Project

General

Profile

Thuraya SG2520 » History » Version 2

Anonymous, 02/19/2016 10:50 PM

1 1
= researching the thuraya sg2520 smartphone =
2
3
 * made by apsi / www.apsat.co.kr
4
 * fcc id: TZ5SG2520, ( search [http://gullfoss2.fcc.gov/prod/oet/cf/eas/reports/GenericSearch.cfm here] )
5
 * the gsm part is a siemens MC 55 revision 0400
6
7
= software =
8
9
( quoted from PE-UT-0056 )
10
11
System OS of SG-2520 terminal is using Windows CE 4.2 Core and it is consisted of OMAP 
12
1510 CPU, ARM Core, RAM 128 MB, and Flash ROM 64 MB. Screen is 176 x 220 Pixel and it 
13
supports Bluetooth, IrDA, 1.30 Mega Pixel and SD card. File access is possible via ActiveSync 
14
but it does not support DB Sync.  
15
16
XP/2000 can be used as development environment and development tool is based on the 
17
Embedded Visual C++ 4.0 and you need to use the SG2520-CORE-SDK-8.2 Device of SDK.  
18
19
see [http://www.thuraya.com/content/thuraya-sg-2520.html this page] for instructions on how to update the phone to the latest firmware version.
20
21
== the usb connector ==
22
23
 * type: 3050-24R-0.5  from HJI&C
24
   * it looks quite a bit like a lg c1200 / zune / ipod connector.
25
 * i think we need [http://www.hyupjininc.com/english/product/product_sub.htm?item_code=3 3050-24P-0.5]
26
27
devices available on the connector:
28
 * uart1 : rx=pin13, tx=pin14, rts=pin20, cts=pin23
29
 * uart2 : rx=pin1, tx=pin3
30
 * i2c : pin7=SCL, pin11=SDA, irq=pin24
31
 * audio: mic=pin8+pin9, spk=pin17+pin18
32
 * usb: DM-=pin10, DM+=pin15, VBUS=pin16
33
 * Ground=pin12, pin19
34
 * extdevice power: pin21, pin22
35
 * external boot : pin2
36
 * charge voltage : pin4+pin5
37
 * external device attached signal : pin6
38
39
== you can connect to the internal modem as follows ==
40
 * from start -> connectivity -> bluetooth
41
 * turn 'on', and select 'dial up network'
42
 * move rocker switch to the right for the 'search' window
43
 * make desktoppc discoverable
44
 * select your desktoppc, then choose 'pairing' from the option menu
45
 * from your desktop connect to the dialup profile
46
 * talks at 115200 baud
47
48
== 'secret' dial codes ==
49
50
|| 3785#*#      || HKLM\SOFTWARE\NaceTech\Network  :CurrentModuleID=1  :SystemPreference=2
51
|| 3597#*#      || HKLM\SOFTWARE\NaceTech\Network  :CurrentModuleID=0  :SystemPreference=0
52
|| 47726#*#     || EngineerMenu.exe
53
|| 357899#*#    || SDUpgrade.exe
54
|| 321*321#*#   || show 'operation time' ?
55
|| 321*123#*#   || show start/end time ?
56
57
=== rom v2.3 ===
58
|| 47722#*# || Diagnostic\GmtsLinkage.exe
59
|| 47723#*# || Diagnostic\GsmLinkage.exe
60
|| 47724#*# || Diagnostic\ImeiSetting.exe
61
|| 47725#*# || Diagnostic\TransVer.exe
62
|| 47726#*# || EngineerMenu.exe
63
|| 357899#*# || SDUpgrade.exe
64
|| 47726##*## || DebugMode.exe
65
|| *#746635625#*# || PhoneLock.exe
66
|| *#737*# || Settings/SGClean.exe   ; master reset
67
|| 7453328466#*# || \DiskOnChip\RilDbg.log  ; RIL debug Switched on
68
|| 74533284633#*# || \DiskOnChip\RilDbg.log  ; RIL debug Switched off 
69
|| 7453776724325#*# || ??
70
|| 321*321#*#   || show 'operation time' ?
71
|| 321*123#*#   || show start/end time ?
72
73
== memory map ==
74
75
||  ''virtual''       ||  ''physical''  || ''size''
76
|| v80000000-81000000 || p00000000-01000000  || 1000000
77
|| v81000000-81400000 || p04000000-04400000  ||  400000
78
|| v83000000-84000000 || p0c000000-0d000000  || 1000000
79
|| v84000000-88000000 || p10000000-14000000  || 4000000
80
|| v88000000-88100000 || p20000000-20100000  ||  100000
81
|| v89000000-8a100000 || pe0000000-e1100000  || 1100000
82
|| v8bf00000-8c000000 || pfff00000-00000000  ||  100000
83
|| vfffd0000-fffd1000 || p10500000-10501000  ||    1000
84
|| vfffd1000-fffd2000 || p10500000-10501000  ||    1000
85
|| vfffd2000-fffd3000 || p10500000-10501000  ||    1000
86
|| vfffd3000-fffd4000 || p10500000-10501000  ||    1000
87
