I found a previous thread about hacking Vizio TV's but I noted a lot of the folks trying to gain access were doing so through telnet or over the network. I just picked up a Vizio M551d-A2R, and taking a look at the mainboard on it I see a couple of un-populated headers that could be a serial and/or JTAG interface based on the traces and connector layout.
Anyone have experience with trying to gain write access to hardware via I2C or Jtag that could help a relative newbie hack his TV to pieces?
(Before you ask, I'm doing this more for the fun of it than any practical purpose, and who knows, maybe we'll see a Vizio TV section pop up on XDA if this goes well)
Technical specs on the TV:
(U20) Mediatek MT5590 (looks like a specially built version for TV's and I cant find a spec sheet)
(U4) Micron 16GB NAND (located on bottom)
(IC9/10) Nanya 128mb DDR3L x2 (256mb RAM total)
(IC11) Nanya 64mb DDR3L Ram
(IC4) EEPROM (cant read label properly)
(RN21) Unpopulated, looks like I'll need to add a bridge or jumper resistor here as it appears to be sitting on the I2C bus traces
(CN3) JTAG(?) header
(CN33) I2C Serial Bus header
Top of Mainboard
Bottom of Mainboard
vizio d24-d1
yes, i just jtag this vizio d24-d1, you need to use a 3.3 volt usb to serial and then solder the ground, tx and rx.
then you can load a terminal on whatever com port the usb to serial you set to use. email me if you need help finding the pins on the board.. and looking at your photos CN20 is probably it
get a meter and test which is ground usually one on left or right
then so the order would be
GND,TX,RX,3.3 volts, (dont hook the 3.3 volt to anything)
but the tx and rx will show 3.3 volts as well
Related
Okay so i took apart my optimus today (I'm Working on UART and JTAG over the bus pirate)
12 small pads (jtag and UART?)
The processor is the msm7627 (S1)
What looks to be an adreno 200 GPU
Qualcomm modem
Radio has 2 pads on the bottom by the USB
WiFi/Bluetooth has its connection at the top where the speaker is along with what I believe is a backup battery (well its not a battery, multimeter says its not giving off any current)
NOTES:
theres an empty hole where the sim slot would be on gsm model
no silkscreening on the board at all (thanks qualcomm)
on disassembly be really careful! i broke the camera off (oops!) and the speaker (but that can be soldered back on)
pictures (In 720P HD)
https://www.dropbox.com/sh/m1443zgp41f8lhc/A2kjWJ8Yf8
Anyone know the Manufacture?
Been searching and searching and searching for the manufacture of the new Asus Vivo tab RT 36 pin connector. I see from other posts (http://forum.xda-developers.com/showthread.php?t=1630300) that the manufacture of the Asus Transformer (TF101, 201, 700, etc) 40-pin connector has been identified as Tyco Electronics (TE Connectivity). I contacted Tyco (http://www.te.com) to inquire about this 36-pin connector. After forwarding the photos of the connector to an engineer, the sales person got back with me and informed me it was not a Tyco Connectivity product. I’m going to post pix of the connector, and the pinout that I have traced thus far, in case anyone else in working on the project.
Thanks
Jgrobert1968
Added 02/26/2013 (plus a few newer photos.......
I am so glad that others have gotten some use out of that schematic. I have searched and searched, and finally, got a break on the manufacture of the 36 pin connection. I happened to glance at the connector on the USB charger cable, and saw some writing. “LOTES 1233”. So, I Googled it and sure enough Lotes Co. LTD. Showed up. See http://www.lotes.cc/ I have sent an email to both the Main office in main land China and to their South Korea representative, Semsus Electronic Co., Ltd. I received a reply from the South Korea representative, which forwarded the message to the main office. Since China is on Holiday, I don’t expect a prompt reply. Sadly, the South Korea representative did inform me that the company does not have a United States distributor.
Posted below are a few more pix. The stats of the connector are that it is 15mm x 2 mm, the 34 data pins are set on a 0.5mm pitch (0.5 mm center to center) and are 0.2 mm wide. The Two power pins are 0.5 mm wide, set at 1.0 mm from the interface card edge (PCB that the pins are soldered to, to provide a platform of connection. The interface PCB is 12.0 mm wide where it slides into the actual connector.
Note of the connections: Both sets of USB data carrying pairs (pins 27-28 and pins 29-30) are capable of connection of a USB device.
Would love to have other’s input on any experiments with the pinout of this connector. I have a feeling that a USB 3.0 capability and Audio OUT signal also will be found to be capable via this 36 pin connection. I’m currently working on constructing my own homemade docking station for my Vivo Tab. A rep at Asus says he doesn’t know of any plans for such a device from Asus for the Vivo Tab.
