Difference between revisions of "Hardware"
Line 5: | Line 5: | ||
|- | |- | ||
| CPU | | CPU | ||
− | | Portal Player PP5021C-TDF. This is the last Nano that used a PortalPlayer processor. | + | | Portal Player PP5021C-TDF. This is the last Nano that used a PortalPlayer processor. If anybody knows of a datasheet for this, please add a link to it. |
|- | |- | ||
| RAM | | RAM | ||
− | | [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=136&partnum=K4M56163PG Samsung K4M56163PG] - | + | | [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=136&partnum=K4M56163PG Samsung K4M56163PG] - A datasheet for this Mobile SDRAM chip can be found [http://pdf1.alldatasheet.net/datasheet-pdf/view/168204/SAMSUNG/K4M56163PG.html here]. |
|- | |- | ||
− | | Utility Flash | + | | Utility Flash |
| [http://www.sst.com/products.xhtml/parallel_flash/39/x16/SST39WF400A SST39WF400A]. This chip is documented very well as is a similar chip on the 2G Nano. | | [http://www.sst.com/products.xhtml/parallel_flash/39/x16/SST39WF400A SST39WF400A]. This chip is documented very well as is a similar chip on the 2G Nano. | ||
|- | |- | ||
Line 21: | Line 21: | ||
|- | |- | ||
| CPU | | CPU | ||
− | | [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=212&partnum=S5L8700 Samsung S5L8701] ARM940T processor. Absolutely no documentation exists for the S5L series, and contacting Samsung doesn't help either. The processor itself is Apple-branded and marked 337S3291 8701 | + | | [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=212&partnum=S5L8700 Samsung S5L8701] ARM940T processor. Absolutely no documentation exists for the S5L series, and contacting Samsung doesn't help either. The processor itself is Apple-branded and marked 337S3291 8701. |
|- | |- | ||
− | | | + | | RAM |
− | | [http://www. | + | | [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=136&partnum=K4M56163PG Samsung K4M56163PG] - [http://pdf1.alldatasheet.net/datasheet-pdf/view/168204/SAMSUNG/K4M56163PG.html here] is the datasheet. This is the same chip used in the iPod 1G Nano. |
|- | |- | ||
− | | | + | | Utility Flash |
− | | [http://www. | + | | [http://www.sst.com/products.xhtml/parallel_flash/39/x16/SST39WF800A SST SST39WF800A],stores Disk Mode, Diagnostic Mode and the code to flash this chip. Tof has [http://home.gna.org/linux4nano/dumping_SST39WF800A.html managed to extract] this data and the dump can be obtained by emailing Emmanuel Fleury. All of the contents in the utility flash chip are encrypted from now on. |
|- | |- | ||
| NAND Flash | | NAND Flash | ||
Line 42: | Line 42: | ||
| Like the flash chip, the memory also varies. The most popular chip seems to be the [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=137&partnum=K4X56163PG&&ppmi=1209 K4X561], a 256Mbit (32MByte) Mobile 1.8V DDRAM. Another similar one that is sometimes used is the [http://www.qimonda.com/mobile-ram/ddr-18/index.html Qimonda HYE18M169CX75]. | | Like the flash chip, the memory also varies. The most popular chip seems to be the [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=137&partnum=K4X56163PG&&ppmi=1209 K4X561], a 256Mbit (32MByte) Mobile 1.8V DDRAM. Another similar one that is sometimes used is the [http://www.qimonda.com/mobile-ram/ddr-18/index.html Qimonda HYE18M169CX75]. | ||
|- | |- | ||
− | | Utility Flash | + | | Utility Flash |
− | | SST25VF080B | + | | [http://www.sst.com/products.xhtml/serial_flash/25/3.0V/SST25VF080B SST25VF080B]. Like the other SST chips, this one is also extremely well documented. |
|- | |- | ||
| NAND Flash | | NAND Flash | ||
Line 58: | Line 58: | ||
| Integrated into the processor, similar to the iPod Touch and iPhone lines. | | Integrated into the processor, similar to the iPod Touch and iPhone lines. | ||
|- | |- | ||
− | | Utility Flash | + | | Utility Flash |
| | | | ||
|- | |- |
Revision as of 23:47, 19 March 2009
Although iPods have many other components, here we are only listing the components that might be relavent to cracking firmware encryption. If you have any suggestions for any other components to add, just post on the talk page or IRC. Links to datasheets are important if they can be found.
