wildlife camera

wildlife camera




CPU NovaTek NT96211FG ARM Processor

DRAM  H5DU2562GTR

Flash


PIC 16F690

Motion control LHI778

CPU and DRAM

Camera side

Display side

Camera side

TP1 Battery power
TP2 Battery power ( after D1 )

TP7 Power for CPU ?

Camera side

PIC 16F690

Controls  LHI778
Uses I2C ?
Switch camera on/off ( power control )

PIC

Programming interface for PIC

TP 17
TP 21
TP 20
TP 18
TP 19


Serial Port 3.3 Volt CPU

Serial port

1 GND
2 TX  (
3 RX
4 3.3 Volt


 hacking-scoutguard-camera

SIM900 GSM Module

SIM 900

This is a small GSM Module from SIMCom

More Information you find

 GPRS_Shield_V2.0

There is a Datasheet  and a update tool for the firmware.

 

Take a look inside

Flash WR504Ub

GSM Amplifier RF7166

GSM Baseband

Could be a Processor  a PNX4900 ???

32-bit ARM926EJ-S

8 kB Instruction RAM  32 Bit (I-TCM),
8 kB Data RAM           (D-TCM)

DSP subsystem
Ceva-Teak

16-bit fixed-point DSP

Aero 4210 RF subsystem

RF subsystem

Dualband LNA inputs


GSM 850 or E-GSM 900
DCS 1800 or PCS 1900

GSM Tracker GT-280 ( Version 2 )


Some change in layout at version 2

New standard Mini-USB Connector
Some layout cleanup.

Remove the LCD pins

MT6252 ( Simvalley SX-310 )

MT6252 

Take a look inside the phone Simvalley SX-310 (  www.pearl.de ).

The manufacturer is UMEOX Mobile www.umeox.com.   ( Look at Bing-Series Model WING ).

Baseband MT6252
Serial Flash
FM Radio Chip
GSM PA

Development system

Using a USB to RS232 converter.

Simvalley SP 40 ( MT 6516 )

MT 6516 

Take a look inside the Simvalley SP 40 (  www.pearl.de )

Chips

Baseband MT6516
GSM Radio AD 6548
GSM PA RF7161
Power Chip (PMU) MT6326
MT6616  ( BT and FM Radio )


More Information about MT6516.

http://forum.xda-developers.com/wiki/index.php?title=Chinese_Clones_MTK6516


Test Menu

Switch off the mobile
Press Vol - and Power on at startup

UART2

The SP 40 has no GPS inside. So we can use this UART2 for something else.

Soldering a 0 - 30 Ohm resistor.

  

Now we can connect to the UART2 at PIN 26 and 29.

UART2 sends some data.

Using the Android Debug Bridge and starting a remote shell

adb shell

#
# ls -l /dev/ttyMT*
crw------- root     root     204, 209 2010-01-03 00:57 ttyMT0
crw------- root     root     204, 210 2010-01-03 00:57 ttyMT1
crw-rw-rw- bluetooth bluetooth 204, 211 2010-01-03 00:57 ttyMT2
crw------- root     root     204, 212 2010-01-03 00:57 ttyMT3
#

# dmesg
<5>[    0.000000] Linux version 2.6.32.9 (ser4@ser4-System-Product-Name) (gcc version 4.4.0 (GCC) ) #1 Fri May 6 19:01:52 CST 2011
<4>[    0.000000] CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
<4>[    0.000000] CPU: VIVT data cache, VIVT instruction cache
<4>[    0.000000] Machine: MT6516 E1K
<4>[    0.000000] DISP_GetVRamSize: 2097152 bytes
<4>[    0.000000] Ignoring unrecognised tag 0x41000802
<4>[    0.000000] Ignoring unrecognised tag 0x54410008

Compile a Kernel Module

Go to the http://www.pearl.de/support/ an search for Sp40
Download the kernel source.
Download the Android ndk android-ndk-r4-linux-x86.zip (only this version works. Because we need gcc 4.4.0 ).
Go into the kernel tree make modules_prepare. The kernel didn't compile.
But you can compile your own kernel drivers!!!!

 Pins on Board

1) UTX4  ( UART 4 )
2) URX1  (UART 1 )
3) PAD_USB_DP  ( USB )
4) PAD_USB_DM  ( USB)
5) PIMC ????
6) BAT
7) GND
8) URX4  (UART 4 )
9) UTX1  ( UART 1 )
10)  PON
11)  ????

Build a I2C Extension

 

i2C

Bus 0

0x18 FM50AF ( Lens driver )

0xFE camera

Bus 1

0xc0 mt6326 pmic ( PIN 1 / 91 )

0xaa mt6516_battery

Bus 2

0x14 BMA220 low-g acceleration sensor

0x92 CM3623 I2C Proximity Sensor with ALS and Interrupt

0x0e MT6616 ( BT and FM Radio )

0x72 mt6516 touchpad

Connect a

Hardware  PCV8574 ( Remote 8-Bit I/O expander )

Build the kernel driver

Happy hacking

GSM Tracker GT-170

This is a GSM Tracker from pearl ( http://www.pearl.de )

More Information about this tracker.

 http://gpstrackerblog.com/2011/10/pearl-gt170-im-test/

Take a look inside the Tracker.

Side 1

GPS Module
SIM Card
10 Pin USB Connector


Side 2

Chips:

MT 6223 DA             Baseband Processor 26 Mhz

TV00560002EDGB   Nor Flash and SRAM

SKY 77554               TX RX Unit

AD6548                   GSM Radio Unit

10 Pin USB on side 1

Pin	Function
1
2	5 Volt
3
4	Power Key ( pulling low = turning on)
5	UART RX  Device → PC   ( 3.3 Volt )
6	UART Tx  PC → Device    ( 3.3 Volt )
7
8
9
10
11	GND
12	GND

JTAG Pinning

No JTAG pins on board.

The GPS Module

-->

GPS Module → MT6223 Uart 2 RX 9600 Baud 8n1 NEMA

 

-->

$PJRC011,JRCGPS*08

$PJRC010,001*27

$GPTXT,01,01,02,ANTSTATUS=OPEN*2B 

-->

$GPGGA,235945.035.......

PINs on Side2

-->

Pin	Function
1	GND
2	PWR Key
3	Row 0
4	Row 1
5	Col 0
6	Col1
7	Row 2

 

-->

Pin	Function
SDA	GPIO46 URTS1_B
SCL	GPIO45 UCTS1_B
GPO	GPIO31 SRCLKENAI

My development system

USB to RS232 converter 3.3 Volt
Green power on switch
10 Pin USB connector from the charging cable

More Information and some sample code

https://github.com/mandl/MTK_Loader



Building QEMU

https://github.com/mandl/fernvale-qemu


./qemu-system-arm -machine mt6223 -s -S 

Using 

https://github.com/radare/radare2


r2 -a arm -b32 -D gdb gdb://localhost:1234

Downloading the firmware

ToDo
Using osmoload (http://bb.osmocom.org/trac/  ) for down and uploading patched firmware.

Measurement

Tuning the AD6548  to an BCCH channel.

FCB Burst

some data

some data