====== Panasonic KX-TG6861 ======

===== hackvalue =====


con PP:

- DSPG chipset

pro PP:

- SPI flash should be read and writable easily

- cheap, 25€ at store, FP with PP

- ARM926

- JTAG pins exposed (and labelled)

pro FP:

- dialog SC14441

con FP:



===== FP: KX-TG6861GB =====

{{::photo_2025-01-04_14-13-11.jpg?400|}}

Pins

<code>
    GND  -5.5V
    URX  UTX
</code>

UART seems to be 1V8, 19200 baud, at boot prints

''\\ \\ OK1\\ \\ ''

pressing ''?<CR>'' responds with ''There is no help''

every upper and lower case single char followed by ''<CR>'' prints ''command unknown''

==== UART commands ====

**might be incomplete/too long** found by brute forcing three-char commands

<code>
ada
adc - start ADC0 and ADC1 sampling, and print to uart
adj
ads
akt - no params - OK
ant - allows 0, 1, 2, 3 as param - antenna?
aud
bel
bof
bom
bon - allows 0, 1, 2 as param
btc
bts
btx
buz
cbc
cgs - no params - OK
cid - no params - 0000
cli
cps
crx
cwc - no params - FFFF
dbm
dmv
dto
ecb - FF
ecc
ecw - FFFF
epc - DD
epd
epf
epr
eps
epv - 5B9C or 2CCE
epw
esc
fer - 00
fld
fle
flr
fls - NAK
gtl - 0000
hok
hrl
hsl
idr - FF FF FF FF FF
idw
key
lcd - '  This command is not prepared'
led - '  This command is not prepared'
lim
lnv - 00
lpr - 00
mgr - FF
mgw
mic - FFFF
mip - FFFF
mmn
moc
mss
mtx
ner
new
odb - OK
odh - OK
odl - OK
pal - OK
pan - OK
pap - FFFF
pdl
per - 00
pew - OK
pid - prints "1: 2: 3: 4: 5: 6: " with newlines otherwise empty
ply - prints "PLAY Start" with params 0, 1
rcd - OK
rci
rec - prints "REC Start" with params 0, 1
red
reg
rfa - OK
rfb - print/choose region "EU 0-4ch\n<Usage>RFB 0:EU\n1:US\n2:EU 0-4ch\n3:3ch Shift(Japan) for TEL\n4:4ch\nShift(Japan) for TEL\n5:LA\n6:LB\n7:Taiwan\n8:JP\n9:JP 0-4,9ch"
rfd - OK
rfq - OK
rfr - FF FF FF FF FF
rft
rfw
rgs - FFFFFFFF
rio
rss - 00 00
rst - RESET the device
rwd
scr
sdh - 1FC8
sdl - 15BC
sfr - 0270
sgr - FF
sgw
slf - 08B4 - takes a second or so
smr
sms
srl
stp - prints "STOP"
tdt - 0
tpc
trc
tst
vac
vda
vdd - 08
ver - print version "DG41EC 14.02"
vfw
vpd - NAK
vpe - ACK
vpi
vpl
vrd
vrg
vrm
vse
vwt
wcr
wgs
wrt
wwd
</code>

==== chipset ====

- IC501: dialog SC14441

- IC601: P25Q16L 1.8V single/dual/quad SPI flash 16MBit

- IC502: 25Q16JWSIM winbond 1.8V dual/quad SPI flash 16MBit

- IC902: PH408A 8bit GPIO expander I2C

strange, why two SPI flashes of same size from different vendors?




===== PP: KX-TGA685EX =====

- audio
    - bottom mic THT
    - speaker w/ soldered wires, blu top, red bot
    - earpiece speaker: spring contact, falls apart/disconnected with case open
- RF
    - under metal can, arrow towards bot
    - DSP group
    - DCX81ACPCFAE4FNC
    - (c) (M) 2010 DSPG
    - 88 pin
    - {{::screenshot_2025-01-04_12-18-06.png?400|}}

- PCB
    - IC2 SOIC8
        - winbond
        - 25Q80EWSIG
        - 8Mbit NOR flash, SPI (dual/quad) or QPI
        - 1MByte
        - 1.8V
        - {{::screenshot_2025-01-04_12-15-31.png?400|}}
    - IC3 SOIC8
        - ST 24C32FP
        - 32Kbit I2C EEPROM
        - 4kBytes
        - {{:screenshot_2025-01-04_12-16-45.png?400|}}
    - labelled pads, left, under ant, from top to bottom
        - GND_J
        - TDO
        - TDI
        - TCK
        - TMS
        - CKM
        - VDDC = 1.16V
        - CP3V = 3.05V

{{:23-48-34.jpg?400|}}
{{:23-48-48.jpg?400|}}

    - labelled pads, right
        - 1.8V = 1.82V
        - CP4V = 2.95V

- voltages
    - JTAG
        - VDDC = 1.16V
        - CP3V = 3.05V
    - IC2 flash
        - 1.8V
    - IC3 EEPROM
        - 3.0V