17042+UBOOT: gas gauge detected (0x0000)
    MAX17042_STATUS (00h) is 0x0000
    MAX17042+UBOOT:  BATTERY      Detected!
    MAX17042+UBOOT:WARM BOOT    
    mmc read: Invalid size
    mmc read: Invalid size
    
    40 bytes read
     Valid max17042 init data is loaded into memory 
     0x1234
     0x215b
     0x00d6
     0x2037
     0x0000
     0x0100
     0x007e
     0x3670
     0x078f
     0x0000
     0x0000
     0x6435
     0x2f2c
     0x0140
     0x7d5a
     0x87a4
     0x1400
     0x205c
     0x205c
     0x6046
     verify if mem loaded: FullcapNom was saved as 2037
    uboot verify: 1d CONFIG is 2210 ; should be 2210 & 0xFDFB
    uboot verify: 2a RELAXCFG is 083b ; should be 083b
    uboot verify: 29 FILTERCFG is 87a4 ; should be 87a4
    uboot verify: 28 LEARNCFG is 2466 ; should be 2406 & 0xFF0F
    uboot verify: 18 DesignCap is 205c ; should be 205c
    uboot verify: 12 Vempty is 7d5a ; should be 7d5a
    uboot verify: 25 TEMPLIM is 2305 ; should be 2305
    uboot verify: 2b MiscCFG is 0810 ; should be 0810 & cc1f
    uboot verify: 2c TGAIN is e3e1 ; should be e3e1
    uboot verify: 2d TOFF is 290e ; should be 290e
    uboot verify: 2e CGAIN is 4000 ; should be 4000
    uboot verify: 2f COFF is 0000 ; should be 0000
    uboot verify: 37 FCTC is 05e0 ; should be 05e0
    MAX17042+UBOOT: warm config is okay
    SOC 90%, booting.
    Board revision PVT
    mmc read: Invalid size
    mmc read: Invalid size
    
    16 bytes read
    ptn 0 name='xloader' start=256 len=131072
    ptn 1 name='bootloader' start=512 len=262144
    ptn 2 name='recovery' start=1024 len=15728640
    ptn 3 name='boot' start=32768 len=16777216
    ptn 4 name='rom' start=65536 len=50331648
    ptn 5 name='bootdata' start=163840 len=50331648
    ptn 6 name='factory' start=262144 len=387973120
    ptn 7 name='system' start=1019904 len=641728512
    ptn 8 name='cache' start=2273280 len=446693376
    ptn 9 name='media' start=3145728 len=1073741824
    ptn 10 name='userdata' start=5242880 len=64991232
    mmc read: Invalid size
    
    1088 bytes read
    BCB found, checking...
    
    ** Unable to use mmc 0:1 for fatload **
    
    ** Unable to use mmc 0:1 for fatload **
    
    ** Unable to use mmc 0:1 for fatload **
    Booting into Android
    mmc read: Invalid size
    mmc read: Invalid size
    
    4 bytes read
    BootCnt 2
    
    1 bytes written
    Autobooting in 0 seconds, press <SPACE> to stop...
    kernel   @ 80088120 (2682952)
    ramdisk  @ 81080000 (157153)
     Initrd start : 81080000 , Initrd end : 810a64c1Acclaim Board.
    
    Starting kernel ...
    
