Project

General

Profile

Actions

Hardware

Teardown video of UK version: https://www.youtube.com/watch?v=RnI5dhKhYFw

DE version:

board-case-front.jpg board-case-back.jpg board-case-bottom.jpg inside.jpg board-net-front.jpg board-net-back.jpg board-proc-front.jpg board-proc-back.jpg board-proc-back-naked.jpg board-proc-back-processor.jpg

Physical Setup / Board Stacking

The hardware consists of two circuit boards:

  • PSU board (top): AC/DC power supply and Ethernet switch
  • main board (bottom): Actual Femtocell mainboard
The two boards are sandwiched together by the following connections:
  • 6-pin fine-pitch connector (most likely for DC power)
  • flexible printed circuit cable (most likely for Ethernet MII/RMII)
  • two large sheet metal parts for ground and/or thermal connection

To operate he opened device in a safe way (i.e. without live AC line voltage present) you can inject 4.0V DC using an external power supply.
One method is to connect using a crocodile clip the ground of the external power supply to one of the two large metal plates interconnecting the two boards, and connect the 4.0V DC of the external power supply to the long vertical pin headers 1 and 2 of J5 interconnecting the two boards (also using a crocodile clip).
Without radio enable the device uses on average 400 mA with peaks at 2.5 A.
It seems also feasible to use a 5V power supply (still capable of at least 2.5 A) instead of 4.0V. The LDOs will get a bit warmer but it seems sustainable.

Major Components

Femtocell SoC (U3)

Broadcomm BCM61610KFB1G (formerly Percello)

NAND Flash (U40)

Hynix H27U1G8F2BTR

RF Transceiver

Maxim MAX2550

Ethernet Switch

Atheros AR8236-AL1A

AC/DC switching power supply controller

RF LDO (WU1)

Connectors

Mainboard J2

  • 12pos 2x6 1.27mm pitch header
  • unpopulated
  • likely (MIPS) JTAG and UART
Function Pin Pin Function
GND 1 2 3V3
idle low 3 4 idle high
idle low 5 6 idel high
UART_RXD 7 8 idle high
UART_TXD 9 10 idle 400 mV
idle high 11 12 idle high

By default the UART port only shows the Bootlog, but no terminal console is provided.
The boot sequence can also not be interrupted.

(!) warning: do not connect these lines to your computer if the device is plugged to and powered by mains electricity. At best this will trigger the residual current circuit breaker of your household. To be able to connect to these pins you have to power the board using and external (isolated) power supply.

Mainboard J3

  • 30pos 0.5mm pitch FPC
  • connects to PSU Board CON1
  • likely LED + AR8236 (R)MII + AR8236 SPI + AR8236 UART

Mainboard J4

  • 3pos 2.54mm pitch hader, center pos missing
  • used to supply 230V AC from mainboard to PSU board
  • connects to PSU Board J4

Mainboard J5

  • 8pos 2x4 1.27mm pitch SMD header
  • DC power input
  • connects to PSU-Board J
Pin Function
1 4V DC (supply for LDOs on mainboard)
2 4V DC (supply for LDOs on mainboard)
3 GND
4 GND
5 GND
6 GND
7 3.3V DC (regulated on PSU board for Ethernet Switch)
8 3.3V DC (regulated on PSU board for Ethernet Switch)

PSU-Board U9

Yellow RJ45 mag-jack, connected to Port 0 of AR8236

PSU-Board U8

Grey RJ45 mag-jack, connected to Port 3 of AR8236

Files (15)
LNK626.pdf View LNK626.pdf 1.39 MB AC/DC controller IC laforge, 05/03/2017 05:52 AM
Hynix_NAND_128Mo_H27U1G8F2BT.pdf View Hynix_NAND_128Mo_H27U1G8F2BT.pdf 347 KB NAND Flash IC laforge, 05/03/2017 05:52 AM
ATHEROS--AR8236.pdf View ATHEROS--AR8236.pdf 922 KB Ethernet Switch IC laforge, 05/03/2017 05:52 AM
FemtocellSecurityTheoryPractice.pdf View FemtocellSecurityTheoryPractice.pdf 1.42 MB 2013 NordSec paper about the identical "SignalPlus" laforge, 05/03/2017 05:52 AM
MAX2550.pdf View MAX2550.pdf 27.4 MB RF Transceiver IC laforge, 05/03/2017 05:53 AM
board-case-bottom.jpg View board-case-bottom.jpg 161 KB case picture, bottom side tsaitgaist, 05/10/2017 10:27 AM
board-case-back.jpg View board-case-back.jpg 280 KB case picture, back side tsaitgaist, 05/10/2017 10:27 AM
board-case-front.jpg View board-case-front.jpg 143 KB case picture, front side tsaitgaist, 05/10/2017 10:27 AM
board-net-back.jpg View board-net-back.jpg 724 KB PSU/network board picture, back side tsaitgaist, 05/10/2017 10:27 AM
board-net-front.jpg View board-net-front.jpg 811 KB PSU/network board picture, front side tsaitgaist, 05/10/2017 10:27 AM
board-proc-back.jpg View board-proc-back.jpg 759 KB main board picture, back side tsaitgaist, 05/10/2017 10:27 AM
board-proc-back-processor.jpg View board-proc-back-processor.jpg 602 KB main board picture with main processor, back side tsaitgaist, 05/10/2017 10:27 AM
board-proc-back-naked.jpg View board-proc-back-naked.jpg 998 KB main board picture without heatink and shield, back side tsaitgaist, 05/10/2017 10:27 AM
inside.jpg View inside.jpg 793 KB picture of device with front case removed tsaitgaist, 05/10/2017 10:27 AM
board-proc-front.jpg View board-proc-front.jpg 899 KB main board picture, front side tsaitgaist, 05/10/2017 10:27 AM

Updated by tsaitgaist almost 7 years ago · 22 revisions

Add picture from clipboard (Maximum size: 48.8 MB)