The Samsung Anyway Jig

[ParanoidDK]

It should just be another cable... if i read the odin manuals and the info that E:V:A got about the anyway box the S100 should work on android phones.. From what i can see the S102 box just got a mode more the Solution 6 and can handle the highere current that the tablets need.

Where we should use Solution 4 for the galaxy phones... And that one is the same on the S100 and the S102

And when looking at pictures of the S102 atleast the case is the one from the S100 it is easy to see on the S102 tag that the last 0 or 1 have just got a new sticker..

I do still belive that the S100 can be used with the new phones but not the tablets it is just all about getting the correct 25 pin to micro usb cable.

But only way i can find out is getting the correct cable and the correct drivers... But will take a look if i can find more cables here later just to see if there are any where we can locate usb connectors from... I might even have to take the usb -> S20 cable i have and open that one up to try to reverse a micro usb cable from that... If i can that and get a hold of drivers i just have to get a EFS broken Galaxy S to test with... Dont really dare to use my SGS3 for demo tests..

----EDIT----
We do have one here that used a Anyway S100 to flash his SGS with...

http://forum.xda-developers.com/showthread.php?t=917229

I can hear him if he can open the micro usb cable up for me so i can try to make one for my jig...

----EDIT 2----
Found this PDF about getting in download mode using the S100/S101 jig.

The Function 6 that they want to enable is the one that change ID Type from UART to USB and 2 is the SDS mode

 

[E:V:A]

It seems to me that this device has nothing to do with the semi-standard today of 5 pin micro USB connectors with resistance coding on the 5th ID pin.

This device is used for all Samsung mobile products, new and old. The different device connectors are all done with device specific cables. That is why they use a DB25 in one end and whatever you need in the other end, including new μ-USB connectors. It is also the reason why you see all those relays inside, controlled by the PIC and by PC. (Did you actually read through OP?)

 

[E:V:A]

Found this PDF about getting in download mode using the S100/S101 jig.
The Function 6 that they want to enable is the one that change ID Type from UART to USB and 2 is the SDS mode

That link is dead, please upload a new link.

And if someone have the Anyway software and drivers, please upload these somewhere. I'm mainly interested in the drivers, although I'm not sure it will be useful to look at it, as I now see that it is using a PIC processor to do some communication magic.

 

[ParanoidDK]

That link is dead, please upload a new link.

And if someone have the Anyway software and drivers, please upload these somewhere. I'm mainly interested in the drivers, although I'm not sure it will be useful to look at it, as I now see that it is using a PIC processor to do some communication magic.

Here is the PDF uploaded again.

http://blog.moonman.dk/files/(10-67)GT-I9000_How_to_enter_download_mode__rev1.0.pdf

I am wanting the drivers more and more also... I think atleast on the android phones the software is odin... but i am not sure... they dont talk about other in the flash guides that talk about the anyway

 

[Renate NST]

Did you actually read through OP?

Mmm, yup.

On one hand we have all the documentation of the resistance coding on the ID pin and control of multiplexors.

On the other hand we have the Samsung Anyway box.
I haven't seen any specific info to connect the Anyway box to a modern micro USB cell phone.
Yes, I understand there could be adapters to connect the 25 pin to micro USB.

Skipping over that for now, let's design the most amazing jig that we possibly can envision.
What could such a box do?
It could control the resistance presented to the ID pin.
Ok, let's come up with a neat circuit that does that to say 12 bit resolution.
That would be sufficient to come up with any value that any manufacturer could need.
If we look at the FSA9280A/88A, it's using an effective 5 bit ADC.
You might find that our circuit needed only 8 bits of resolution.
Ok, what else could our box do?
It could process audio if the muxes were in CarKit mode. Nah, no point in that.
It could process MHL if the muxes were outputing MHL, Nah, no point in that.
It could pass the USB if the muxes were in USB mode. Well, not much of a feature, but we'll put that in.
It could convert the UART signal to USB if the muxes were in USB mode. That's a big part of what the jig is for.

Well, what else could the jig do?
Do some fancy decryption or processing of the UART before it goes out the USB to the host?
That doesn't seem very likely. Any processing could be done more easily on the host.

Maybe I'm missing something here, something I didn't read.
Has anybody tried a box with switches for resistors and an FTDI serial converter?
What more could an Anyway box or any other box do than that?

 

[ParanoidDK]

Mmm, yup.

On one hand we have all the documentation of the resistance coding on the ID pin and control of multiplexors.

On the other hand we have the Samsung Anyway box.
I haven't seen any specific info to connect the Anyway box to a modern micro USB cell phone.
Yes, I understand there could be adapters to connect the 25 pin to micro USB.

