From freemyipod.org
Jump to: navigation, search

The 920-0614-03 is seemingly a development/prototype iPod Nano 4G (or possibly iPod Touch 2G board?). It appeared on a bunch of eBay auctions around September 2023.


SoC: S5L8729

Flash: Usually desoldered

DRAM: To be checked


The boards has at least two ways to access UART:

  1. Over DE9 connector.
  1. Over USB/Serial bridge.
  1. Over 30-pin connector.

TODO: Figure out which serial is which, and document reanimating DE9/USB.


The board runs from either the 30-pin connector by itself (although it can sometimes be unstable) or from 5V over a DC power jack (which provides a 4v-ish supply which simulates the devices' battery).


JTAG is available over the 30 pin connector, but is also seemingly locked out as on production devices.

Getting code to run

wInd3x works on the device. On devices without Flash attempting to run the standard WTF causes a reset.

Differences from production device


Different CHIPIDL/H values are present in the CHIPID peripheral:

SoC CHIPIDL (0x3d100_0004) CHIPIDH (0x3d100_0008)
Nano 4G 19000011 8720000f
920-0614-03 11000001 8720180f


  1. CHIPIDL & 0x10 == 0: The BootROM accepts an additional top-level serial: 0x01 0xFB 0x00 0xFB in addition to the standard 0x01 0xFB 0x01 0xFB
  2. CHIPIDL & (1 << 27) == 0: The WTF's ChipID[2] function returns 2 instead of 3 in *second argument.


As the board has clearly labeled and accessible GPIO pins / configuration straps, it's a good candidate to reverse engineer pin functionality as used in the production device.

S5L8720 GPIO Function on board
91 'DFU' button
5 DB9 UART TX (J9204)


Protective case design: https://www.printables.com/model/628404-920-0614-03-ipod-nano-4g-prototype-case