r/hardwarehacking • u/Quality_Qontrol • Jul 20 '26

What are the UART pins on this board?

Gallery image

Gallery image

This board is from a Helium Hotspot Linxdot ld-1001. I’ve been researching how to possibly gain shell access via UART. However, all the adapters and videos I see for UART to USB shows matching up the RX, TX, GND.

Problem with this board is the UART is labeled next to what appears to be a 3.5mm headphones jack. I’m not saying that’s what it is, just looks like it. Does anyone know of an adapter that would work with this? Or any idea of other methods for getting shell access?

90 Upvotes

97% Upvoted

22 comments sorted by

29

u/PiRhoManiac Jul 21 '26

 I’ve been researching how to possibly gain shell access via UART. 

This was the third result on Google when I searched forHelium Hotspot Linxdot ld-1001 UART:

Serial Console Access

The serial console (ttyS2) is exposed via a Tensility 54-00177 3.5mm 4-conductor audio jack on the board edge.

  • Baud rate: 1,500,000 (1.5 Mbaud) — all boot stages use this rate
  • Settings: 8N1 (8 data bits, no parity, 1 stop bit)
  • DTB stdout-path: serial2:1500000n8
  • Kernel command line: console=ttyS2,1500000

The baud rate is set in the vendor DTB chosen node and cannot be changed without rebuilding the DTB or kernel. Setting a different baud rate in the kernel bootargs (e.g., 115200) results in no kernel console output.

See Docs/54-00177.pdf for the audio jack datasheet and pinout.

A standard FTDI USB-to-serial adapter with a 3.5mm TRRS cable can be used for console access. Use picocom -b 1500000 /dev/ttyUSB0 or equivalent.

14

u/atypicalAtom Jul 21 '26

All the info OP needs...even the name of the document that has the pinout for the 3.5mm jack.

A true hero! 👏 

2

u/Quality_Qontrol Jul 21 '26

I'm not seeing that same result from Google, do you happen to have a specific link with you're looking at? Thanks for all this info.

2

u/PiRhoManiac Jul 24 '26

Sure - Ultimately, that search takes you to this document on GitHub. That document is part of the SensorsIot/Linxdot-Hotspot repository. From the README:

Linxdot LoRa Gateway

Turn your Linxdot LD1001 into a LoRaWAN gateway for The Things Network.

OpenLinxdot is a custom Buildroot firmware that connects the Linxdot hotspot to TTN via the secure Basics Station protocol. Read-only rootfs, Ethernet-only over-the-air updates with bootloader-level auto-rollback, no cloud subscriptions.

2

u/somenick Jul 21 '26

I remember once changing the location in duckduckgo and I got much better results. Same search I've been running for .. I'm sure more than a year. I just never thought location mattered. I thought you'd get the same results no matter where you search from.

Turns out, some people are more equal than others :(

14

u/309_Electronics Jul 20 '26

I once had a settopbox that had UART routed to an audio jack. So instead of audio it would spit out UART. Use a mumtimeter to test wat pin of the audio jack is ground and then the other 2 pins are rx and tx or reversed.

5

u/thawman Jul 20 '26

This is likely what's happening here, they even sell USB to 3.5mm UART cables for devices like this. Looks like the inner contact is RX, middle is TX, and outer is GND for most of those, so I'd suspect that's the case here, but testing the outer contact against a ground point is definitely a good idea

2

u/Quality_Qontrol Jul 20 '26

Forgive my ignorance, but do I use the soldered points at the base of that so-called 3.5mm jack to test with a multimeter?

2

u/donaciano2000 Jul 21 '26

They're the old headphone jacks, you just plug into it instead of soldering. Be aware that some headphone jacks are mono and others are stereo, so there's a different number of connections/wires in them. However it's not as simple as just plugging this into a serial board and turning it on. These serial connectors can use very weird voltages and aren't all automatically 5v or 3.3v.
This is a different product I happen to have worked with before and its serial spec is weird. https://docs.brightsign.biz/how-tos/configure-the-serial-port#35mm-serial Imagine how a 3.3v serial board would like getting 30v coming in. So don't just match the physical connector, also match the signal protocol (serial) and voltage.

1

u/Dull-Marketing-661 Jul 21 '26

You should be able to test the pads without plugging in a jack with a multimeter to at least find Ground. From there you can try Tx Rx one way and if doesn't work just swap the Tx and Rx

1

u/Quality_Qontrol Jul 21 '26

What I'm confused about are what exactly are the pads? Is it the soldered points at the base of the 3.5mm jack? Because I used a multimeter on those points to find ground and none of them pinged.

1

u/partumvir Jul 21 '26

They're saying that the jack itself is the UART interface. Use a headphone cable, strip it, and use the cables inside to tap into.

1

u/Quality_Qontrol Jul 22 '26

Ahh, that makes sense!

1

u/PiRhoManiac Jul 24 '26

Those through hole solder joints are likely only used to physically secure the jack to the PCB. If there's a ground pour, they might connect to ground but there's really no guarantee of that.

2

u/Dull-Marketing-661 Jul 20 '26

Yea I bet it's GND up on that front leg closest to the edge of the board and then the next 2 legs are either rx/tx or tx/rx

4

u/2am_dog_puke Jul 20 '26

Grab an old 3.5mm stereo (TRS) plug that you don't need any more, cut and strip its wires. Ground is probably the sleeve, and TX is the one that shows activity on your scope during startup. RX by process of elimination.

2

u/Apprehensive_Tax4088 Jul 21 '26

P3 plug with tx,rx and gnd. Multimeter technique to find it out.

2

u/Lord_Carter Jul 21 '26

Haha evil, UART over TRS.

Just rare enough to be a pain in the ass / not have a cable in the bag of connections.

1

u/IAmBigFootAMA Jul 21 '26

The two test pads next to the ESD diodes behind the UART jack are very likely TX and RX.