Project

General

Profile

Thuraya SG2520 » History » Version 5

laforge, 10/11/2019 12:26 PM

1 1
2 4
h1. researching the thuraya sg2520 smartphone
3 1
4
5 4
* made by apsi / www.apsat.co.kr
6
* fcc id: TZ5SG2520, ( search "here":http://gullfoss2.fcc.gov/prod/oet/cf/eas/reports/GenericSearch.cfm )
7
* the gsm part is a siemens MC 55 revision 0400
8
9
10
h1. software
11
12
13 1
System OS of SG-2520 terminal is using Windows CE 4.2 Core and it is consisted of OMAP 
14
1510 CPU, ARM Core, RAM 128 MB, and Flash ROM 64 MB. Screen is 176 x 220 Pixel and it 
15 4
supports Bluetooth, [[IrDA]], 1.30 Mega Pixel and SD card. File access is possible via [[ActiveSync]] 
16 1
but it does not support DB Sync.  
17
18
XP/2000 can be used as development environment and development tool is based on the 
19
Embedded Visual C++ 4.0 and you need to use the SG2520-CORE-SDK-8.2 Device of SDK.  
20
21 4
see "this page":http://www.thuraya.com/content/thuraya-sg-2520.html for instructions on how to update the phone to the latest firmware version.
22 1
23
24 4
h2. the usb connector
25 1
26 4
27
* type: 3050-24R-0.5  from HJI&C
28
*** it looks quite a bit like a lg c1200 / zune / ipod connector.
29
* i think we need "3050-24P-0.5":http://www.hyupjininc.com/english/product/product_sub.htm?item_code=3
30
31 1
devices available on the connector:
32 4
* uart1 : rx=pin13, tx=pin14, rts=pin20, cts=pin23
33
* uart2 : rx=pin1, tx=pin3
34
* i2c : pin7=SCL, pin11=SDA, irq=pin24
35
* audio: mic=pin8+pin9, spk=pin17+pin18
36
* usb: DM-=pin10, DM+=pin15, VBUS=pin16
37
* Ground=pin12, pin19
38
* extdevice power: pin21, pin22
39
* external boot : pin2
40
* charge voltage : pin4+pin5
41
* external device attached signal : pin6
42 1
43
44 4
h2. you can connect to the internal modem as follows
45 1
46 4
* from start -> connectivity -> bluetooth
47
* turn 'on', and select 'dial up network'
48
* move rocker switch to the right for the 'search' window
49
* make desktoppc discoverable
50
* select your desktoppc, then choose 'pairing' from the option menu
51
* from your desktop connect to the dialup profile
52
* talks at 115200 baud
53
54
55
h2. 'secret' dial codes
56
57
58 1
|| 3785#*#      || HKLM\SOFTWARE\NaceTech\Network  :CurrentModuleID=1  :SystemPreference=2
59
|| 3597#*#      || HKLM\SOFTWARE\NaceTech\Network  :CurrentModuleID=0  :SystemPreference=0
60 4
|| 47726#*#     || [[EngineerMenu]].exe
61 1
|| 357899#*#    || SDUpgrade.exe
62
|| 321*321#*#   || show 'operation time' ?
63
|| 321*123#*#   || show start/end time ?
64
65 4
66
h3. rom v2.3
67
68 1
|| 47722#*# || Diagnostic\GmtsLinkage.exe
69
|| 47723#*# || Diagnostic\GsmLinkage.exe
70
|| 47724#*# || Diagnostic\ImeiSetting.exe
71
|| 47725#*# || Diagnostic\TransVer.exe
72 4
|| 47726#*# || [[EngineerMenu]].exe
73 1
|| 357899#*# || SDUpgrade.exe
74 4
|| 47726##*## || [[DebugMode]].exe
75
|| *#746635625#*# || [[PhoneLock]].exe
76 1
|| *#737*# || Settings/SGClean.exe   ; master reset
77
|| 7453328466#*# || \DiskOnChip\RilDbg.log  ; RIL debug Switched on
78
|| 74533284633#*# || \DiskOnChip\RilDbg.log  ; RIL debug Switched off 
79
|| 7453776724325#*# || ??
80
|| 321*321#*#   || show 'operation time' ?
81
|| 321*123#*#   || show start/end time ?
82
83
84 4
h2. memory map
85
86
87
||  _virtual_       ||  _physical_  || _size_
88 1
|| v80000000-81000000 || p00000000-01000000  || 1000000
89
|| v81000000-81400000 || p04000000-04400000  ||  400000
90
|| v83000000-84000000 || p0c000000-0d000000  || 1000000
91
|| v84000000-88000000 || p10000000-14000000  || 4000000
92
|| v88000000-88100000 || p20000000-20100000  ||  100000
93
|| v89000000-8a100000 || pe0000000-e1100000  || 1100000
94
|| v8bf00000-8c000000 || pfff00000-00000000  ||  100000
95
|| vfffd0000-fffd1000 || p10500000-10501000  ||    1000
96
|| vfffd1000-fffd2000 || p10500000-10501000  ||    1000
97
|| vfffd2000-fffd3000 || p10500000-10501000  ||    1000
98