    Linux version 2.6.35.7 ([email protected]) (gcc version 4.4.1 (Sourcery G++ Lite 2010q1-202) ) #1 SMP PREEMPT Fri Nov 11 12:35:42 PST 2011
    CPU: ARMv7 Processor [411fc093] revision 3 (ARMv7), cr=10c53c7f
    CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
    Machine: OMAP4430 ACCLAIM
    Memory policy: ECC disabled, Data cache writealloc
    On node 0 totalpages: 245760
    free_area_init_node: node 0, pgdat c0587e00, node_mem_map c062a000
      Normal zone: 1536 pages used for memmap
      Normal zone: 0 pages reserved
      Normal zone: 178688 pages, LIFO batch:31
      HighMem zone: 512 pages used for memmap
      HighMem zone: 65024 pages, LIFO batch:15
    ***********************
    OMAP4430 ES2.3 type(HS)
    id-code  (6b95c02f)
    Die-id   (5C360006-00000001-09111715-1601D00D)
    Prod-id  (000DB95C-000600CC)
    ***********************
    SRAM: Mapped pa 0x40300000 to va 0xfe400000 size: 0x100000
    FIXME: omap44xx_sram_init not implemented
    Reserving 33554432 bytes SDRAM for VRAM
    SMC: Allocated workspace of 3M at (0x9c900000)
    PERCPU: Embedded 7 pages/cpu @c0e37000 s5632 r8192 d14848 u65536
    pcpu-alloc: s5632 r8192 d14848 u65536 alloc=16*4096
    pcpu-alloc: [0] 0 [0] 1 
    Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 243712
    Kernel command line: androidboot.console=ttyO0 console=ttyO0,115200n8 [email protected] [email protected] init=/init rootwait vram=32M,82000000 omapfb.vram=0:[email protected]
    PID hash table entries: 4096 (order: 2, 16384 bytes)
    Dentry cache hash table entries: 131072 (order: 7, 524288 bytes)
    Inode-cache hash table entries: 65536 (order: 6, 262144 bytes)
    Memory: 448MB 256MB 256MB = 960MB total
    Memory: 935252k/935252k available, 47788k reserved, 262144K highmem
    Virtual kernel memory layout:
        vector  : 0xffff0000 - 0xffff1000   (   4 kB)
        fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
        DMA     : 0xffc00000 - 0xffe00000   (   2 MB)
        vmalloc : 0xf0800000 - 0xf8000000   ( 120 MB)
        lowmem  : 0xc0000000 - 0xf0000000   ( 768 MB)
        pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
        modules : 0xbf000000 - 0xbfe00000   (  14 MB)
          .init : 0xc0008000 - 0xc003d000   ( 212 kB)
          .text : 0xc003d000 - 0xc053f000   (5128 kB)
          .data : 0xc0540000 - 0xc05888c0   ( 291 kB)
    SLUB: Genslabs=11, HWalign=32, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
    Hierarchical RCU implementation.
    	RCU-based detection of stalled CPUs is disabled.
    	Verbose stalled-CPUs detection is disabled.

    You will need
    In order to get started you will need some things. Here's what you will need.

    1. Torx T5 screw driver (the star kind)
    2. Soldering iron ( any soldering iron)
    3. Case opener tool ( or guitar pick or something small and plastic)
    4. 30-40 AWG wire (small wires)
    5. 1.8V UART to USB converter (Like The Bus Priate)
    6. Tweezers (Makes it easier to handle small things)
    Most of the tools and parts used can be obtained at Lowes or Radio Shack

    For a UART device, I recommend The Bus Pirate. The Bus Pirate is known as "The Hacker's Multi-tool" and it is useful for alot more than just UART. It is an Open-Source, Open-Hardware, community supported tool. You can get it from SeeedStudios.com for $27.15.

    Instructions
    There are several ways to set up UART. Here is how I set up mine.
    Image 1:
    1.jpg

    Disassembly
    1. If you have an SDCard inserted, remove it.
    2. Remove two(2) T5 Torx screws securing the back cover to the unit
    3. Using the Case Opener tool, pry the rear cover off the unit. It is held on by small plastic hooks. They are fairly durable and I have not broken any in several removal and installations.
    4. Remove ten(10) T5 torx screws from the metal case which secure the front cover
      Image 2:
      2011-12-30%2014.09.50.jpg
    5. disconnect the battery and the volume control swich connections which are accessible through holes in the metal case.
    6. Remove the front cover using a case opener tool or your bare hands, whichever is more comfortable for you
    7. Remove the board and LCD from the metal case
      Modification
      Image 3:
      2011-12-30%2014.11.34.jpg
    8. Locate the UART RX and TX lines on the board shown in Image2.

      You can hook your UART device to this directly, RX to TX and TX to RX, or keep reading and I'll show you how I set mine up. so..

