Difference between revisions of "920-0614-03"

From freemyipod.org
Jump to: navigation, search
Line 35: Line 35:
 
== Differences from production device ==
 
== Differences from production device ==
  
So far, it seems like the SoC present on the board is no different from production SoCs.
+
=== CHIPID ===
  
=== CHIPID ===
+
Different CHIPIDL/H values are present in the CHIPID peripheral:
 +
 
 +
{| class="wikitable"
 +
|-
 +
! SoC !! CHIPIDL (<code>0x3d100_0004</code>) !! CHIPIDH (<code>0x3d100_0008</code>)
 +
|-
 +
| Nano 4G || <code>19000011</code> || <code>8720000f</code>
 +
|-
 +
| 920-0614-03 || <code>11000001</code> || <code>8720180f</code>
 +
|}
  
Seems like a perfectly standard S5L8720:
+
Effects:
  
<pre>
+
# <code>CHIPIDL & 10 == 0</code>: The BootROM accepts an additional top-level serial: 0x01 0xFB '''0x00''' 0xFB in addition to the standard 0x01 0xFB '''0x01''' 0xFB
3d100000: 0100 0000 0100 0011 0f18 2087 104f 6d76  .......... ..Omv
 
3d100010: d700 0000 0300 0000 0000 0000 0000 0000  ................
 
</pre>
 
  
 
== Pins ==
 
== Pins ==

Revision as of 17:26, 27 October 2023

The 920-0614-03 is seemingly a development/prototype iPod Nano 4G (or possibly iPod Touch 2G board?). It appeared on a bunch of eBay auctions around September 2023.

Specs

SoC: S5L8729

Flash: Usually desoldered

DRAM: To be checked

UART

The boards has at least two ways to access UART:

  1. Over DE9 connector.
  1. Over USB/Serial bridge.
  1. Over 30-pin connector.

TODO: Figure out which serial is which, and document reanimating DE9/USB.

Power

The board runs from either the 30-pin connector by itself (although it can sometimes be unstable) or from 5V over a DC power jack (which provides a 4v-ish supply which simulates the devices' battery).

JTAG

JTAG is available over the 30 pin connector, but is also seemingly locked out as on production devices.

Getting code to run

wInd3x works on the device. On devices without Flash attempting to run the standard WTF causes a reset.

Differences from production device

CHIPID

Different CHIPIDL/H values are present in the CHIPID peripheral:

SoC CHIPIDL (0x3d100_0004) CHIPIDH (0x3d100_0008)
Nano 4G 19000011 8720000f
920-0614-03 11000001 8720180f

Effects:

  1. CHIPIDL & 10 == 0: The BootROM accepts an additional top-level serial: 0x01 0xFB 0x00 0xFB in addition to the standard 0x01 0xFB 0x01 0xFB

Pins

As the board has clearly labeled and accessible GPIO pins / configuration straps, it's a good candidate to reverse engineer pin functionality as used in the production device.

S5L8720 GPIO Function on board
91 'DFU' button