Skipping over that for now, let's design the most amazing jig that we possibly can envision.
What could such a box do?
It could control the resistance presented to the ID pin.
Ok, let's come up with a neat circuit that does that to say 12 bit resolution.
That would be sufficient to come up with any value that any manufacturer could need.
If we look at the FSA9280A/88A, it's using an effective 5 bit ADC.
You might find that our circuit needed only 8 bits of resolution.
Ok, what else could our box do?
It could process audio if the muxes were in CarKit mode. Nah, no point in that.
It could process MHL if the muxes were outputing MHL, Nah, no point in that.
It could pass the USB if the muxes were in USB mode. Well, not much of a feature, but we'll put that in.
It could convert the UART signal to USB if the muxes were in USB mode. That's a big part of what the jig is for.

Well, what else could the jig do?
Do some fancy decryption or processing of the UART before it goes out the USB to the host?
That doesn't seem very likely. Any processing could be done more easily on the host.

Maybe I'm missing something here, something I didn't read.
Has anybody tried a box with switches for resistors and an FTDI serial converter?
What more could an Anyway box or any other box do than that?

I do see your concern but the anyway box is a "multi" box if you look in the pdf samsung gave there service centers about the SGS's lack of 3 button download mode...

----FROM-PDF-----
If phone cannot enter to download mode with H/W Key combination,
you can use the Anyway JIG (S100 or S101)

 

[E:V:A]

I haven't seen any specific info to connect the Anyway box to a modern micro USB cell phone.
Yes, I understand there could be adapters to connect the 25 pin to micro USB.

I'm afraid you are mislead by something. Probably because you have never seen any of the Samsung Service Manuals, wherein they clearly state what cable to use for each phone! There is nothing to discuss about the cable(s). It's just a cable, and the main purpose of the Anyway is to be as device flexible as possible. This is no longer needed as we all are using mUSB cables and much of the internal behavior is standardised by MIPI. In this mode the Anyway is just acting like an advanced level shifter with adjustable USB_ID resistances. Therefore, what is really interesting is how the software & hardware combo, communicates with the device, and what it is saying!

...and if you had actually read the second post, you would have seen the links to a few different jigs right there!

 

[Renate NST]

Ok, but why do we think that there is some special trick that the box is performing?
Yes, you could do some major reverse engineering on the Anyway box,
but most of the electronics and code in the PIC is for models that we're not interested in.
Have people not been able to do all that is possible with a simple resistor box and a FTDI?

 

[E:V:A]

Ok, but why do we think that there is some special trick that the box is performing?
Yes, you could do some major reverse engineering on the Anyway box,
but most of the electronics and code in the PIC is for models that we're not interested in.
Have people not been able to do all that is possible with a simple resistor box and a FTDI?

Because the box is:
(a) using some hardware settings that we don't understand, to gain automatic download when phone is bricked.
(b) Using some special drivers/protocols to communicate over UART with either AP or BP (modem). We only have drivers for the AP. (There are apparently two UARTs and one USB that can all be used in that box.)
(c) How these settings differs for different hardware variations. (E.g the SGS2 come in at least 18 different hardware models!)


So no, we are not interested in reverse engineering that box, just to understand certain setting needed and the communication protocols used to make your phone do some tricky debug or download magic, that is not available through the simple resistor (only) JIG or known button combo.

 

[E:V:A]

Another point that just popped into my mind, is that the Anyway could possibly also be used as a JTAG. As the later MIPI and JTAG specifications allow for single wire JTAG'ing over USB... This would even further explain the need for the more complicated PIC pass-through.

 

[Renate NST]

There are apparently two UARTs and one USB that can all be used in that box.

Might one of the UART 9 pin connectors feed directly to the USB UART data path
and the other just go into the PIC for control?

Also, the PIC does not have any native USB support.
It would seem that the USB connector on the box is a pass-through for the device USB when in a USB mode.

It should be simple enough to power up the box without a device and see which UART connector will echo something.

Likewise, it can be proved that the USB connector is not going anywhere near the PIC by powering up the box without a device and see that nothing is USB scanned.

7.3728 MHz = 4 x (16 x 115.2 kHz)
U2 + C2-5 = RS-232 driver and charge pump
U8 = relay driver

 

[ParanoidDK]

Well i have to look for the psu for the box... even tho it is a 5V box it dont power on just bu using the usb connection to the computer... But that cant be before i get back to work tomorrow... I also have to look for more cables ofc... and destroy the usb -> s20 cable i found to see if i can use the usb leads to that to figure out how to make a micro usb cable for it...

 

[E:V:A]

Here is some interesting MIPI documents regarding JTAG (1149.1, 1149.7, NIDnT) and the SWD (Software Dubug) interface.

