Difference between revisions of "920-0614-03"
| (6 intermediate revisions by the same user not shown) | |||
| Line 3: | Line 3: | ||
== Specs == | == Specs == | ||
| − | '''SoC''': | + | '''SoC''': S5L8720 |
'''Flash''': Usually desoldered | '''Flash''': Usually desoldered | ||
| Line 35: | Line 35: | ||
== Differences from production device == | == Differences from production device == | ||
| − | + | === CHIPID === | |
| − | + | Different CHIPIDL/H values are present in the CHIPID peripheral: | |
| + | |||
| + | {| class="wikitable" | ||
| + | |- | ||
| + | ! SoC !! CHIPIDL (<code>0x3d100_0004</code>) !! CHIPIDH (<code>0x3d100_0008</code>) | ||
| + | |- | ||
| + | | Nano 4G || <code>19000011</code> || <code>8720000f</code> | ||
| + | |- | ||
| + | | 920-0614-03 || <code>11000001</code> || <code>8720180f</code> | ||
| + | |} | ||
| − | + | Effects: | |
| − | < | + | # <code>CHIPIDL & 0x10 == 0</code>: The BootROM accepts an additional top-level serial: 0x01 0xFB '''0x00''' 0xFB in addition to the standard 0x01 0xFB '''0x01''' 0xFB |
| − | + | # <code>CHIPIDL & (1 << 27) == 0</code>: The WTF's ChipID[2] function returns 2 instead of 3 in second argument. | |
| − | |||
| − | </ | ||
== Pins == | == Pins == | ||
| Line 55: | Line 62: | ||
|- | |- | ||
| 91 || 'DFU' button | | 91 || 'DFU' button | ||
| + | |- | ||
| + | | 5 || DB9 UART TX (J9204) | ||
|} | |} | ||
| + | |||
| + | == Case == | ||
| + | |||
| + | Protective case design: https://www.printables.com/model/628404-920-0614-03-ipod-nano-4g-prototype-case | ||
Latest revision as of 03:10, 23 December 2024
The 920-0614-03 is seemingly a development/prototype iPod Nano 4G (or possibly iPod Touch 2G board?). It appeared on a bunch of eBay auctions around September 2023.
Contents
Specs
SoC: S5L8720
Flash: Usually desoldered
DRAM: To be checked
UART
The boards has at least two ways to access UART:
- Over DE9 connector.
- Over USB/Serial bridge.
- Over 30-pin connector.
TODO: Figure out which serial is which, and document reanimating DE9/USB.
Power
The board runs from either the 30-pin connector by itself (although it can sometimes be unstable) or from 5V over a DC power jack (which provides a 4v-ish supply which simulates the devices' battery).
JTAG
JTAG is available over the 30 pin connector, but is also seemingly locked out as on production devices.
Getting code to run
wInd3x works on the device. On devices without Flash attempting to run the standard WTF causes a reset.
Differences from production device
CHIPID
Different CHIPIDL/H values are present in the CHIPID peripheral:
| SoC | CHIPIDL (0x3d100_0004) |
CHIPIDH (0x3d100_0008)
|
|---|---|---|
| Nano 4G | 19000011 |
8720000f
|
| 920-0614-03 | 11000001 |
8720180f
|
Effects:
CHIPIDL & 0x10 == 0: The BootROM accepts an additional top-level serial: 0x01 0xFB 0x00 0xFB in addition to the standard 0x01 0xFB 0x01 0xFBCHIPIDL & (1 << 27) == 0: The WTF's ChipID[2] function returns 2 instead of 3 in second argument.
Pins
As the board has clearly labeled and accessible GPIO pins / configuration straps, it's a good candidate to reverse engineer pin functionality as used in the production device.
| S5L8720 GPIO | Function on board |
|---|---|
| 91 | 'DFU' button |
| 5 | DB9 UART TX (J9204) |
Case
Protective case design: https://www.printables.com/model/628404-920-0614-03-ipod-nano-4g-prototype-case
