Some change in layout at version 2
New standard Mini-USB Connector
Some layout cleanup.
Remove the LCD pins
Monday, November 5, 2012
Monday, April 23, 2012
MT6252 ( Simvalley SX-310 )
MT6252
Take a look inside the phone Simvalley SX-310 ( www.pearl.de ).
The manufacturer is UMEOX Mobile www.umeox.com. ( Look at Bing-Series Model WING ).
Baseband MT6252
Serial Flash
FM Radio Chip
GSM PA
Development system
Using a USB to RS232 converter.
Take a look inside the phone Simvalley SX-310 ( www.pearl.de ).
The manufacturer is UMEOX Mobile www.umeox.com. ( Look at Bing-Series Model WING ).
Serial Flash
FM Radio Chip
GSM PA
Development system
Using a USB to RS232 converter.
Simvalley SP 40 ( MT 6516 )
MT 6516
Take a look inside the Simvalley SP 40 ( www.pearl.de )
Chips
Baseband MT6516
GSM Radio AD 6548
GSM PA RF7161
Power Chip (PMU) MT6326
MT6616 ( BT and FM Radio )
More Information about MT6516.
http://forum.xda-developers.com/wiki/index.php?title=Chinese_Clones_MTK6516
Test Menu
Switch off the mobile
Press Vol - and Power on at startup
UART2
The SP 40 has no GPS inside. So we can use this UART2 for something else.
Soldering a 0 - 30 Ohm resistor.
UART2 sends some data.
Using the Android Debug Bridge and starting a remote shell
adb shell
#
# ls -l /dev/ttyMT*
crw------- root root 204, 209 2010-01-03 00:57 ttyMT0
crw------- root root 204, 210 2010-01-03 00:57 ttyMT1
crw-rw-rw- bluetooth bluetooth 204, 211 2010-01-03 00:57 ttyMT2
crw------- root root 204, 212 2010-01-03 00:57 ttyMT3
#
# dmesg
<5>[ 0.000000] Linux version 2.6.32.9 (ser4@ser4-System-Product-Name) (gcc version 4.4.0 (GCC) ) #1 Fri May 6 19:01:52 CST 2011
<4>[ 0.000000] CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
<4>[ 0.000000] CPU: VIVT data cache, VIVT instruction cache
<4>[ 0.000000] Machine: MT6516 E1K
<4>[ 0.000000] DISP_GetVRamSize: 2097152 bytes
<4>[ 0.000000] Ignoring unrecognised tag 0x41000802
<4>[ 0.000000] Ignoring unrecognised tag 0x54410008
Compile a Kernel Module
Go to the http://www.pearl.de/support/ an search for Sp40
Download the kernel source.
Download the Android ndk android-ndk-r4-linux-x86.zip (only this version works. Because we need gcc 4.4.0 ).
Go into the kernel tree make modules_prepare. The kernel didn't compile.
But you can compile your own kernel drivers!!!!
Pins on Board
1) UTX4 ( UART 4 )
2) URX1 (UART 1 )
3) PAD_USB_DP ( USB )
4) PAD_USB_DM ( USB)
5) PIMC ????
6) BAT
7) GND
8) URX4 (UART 4 )
9) UTX1 ( UART 1 )
10) PON
11) ????
Build a I2C Extension
Hardware PCV8574 ( Remote 8-Bit I/O expander )
Build the kernel driver
Happy hacking
Take a look inside the Simvalley SP 40 ( www.pearl.de )
Chips
Baseband MT6516
GSM Radio AD 6548
GSM PA RF7161
Power Chip (PMU) MT6326
MT6616 ( BT and FM Radio )
More Information about MT6516.
http://forum.xda-developers.com/wiki/index.php?title=Chinese_Clones_MTK6516
Test Menu
Switch off the mobile
Press Vol - and Power on at startup
UART2
The SP 40 has no GPS inside. So we can use this UART2 for something else.
Soldering a 0 - 30 Ohm resistor.
Now we can connect to the UART2 at PIN 26 and 29.
Using the Android Debug Bridge and starting a remote shell
adb shell
#
# ls -l /dev/ttyMT*
crw------- root root 204, 209 2010-01-03 00:57 ttyMT0
crw------- root root 204, 210 2010-01-03 00:57 ttyMT1
crw-rw-rw- bluetooth bluetooth 204, 211 2010-01-03 00:57 ttyMT2
crw------- root root 204, 212 2010-01-03 00:57 ttyMT3
#
# dmesg
<5>[ 0.000000] Linux version 2.6.32.9 (ser4@ser4-System-Product-Name) (gcc version 4.4.0 (GCC) ) #1 Fri May 6 19:01:52 CST 2011
<4>[ 0.000000] CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
<4>[ 0.000000] CPU: VIVT data cache, VIVT instruction cache
<4>[ 0.000000] Machine: MT6516 E1K
<4>[ 0.000000] DISP_GetVRamSize: 2097152 bytes
<4>[ 0.000000] Ignoring unrecognised tag 0x41000802
<4>[ 0.000000] Ignoring unrecognised tag 0x54410008
Compile a Kernel Module
Go to the http://www.pearl.de/support/ an search for Sp40
Download the kernel source.
