Hardware: Difference between revisions

From freemyipod
Jump to navigation Jump to search
← Older edit
User890104 (talk | contribs)
Bureaucrats, svnadmins, Administrators
391 edits
Cmwslw (talk | contribs)
confirmed
742 edits
No edit summary
No edit summary
 
(80 intermediate revisions by 16 users not shown)
Line 1: Line 1:
Although iPods have many other components, here we are only listing the components that might be relavent to cracking firmware encryption. If you have any suggestions for any other components to add, just post on the talk page or IRC. Links to datasheets are important if they can be found. For a visual hardware reference, visit the [[Hardware annotation]] page.
== Overview ==


'''The datasheet for the S5L8700X series (possibly part of it?) has been located!''' You can download it [http://rapidshare.com/files/101234522/S5L8700X-DS.pdf.html here] (link from [http://www.rockbox.org/twiki/bin/view/Main/SamsungSA58#SA58700_codename_Blues this Rockbox wiki page]), but I (cmwslw) will try to get it hosted on my site soon. The datasheet describes every pin (page 1-5) and instruction (page 3-1) in detail. We now know the exact locations of the JTAG pins, and a lot of other information about the chip.
This is just a basic comparison of each generation's main components. For a detailed hardware analysis of a generation, click on it's link.
==1G Nano==
 
{| border="1" cellpadding="5" cellspacing="0"
{| class="wikitable"
! Component !! Details
! Generation !! SoC !! SoC Family Code Name !! CPU Core !! RAM !! NOR/Utility Flash !! Device Code Name!! UpdaterFamilyID
|-
| CPU  
| Portal Player PP5021C-TDF. This is the last Nano that used a PortalPlayer processor before Apple started using Samsung. If anybody knows of a datasheet for this, please add a link to it.
|-
|-
| RAM
|[[Nano 1G]]
| [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=136&partnum=K4M56163PG Samsung K4M56163PG] - A datasheet for this Mobile SDRAM chip can be found [http://pdf1.alldatasheet.net/datasheet-pdf/view/168204/SAMSUNG/K4M56163PG.html here].
|PP5021C-TDF
|M26
|ARM7TDMI x 2
|[https://files.freemyipod.org/misc/K4M56163PG.pdf K4M56163PG] (32MiB)
|[https://files.freemyipod.org/misc/SST39WF400A.pdf SST39WF400A] (512KiB)
|
|14/17
|-
|-
| Utility Flash
|[[Nano 2G]]
| [http://www.sst.com/products.xhtml/parallel_flash/39/x16/SST39WF400A SST39WF400A]. This chip is documented very well as is a similar chip on the 2G Nano.
|S5L8701
|}
|M1
==2G Nano==
|ARM940T
{| border="1" cellpadding="5" cellspacing="0"
|[https://files.freemyipod.org/misc/K4M56163PG.pdf K4M56163PG] (32MiB)
! Component !! Details
|[https://files.freemyipod.org/misc/SST39WF800A.pdf SST39WF800A] (1MiB)
|N36
|19/29
|-
|-
| CPU
|[[Nano 3G]]
| [[S5L8700 datasheet|Samsung S5L8701]] System On Chip (SoC), includes ARM940T(SAM44X?) central processor, advanced DSP, 50kb boot ROM, 256kb SRAM, external RAM, flash and LCD controllers, USB(1.1-host; 2.0-function) and some other parts. Package: [http://www.samsung.com/global/business/semiconductor/support/PackageInformation/downloads/SystemLSI/FBGA/232_FBGA_1010_12_05.pdf 232-pin FBGA 10x10mm] or 224/226-pin 9x9mm. Similar chips: [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=212&partnum=SA58700 SA58700X07].  No documentation available for the S5L series, and contacting Samsung doesn't help either. The processor itself is Apple-branded and marked 337S3291 8701.
|rowspan="4"|S5L8702
|rowspan="4"|M1A
|rowspan="4"|ARM926
|[https://files.freemyipod.org/misc/K4X56163PI-L.pdf K4X56163PI] (32MiB)
|rowspan="4"|[https://files.freemyipod.org/misc/SST25VF080B.pdf SST25VF080B] (1MiB)
|N46
|26
|-
|-
| RAM
|[[Classic 1G]]
| [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=136&partnum=K4M56163PG Samsung K4M56163PG] - [http://pdf1.alldatasheet.net/datasheet-pdf/view/168204/SAMSUNG/K4M56163PG.html here] is the datasheet. This is the same chip used in the iPod 1G Nano. Sometimes the Qimonda [http://www.alldatasheet.com/datasheet-pdf/pdf/207179/QIMONDA/HYE18L256169BFX-7.5.html HYE18L256] chip is used instead.
|rowspan="3"|[https://files.freemyipod.org/misc/K4X51163PE-L.pdf K4X51163PE] (64MiB)
|rowspan="3"|N25
|24
|-
|-
| Utility Flash
|[[Classic 2G]]
| [http://www.sst.com/products.xhtml/parallel_flash/39/x16/SST39WF800A SST SST39WF800A],stores Disk Mode, Diagnostic Mode and the code to flash this chip. Tof has [http://home.gna.org/linux4nano/dumping_SST39WF800A.html managed to extract] this data and the dump can be obtained by emailing Emmanuel Fleury. All of the contents in the utility flash chip are encrypted from now on.
|33
|-
|-
| DSP
|[[Classic 3G]]
| Combination of Samsung 16-bit CalmRisc16 and Samsung 24-bit CalmMAC2424. Performance - up to 40MIPS (24x24 operation per cycle). During boot performs [[Bootstrapping sequence|data verification and decryption]].
|35/38
|
|}
 