Contents
1G Nano
Component | Details |
---|---|
CPU | Portal Player PP5021C-TDF. This is the last Nano that used a PortalPlayer processor. If anybody knows of a datasheet for this, please add a link to it. |
RAM | Samsung K4M56163PG - A datasheet for this Mobile SDRAM chip can be found here. |
Utility Flash | SST39WF400A. This chip is documented very well as is a similar chip on the 2G Nano. |
NAND Flash | This chip is dependent on the iPod model, but all interface in the same way. |
2G Nano
Component | Details |
---|---|
CPU | Samsung S5L8701 ARM940T processor. Absolutely no documentation exists for the S5L series, and contacting Samsung doesn't help either. The processor itself is Apple-branded and marked 337S3291 8701. |
RAM | Samsung K4M56163PG - here is the datasheet. This is the same chip used in the iPod 1G Nano. |
Utility Flash | SST SST39WF800A,stores Disk Mode, Diagnostic Mode and the code to flash this chip. Tof has managed to extract this data and the dump can be obtained by emailing Emmanuel Fleury. All of the contents in the utility flash chip are encrypted from now on. |
NAND Flash | This chip is dependent on the iPod model, but all interface in the same way. Common ones for the 2G Nano are the Samsung K9MBG08U5M and the Hynix HY27UW08BGFM. |
3G Nano
Component | Details |
---|---|
CPU | Samsung S5L8702 ARM940T processor. The package itself is Apple-branded and marked 337S3473 8702. |
RAM | Like the flash chip, the memory also varies. The most popular chip seems to be the K4X561, a 256Mbit (32MByte) Mobile 1.8V DDRAM. Another similar one that is sometimes used is the Qimonda HYE18M169CX75. |
Utility Flash | SST25VF080B. Like the other SST chips, this one is also extremely well documented. |
NAND Flash | This chip is dependent on the iPod model, but all interface in the same way. A common one for the 3G Nano is the Samsung K9MBG08U5M. |
4G Nano
Component | Details |
---|---|
CPU | Samsung S5L8720 ARM940T processor. It is definitely worth knowing that this is the exact same processor used in the iTouch 2G. This could mean that some of the same exploits for that could possibly be used. Here is a very interesting page about the S5L8720 processor. |
RAM | Integrated into the processor, similar to the iPod Touch and iPhone lines. |
Utility Flash | |
NAND Flash | This chip is dependent on the iPod model, but all interface in the same way. |
Helpful pages
http://theiphonewiki.com/wiki/index.php?title=S5L8720_(Hardware)
http://www.ipodlinux.org/wiki/Generations (Be careful! This is extremely inaccurate.)
1G Nano
http://www2.electronicproducts.com/Apple_iPod_nano-whatsinside-2.aspx
http://arstechnica.com/apple/reviews/2005/09/nano.ars/4
[1] - The pictures listed
2G Nano
http://home.gna.org/linux4nano/download/hardware_synth-1.0.pdf
http://www.ifixit.com/Guide/First-Look/iPod-Nano-2nd-Generation/592/1
http://arstechnica.com/apple/reviews/2006/09/ipod-2g.ars/4
3G Nano
http://www2.electronicproducts.com/Applie_iPod_Nano_(4GB)_3rd_Generation-whatsinside-16.aspx#
http://content.techrepublic.com.com/2346-13636_11-170826-1.html
http://www.ifixit.com/Guide/First-Look/iPod-Nano-3rd-Generation/594/1
http://insidetronics.blogspot.com/2007/09/teardown-ipod-nano-3g.html
4G Nano
http://www.ifixit.com/Guide/First-Look/iPod-Nano-4th-Generation/584/1
Other (for comparison)
http://www2.electronicproducts.com/Apple_iPod_Touch-whatsinside-57.aspx
http://www2.electronicproducts.com/Apple_iPhone-whatsinside-4.aspx