      Stop here and use UART or continue on for a cleaner method
    9. run 40 awg wire to a piece of perf-board, about 8 holes wide.
    10. Using 20 awg wire, make a loop on the perf-board which joins two holes in two spots on the small piece of perf-board
    11. attach the UART RX
      Image 4:
      2011-12-30%2023.17.49.jpg
    12. Route the wires along the board and tape them down
    13. Use epoxy to mount the perfboard. It should be mounted at a very slight downward angle. Set something under the board while it dries. This gives room for the case to close.
    14. Reassemble the unit, Assembly is reverse of Disassembly.
      Image 5:
      2011-12-31%2009.18.08.jpg
    15. Hook up RX, TX to your perf-board hooks and connect ground to the metal case.
      Image 6:
      2011-12-31%2010.04.16.jpg

    You will now be able to talk to your UART device using
    Baud: 115200
    Bits: 8
    Parity: None
    Stop Bits: 1
    Voltage: 1.8 (open drain)

    For the Bus Pirate, get it working in a termianal and use the following settings:
    Code:
    HiZ>m
    1. HiZ
    2. 1-WIRE
    3. UART
    4. I2C
    5. SPI
    6. 2WIRE
    7. 3WIRE
    8. LCD
    9. DIO
    x. exit(without change)
    
    (1)>3
    Set serial port speed: (bps)
     1. 300
     2. 1200
     3. 2400
     4. 4800
     5. 9600
     6. 19200
     7. 38400
     8. 57600
     9. 115200
    10. BRG raw value
    
    (1)>9
    Data bits and parity:
     1. 8, NONE *default 
     2. 8, EVEN 
     3. 8, ODD 
     4. 9, NONE
    (1)>1
    Stop bits:
     1. 1 *default
     2. 2
    (1)>1
    Receive polarity:
     1. Idle 1 *default
     2. Idle 0
    (1)>1
    Select output type:
     1. Open drain (H=Hi-Z, L=GND)
     2. Normal (H=3.3V, L=GND)
    
    (1)>1
    Ready
    UART>(3)

    Conclusion
    For those of you helping with security bypass methods, this will surely be useful as it will tell you when a secure failure is encountered. For those of you who want to experiment with U-Boot or a cool electronics project, I'd encourage you to try this. There's not alot that can go wrong because the board is well built and fairly heat resistant and the tools/parts used in this mod are available from several sources.

    I hope this was informative and/or interesting for you to read.

    Thanks to pokey9000 for pointing me to the right area.
    4
    I changed up my UART connection. I feel this is much cleaner and runs less wire through the nook. This makes it into a really good development device.

    This new setup is made with a piece of perf-board from Radio Shack and it's held onto the nook using double-sided tape. Here are some pictures:

    210f6nn.jpg



    1z3cie0.jpg


    The wires are routed through the crack in the back cover and run to the same points mentioned in the Original Post. The 3rd connection (middle) here is Ground. Ground is the point on the board closest to the edge and furthest from UART TX in the staggered group of pins..
    4
    I thought I'd update this... I though I'd update this after a few weeks of working with it. The external connection works very well. It is easy to remove and replace if required with just 3 solder joints if required. The external perf-board is very unobtrusive, and does not interfere with operation.

    I also found a case that works well with this modification. it's called "Mini Suit" for Nook Tablet.
    12+-+1


    If you go with this method and need a case, Mini Suit will suit you.
    1
    this is great! I have been looking at my arduino and my pandaII (.netMF) dev boards and my tablet for a few days now.

    Glad I dont have to pull out the logic analyser and find those pins..
    1
    this is great! I have been looking at my arduino and my pandaII (.netMF) dev boards and my tablet for a few days now.

    Glad I dont have to pull out the logic analyser and find those pins..

    that's exactly what I did...

    2nhkrcm.jpg
Our Apps
Get our official app!
The best way to access XDA on your phone
Nav Gestures
Add swipe gestures to any Android
One Handed Mode
Eases uses one hand with your phone