==3G Nano==
{| border="1" cellpadding="5" cellspacing="0"
! Component !! Details
|-
|-
| CPU
|[[Nano 4G]]
| [[S5L8700 datasheet|Samsung S5L8701]] ARM940T processor. The package itself is Apple-branded and marked 337S3473 8702.
|rowspan="2"|S5L8720
|M2S
|rowspan="4"|ARM1176
|K4X56323PI (32MiB)
|''none''
|N58
|31
|-
|-
| RAM
|iPod touch (2nd generation)
| Like the flash chip, the memory also varies. The most popular chip seems to be the [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=137&partnum=K4X56163PG&&ppmi=1209 K4X56163PI]. Another similar one that is sometimes used is the [http://www.qimonda.com/mobile-ram/ddr-18/index.html Qimonda HYE18M169CX75].
|M2P
|K4X1G323PD (128MiB)
|''none''
|N72AP
|
|-
|-
| Utility Flash
|[[Nano 5G]]
| [http://www.sst.com/products.xhtml/serial_flash/25/3.0V/SST25VF080B SST25VF080B]. Like the other SST chips, this one is also extremely well documented.
|S5L8730
|}
|M2?
==4G Nano==
|K4X51323PG (64MiB)
{| border="1" cellpadding="5" cellspacing="0"
|''none''
! Component !! Details
|N33
|34
|-
|-
| CPU
|[[Nano 6G]]
| [[S5L8700 datasheet|Samsung S5L8701]] ARM940T processor. It is definitely worth knowing that this is the exact same processor used in the iTouch 2G. This could mean that some of the same exploits for that could possibly be used. [http://theiphonewiki.com/wiki/index.php?title=S5L8720_(Hardware) Here] is a very interesting page about the S5L8720 processor.
|S5L8723
|
|K4X51323PI (64MiB)
|''none''
|N20<ref>N20 Snowfox in the ''Diagnostics mode'' header</ref>
|36
|-
|-
| RAM
|[[Nano 7G]]
| Integrated into the processor, similar to the iPod Touch and iPhone lines.
|S5L8740
|M2R<ref>m2rfmssWriteBLPage in 1.0.4 [[RetailOS]]</ref>
|rowspan="2"|Cortex A5
|H9DKNNN51J (64MiB)
|''none''
|N31<ref>N31 Snowfox in the ''Diagnostics mode'' header</ref>
|37
|-
|-
| Utility Flash
|Haywire
| Possibly the chip on the lower part of the 4G board? See [Hardware annotation].
|S5L8747
|
|H9TKNNN2GD (256MiB)
|''none''
|
|''none''
|}
|}
==Helpful pages==
http://theiphonewiki.com/wiki/index.php?title=S5L8720_(Hardware)


http://www.ipodlinux.org/wiki/Generations (Be careful! This is extremely inaccurate.)
=== Explanations ===


http://www.rockbox.org/twiki/bin/view/Main/SamsungSA58#SA58700_codename_Blues
* '''Device Code Name''': product code name, from early prototype phases to production run device. Most commonly used internal reference.
===1G Nano===
* '''SoC Family Code Name''': device family code name, seems to follow large generational changes in SoC. Mostly seen around hardware (init) code, eg. flash interface, diags, etc.
http://www2.electronicproducts.com/Apple_iPod_nano-whatsinside-2.aspx


http://arstechnica.com/apple/reviews/2005/09/nano.ars/4
==Helpful pages==
 
Chip analyses
[http://pc.watch.impress.co.jp/docs/2005/0908/nano21.jpg Image of the 1G Nano board]
*http://www2.electronicproducts.com/Apple_iPod_Touch-whatsinside-57.aspx
 