"MIPI_TDWG_whitepaper_NIDnT_V1_0" (pdf)

 

[ParanoidDK]

I found a cable more for the AnyWay jig today... The cable is for the SGH-F310 B&O phone... But just my luck the batterys ran out when taking pics of the nakid cable... I will take a look more here when i get off work (if i get the time) to see if there are more cables... I have still not found a 5V psu there... I did open the S20 USB cable up and found on that the pins on the S20 plug is pin 19-20-21 on the 25 Pins for the anyway box.

(Black is just ground and that is the same on both cables.)
Problem is just when looking at the pins for the S20 on the 25pins side the colors are:

--19-----20----21
Purple-Orange-Green
(Green is the Red cable on the USB connector so i guess that one is +)

But on the B&O it is:
--19----20-----21
Green-Yellow-Purple

And the S20 usb cable is just a 4 pins cable... But not i atleast know what cables are what and where to connect the USB + and - and it should be possible to figure out what port 19 and 20 are if i open the usb side of the S20 cable.

But if we do use 5 cables on the micro usb plug in the anyway then we just have 21 plugs to messure on to find the one that gives 300k ohm the correct place..

-----EDIT----
Ok i found the pins in the 25 pins plug on the box for the usb connection.
- / Data- / Data+ / +
4&5 / 19 / 20 / 21

Then we as i say just need to know the sense port in the micro usb where to connect that one. But as i can read it will just have to test with port 4&5 and then the rest of the ports when the box will pull download mode to find the right ammount of ohm...

 

[E:V:A]

^^ @ParanoidDK: I have no idea what you're trying to do! Why are you opening all your cables? What you are doing seem to be a waste of time, since there is no useful info at all, to gain from the cables. The resistor values are probably set by a programmable resistor bank, if at all. (The only cables with USB_ID are mini- and micro-USB plugs.)

It would be far more helpful if you could provide the drivers or installation program using this device! Or the manual, if there is one!

It would seem that the USB connector on the box is a pass-through for the device USB when in a USB mode.

This would indeed be a more interesting test.

 

[ParanoidDK]

Well as i dont have the micro usb cable because they did't get it before the support left i have to find the usb lines out from the 25 pins connector so i can make a micro usb cable for it... also i dont have any drivers for the box so that is also a no go for the time beeing....

Sent from my GT-I9300 using xda premium

 

[drkcobra]

PIC Image

Has anyone who possesses the S100, S101 or S102 (preferred version) anyway boxes read the Microchip 16F876 PIC microcontroller on the board? If so, would you kind enough to share the bin of it? Thanks!

 

[Renate NST]

Apparently you can use the Anyway jig without a host.
Presumably this just acts like a resistor box?
http://forum.xda-developers.com/showthread.php?t=917229

On the other side, a bunch of sleuthing can be done without any interface cables.
First, you need to power up the unit with 5 volts in at the coaxial power in connector.
Scan the USB port using something that will enumerate the USB bus.
(I'm guessing that it will come up with nothing without a device connected.)
Check the two UART connectors.
Because they are both directly wired to RS-232 level shifters they will both be electrically active.
(I would guess that a straight through PC standard cable to a host would work at 115.2k 8N1
and that one of the connectors would respond somewhat and the other wouldn't.)

 

[ParanoidDK]

Apparently you can use the Anyway jig without a host.
Presumably this just acts like a resistor box?
http://forum.xda-developers.com/showthread.php?t=917229

On the other side, a bunch of sleuthing can be done without any interface cables.
First, you need to power up the unit with 5 volts in at the coaxial power in connector.
Scan the USB port using something that will enumerate the USB bus.
(I'm guessing that it will come up with nothing without a device connected.)
Check the two UART connectors.
Because they are both directly wired to RS-232 level shifters they will both be electrically active.
(I would guess that a straight through PC standard cable to a host would work at 115.2k 8N1
and that one of the connectors would respond somewhat and the other wouldn't.)

As soon i can find the PSU for the unit i can look into doing that... I found the 2 RS232 cables for it also... And i am sure i have a few more cables hidden in that bin under that big ass heavy Laser Printer that we broke on our support and trow out...

 

[E:V:A]

As soon i can find the PSU for the unit i can look into doing that... I found the 2 RS232 cables for it also... And i am sure i have a few more cables hidden in that bin under that big ass heavy Laser Printer that we broke on our support and trow out...

What is the PSU? Power Supply Unit?? If so, you could probably use any old power supply rated at +/- 5V @ 1.2A.

Regarding the two RS232 ports, I would guess that either:
(a) one is using the old-school +/-15V while the other is using the more modern 1.8 or 3V levels. Alternatively they are connected to two different devices.
(b) one is connected to PIC for programking and control, while the other is a pass through directly to D+/D- of DUT (Device Under Test).