This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong. ====== Panasonic KX-TG6861 ====== ===== hackvalue ===== con PP: - DSPG chipset pro PP: - SPI flash should be read and writable easily - cheap, 25€ at store, FP with PP - ARM926 - JTAG pins exposed (and labelled) pro FP: - dialog SC14441 con FP: ===== FP: KX-TG6861GB ===== {{::photo_2025-01-04_14-13-11.jpg?400|}} Pins <code> GND -5.5V URX UTX </code> UART seems to be 1V8, 19200 baud, at boot prints ''\\ \\ OK1\\ \\ '' pressing ''?<CR>'' responds with ''There is no help'' every upper and lower case single char followed by ''<CR>'' prints ''command unknown'' ==== UART commands ==== **might be incomplete/too long** found by brute forcing three-char commands <code> ada adc - start ADC0 and ADC1 sampling, and print to uart adj ads akt - no params - OK ant - allows 0, 1, 2, 3 as param - antenna? aud bel bof bom bon - allows 0, 1, 2 as param btc bts btx buz cbc cgs - no params - OK cid - no params - 0000 cli cps crx cwc - no params - FFFF dbm dmv dto ecb - FF ecc ecw - FFFF epc - DD epd epf epr eps epv - 5B9C or 2CCE epw esc fer - 00 fld fle flr fls - NAK gtl - 0000 hok hrl hsl idr - FF FF FF FF FF idw key lcd - ' This command is not prepared' led - ' This command is not prepared' lim lnv - 00 lpr - 00 mgr - FF mgw mic - FFFF mip - FFFF mmn moc mss mtx ner new odb - OK odh - OK odl - OK pal - OK pan - OK pap - FFFF pdl per - 00 pew - OK pid - prints "1: 2: 3: 4: 5: 6: " with newlines otherwise empty ply - prints "PLAY Start" with params 0, 1 rcd - OK rci rec - prints "REC Start" with params 0, 1 red reg rfa - OK rfb - print/choose region "EU 0-4ch\n<Usage>RFB 0:EU\n1:US\n2:EU 0-4ch\n3:3ch Shift(Japan) for TEL\n4:4ch\nShift(Japan) for TEL\n5:LA\n6:LB\n7:Taiwan\n8:JP\n9:JP 0-4,9ch" rfd - OK rfq - OK rfr - FF FF FF FF FF rft rfw rgs - FFFFFFFF rio rss - 00 00 rst - RESET the device rwd scr sdh - 1FC8 sdl - 15BC sfr - 0270 sgr - FF sgw slf - 08B4 - takes a second or so smr sms srl stp - prints "STOP" tdt - 0 tpc trc tst vac vda vdd - 08 ver - print version "DG41EC 14.02" vfw vpd - NAK vpe - ACK vpi vpl vrd vrg vrm vse vwt wcr wgs wrt wwd </code> ==== chipset ==== - IC501: dialog SC14441 - IC601: P25Q16L 1.8V single/dual/quad SPI flash 16MBit - IC502: 25Q16JWSIM winbond 1.8V dual/quad SPI flash 16MBit - IC902: PH408A 8bit GPIO expander I2C strange, why two SPI flashes of same size from different vendors? ===== PP: KX-TGA685EX ===== - audio - bottom mic THT - speaker w/ soldered wires, blu top, red bot - earpiece speaker: spring contact, falls apart/disconnected with case open - RF - under metal can, arrow towards bot - DSP group - DCX81ACPCFAE4FNC - (c) (M) 2010 DSPG - 88 pin - {{::screenshot_2025-01-04_12-18-06.png?400|}} - PCB - IC2 SOIC8 - winbond - 25Q80EWSIG - 8Mbit NOR flash, SPI (dual/quad) or QPI - 1MByte - 1.8V - {{::screenshot_2025-01-04_12-15-31.png?400|}} - IC3 SOIC8 - ST 24C32FP - 32Kbit I2C EEPROM - 4kBytes - {{:screenshot_2025-01-04_12-16-45.png?400|}} - labelled pads, left, under ant, from top to bottom - GND_J - TDO - TDI - TCK - TMS - CKM - VDDC = 1.16V - CP3V = 3.05V {{:23-48-34.jpg?400|}} {{:23-48-48.jpg?400|}} - labelled pads, right - 1.8V = 1.82V - CP4V = 2.95V - voltages - JTAG - VDDC = 1.16V - CP3V = 3.05V - IC2 flash - 1.8V - IC3 EEPROM - 3.0V