|| vffff0000-ffff1000 || p10504000-10505000  ||    1000
88
|| vffff2000-ffff3000 || p10504000-10505000  ||    1000
89
|| vffff4000-ffff5000 || p10504000-10505000  ||    1000
90
|| vffff6000-ffff7000 || p10504000-10505000  ||    1000
91
|| vffffc000-ffffd000 || p10505000-10506000  ||    1000
92
93
== disk on chip ==
94
95
|| binary partition || pdocread -n 0 -b 0x20000 0 0x100000 bdk0.nb || bootloader
96
|| 20M xip image || pdocread -h 0x87c12aae 0 0x1400000 dsk1.nb || DSK1: osimage
97
|| 64M fat32  || pdocread -h 0x47b6a28e 0 0x4000000 dsk2.nb || DSK2: contains thuraya shell etc.
98
|| 30M fat16 || pdocread -h 0xa7b6a2f2 0 0x1e00000 dsk4.nb || DSK4: userfilesystem
99
|| OTP || pdocread -o 0 0x1c || 001AB1018CE7,356013006101607  ( the bluetooth-mac + imei )
100
101
== hardware ==
102
103
 * large circuitboard 
104
   * display
105
   * keyboard
106
   * sdcard slot 
107
   * samsung btez1702sa / 060420 aba
108
      * bluetooth
109
   * 604A / 0547  (16 pin chip )
110
   * microphone
111
   * pads where speaker attaches
112
   * Infrared part
113
 * small circuitboard 'siemens mc55'
114
   * infineon PMB 7850 E / 60608 / EL606065S04
115
      * GSM / GPRS Single Chip Baseb
116
   * dialog D0767CB LF / 060855YH
117
      * power management
118
   * M36W0T604 / 0T1ZAQ / 99246 v5 / MYS 99 603 / (st)
119
      * 16MByte flash + 2MByte sram
120
 * main board front
121
   * TPS65010 / TI 5CW / ZCH5 G4
122
      * powermanagement chip
123
   * SEC 631 BL75 / K4M511633C
124
      * 64M byte SDRAM
125
   * Ricoh 387A / A59
126
      * realtime clock
127
   * 635 / 555L18
128
      * probably timer chip.
129
   * TI OMAP1510G / 65C052W / ZZG2
130
      * probably the application processor
131
   * NLAS 3699 G5CHN ( several of these )
132
      * 4 low power RON switch
133
   * M-systems DiskOnChip G4 / MD8832-d16-V3-X-P
134
      * flash chip
135
   * nVidia GoForce 4000 / S AGKTP / taiwan 452a2
136
      * video codec
137
   * TI AIC1110 / 69HLJ
138
      * pcm codec with mic+spk amps
139
   * TI AIC23BIZ / 61K9T
140
      * audio codec with headphone amp
141
   * SIRF / GSC3f-7879 / DRRPAB / NO2WCQF / 0628 KR
142
      * gps 
143
   * small battery
144
 * main board back
145
   * DALMA v2.1 / P2YH6-032
146
      * probably the sat radio part
147
   * TI OMAP1510G / 65C052W / ZZG2
148
      * probably the SAT processor
149
   * intel 3050L0ZBQ / 5616B221 / Z617I112A
150
      * probably ram+flash
151
   * connector for camera part
152
   * philips 9535 / 0419 / buG634
153
      * i2c gpio pins
154
   * philips 8028 / 218W / ctG607B
155
      * 2.5Ghz IF freq synth
156
   * AD9864 / BCPZ / # 0622 / 906925.1
157
      * IF digitizing part
158
   * sim connector
159
   * battery connector
160
   * 16 pad test connector
161
 * camera part
162
   * connector on top for siemens board
163
164
== talking to thuraya modem via bluetooth on osx ==
165
166
 * on device, enable bt, show, 'dun'
167
 * on mac: add serialport for 'dialup networking' and 'rs232'
168
169
== sg2520 usb modes ==
170
171
in the {{{settings -> system -> external connect}}} menu you can select between 3 modes:
172
173
{{{
174
[activesync mode]
175
usbvidpid:  1a26:9d84
176
    class=0xff, subclass=0xff, protocol=0xff
177
178
[usb modem] in gsm mode
179
usbvidpid: 1a26:9d81   class=0x02
180
 interface#1 class=0x02[CDC] subclass=0x02 [ACM] protocol=0x01 [at commands]
181
 interface#2 class=0x0A[CDCData] subclass=0x00 protocol=0x00
182
183
[usb modem] in sat mode
184
usbvidpid: 1a26:9d82   class=0x02
185
 interface#1 class=0x02[CDC] subclass=0x02 [ACM] protocol=0x01 [at commands]
186
 interface#2 class=0x0A[CDCData] subclass=0x00 protocol=0x00
187
188
[uart]
189
usbvidpid: 1a26:9d83   class=0x02
190
 interface#1 class=0x02[CDC] subclass=0x02 [ACM] protocol=0xff
191
 interface#2 class=0x0A[CDCData] subclass=0x00 protocol=0x00
192
}}}
Add picture from clipboard (Maximum size: 48.8 MB)