TF701 36 pin connector
Did you get any more information on the pin layout and connector?
We are searching for the same information, but for the 36 pin connector used on the TF701.
Regards
Hi all,
I'm new on this forum, and I'm building a DIY tablet with Orange Pi & A20 SoC (maybe I will change for LeMaker Bass) & Android 4.2.2 (v.5 with Bass).
This is a 17.3' screen tablet. I already have a IPS screen, and all works, 4h30 autonomy
Anyway, now I'm looking for a cheap but quality solution for a touch screen. So, multitouch, and easy interface: USB is the better choice for me.
I have seen the "HP ENVY TouchSmart 17 t" touch screen. About 90$ in Chineese shops. The others touch screen are about 180$, because not a serial manufacturing...
Here a pic of the PCB (attached file)
So, my question:It seems that the chip is eGalax (so no problem for the driver: /drivers/input/touchscreen/usbtouchscreen.c), and the interface looks USB (by looking CN1 ref) -> VDD, D+, D-, Ground
But, because of norms of USB VDD, D-, D+, Ground: D+ and D- are inversed... It distrub me a little.
Does somebody can confirm this is really an USB device ?
Thanks
Hi everyone,
I have a bricked K1 Plus box that apparently has some hardware damage to the eMMC power supply.
Via UART I am only getting
Code:
GXBB:BL1:08dafd:0a8993;FEAT:EDFC318C;POC:3;RCY:0;EMMC:800;NAND:81;SD:800;USB:8;GXBB:Fixed PLL lock failed
BL1:08dafd:0a8993;FEAT:EDFC318C;POC:3;RCY:0;EMMC:800;NAND:81;SD:800;USB:8;LOOP:1;EMMC:800;NAND:81;SD:800;USB:8;LOOP:2;EMMC:400;NAND:81;SD:800;USB:8;LOOP:3;EMMC:800;NAND:81;SD:800;USB:8;
Looking at the board, there is a S47BAB SOT23-6 power regulator and a A19T that are getting very hot immediately after power is plugged in.
// great, wasted time creating and uploading pictures of PCB but cannot include them as a new user... couldn't vBulletin tell me when clicking the "insert image" button?
In any case, it's about 1U4 and 1Q3.
A19T is an AO3401 p-Channel MOSFET,
Pin 2 (Source) of A19T goes to Pin 6 (Output?) of the S47BAB regulator, which I could not find any information about.
So I think the regulator itself might still be fine, but it has way too much load attached...
It seems to be the power supply for the eMMC module, does anyone have the schematic for K1 Plus to verify that?
Could someone measure the correct voltage at that regulator / MOSFET, I think it should be either 1.8V or 3.3V for the eMMC?
I'm currently waiting for replacement AO3401 to arrive, however I still wonder how this could draw so much current? (when the MOSFET burns up shouldn't it be either permanently conductive or non-conductive?)
The eMMC itself is not getting any hot, the only other part that is getting slightly warm is the regulator 1U1 and some resistors near the S905 XTAL, but that is probably normal).
Next thing I would try to desolder the MOSFET and see if S905 can boot from USB or microSD. "PLL lock failed" might be just due to some overload of the power supply I hope?
Any help and ideas are appreciated
I had the same problem, but I resolved using the attached firmware with amlogic burning tool 2.2 and a cable usb with a data port + a power port.
I noted that with a standard usb cable male to male there is not enaugh power.
In this way the burner tool recognize the box and you can flash the firmware
Hi,
I have this tablet: http://en.senter.com.cn/products_detail/productId=183.html
It has this type of https://www.graperain.com/ARM-Embedded-MSM8916-System-On-Module/ SOM with MSM8916 CPU. Actual SOM inside the tablet has different marking on it but it looks exactly as the one in the picture. Dimensions are also the same. I googled a little bit and the SOM probably contains PM8916 power management IC. The board that SOM sits on contains ADP1612 boost converter that genereates 5 volts for OTG (at least I think so).
The tablet runs 5.1.1 Android (32 bit) with 3.10.49 kernel.
The problem is the tablet can't be charged while the USB is in OTG mode (I want to connect USB webcam to the tablet and at the same time to charge the tablet). This functionality is called accessory charging adaptor (ACA). I tried to connect OTG cable with 124 kohm resistor and to supply 5 volts for USB webcam externally but this way tablet doesn't enumerate the webcam.
Do you think ACA can be enabled in software? I don't need the tablet to generate 5 V for OTG, I can supply it externally. But I want it to enumerate the webcam and to charge from my external 5 V supply.
I extracted device tree that the tablet uses - http://gaminn.sweb.cz/dt.txt . Do you think it is possible to edit it in order to enable ACA?