|| vfffd3000-fffd4000 || p10500000-10501000  ||    1000
99
|| vffff0000-ffff1000 || p10504000-10505000  ||    1000
100
|| vffff2000-ffff3000 || p10504000-10505000  ||    1000
101
|| vffff4000-ffff5000 || p10504000-10505000  ||    1000
102
|| vffff6000-ffff7000 || p10504000-10505000  ||    1000
103
|| vffffc000-ffffd000 || p10505000-10506000  ||    1000
104
105
106 4
h2. disk on chip
107
108
109 1
|| binary partition || pdocread -n 0 -b 0x20000 0 0x100000 bdk0.nb || bootloader
110
|| 20M xip image || pdocread -h 0x87c12aae 0 0x1400000 dsk1.nb || DSK1: osimage
111
|| 64M fat32  || pdocread -h 0x47b6a28e 0 0x4000000 dsk2.nb || DSK2: contains thuraya shell etc.
112
|| 30M fat16 || pdocread -h 0xa7b6a2f2 0 0x1e00000 dsk4.nb || DSK4: userfilesystem
113
|| OTP || pdocread -o 0 0x1c || 001AB1018CE7,356013006101607  ( the bluetooth-mac + imei )
114
115
116 4
h2. hardware
117 1
118
119 4
* large circuitboard 
120
*** display
121
*** keyboard
122
*** sdcard slot 
123
*** samsung btez1702sa / 060420 aba
124
****** bluetooth
125
*** 604A / 0547  (16 pin chip )
126
*** microphone
127
*** pads where speaker attaches
128
*** Infrared part
129
* small circuitboard 'siemens mc55'
130
*** infineon PMB 7850 E / 60608 / EL606065S04
131
****** GSM / GPRS Single Chip Baseb
132
*** dialog D0767CB LF / 060855YH
133
****** power management
134
*** M36W0T604 / 0T1ZAQ / 99246 v5 / MYS 99 603 / (st)
135
****** 16MByte flash + 2MByte sram
136
* main board front
137
*** TPS65010 / TI 5CW / ZCH5 G4
138
****** powermanagement chip
139
*** SEC 631 BL75 / K4M511633C
140
****** 64M byte SDRAM
141
*** Ricoh 387A / A59
142
****** realtime clock
143
*** 635 / 555L18
144
****** probably timer chip.
145
*** TI OMAP1510G / 65C052W / ZZG2
146
****** probably the application processor
147
*** NLAS 3699 G5CHN ( several of these )
148
****** 4 low power RON switch
149
*** M-systems [[DiskOnChip]] G4 / MD8832-d16-V3-X-P
150
****** flash chip
151
*** nVidia [[GoForce]] 4000 / S AGKTP / taiwan 452a2
152
****** video codec
153
*** TI AIC1110 / 69HLJ
154
****** pcm codec with mic+spk amps
155
*** TI AIC23BIZ / 61K9T
156
****** audio codec with headphone amp
157
*** SIRF / GSC3f-7879 / DRRPAB / NO2WCQF / 0628 KR
158
****** gps 
159
*** small battery
160
* main board back
161
*** DALMA v2.1 / P2YH6-032
162
****** probably the sat radio part
163
*** TI OMAP1510G / 65C052W / ZZG2
164
****** probably the SAT processor
165
*** intel 3050L0ZBQ / 5616B221 / Z617I112A
166
****** probably ram+flash
167
*** connector for camera part
168
*** philips 9535 / 0419 / buG634
169
****** i2c gpio pins
170
*** philips 8028 / 218W / ctG607B
171
****** 2.5Ghz IF freq synth
172
*** AD9864 / BCPZ / # 0622 / 906925.1
173
****** IF digitizing part
174
*** sim connector
175
*** battery connector
176
*** 16 pad test connector
177
* camera part
178
*** connector on top for siemens board
179 1
180
181 4
h2. talking to thuraya modem via bluetooth on osx
182 1
183 4
184
* on device, enable bt, show, 'dun'
185
* on mac: add serialport for 'dialup networking' and 'rs232'
186
187
188
h2. sg2520 usb modes
189
190
191
<pre>
192
193
<pre>
194 1
[activesync mode]
195
usbvidpid:  1a26:9d84
196
    class=0xff, subclass=0xff, protocol=0xff
197
198
[usb modem] in gsm mode
199
usbvidpid: 1a26:9d81   class=0x02
200
 interface#1 class=0x02[CDC] subclass=0x02 [ACM] protocol=0x01 [at commands]
201
 interface#2 class=0x0A[CDCData] subclass=0x00 protocol=0x00
202
203
[usb modem] in sat mode
204
usbvidpid: 1a26:9d82   class=0x02
205
 interface#1 class=0x02[CDC] subclass=0x02 [ACM] protocol=0x01 [at commands]
206
 interface#2 class=0x0A[CDCData] subclass=0x00 protocol=0x00
207
208
[uart]
209
usbvidpid: 1a26:9d83   class=0x02
210
 interface#1 class=0x02[CDC] subclass=0x02 [ACM] protocol=0xff
211
 interface#2 class=0x0A[CDCData] subclass=0x00 protocol=0x00
212 4
</pre>
Add picture from clipboard (Maximum size: 48.8 MB)