Download the Android ndk android-ndk-r4-linux-x86.zip (only this version works. Because we need gcc 4.4.0 ).
Go into the kernel tree make modules_prepare. The kernel didn't compile.
But you can compile your own kernel drivers!!!!
Pins on Board
1) UTX4 ( UART 4 )
2) URX1 (UART 1 )
3) PAD_USB_DP ( USB )
4) PAD_USB_DM ( USB)
5) PIMC ????
6) BAT
7) GND
8) URX4 (UART 4 )
9) UTX1 ( UART 1 )
10) PON
11) ????
Build a I2C Extension
i2C
Bus 0
0x18 FM50AF ( Lens
driver )
0xFE camera
Bus 1
0xc0 mt6326 pmic (
PIN 1 / 91 )
0xaa mt6516_battery
Bus 2
0x14 BMA220 low-g
acceleration sensor
0x92 CM3623 I2C
Proximity Sensor with ALS and Interrupt
0x0e MT6616 ( BT and
FM Radio )
0x72 mt6516 touchpad
Connect a
Hardware PCV8574 ( Remote 8-Bit I/O expander )
Build the kernel driver
Happy hacking
Monday, November 7, 2011
GSM Tracker GT-170
This is a GSM Tracker from pearl ( http://www.pearl.de )
More Information about this tracker.
http://gpstrackerblog.com/2011/10/pearl-gt170-im-test/
Take a look inside the Tracker.
Side 1
GPS Module
SIM Card
10 Pin USB Connector
Side 2
10 Pin USB on side 1
JTAG Pinning
No JTAG pins on board.
The GPS Module
-->
-->
-->
-->
-->
My development system
USB to RS232 converter 3.3 Volt
Green power on switch
10 Pin USB connector from the charging cable
More Information and some sample code
https://github.com/mandl/MTK_Loader
Building QEMU
https://github.com/mandl/fernvale-qemu
./qemu-system-arm -machine mt6223 -s -S
Using
https://github.com/radare/radare2
r2 -a arm -b32 -D gdb gdb://localhost:1234
Downloading the firmware
ToDo
Using osmoload (http://bb.osmocom.org/trac/ ) for down and uploading patched firmware.
Measurement
Tuning the AD6548 to an BCCH channel.
More Information about this tracker.
http://gpstrackerblog.com/2011/10/pearl-gt170-im-test/
Take a look inside the Tracker.
Side 1
SIM Card
10 Pin USB Connector
Side 2
Chips:
MT 6223 DA Baseband Processor 26 Mhz
TV00560002EDGB Nor Flash and SRAM
SKY 77554 TX RX Unit
AD6548 GSM Radio Unit
10 Pin USB on side 1
| Pin | Function |
| 1 | |
| 2 | 5 Volt |
| 3 | |
| 4 | Power Key ( pulling low = turning on) |
| 5 | UART RX Device → PC ( 3.3 Volt ) |
| 6 | UART Tx PC → Device ( 3.3 Volt ) |
| 7 | |
| 8 | |
| 9 | |
| 10 | |
| 11 | GND |
| 12 | GND |
JTAG Pinning
No JTAG pins on board.
The GPS Module
GPS Module → MT6223 Uart 2 RX 9600
Baud 8n1 NEMA
$PJRC011,JRCGPS*08
$PJRC010,001*27
$GPTXT,01,01,02,ANTSTATUS=OPEN*2B
$GPGGA,235945.035.......
PINs on Side2
| Pin | Function |
| 1 | GND |
| 2 | PWR Key |
| 3 | Row 0 |
| 4 | Row 1 |
| 5 | Col 0 |
| 6 | Col1 |
| 7 | Row 2 |
| Pin | Function |
| SDA | GPIO46 URTS1_B |
| SCL | GPIO45 UCTS1_B |
| GPO | GPIO31 SRCLKENAI |
My development system
USB to RS232 converter 3.3 Volt
Green power on switch
10 Pin USB connector from the charging cable
More Information and some sample code
https://github.com/mandl/MTK_Loader
Building QEMU
https://github.com/mandl/fernvale-qemu
./qemu-system-arm -machine mt6223 -s -S
Using
https://github.com/radare/radare2
r2 -a arm -b32 -D gdb gdb://localhost:1234
Downloading the firmware
ToDo
Using osmoload (http://bb.osmocom.org/trac/ ) for down and uploading patched firmware.
Measurement
Tuning the AD6548 to an BCCH channel.
 |
| FCB Burst |
 |
| some data |
 |
| some data |
Subscribe to:
Posts (Atom)