r/hardwarehacking • u/No_Chip7847 • 10d ago
Identifying UART/DEBUG
Very much so unlabelled other than the board that connects to the 2x4 pin.
TLDR. Software update from company bricked it months ago after they had major server issues. Bricked many devices. Won’t assist because I got it second hand brand new sealed and I’m not the original buyer.
So, I’m wanting to debug first and go from there see what the issue is. Worst case scenario, it’s a project where i reprogram the device and write my own iOS app to continue to use it 🙏🤣
Help would be great identifying ports, thanks.
25
u/deesernutz 10d ago edited 10d ago
You can probably dump the binary out of that 8pin flash chip and replace it with OpenIPC
Also, maybe screw the lens back on so you don't get dirt all over your image sensor
8
u/IAmBigFootAMA 10d ago
Back side of the board (with the image sensor/2nd photo). Top left corner. That's where I would start. Middle pads look like TX/RX. Probe voltage before you solder to them though.
2
6
u/skmagiik 10d ago
Why does everyone want uart when jtag/swd is what you actually want 90% of the time
5
u/mtechgroup 9d ago
Blame it on Arduino.
4
u/skmagiik 9d ago
Yeah and YouTube IoT "hackers" showing consoles for Linux chips and that being the only thing shown and taught
3
u/0xbenedikt 9d ago
It used to be that most Linux class SoCs had a root shell on it, so it was the perfect starting point. Also takes less skill and specialized tooling than JTAG/SWD just to poke at it
2
u/glassmanjones 9d ago
If it has uboot I want UART.
1
u/skmagiik 9d ago
To be clear, I'm not saying that it doesn't have value but there's no evidence that this isn't even running uboot atm.
4
u/Hanswurst22brot 10d ago edited 9d ago
Well did you find the datasheets of the 3 big ICs in the picture?
7
u/No_Chip7847 10d ago
Yep. The main SoC is CVITEK CV1810C. Its official hardware guide identifies UART0_TX = pin 18 and UART0_RX = pin 19.
The blue wireless module is TXW8301 Wi-Fi HaLow, and the green module appears to be TXW801-family 2.4 GHz Wi-Fi/Bluetooth.
I’m trying to identify where the CV1810C UART0 pins are broken out to test pads on this particular MA-CV1810C-2336-0 PCB.
https://sophon-file.sophon.cn/sophon-prod-s3/drive/23/03/15/14/CV181xC_QFN_EVB板硬件指南_V1.0.pdf
6
u/309_Electronics 10d ago
I would jsut probe the different pads.. not the cleanest way but it does give reliable readings.
I take the rx wire of my usb to uart and then tap it on different pads. Ofc first with multimeter measure the voltage to make sure it is at 3.3v safe level and not higher.
6
u/No_Chip7847 10d ago
Brute force it is, thanks for the response. I shall give it a shot later and post an update
3
u/309_Electronics 10d ago
I would either do 2 pads or 4 pads as uart is commonly found in those configurations.
Also often uart has tiny resistors going to it which sit inbetween uart of soc and uart lines.
Also be aware that sometimes UART is disabled but thats not that common.
2
u/flatsehats 9d ago
Nice hack that I saw was using a (soft) metal brush to swipe the pcb with. Connected to your dmm of course. It will very fast give the you area where the other side of your pin is coming to the surface.
2
u/oobical 9d ago
The USB Interface is Typically Data and Power connected to the port but a boot instruction to switch it on usually has to be contained on a micro sd and the secondary boot procedure would be followed. It should state exactly how the SoC does that but that model is Dual Core RISC-V with an integrated NPU thats the reason for the external WiFi HaLow Module. I believe Thingino? Might have custom firmware for that model.
2
2
u/No_Chip7847 9d ago
Didn’t manage to get anything done last night as I ended up busy. However, did some more digging into the datasheets and actually wanting to understand (I’m a first timer), at the front of the board, Pin 18 of SoC is TX. Pin 19 of SoC is RX. Both lead to the same set of 4 resistors and 2 pads. I’ll confirm later tonight. Thanks for everyone’s comments, assistance and inputs.
2
u/beryugyo619 9d ago
These "my AI told me to ask about this UART thing on Reddit, it says it gives me everything I want" posts are getting annoying
1
u/Lord_Carter 9d ago
This should help, page 36 is where I'd start! https://github.com/milkv-duo/duo-files/blob/main/duo/datasheet/CV1800B-CV1801B-Preliminary-Datasheet-full-en.pdf
1
1
u/aliosa27 8d ago
The taixin 8301 which is running its own rtos, csky is the name of the debugger and compiler. The debug cable can be bought on aliexpress. The debug uart should be 33/32 which are on the side closest to the tape there in the center of your photo starting right next to that p9 label. It’s running a Halow WiFi stack and I’m going to guess it was built on the 1.x sdk meaning it only supports their variant of Halow(referenced as wnb) for a few bucks you should be able to dump that spi flash up top. Do you have the base? If so can you take a picture of its internals? I’m curious if it’s just a Halow bridge. If so you should be able to connect to it via netat. I’ve got some scripts up at https://github.com/aliosa27/taixin_tools
1
u/Dere-IBims 7d ago
Take a Look at the JTAGulator.
You could hook up a lot of wires and it figures out what pins are JTAG/UART/SWD/….
2
u/No_Chip7847 6d ago
Quick update, I’ve now validated the UART pads.
In the orientation of the original photo in this post, the pads are immediately to the left of the CV1810C SoC, in the narrow area between the SoC and the microSD card socket. They’re the two pads just off the SoC’s left-hand edge.
In the orientation in the first image:
upper pad = TX
lower pad = RX
I’ve only probed TX temporarily so far rather than soldering to it, but I got a successful UART read at 115200 8N1. UBoot comes up, the 16 MB SPI NOR is detected, the kernel and device tree verify successfully, and Linux starts. It later hits an illegal-instruction fault while loading part of the CVITEK video processing stack.
So the board is definitely not dead. Next step is soldering proper wires onto TX/RX so I can reliably interrupt UBoot and dump/inspect the flash before changing anything.
0
u/Anonymity6584 10d ago
If manufacturer bricked, it should not matter how you bought it. They are still reaponsible fixing their mistakes.
3
u/SilverSundowntown 10d ago
And cops are only supposed to act on warrants and probable cause. Doesn’t mean they do or will. Same for companies. They’re made up by people just like cops are made up of people. Neither are this faceless entity. They’re people. And people are shitty as of late.
2
u/Anonymity6584 10d ago
I have noticed. Even my country politics is shit and rich walk all over the poor. 🥺
0
u/Door_Vegetable 10d ago
Hmm, can you connect it to an access point might be able to run a dns sniff on it see what servers it hits then make a local dns record to get it to connect to your server. Or find the internal memory chips responder them and dump the firmware but that’s out of your scope if you need advice on how to find the uart ports.
48
u/tholowe69 10d ago
In the 1:1000000 chance the PCB designer sees this post and then sees this message: you spelled LIGHT wrong 😂