*http://www2.electronicproducts.com/Apple_iPhone-whatsinside-4.aspx
[http://www.ipodlinux.org/wiki/Generations#iPod_Nano_.28Nano1G.29] - The pictures listed
Additional information
===2G Nano===
*http://dendrites.blog.163.com/blog/static/165376178201082112922174/
http://home.gna.org/linux4nano/download/hardware_synth-1.0.pdf
*https://theapplewiki.com/wiki/User:Ilikeiphone123/Playground/Codenames
 
http://www.ifixit.com/Guide/First-Look/iPod-Nano-2nd-Generation/592/1
 
http://arstechnica.com/apple/reviews/2006/09/ipod-2g.ars/4
===3G Nano===
http://www2.electronicproducts.com/Applie_iPod_Nano_(4GB)_3rd_Generation-whatsinside-16.aspx#
 
http://content.techrepublic.com.com/2346-13636_11-170826-1.html
 
http://www.ifixit.com/Guide/First-Look/iPod-Nano-3rd-Generation/594/1
 
http://insidetronics.blogspot.com/2007/09/teardown-ipod-nano-3g.html
 
[http://www.combert-elec.com/www/bookpic/200810916515460624.jpg Image of 3G Nano board]
===4G Nano===
http://www.ifixit.com/Guide/First-Look/iPod-Nano-4th-Generation/584/1
===Other (for comparison)===
http://www2.electronicproducts.com/Apple_iPod_Touch-whatsinside-57.aspx


http://www2.electronicproducts.com/Apple_iPhone-whatsinside-4.aspx
==Notes==
<references />

Latest revision as of 09:37, 6 June 2026

Overview

This is just a basic comparison of each generation's main components. For a detailed hardware analysis of a generation, click on it's link.

Generation SoC SoC Family Code Name CPU Core RAM NOR/Utility Flash Device Code Name UpdaterFamilyID
iPod nano (1st generation) PP5021C-TDF M26 ARM7TDMI x 2 K4M56163PG (32MiB) SST39WF400A (512KiB) 14/17
iPod nano (2nd generation) S5L8701 M1 ARM940T K4M56163PG (32MiB) SST39WF800A (1MiB) N36 19/29
iPod nano (3rd generation) S5L8702 M1A ARM926 K4X56163PI (32MiB) SST25VF080B (1MiB) N46 26
iPod classic (6th generation) K4X51163PE (64MiB) N25 24
iPod classic (6th generation) 33
iPod classic (6th generation) 35/38
iPod nano (4th generation) S5L8720 M2S ARM1176 K4X56323PI (32MiB) none N58 31
iPod touch (2nd generation) M2P K4X1G323PD (128MiB) none N72AP
iPod nano (5th generation) S5L8730 M2? K4X51323PG (64MiB) none N33 34
iPod nano (6th generation) S5L8723 K4X51323PI (64MiB) none N20[1] 36
iPod nano (7th generation) S5L8740 M2R[2] Cortex A5 H9DKNNN51J (64MiB) none N31[3] 37
Haywire S5L8747 H9TKNNN2GD (256MiB) none none

Explanations

  • Device Code Name: product code name, from early prototype phases to production run device. Most commonly used internal reference.
  • SoC Family Code Name: device family code name, seems to follow large generational changes in SoC. Mostly seen around hardware (init) code, eg. flash interface, diags, etc.

Helpful pages

Chip analyses

Additional information

Notes

  1. ↑ N20 Snowfox in the Diagnostics mode header
  2. ↑ m2rfmssWriteBLPage in 1.0.4 retailOS
  3. ↑ N31 Snowfox in the Diagnostics mode header
Retrieved from "https://freemyipod.org/index.php?title=Hardware&oldid=22352"